@wrongstack/sage-mcp 0.296.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,187 @@
+# @wrongstack/sage-mcp
+
+WrongStack **SAGE Memory** exposed as an [MCP](https://modelcontextprotocol.io/) server. Use it from any MCP-compatible client (Claude Desktop, another agent, an IDE) to read, write, and curate your project's structured long-term memory.
+
+Two operating modes:
+
+| Mode | Entry point | What it does |
+|------|-------------|--------------|
+| **Standalone** | the `wstack-sage-mcp` binary this package ships | Boots *only* SAGE Memory — no `@wrongstack/cli` needed — and serves it over MCP. Connects to the existing SAGE IPC project server (Unix socket / Windows named pipe) lazily, exactly like the rest of the SAGE ecosystem. |
+| **In-process** *(deferred to Phase 4)* | `wstack sage-mcp ...` *inside* the existing CLI | Strictly additive, opt-in only; preserves the rule "*without changing Sage's existing normal behavior*". |
+
+This package does **not** introduce a new database, a new file format, or a new SQLite owner. The single-owner-of-state model in `packages/sage/src/project-server.ts` is preserved exactly: SAGE has one writer per project, and clients attach to it. MCP is one more client shape.
+
+## Install
+
+Built artifacts come from `pnpm -F @wrongstack/sage-mcp build`. The CLI binary lives at `dist/cli.js` and is published as `wstack-sage-mcp`.
+
+```sh
+pnpm install
+pnpm -F @wrongstack/sage-mcp build
+```
+
+## Quick start — Claude Desktop
+
+Save this as your Claude Desktop MCP config (path: `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, `%APPDATA%\Claude\claude_desktop_config.json` on Windows):
+
+```json
+{
+  "mcpServers": {
+    "sage": {
+      "command": "wstack-sage-mcp",
+      "args": [
+        "--project-root",
+        "/absolute/path/to/your/project"
+      ]
+    }
+  }
+}
+```
+
+Replace `/absolute/path/to/your/project` with the directory where you've been running `wstack`. Restart Claude Desktop; the SAGE tools appear in the tool picker.
+
+### Expose writes to the model
+
+Default policy is **read-only** (`memory_search`, `memory_for_file`, `memory_for_path`, `memory_graph`). For an agent that should also `remember`, `forget`, or `memory_delete`:
+
+```json
+{
+  "mcpServers": {
+    "sage": {
+      "command": "wstack-sage-mcp",
+      "args": [
+        "--project-root",
+        "/absolute/path/to/your/project",
+        "--writable"
+      ]
+    }
+  }
+}
+```
+
+Claude Desktop will surface its own confirmation gesture before calling write-class tools. The Sage `force: true` gate on `memory_delete` is preserved at the MCP boundary — see *Safety guarantees* below.
+
+### Loopback HTTP (advanced)
+
+If you want multiple clients to talk to the same SAGE project (e.g. two IDEs, one Claude Desktop, one custom script):
+
+```sh
+wstack-sage-mcp \
+  --project-root /absolute/path/to/project \
+  --http \
+  --port 8765
+```
+
+Then point any MCP HTTP client at `http://127.0.0.1:8765/`. Non-loopback hosts require `--token`:
+
+```sh
+wstack-sage-mcp \
+  --project-root /absolute/path/to/project \
+  --http --host 0.0.0.0 --port 8765 --token "$(openssl rand -hex 32)"
+```
+
+The HTTP transport reuses `serveHttp` from `@wrongstack/mcp` directly; the same loopback-default + token-required gate that `wstack mcp serve` enforces applies here.
+
+## CLI reference
+
+```
+wstack-sage-mcp --project-root <path> [options]
+
+Options:
+  --project-root <path>   Project root whose SAGE memory should be served (required).
+  --storage-dir <path>    Override the SAGE storage directory.
+  --stdio                 Use stdio transport (default).
+  --http                  Use HTTP transport.
+  --port <n>              TCP port for HTTP mode (default 0 = ephemeral).
+  --host <h>              Bind host for HTTP mode (default 127.0.0.1; non-loopback REQUIRES --token).
+  --token <t>             Bearer token for HTTP mode.
+  --writable              Expose standard-tier (write/delete) tools.
+  -h, --help              Show this message.
+```
+
+## Tool allowlist
+
+| Policy | Tools exposed |
+|--------|---------------|
+| **Default (read-only)** | `memory_search`, `memory_for_file`, `memory_for_path`, `memory_graph` |
+| **`--writable`** adds   | `remember`, `forget`, `memory_delete`, `memory_update`, `memory_recover`, `memory_backfill_recoverable`, `memory_verify`, `memory_hygiene`, `memory_candidates` |
+
+`selectAllowedTools` is implemented at `src/policy.ts` and is fully unit-tested. The model is: `permission === 'deny'` is always excluded; `permission === 'auto'` is exposed under any risk tier when `--writable`; `permission === 'confirm'` is exposed only under `--writable`; `riskTier === 'destructive'` is **never** exposed (no current Sage tool is tagged destructive — this is forward-compatible).
+
+## Safety guarantees
+
+- **`memory_delete` requires `force: true`** — same gate as `packages/sage/src/tools/memory-tools.ts:332-340`. MCP clients calling without `force` receive an `isError: true` JSON-RPC response, not a deletion.
+- **`memory_update` validates** that at least one field is supplied.
+- **`memory_verify`** mutates anchor state but accepts only known memory ids.
+- **Audit log**: deletes are recorded in `readAudit` (use `Sage.audit` capability if you wire one in; tools don't expose this directly).
+- **Loopback default for HTTP** — `serveHttp` refuses non-loopback binds without `--token`, matching `wstack mcp serve`.
+- **Single-owner-of-SQLite** preserved — the standalone binary connects via `ProjectSageMemoryPort`, which lazily spawns `project-server.js` from `@wrongstack/sage` and never opens its own SQLite handle on a running project.
+
+## Verifying your install
+
+```sh
+pnpm -F @wrongstack/sage-mcp tsx scripts/smoke.ts
+```
+
+This boots the MCP server in-process and exercises all 8 protocol-level invariants (initialize / tools/list / memory_search / force-gate on `memory_delete` / malformed envelopes / method-not-found / unknown-tool). Exits 0 on full pass, non-zero with a precise message on the first failed assertion. **The smoke is host-independent** — it uses Node `PassThrough` streams instead of child-process spawn, so it works on Windows, Linux, and macOS.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  MCP client (Claude Desktop, custom agent, IDE)                  │
+│      ↕ stdio / http                                              │
+└─────────────────────────────────────────────────────────────────┘
+                          │
+                          ▼
+┌─────────────────────────────────────────────────────────────────┐
+│  wstack-sage-mcp                                                 │
+│   • MCPServer.handleMessage  ← from @wrongstack/mcp              │
+│   • serveStdio / serveHttp   ← from @wrongstack/mcp              │
+│   • createSageMcpToolHost    ← src/adapter.ts                   │
+│         listTools = createSageTools(port) filtered by policy    │
+│         callTool = Tool.validate → Tool.execute → JSON content  │
+└─────────────────────────────────────────────────────────────────┘
+                          │
+                          ▼
+┌─────────────────────────────────────────────────────────────────┐
+│  ProjectSageMemoryPort                                            │
+│  (reconnecting IPC client; transparently acquires the SAGE       │
+│   project server if not already running)                        │
+└─────────────────────────────────────────────────────────────────┘
+                          │
+                          ▼
+┌─────────────────────────────────────────────────────────────────┐
+│  SAGE project server (existing; packages/sage/src/project-server.ts)  │
+│  Unix socket / Windows named pipe — single owner of SQLite       │
+└─────────────────────────────────────────────────────────────────┘
+                          │
+                          ▼
+┌─────────────────────────────────────────────────────────────────┐
+│  node:sqlite DatabaseSync (WAL)                                  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Public exports (`@wrongstack/sage-mcp`)
+
+```ts
+import {
+  createSageMcpServer,    // (port, opts) => MCPServer
+  createSageMcpToolHost,   // (port, opts) => MCPServerToolHost
+  requireSageService,     // (port) => SageServiceLike; throws if absent
+  selectAllowedTools,     // (tools, opts) => filtered tools (for tests / custom policies)
+  type SageMcpToolHostOptions,
+  type SageMcpPolicyOptions,
+  type SageMcpAllowedTool,
+} from '@wrongstack/sage-mcp';
+```
+
+## Related packages
+
+- `@wrongstack/sage` — implementation owner of memory; provides `createSageTools`, `SqliteMemoryPort`, `ProjectSageMemoryPort`.
+- `@wrongstack/mcp` — MCP toolkit; provides `MCPServer`, `serveStdio`, `serveHttp`, `MCPRegistry`, `transport-security`. This package reuses those primitives; it does not extend them.
+- `@wrongstack/kanban` — the kanban daemon follows the same single-owner-of-state, many-clients-over-IPC architecture. Same pattern, different data.
+
+## License
+
+MIT — see repository root.

package/dist/adapter.d.ts

@@ -0,0 +1,41 @@
+/**
+ * MCPServerToolHost adapter for SAGE Memory.
+ *
+ * Maps `createSageTools(port)` from `@wrongstack/sage` into the
+ * transport-agnostic `MCPServerToolHost` shape expected by
+ * `@wrongstack/mcp`'s `MCPServer` (`packages/mcp/src/server.ts:36-39`).
+ *
+ * Tool-level safety gates (e.g. `force: true` on `memory_delete` from
+ * `packages/sage/src/tools/memory-tools.ts:332-340`) are preserved by passing
+ * the Sage tool's `Tool.validate` + `Tool.execute` through unchanged —
+ * a Sage `validate` failure surfaces as `isError: true` MCP content,
+ * the same end-shape `wstack mcp serve` already returns in
+ * `packages/cli/src/mcp-serve.ts:298-318`.
+ *
+ * The synthetic `Context` mirrors `packages/cli/src/mcp-serve.ts:179-214`
+ * (`makeServeContext`). It has no provider, no session, no tokenCounter.
+ * SAGE's `remember` tool reads `ctx.meta['agentRole']` /
+ * `ctx.meta['mode']` to auto-scope audience
+ * (`packages/sage/src/tools/memory-tools.ts:166-178`); we force
+ * `arguments.no_auto_audience = true` so MCP callers must opt in explicitly.
+ */
+import { MCPServer, type MCPServerToolHost } from '@wrongstack/mcp';
+import type { MemoryPort } from '@wrongstack/core/types';
+import { type SageServiceLike } from '@wrongstack/sage';
+import { type SageMcpPolicyOptions } from './policy.js';
+export interface SageMcpToolHostOptions extends SageMcpPolicyOptions {
+}
+/**
+ * Resolve the SAGE service capability from any `MemoryPort`. Both
+ * `SqliteMemoryPort` and `ProjectSageMemoryPort` expose it via
+ * `getCapability(SAGE_SERVICE_CAPABILITY)`; if either is missing,
+ * we throw a precise error.
+ *
+ * The capability lookup is the same shape
+ * `packages/runtime/src/container.ts:131-152` already relies on for
+ * wiring the IPC bound port into the tool registry.
+ */
+export declare function requireSageService(port: MemoryPort): SageServiceLike;
+export declare function createSageMcpToolHost(port: MemoryPort, opts?: SageMcpToolHostOptions): MCPServerToolHost;
+export declare function createSageMcpServer(port: MemoryPort, opts?: SageMcpToolHostOptions): MCPServer;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,SAAS,EAGT,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAc,UAAU,EAAQ,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAG5E,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;CAAG;AAEvE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,CASpE;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,sBAA2B,GAChC,iBAAiB,CAqFnB;AAiBD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,sBAA2B,GAChC,SAAS,CAMX"}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    storageDirectory?: string | undefined;
+    transport: 'stdio' | 'http';
+    httpPort: number;
+    httpHost: string;
+    httpToken?: string | undefined;
+    writable: boolean;
+    help: boolean;
+}
+export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAmCA,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACf;AA4BD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA8C7D"}

package/dist/cli.js

@@ -0,0 +1,305 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { realpathSync } from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { canonicalProjectRoot } from "@wrongstack/core/utils";
+import { serveHttp, serveStdio } from "@wrongstack/mcp";
+import {
+  ProjectSageMemoryPort,
+  isSageProjectServerAvailable
+} from "@wrongstack/sage";
+
+// src/adapter.ts
+import {
+  MCPServer
+} from "@wrongstack/mcp";
+import {
+  createSageTools,
+  getSageService,
+  isSqliteAvailable
+} from "@wrongstack/sage";
+
+// src/policy.ts
+function selectAllowedTools(tools, opts = {}) {
+  const allowed = [];
+  for (const tool of tools) {
+    if (tool.permission === "deny") continue;
+    if (tool.riskTier === "destructive") continue;
+    if (tool.permission === "auto") {
+      if (tool.riskTier === "safe" || opts.writable === true) {
+        allowed.push({ name: tool.name, tool });
+      }
+      continue;
+    }
+    if (opts.writable !== true) continue;
+    if (tool.riskTier !== "standard" && tool.riskTier !== "safe") continue;
+    allowed.push({ name: tool.name, tool });
+  }
+  return allowed;
+}
+
+// src/version.ts
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+var here = dirname(fileURLToPath(import.meta.url));
+var pkgPath = resolve(here, "..", "package.json");
+var cached;
+function readServerInfo() {
+  if (cached) return cached;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    cached = {
+      name: pkg.name ?? "@wrongstack/sage-mcp",
+      version: pkg.version ?? "0.0.0"
+    };
+    return cached;
+  } catch {
+    cached = { name: "@wrongstack/sage-mcp", version: "0.0.0" };
+    return cached;
+  }
+}
+var SERVER_INFO = readServerInfo();
+
+// src/adapter.ts
+function requireSageService(port) {
+  const service = getSageService(port);
+  if (!service) {
+    throw new Error(
+      "SAGE MCP: the supplied MemoryPort does not expose the SAGE service capability. Use the port created by createProjectSageMemoryPort(...) or SqliteMemoryPort directly."
+    );
+  }
+  return service;
+}
+function createSageMcpToolHost(port, opts = {}) {
+  if (!isSqliteAvailable()) {
+    throw new Error(
+      "SAGE MCP: node:sqlite is unavailable; SAGE requires Node >= 22.5"
+    );
+  }
+  const service = requireSageService(port);
+  const allTools = createSageTools(service);
+  const allowed = selectAllowedTools(allTools, opts);
+  const allowedByName = new Map(allowed.map((entry) => [entry.name, entry.tool]));
+  const ctx = createSyntheticContext();
+  const ac = new AbortController();
+  const signal = ac.signal;
+  function jsonSchemaToObject(schema) {
+    return schema;
+  }
+  return {
+    listTools() {
+      return allowed.map(
+        ({ name, tool }) => ({
+          name,
+          ...tool.description ? { description: tool.description } : {},
+          inputSchema: jsonSchemaToObject(tool.inputSchema)
+        })
+      );
+    },
+    async callTool(name, args) {
+      const tool = allowedByName.get(name);
+      if (!tool) {
+        return {
+          content: `Tool "${name}" is not exposed by this SAGE MCP server`,
+          isError: true
+        };
+      }
+      const callArgs = { ...args };
+      if (name === "remember" && callArgs["no_auto_audience"] === void 0) {
+        callArgs["no_auto_audience"] = true;
+      }
+      const validate = tool.validate;
+      if (typeof validate === "function") {
+        const errors = await validate(callArgs);
+        if (Array.isArray(errors) && errors.length > 0) {
+          return { content: errors.join("\n"), isError: true };
+        }
+      }
+      let output;
+      try {
+        output = await tool.execute(callArgs, ctx, { signal });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { content: message, isError: true };
+      }
+      if (typeof output === "string") return { content: output, isError: false };
+      return { content: output, isError: false };
+    }
+  };
+}
+function createSyntheticContext() {
+  return {
+    systemPrompt: [],
+    cwd: process.cwd(),
+    projectRoot: process.cwd(),
+    allowOutsideProjectRoot: false,
+    model: "sage-mcp",
+    tools: [],
+    meta: {}
+  };
+}
+function createSageMcpServer(port, opts = {}) {
+  const host = createSageMcpToolHost(port, opts);
+  return new MCPServer({
+    host,
+    serverInfo: { name: "wrongstack-sage-mcp", version: SERVER_INFO.version }
+  });
+}
+
+// src/cli.ts
+function printHelp(stdout) {
+  stdout.write(
+    [
+      `${SERVER_INFO.name} v${SERVER_INFO.version} \u2014 SAGE Memory MCP server`,
+      "",
+      "Usage:",
+      `  ${SERVER_INFO.name} --project-root <path> [options]`,
+      "",
+      "Options:",
+      "  --project-root <path>   Project root whose SAGE memory should be served (required).",
+      "  --storage-dir <path>    Override the SAGE storage directory.",
+      "  --stdio                 Use stdio transport (default).",
+      "  --http                  Use HTTP transport.",
+      "  --port <n>              TCP port for HTTP mode (default 0 = ephemeral).",
+      "  --host <h>              Bind host for HTTP mode (default 127.0.0.1;",
+      "                          non-loopback REQUIRES --token, refused by serveHttp).",
+      "  --token <t>             Bearer token for HTTP mode.",
+      "  --writable              Expose standard-tier (write/delete) tools.",
+      "  -h, --help              Show this message.",
+      "",
+      "Existing SAGE IPC server connection:",
+      `  isSageProjectServerAvailable() = ${String(isSageProjectServerAvailable())}`
+    ].join("\n") + "\n"
+  );
+}
+function parseArgs(argv) {
+  const out = {
+    projectRoot: "",
+    transport: "stdio",
+    httpPort: 0,
+    httpHost: "127.0.0.1",
+    writable: false,
+    help: false
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--project-root":
+        out.projectRoot = path.resolve(argv[++i] ?? "");
+        break;
+      case "--storage-dir":
+        out.storageDirectory = path.resolve(argv[++i] ?? "");
+        break;
+      case "--stdio":
+        out.transport = "stdio";
+        break;
+      case "--http":
+        out.transport = "http";
+        break;
+      case "--port":
+        out.httpPort = Number(argv[++i] ?? "") || 0;
+        break;
+      case "--host":
+        out.httpHost = argv[++i] ?? "127.0.0.1";
+        break;
+      case "--token":
+        out.httpToken = argv[++i];
+        break;
+      case "--writable":
+        out.writable = true;
+        break;
+      case "-h":
+      case "--help":
+        out.help = true;
+        break;
+      default:
+        break;
+    }
+  }
+  return out;
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    printHelp(process.stdout);
+    return 0;
+  }
+  if (!args.projectRoot) {
+    process.stderr.write(`${SERVER_INFO.name}: --project-root is required
+`);
+    printHelp(process.stderr);
+    return 2;
+  }
+  const projectRoot = canonicalProjectRoot(args.projectRoot);
+  const port = new ProjectSageMemoryPort({
+    projectRoot,
+    ...args.storageDirectory ? { directory: args.storageDirectory } : {}
+  });
+  try {
+    await port.initialize();
+  } catch (error) {
+    process.stderr.write(
+      `${SERVER_INFO.name}: cannot attach to SAGE project server for ${projectRoot}: ` + (error instanceof Error ? error.message : String(error)) + "\n"
+    );
+    return 3;
+  }
+  const server = createSageMcpServer(port, { writable: args.writable });
+  if (args.transport === "http") {
+    const handle2 = await serveHttp(server, {
+      port: args.httpPort,
+      host: args.httpHost,
+      ...args.httpToken ? { token: args.httpToken } : {},
+      logger: { warn: (m) => process.stderr.write(`[sage-mcp] ${m}
+`) }
+    });
+    process.stderr.write(
+      `${SERVER_INFO.name}: ready at ${handle2.url} \u2014 projectRoot=${projectRoot} transport=http writable=${String(args.writable)}${args.httpToken ? " [token auth]" : ""}
+`
+    );
+    return await new Promise((resolve3) => {
+      const stop = () => resolve3(0);
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
+  }
+  const handle = serveStdio(server);
+  process.stderr.write(
+    `${SERVER_INFO.name}: ready on stdio \u2014 projectRoot=${projectRoot} transport=stdio writable=${String(args.writable)}
+`
+  );
+  await handle.done;
+  await port.dispose();
+  return 0;
+}
+function isMainModule() {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  const self = fileURLToPath2(import.meta.url);
+  if (path.resolve(entry) === self) return true;
+  try {
+    return realpathSync(entry) === realpathSync(self);
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  main().then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (error) => {
+      process.stderr.write(`${SERVER_INFO.name}: unexpected error
+`);
+      process.stderr.write(error instanceof Error ? error.stack ?? error.message : String(error));
+      process.stderr.write("\n");
+      process.exitCode = 1;
+    }
+  );
+}
+export {
+  parseArgs
+};
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/cli.ts", "../src/adapter.ts", "../src/policy.ts", "../src/version.ts"],
+  "sourcesContent": ["#!/usr/bin/env node\n/**\n * `wstack-sage-mcp` \u2014 Standalone MCP server for WrongStack SAGE Memory.\n *\n * Two operating modes (default stdio; --http for loopback HTTP):\n *\n *   $ wstack-sage-mcp --project-root <path>\n *     # talks JSON-RPC over stdio\n *\n *   $ wstack-sage-mcp --project-root <path> --http --port 8765\n *     # loopback HTTP; refuses non-loopback without --token\n *\n * The memory port is acquired by connecting to the existing SAGE IPC\n * project server (Unix socket / Windows named pipe). If no server is\n * running, the connection logic in `SageProjectServerConnection`\n * (`packages/sage/src/project-server-client.ts:233-275`) lazily spawns\n * `project-server.js` from `@wrongstack/sage` \u2014 the same single-owner\n * SQLite process that any wstack CLI / TUI / WebUI would attach to.\n *\n * Default tool policy: read-only (`permission === 'auto'`,\n * `riskTier === 'safe'`). Pass `--writable` to expose standard-tier\n * Sage tools (writes, deletes, hygiene).\n */\nimport { realpathSync } from 'node:fs';\nimport * as path from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { canonicalProjectRoot } from '@wrongstack/core/utils';\nimport { serveHttp, serveStdio } from '@wrongstack/mcp';\nimport {\n  ProjectSageMemoryPort,\n  isSageProjectServerAvailable,\n} from '@wrongstack/sage';\nimport { createSageMcpServer } from './adapter.js';\nimport { SERVER_INFO } from './version.js';\n\ninterface ParsedArgs {\n  projectRoot: string;\n  storageDirectory?: string | undefined;\n  transport: 'stdio' | 'http';\n  httpPort: number;\n  httpHost: string;\n  httpToken?: string | undefined;\n  writable: boolean;\n  help: boolean;\n}\n\nfunction printHelp(stdout: NodeJS.WriteStream): void {\n  stdout.write(\n    [\n      `${SERVER_INFO.name} v${SERVER_INFO.version} \u2014 SAGE Memory MCP server`,\n      '',\n      'Usage:',\n      `  ${SERVER_INFO.name} --project-root <path> [options]`,\n      '',\n      'Options:',\n      '  --project-root <path>   Project root whose SAGE memory should be served (required).',\n      '  --storage-dir <path>    Override the SAGE storage directory.',\n      '  --stdio                 Use stdio transport (default).',\n      '  --http                  Use HTTP transport.',\n      '  --port <n>              TCP port for HTTP mode (default 0 = ephemeral).',\n      '  --host <h>              Bind host for HTTP mode (default 127.0.0.1;',\n      '                          non-loopback REQUIRES --token, refused by serveHttp).',\n      '  --token <t>             Bearer token for HTTP mode.',\n      '  --writable              Expose standard-tier (write/delete) tools.',\n      '  -h, --help              Show this message.',\n      '',\n      'Existing SAGE IPC server connection:',\n      `  isSageProjectServerAvailable() = ${String(isSageProjectServerAvailable())}`,\n    ].join('\\n') + '\\n',\n  );\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const out: ParsedArgs = {\n    projectRoot: '',\n    transport: 'stdio',\n    httpPort: 0,\n    httpHost: '127.0.0.1',\n    writable: false,\n    help: false,\n  };\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    switch (arg) {\n      case '--project-root':\n        out.projectRoot = path.resolve(argv[++i] ?? '');\n        break;\n      case '--storage-dir':\n        out.storageDirectory = path.resolve(argv[++i] ?? '');\n        break;\n      case '--stdio':\n        out.transport = 'stdio';\n        break;\n      case '--http':\n        out.transport = 'http';\n        break;\n      case '--port':\n        out.httpPort = Number(argv[++i] ?? '') || 0;\n        break;\n      case '--host':\n        out.httpHost = argv[++i] ?? '127.0.0.1';\n        break;\n      case '--token':\n        out.httpToken = argv[++i];\n        break;\n      case '--writable':\n        out.writable = true;\n        break;\n      case '-h':\n      case '--help':\n        out.help = true;\n        break;\n      default:\n        // ignore unknown flags (forward-compat)\n        break;\n    }\n  }\n  return out;\n}\n\nasync function main(): Promise<number> {\n  const args = parseArgs(process.argv.slice(2));\n  if (args.help) {\n    printHelp(process.stdout);\n    return 0;\n  }\n  if (!args.projectRoot) {\n    process.stderr.write(`${SERVER_INFO.name}: --project-root is required\\n`);\n    printHelp(process.stderr);\n    return 2;\n  }\n\n  const projectRoot = canonicalProjectRoot(args.projectRoot);\n  const port = new ProjectSageMemoryPort({\n    projectRoot,\n    ...(args.storageDirectory ? { directory: args.storageDirectory } : {}),\n  });\n\n  // Acquire (or lazily spawn) the SAGE IPC server. We don't lower this to\n  // a try/catch around `port.initialize()` because the connection logic\n  // already surfaces a precise message via `isSageProjectServerAvailable()`.\n  try {\n    await port.initialize();\n  } catch (error) {\n    process.stderr.write(\n      `${SERVER_INFO.name}: cannot attach to SAGE project server for ${projectRoot}: ` +\n        (error instanceof Error ? error.message : String(error)) +\n        '\\n',\n    );\n    return 3;\n  }\n\n  const server = createSageMcpServer(port, { writable: args.writable });\n\n  if (args.transport === 'http') {\n    const handle = await serveHttp(server, {\n      port: args.httpPort,\n      host: args.httpHost,\n      ...(args.httpToken ? { token: args.httpToken } : {}),\n      logger: { warn: (m) => process.stderr.write(`[sage-mcp] ${m}\\n`) },\n    });\n    process.stderr.write(\n      `${SERVER_INFO.name}: ready at ${handle.url} \u2014 projectRoot=${projectRoot} ` +\n        `transport=http writable=${String(args.writable)}${args.httpToken ? ' [token auth]' : ''}\\n`,\n    );\n    return await new Promise<number>((resolve) => {\n      const stop = () => resolve(0);\n      process.once('SIGINT', stop);\n      process.once('SIGTERM', stop);\n    });\n  }\n\n  // stdio mode\n  const handle = serveStdio(server);\n  process.stderr.write(\n    `${SERVER_INFO.name}: ready on stdio \u2014 projectRoot=${projectRoot} ` +\n      `transport=stdio writable=${String(args.writable)}\\n`,\n  );\n  await handle.done;\n  await port.dispose();\n  return 0;\n}\n\n/**\n * Only run the CLI when this module IS the process entry point.\n *\n * `tests/cli.test.ts` imports `parseArgs` from here. Without this guard the\n * import ran `main()` inside the Vitest worker: Vitest's argv carries no\n * `--project-root`, so `main` printed the help block and set\n * `process.exitCode = 2`. The worker fork then exited mid-run and the pool's\n * next `send()` failed with `EPIPE` \u2014 surfacing as a single unhandled\n * \"Worker forks emitted error\" that failed the whole suite while every\n * individual test still passed.\n *\n * The comparison has to be real-path based: `file://${process.argv[1]}` never\n * matches on Windows (argv[1] is a backslash path, `import.meta.url` is a\n * percent-encoded forward-slash URL), and on POSIX argv[1] is the\n * `node_modules/.bin/wstack-sage-mcp` symlink rather than `dist/cli.js`.\n */\nfunction isMainModule(): boolean {\n  const entry = process.argv[1];\n  if (!entry) return false;\n  const self = fileURLToPath(import.meta.url);\n  if (path.resolve(entry) === self) return true;\n  try {\n    return realpathSync(entry) === realpathSync(self);\n  } catch {\n    return false;\n  }\n}\n\nif (isMainModule()) {\n  main().then(\n    (code) => {\n      process.exitCode = code;\n    },\n    (error) => {\n      process.stderr.write(`${SERVER_INFO.name}: unexpected error\\n`);\n      process.stderr.write(error instanceof Error ? (error.stack ?? error.message) : String(error));\n      process.stderr.write('\\n');\n      process.exitCode = 1;\n    },\n  );\n}\n", "/**\n * MCPServerToolHost adapter for SAGE Memory.\n *\n * Maps `createSageTools(port)` from `@wrongstack/sage` into the\n * transport-agnostic `MCPServerToolHost` shape expected by\n * `@wrongstack/mcp`'s `MCPServer` (`packages/mcp/src/server.ts:36-39`).\n *\n * Tool-level safety gates (e.g. `force: true` on `memory_delete` from\n * `packages/sage/src/tools/memory-tools.ts:332-340`) are preserved by passing\n * the Sage tool's `Tool.validate` + `Tool.execute` through unchanged \u2014\n * a Sage `validate` failure surfaces as `isError: true` MCP content,\n * the same end-shape `wstack mcp serve` already returns in\n * `packages/cli/src/mcp-serve.ts:298-318`.\n *\n * The synthetic `Context` mirrors `packages/cli/src/mcp-serve.ts:179-214`\n * (`makeServeContext`). It has no provider, no session, no tokenCounter.\n * SAGE's `remember` tool reads `ctx.meta['agentRole']` /\n * `ctx.meta['mode']` to auto-scope audience\n * (`packages/sage/src/tools/memory-tools.ts:166-178`); we force\n * `arguments.no_auto_audience = true` so MCP callers must opt in explicitly.\n */\nimport {\n  MCPServer,\n  type MCPServerCallResult,\n  type MCPServerTool,\n  type MCPServerToolHost,\n} from '@wrongstack/mcp';\nimport type { Context } from '@wrongstack/core/agent';\nimport type { JSONSchema, MemoryPort, Tool } from '@wrongstack/core/types';\nimport {\n  type SageServiceLike,\n  createSageTools,\n  getSageService,\n  isSqliteAvailable,\n} from '@wrongstack/sage';\nimport { selectAllowedTools, type SageMcpPolicyOptions } from './policy.js';\nimport { SERVER_INFO } from './version.js';\n\nexport interface SageMcpToolHostOptions extends SageMcpPolicyOptions {}\n\n/**\n * Resolve the SAGE service capability from any `MemoryPort`. Both\n * `SqliteMemoryPort` and `ProjectSageMemoryPort` expose it via\n * `getCapability(SAGE_SERVICE_CAPABILITY)`; if either is missing,\n * we throw a precise error.\n *\n * The capability lookup is the same shape\n * `packages/runtime/src/container.ts:131-152` already relies on for\n * wiring the IPC bound port into the tool registry.\n */\nexport function requireSageService(port: MemoryPort): SageServiceLike {\n  const service = getSageService(port);\n  if (!service) {\n    throw new Error(\n      'SAGE MCP: the supplied MemoryPort does not expose the SAGE service capability. ' +\n        'Use the port created by createProjectSageMemoryPort(...) or SqliteMemoryPort directly.',\n    );\n  }\n  return service;\n}\n\nexport function createSageMcpToolHost(\n  port: MemoryPort,\n  opts: SageMcpToolHostOptions = {},\n): MCPServerToolHost {\n  if (!isSqliteAvailable()) {\n    // The same gate as `packages/runtime/src/container.ts:139-144` \u2014\n    // SAGE requires Node >= 22.5 with `node:sqlite`. Fail loudly here\n    // instead of letting the first `Tool.execute` crash mid-protocol.\n    throw new Error(\n      'SAGE MCP: node:sqlite is unavailable; SAGE requires Node >= 22.5',\n    );\n  }\n\n  const service = requireSageService(port);\n  const allTools: Tool[] = createSageTools(service);\n  const allowed = selectAllowedTools(allTools, opts);\n  const allowedByName = new Map<string, Tool>(allowed.map((entry) => [entry.name, entry.tool]));\n\n  // Synthetic Context \u2014 no provider / session / tokenCounter. SAGE-only memory\n  // ops never read those fields; `ctx.meta` is empty, which makes\n  // `no_auto_audience = true` (set below) both deterministic and defensible.\n  const ctx = createSyntheticContext();\n  const ac = new AbortController();\n  const signal = ac.signal;\n\n  function jsonSchemaToObject(schema: JSONSchema): Record<string, unknown> {\n    // JSONSchema's permissive `[k: string]: unknown` already satisfies the\n    // MCP `Record<string, unknown>` inputSchema contract. We only narrow\n    // the top-level return type for the strict MCPServerTool type.\n    return schema as unknown as Record<string, unknown>;\n  }\n\n  return {\n    listTools(): MCPServerTool[] {\n      return allowed.map(\n        ({ name, tool }): MCPServerTool => ({\n          name,\n          ...(tool.description ? { description: tool.description } : {}),\n          inputSchema: jsonSchemaToObject(tool.inputSchema),\n        }),\n      );\n    },\n\n    async callTool(name: string, args: Record<string, unknown>): Promise<MCPServerCallResult> {\n      const tool = allowedByName.get(name);\n      if (!tool) {\n        return {\n          content: `Tool \"${name}\" is not exposed by this SAGE MCP server`,\n          isError: true,\n        };\n      }\n\n      // For `remember`, force no_auto_audience=true. SAGE's auto-audience\n      // detection reads `ctx.meta['agentRole']`/`ctx.meta['mode']`; MCP\n      // callers do not supply a role/mode so we cannot infer one.\n      const callArgs: Record<string, unknown> = { ...args };\n      if (name === 'remember' && callArgs['no_auto_audience'] === undefined) {\n        callArgs['no_auto_audience'] = true;\n      }\n\n      // Tool.validate is the canonical safety gate (e.g., the `force: true`\n      // requirement on memory_delete). Surface validation failures exactly\n      // like `wstack mcp serve` would.\n      const validate = tool.validate;\n      if (typeof validate === 'function') {\n        const errors = await validate(callArgs);\n        if (Array.isArray(errors) && errors.length > 0) {\n          return { content: errors.join('\\n'), isError: true };\n        }\n      }\n\n      let output: unknown;\n      try {\n        output = await tool.execute(callArgs, ctx, { signal });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return { content: message, isError: true };\n      }\n\n      // The output shape mirrors how `wstack mcp serve` returns its\n      // executor result (a string, see packages/cli/src/mcp-serve.ts:316).\n      // Sage tools return strings, structured objects, or arrays; we let\n      // `MCPServer.toContentBlocks` (server.ts:303-316) handle the\n      // text-block wrapping uniformly.\n      if (typeof output === 'string') return { content: output, isError: false };\n      return { content: output as unknown, isError: false };\n    },\n  };\n}\n\nfunction createSyntheticContext(): Context {\n  // Minimal Context stand-in. SAGE memory ops only read `ctx.meta`; the\n  // provider/session/tokenCounter stubs throw on use, which is desired\n  // because MCP-side memory calls are pure data operations.\n  return {\n    systemPrompt: [],\n    cwd: process.cwd(),\n    projectRoot: process.cwd(),\n    allowOutsideProjectRoot: false,\n    model: 'sage-mcp',\n    tools: [],\n    meta: {},\n  } as unknown as Context;\n}\n\nexport function createSageMcpServer(\n  port: MemoryPort,\n  opts: SageMcpToolHostOptions = {},\n): MCPServer {\n  const host = createSageMcpToolHost(port, opts);\n  return new MCPServer({\n    host,\n    serverInfo: { name: 'wrongstack-sage-mcp', version: SERVER_INFO.version },\n  });\n}\n", "/**\n * Tool allowlist policy for the SAGE MCP server.\n *\n * Mirrors `packages/cli/src/mcp-serve.ts:217-236` (selectExposedTools).\n *\n * Tool permission model:\n *   - Sage tools use `permission: 'confirm'` for any write/delete/update/\n *     recover/backfill/verify/hygiene operation\n *     (`packages/sage/src/tools/memory-tools.ts`), reserving\n *     `permission: 'auto'` for read-only tools.\n *   - `wstack mcp serve` (`packages/cli/src/mcp-serve.ts:217-236`)\n *     decides auto-approval by routing through a host `PermissionPolicy`\n *     (`AutoApprovePermissionPolicy` defaults to read-only).\n *\n * SAGE MCP chooses a simpler axis: MCP has no UI confirm flow, so a write\n * tool surfaced over MCP cannot be approved inline \u2014 the MCP client (e.g.\n * Claude Desktop) is expected to surface its own confirm UX before\n * forwarding the call. Default policy is therefore \"read-only\", exposing\n * only `permission: 'auto'` AND `riskTier === 'safe'` tools. Pass\n * `--writable` to additionally expose `permission === 'confirm'` tools\n * whose `riskTier !== 'destructive'`. The MCP client owns the user-facing\n * confirmation gesture in that case.\n *\n * The tool's own `Tool.validate(input)` (see\n * `packages/sage/src/tools/memory-tools.ts:276-283` and `:332-340`) remains\n * the source of truth for per-call safety checks such as `force: true` on\n * `memory_delete`. Policy only controls visibility.\n */\nimport type { Tool } from '@wrongstack/core/types';\n\nexport interface SageMcpPolicyOptions {\n  writable?: boolean;\n}\n\nexport interface SageMcpAllowedTool {\n  name: string;\n  tool: Tool;\n}\n\nexport function selectAllowedTools(\n  tools: Tool[],\n  opts: SageMcpPolicyOptions = {},\n): SageMcpAllowedTool[] {\n  const allowed: SageMcpAllowedTool[] = [];\n  for (const tool of tools) {\n    if (tool.permission === 'deny') continue;\n    if (tool.riskTier === 'destructive') continue;\n    if (tool.permission === 'auto') {\n      if (tool.riskTier === 'safe' || opts.writable === true) {\n        allowed.push({ name: tool.name, tool });\n      }\n      continue;\n    }\n    // permission === 'confirm'\n    if (opts.writable !== true) continue;\n    if (tool.riskTier !== 'standard' && tool.riskTier !== 'safe') continue;\n    allowed.push({ name: tool.name, tool });\n  }\n  return allowed;\n}\n", "/**\n * Single source of truth for the package version reported to MCP clients.\n * Kept tiny so a build step never has to run before `pnpm --filter` tests\n * can read it.\n */\nimport { readFileSync } from 'node:fs';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, resolve } from 'node:path';\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst pkgPath = resolve(here, '..', 'package.json');\n\ninterface MinimalPackage {\n  name?: string;\n  version?: string;\n}\n\nlet cached: { name: string; version: string } | undefined;\nfunction readServerInfo(): { name: string; version: string } {\n  if (cached) return cached;\n  try {\n    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as MinimalPackage;\n    cached = {\n      name: pkg.name ?? '@wrongstack/sage-mcp',\n      version: pkg.version ?? '0.0.0',\n    };\n    return cached;\n  } catch {\n    cached = { name: '@wrongstack/sage-mcp', version: '0.0.0' };\n    return cached;\n  }\n}\n\nexport const SERVER_INFO = readServerInfo();\n"],
+  "mappings": ";;;AAuBA,SAAS,oBAAoB;AAC7B,YAAY,UAAU;AACtB,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,WAAW,kBAAkB;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;;;ACVP;AAAA,EACE;AAAA,OAIK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACKA,SAAS,mBACd,OACA,OAA6B,CAAC,GACR;AACtB,QAAM,UAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,eAAe,OAAQ;AAChC,QAAI,KAAK,aAAa,cAAe;AACrC,QAAI,KAAK,eAAe,QAAQ;AAC9B,UAAI,KAAK,aAAa,UAAU,KAAK,aAAa,MAAM;AACtD,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,MACxC;AACA;AAAA,IACF;AAEA,QAAI,KAAK,aAAa,KAAM;AAC5B,QAAI,KAAK,aAAa,cAAc,KAAK,aAAa,OAAQ;AAC9D,YAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EACxC;AACA,SAAO;AACT;;;ACtDA,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AAEjC,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,QAAQ,MAAM,MAAM,cAAc;AAOlD,IAAI;AACJ,SAAS,iBAAoD;AAC3D,MAAI,OAAQ,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AACpD,aAAS;AAAA,MACP,MAAM,IAAI,QAAQ;AAAA,MAClB,SAAS,IAAI,WAAW;AAAA,IAC1B;AACA,WAAO;AAAA,EACT,QAAQ;AACN,aAAS,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AAC1D,WAAO;AAAA,EACT;AACF;AAEO,IAAM,cAAc,eAAe;;;AFiBnC,SAAS,mBAAmB,MAAmC;AACpE,QAAM,UAAU,eAAe,IAAI;AACnC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,sBACd,MACA,OAA+B,CAAC,GACb;AACnB,MAAI,CAAC,kBAAkB,GAAG;AAIxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,IAAI;AACvC,QAAM,WAAmB,gBAAgB,OAAO;AAChD,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,QAAM,gBAAgB,IAAI,IAAkB,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,CAAC;AAK5F,QAAM,MAAM,uBAAuB;AACnC,QAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAM,SAAS,GAAG;AAElB,WAAS,mBAAmB,QAA6C;AAIvE,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,YAA6B;AAC3B,aAAO,QAAQ;AAAA,QACb,CAAC,EAAE,MAAM,KAAK,OAAsB;AAAA,UAClC;AAAA,UACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,UAC5D,aAAa,mBAAmB,KAAK,WAAW;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,MAAc,MAA6D;AACxF,YAAM,OAAO,cAAc,IAAI,IAAI;AACnC,UAAI,CAAC,MAAM;AACT,eAAO;AAAA,UACL,SAAS,SAAS,IAAI;AAAA,UACtB,SAAS;AAAA,QACX;AAAA,MACF;AAKA,YAAM,WAAoC,EAAE,GAAG,KAAK;AACpD,UAAI,SAAS,cAAc,SAAS,kBAAkB,MAAM,QAAW;AACrE,iBAAS,kBAAkB,IAAI;AAAA,MACjC;AAKA,YAAM,WAAW,KAAK;AACtB,UAAI,OAAO,aAAa,YAAY;AAClC,cAAM,SAAS,MAAM,SAAS,QAAQ;AACtC,YAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,iBAAO,EAAE,SAAS,OAAO,KAAK,IAAI,GAAG,SAAS,KAAK;AAAA,QACrD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,QAAQ,UAAU,KAAK,EAAE,OAAO,CAAC;AAAA,MACvD,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,eAAO,EAAE,SAAS,SAAS,SAAS,KAAK;AAAA,MAC3C;AAOA,UAAI,OAAO,WAAW,SAAU,QAAO,EAAE,SAAS,QAAQ,SAAS,MAAM;AACzE,aAAO,EAAE,SAAS,QAAmB,SAAS,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEA,SAAS,yBAAkC;AAIzC,SAAO;AAAA,IACL,cAAc,CAAC;AAAA,IACf,KAAK,QAAQ,IAAI;AAAA,IACjB,aAAa,QAAQ,IAAI;AAAA,IACzB,yBAAyB;AAAA,IACzB,OAAO;AAAA,IACP,OAAO,CAAC;AAAA,IACR,MAAM,CAAC;AAAA,EACT;AACF;AAEO,SAAS,oBACd,MACA,OAA+B,CAAC,GACrB;AACX,QAAM,OAAO,sBAAsB,MAAM,IAAI;AAC7C,SAAO,IAAI,UAAU;AAAA,IACnB;AAAA,IACA,YAAY,EAAE,MAAM,uBAAuB,SAAS,YAAY,QAAQ;AAAA,EAC1E,CAAC;AACH;;;ADjIA,SAAS,UAAU,QAAkC;AACnD,SAAO;AAAA,IACL;AAAA,MACE,GAAG,YAAY,IAAI,KAAK,YAAY,OAAO;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,KAAK,YAAY,IAAI;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,sCAAsC,OAAO,6BAA6B,CAAC,CAAC;AAAA,IAC9E,EAAE,KAAK,IAAI,IAAI;AAAA,EACjB;AACF;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,MAAkB;AAAA,IACtB,aAAa;AAAA,IACb,WAAW;AAAA,IACX,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACA,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,YAAQ,KAAK;AAAA,MACX,KAAK;AACH,YAAI,cAAmB,aAAQ,KAAK,EAAE,CAAC,KAAK,EAAE;AAC9C;AAAA,MACF,KAAK;AACH,YAAI,mBAAwB,aAAQ,KAAK,EAAE,CAAC,KAAK,EAAE;AACnD;AAAA,MACF,KAAK;AACH,YAAI,YAAY;AAChB;AAAA,MACF,KAAK;AACH,YAAI,YAAY;AAChB;AAAA,MACF,KAAK;AACH,YAAI,WAAW,OAAO,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK;AAC1C;AAAA,MACF,KAAK;AACH,YAAI,WAAW,KAAK,EAAE,CAAC,KAAK;AAC5B;AAAA,MACF,KAAK;AACH,YAAI,YAAY,KAAK,EAAE,CAAC;AACxB;AAAA,MACF,KAAK;AACH,YAAI,WAAW;AACf;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,YAAI,OAAO;AACX;AAAA,MACF;AAEE;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,OAAwB;AACrC,QAAM,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC5C,MAAI,KAAK,MAAM;AACb,cAAU,QAAQ,MAAM;AACxB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,YAAQ,OAAO,MAAM,GAAG,YAAY,IAAI;AAAA,CAAgC;AACxE,cAAU,QAAQ,MAAM;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,qBAAqB,KAAK,WAAW;AACzD,QAAM,OAAO,IAAI,sBAAsB;AAAA,IACrC;AAAA,IACA,GAAI,KAAK,mBAAmB,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;AAAA,EACtE,CAAC;AAKD,MAAI;AACF,UAAM,KAAK,WAAW;AAAA,EACxB,SAAS,OAAO;AACd,YAAQ,OAAO;AAAA,MACb,GAAG,YAAY,IAAI,8CAA8C,WAAW,QACzE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACtD;AAAA,IACJ;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,oBAAoB,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC;AAEpE,MAAI,KAAK,cAAc,QAAQ;AAC7B,UAAMC,UAAS,MAAM,UAAU,QAAQ;AAAA,MACrC,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,GAAI,KAAK,YAAY,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC;AAAA,MAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,QAAQ,OAAO,MAAM,cAAc,CAAC;AAAA,CAAI,EAAE;AAAA,IACnE,CAAC;AACD,YAAQ,OAAO;AAAA,MACb,GAAG,YAAY,IAAI,cAAcA,QAAO,GAAG,uBAAkB,WAAW,4BAC3C,OAAO,KAAK,QAAQ,CAAC,GAAG,KAAK,YAAY,kBAAkB,EAAE;AAAA;AAAA,IAC5F;AACA,WAAO,MAAM,IAAI,QAAgB,CAACC,aAAY;AAC5C,YAAM,OAAO,MAAMA,SAAQ,CAAC;AAC5B,cAAQ,KAAK,UAAU,IAAI;AAC3B,cAAQ,KAAK,WAAW,IAAI;AAAA,IAC9B,CAAC;AAAA,EACH;AAGA,QAAM,SAAS,WAAW,MAAM;AAChC,UAAQ,OAAO;AAAA,IACb,GAAG,YAAY,IAAI,uCAAkC,WAAW,6BAClC,OAAO,KAAK,QAAQ,CAAC;AAAA;AAAA,EACrD;AACA,QAAM,OAAO;AACb,QAAM,KAAK,QAAQ;AACnB,SAAO;AACT;AAkBA,SAAS,eAAwB;AAC/B,QAAM,QAAQ,QAAQ,KAAK,CAAC;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAOC,eAAc,YAAY,GAAG;AAC1C,MAAS,aAAQ,KAAK,MAAM,KAAM,QAAO;AACzC,MAAI;AACF,WAAO,aAAa,KAAK,MAAM,aAAa,IAAI;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAI,aAAa,GAAG;AAClB,OAAK,EAAE;AAAA,IACL,CAAC,SAAS;AACR,cAAQ,WAAW;AAAA,IACrB;AAAA,IACA,CAAC,UAAU;AACT,cAAQ,OAAO,MAAM,GAAG,YAAY,IAAI;AAAA,CAAsB;AAC9D,cAAQ,OAAO,MAAM,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK,CAAC;AAC5F,cAAQ,OAAO,MAAM,IAAI;AACzB,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACF;",
+  "names": ["fileURLToPath", "handle", "resolve", "fileURLToPath"]
+}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Public exports of `@wrongstack/sage-mcp`.
+ *
+ * The two things a host needs are:
+ *   - `createSageMcpServer(port, opts)` — build an `MCPServer` over a SAGE
+ *     memory port. Pass the port, hand the result to `serveStdio` /
+ *     `serveHttp` from `@wrongstack/mcp`.
+ *   - `createSageMcpToolHost(port, opts)` — finer-grained: build just the
+ *     host if you want to compose the server differently.
+ *
+ * The standalone `wstack-sage-mcp` binary lives at `src/cli.ts` (the
+ * `bin` entry in `package.json`); it is not re-exported here.
+ */
+export { createSageMcpServer, createSageMcpToolHost, requireSageService, type SageMcpToolHostOptions, } from './adapter.js';
+export { selectAllowedTools, type SageMcpAllowedTool, type SageMcpPolicyOptions, } from './policy.js';
+export { SERVER_INFO } from './version.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,145 @@
+// src/adapter.ts
+import {
+  MCPServer
+} from "@wrongstack/mcp";
+import {
+  createSageTools,
+  getSageService,
+  isSqliteAvailable
+} from "@wrongstack/sage";
+
+// src/policy.ts
+function selectAllowedTools(tools, opts = {}) {
+  const allowed = [];
+  for (const tool of tools) {
+    if (tool.permission === "deny") continue;
+    if (tool.riskTier === "destructive") continue;
+    if (tool.permission === "auto") {
+      if (tool.riskTier === "safe" || opts.writable === true) {
+        allowed.push({ name: tool.name, tool });
+      }
+      continue;
+    }
+    if (opts.writable !== true) continue;
+    if (tool.riskTier !== "standard" && tool.riskTier !== "safe") continue;
+    allowed.push({ name: tool.name, tool });
+  }
+  return allowed;
+}
+
+// src/version.ts
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+var here = dirname(fileURLToPath(import.meta.url));
+var pkgPath = resolve(here, "..", "package.json");
+var cached;
+function readServerInfo() {
+  if (cached) return cached;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    cached = {
+      name: pkg.name ?? "@wrongstack/sage-mcp",
+      version: pkg.version ?? "0.0.0"
+    };
+    return cached;
+  } catch {
+    cached = { name: "@wrongstack/sage-mcp", version: "0.0.0" };
+    return cached;
+  }
+}
+var SERVER_INFO = readServerInfo();
+
+// src/adapter.ts
+function requireSageService(port) {
+  const service = getSageService(port);
+  if (!service) {
+    throw new Error(
+      "SAGE MCP: the supplied MemoryPort does not expose the SAGE service capability. Use the port created by createProjectSageMemoryPort(...) or SqliteMemoryPort directly."
+    );
+  }
+  return service;
+}
+function createSageMcpToolHost(port, opts = {}) {
+  if (!isSqliteAvailable()) {
+    throw new Error(
+      "SAGE MCP: node:sqlite is unavailable; SAGE requires Node >= 22.5"
+    );
+  }
+  const service = requireSageService(port);
+  const allTools = createSageTools(service);
+  const allowed = selectAllowedTools(allTools, opts);
+  const allowedByName = new Map(allowed.map((entry) => [entry.name, entry.tool]));
+  const ctx = createSyntheticContext();
+  const ac = new AbortController();
+  const signal = ac.signal;
+  function jsonSchemaToObject(schema) {
+    return schema;
+  }
+  return {
+    listTools() {
+      return allowed.map(
+        ({ name, tool }) => ({
+          name,
+          ...tool.description ? { description: tool.description } : {},
+          inputSchema: jsonSchemaToObject(tool.inputSchema)
+        })
+      );
+    },
+    async callTool(name, args) {
+      const tool = allowedByName.get(name);
+      if (!tool) {
+        return {
+          content: `Tool "${name}" is not exposed by this SAGE MCP server`,
+          isError: true
+        };
+      }
+      const callArgs = { ...args };
+      if (name === "remember" && callArgs["no_auto_audience"] === void 0) {
+        callArgs["no_auto_audience"] = true;
+      }
+      const validate = tool.validate;
+      if (typeof validate === "function") {
+        const errors = await validate(callArgs);
+        if (Array.isArray(errors) && errors.length > 0) {
+          return { content: errors.join("\n"), isError: true };
+        }
+      }
+      let output;
+      try {
+        output = await tool.execute(callArgs, ctx, { signal });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { content: message, isError: true };
+      }
+      if (typeof output === "string") return { content: output, isError: false };
+      return { content: output, isError: false };
+    }
+  };
+}
+function createSyntheticContext() {
+  return {
+    systemPrompt: [],
+    cwd: process.cwd(),
+    projectRoot: process.cwd(),
+    allowOutsideProjectRoot: false,
+    model: "sage-mcp",
+    tools: [],
+    meta: {}
+  };
+}
+function createSageMcpServer(port, opts = {}) {
+  const host = createSageMcpToolHost(port, opts);
+  return new MCPServer({
+    host,
+    serverInfo: { name: "wrongstack-sage-mcp", version: SERVER_INFO.version }
+  });
+}
+export {
+  SERVER_INFO,
+  createSageMcpServer,
+  createSageMcpToolHost,
+  requireSageService,
+  selectAllowedTools
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/adapter.ts", "../src/policy.ts", "../src/version.ts"],
+  "sourcesContent": ["/**\n * MCPServerToolHost adapter for SAGE Memory.\n *\n * Maps `createSageTools(port)` from `@wrongstack/sage` into the\n * transport-agnostic `MCPServerToolHost` shape expected by\n * `@wrongstack/mcp`'s `MCPServer` (`packages/mcp/src/server.ts:36-39`).\n *\n * Tool-level safety gates (e.g. `force: true` on `memory_delete` from\n * `packages/sage/src/tools/memory-tools.ts:332-340`) are preserved by passing\n * the Sage tool's `Tool.validate` + `Tool.execute` through unchanged \u2014\n * a Sage `validate` failure surfaces as `isError: true` MCP content,\n * the same end-shape `wstack mcp serve` already returns in\n * `packages/cli/src/mcp-serve.ts:298-318`.\n *\n * The synthetic `Context` mirrors `packages/cli/src/mcp-serve.ts:179-214`\n * (`makeServeContext`). It has no provider, no session, no tokenCounter.\n * SAGE's `remember` tool reads `ctx.meta['agentRole']` /\n * `ctx.meta['mode']` to auto-scope audience\n * (`packages/sage/src/tools/memory-tools.ts:166-178`); we force\n * `arguments.no_auto_audience = true` so MCP callers must opt in explicitly.\n */\nimport {\n  MCPServer,\n  type MCPServerCallResult,\n  type MCPServerTool,\n  type MCPServerToolHost,\n} from '@wrongstack/mcp';\nimport type { Context } from '@wrongstack/core/agent';\nimport type { JSONSchema, MemoryPort, Tool } from '@wrongstack/core/types';\nimport {\n  type SageServiceLike,\n  createSageTools,\n  getSageService,\n  isSqliteAvailable,\n} from '@wrongstack/sage';\nimport { selectAllowedTools, type SageMcpPolicyOptions } from './policy.js';\nimport { SERVER_INFO } from './version.js';\n\nexport interface SageMcpToolHostOptions extends SageMcpPolicyOptions {}\n\n/**\n * Resolve the SAGE service capability from any `MemoryPort`. Both\n * `SqliteMemoryPort` and `ProjectSageMemoryPort` expose it via\n * `getCapability(SAGE_SERVICE_CAPABILITY)`; if either is missing,\n * we throw a precise error.\n *\n * The capability lookup is the same shape\n * `packages/runtime/src/container.ts:131-152` already relies on for\n * wiring the IPC bound port into the tool registry.\n */\nexport function requireSageService(port: MemoryPort): SageServiceLike {\n  const service = getSageService(port);\n  if (!service) {\n    throw new Error(\n      'SAGE MCP: the supplied MemoryPort does not expose the SAGE service capability. ' +\n        'Use the port created by createProjectSageMemoryPort(...) or SqliteMemoryPort directly.',\n    );\n  }\n  return service;\n}\n\nexport function createSageMcpToolHost(\n  port: MemoryPort,\n  opts: SageMcpToolHostOptions = {},\n): MCPServerToolHost {\n  if (!isSqliteAvailable()) {\n    // The same gate as `packages/runtime/src/container.ts:139-144` \u2014\n    // SAGE requires Node >= 22.5 with `node:sqlite`. Fail loudly here\n    // instead of letting the first `Tool.execute` crash mid-protocol.\n    throw new Error(\n      'SAGE MCP: node:sqlite is unavailable; SAGE requires Node >= 22.5',\n    );\n  }\n\n  const service = requireSageService(port);\n  const allTools: Tool[] = createSageTools(service);\n  const allowed = selectAllowedTools(allTools, opts);\n  const allowedByName = new Map<string, Tool>(allowed.map((entry) => [entry.name, entry.tool]));\n\n  // Synthetic Context \u2014 no provider / session / tokenCounter. SAGE-only memory\n  // ops never read those fields; `ctx.meta` is empty, which makes\n  // `no_auto_audience = true` (set below) both deterministic and defensible.\n  const ctx = createSyntheticContext();\n  const ac = new AbortController();\n  const signal = ac.signal;\n\n  function jsonSchemaToObject(schema: JSONSchema): Record<string, unknown> {\n    // JSONSchema's permissive `[k: string]: unknown` already satisfies the\n    // MCP `Record<string, unknown>` inputSchema contract. We only narrow\n    // the top-level return type for the strict MCPServerTool type.\n    return schema as unknown as Record<string, unknown>;\n  }\n\n  return {\n    listTools(): MCPServerTool[] {\n      return allowed.map(\n        ({ name, tool }): MCPServerTool => ({\n          name,\n          ...(tool.description ? { description: tool.description } : {}),\n          inputSchema: jsonSchemaToObject(tool.inputSchema),\n        }),\n      );\n    },\n\n    async callTool(name: string, args: Record<string, unknown>): Promise<MCPServerCallResult> {\n      const tool = allowedByName.get(name);\n      if (!tool) {\n        return {\n          content: `Tool \"${name}\" is not exposed by this SAGE MCP server`,\n          isError: true,\n        };\n      }\n\n      // For `remember`, force no_auto_audience=true. SAGE's auto-audience\n      // detection reads `ctx.meta['agentRole']`/`ctx.meta['mode']`; MCP\n      // callers do not supply a role/mode so we cannot infer one.\n      const callArgs: Record<string, unknown> = { ...args };\n      if (name === 'remember' && callArgs['no_auto_audience'] === undefined) {\n        callArgs['no_auto_audience'] = true;\n      }\n\n      // Tool.validate is the canonical safety gate (e.g., the `force: true`\n      // requirement on memory_delete). Surface validation failures exactly\n      // like `wstack mcp serve` would.\n      const validate = tool.validate;\n      if (typeof validate === 'function') {\n        const errors = await validate(callArgs);\n        if (Array.isArray(errors) && errors.length > 0) {\n          return { content: errors.join('\\n'), isError: true };\n        }\n      }\n\n      let output: unknown;\n      try {\n        output = await tool.execute(callArgs, ctx, { signal });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return { content: message, isError: true };\n      }\n\n      // The output shape mirrors how `wstack mcp serve` returns its\n      // executor result (a string, see packages/cli/src/mcp-serve.ts:316).\n      // Sage tools return strings, structured objects, or arrays; we let\n      // `MCPServer.toContentBlocks` (server.ts:303-316) handle the\n      // text-block wrapping uniformly.\n      if (typeof output === 'string') return { content: output, isError: false };\n      return { content: output as unknown, isError: false };\n    },\n  };\n}\n\nfunction createSyntheticContext(): Context {\n  // Minimal Context stand-in. SAGE memory ops only read `ctx.meta`; the\n  // provider/session/tokenCounter stubs throw on use, which is desired\n  // because MCP-side memory calls are pure data operations.\n  return {\n    systemPrompt: [],\n    cwd: process.cwd(),\n    projectRoot: process.cwd(),\n    allowOutsideProjectRoot: false,\n    model: 'sage-mcp',\n    tools: [],\n    meta: {},\n  } as unknown as Context;\n}\n\nexport function createSageMcpServer(\n  port: MemoryPort,\n  opts: SageMcpToolHostOptions = {},\n): MCPServer {\n  const host = createSageMcpToolHost(port, opts);\n  return new MCPServer({\n    host,\n    serverInfo: { name: 'wrongstack-sage-mcp', version: SERVER_INFO.version },\n  });\n}\n", "/**\n * Tool allowlist policy for the SAGE MCP server.\n *\n * Mirrors `packages/cli/src/mcp-serve.ts:217-236` (selectExposedTools).\n *\n * Tool permission model:\n *   - Sage tools use `permission: 'confirm'` for any write/delete/update/\n *     recover/backfill/verify/hygiene operation\n *     (`packages/sage/src/tools/memory-tools.ts`), reserving\n *     `permission: 'auto'` for read-only tools.\n *   - `wstack mcp serve` (`packages/cli/src/mcp-serve.ts:217-236`)\n *     decides auto-approval by routing through a host `PermissionPolicy`\n *     (`AutoApprovePermissionPolicy` defaults to read-only).\n *\n * SAGE MCP chooses a simpler axis: MCP has no UI confirm flow, so a write\n * tool surfaced over MCP cannot be approved inline \u2014 the MCP client (e.g.\n * Claude Desktop) is expected to surface its own confirm UX before\n * forwarding the call. Default policy is therefore \"read-only\", exposing\n * only `permission: 'auto'` AND `riskTier === 'safe'` tools. Pass\n * `--writable` to additionally expose `permission === 'confirm'` tools\n * whose `riskTier !== 'destructive'`. The MCP client owns the user-facing\n * confirmation gesture in that case.\n *\n * The tool's own `Tool.validate(input)` (see\n * `packages/sage/src/tools/memory-tools.ts:276-283` and `:332-340`) remains\n * the source of truth for per-call safety checks such as `force: true` on\n * `memory_delete`. Policy only controls visibility.\n */\nimport type { Tool } from '@wrongstack/core/types';\n\nexport interface SageMcpPolicyOptions {\n  writable?: boolean;\n}\n\nexport interface SageMcpAllowedTool {\n  name: string;\n  tool: Tool;\n}\n\nexport function selectAllowedTools(\n  tools: Tool[],\n  opts: SageMcpPolicyOptions = {},\n): SageMcpAllowedTool[] {\n  const allowed: SageMcpAllowedTool[] = [];\n  for (const tool of tools) {\n    if (tool.permission === 'deny') continue;\n    if (tool.riskTier === 'destructive') continue;\n    if (tool.permission === 'auto') {\n      if (tool.riskTier === 'safe' || opts.writable === true) {\n        allowed.push({ name: tool.name, tool });\n      }\n      continue;\n    }\n    // permission === 'confirm'\n    if (opts.writable !== true) continue;\n    if (tool.riskTier !== 'standard' && tool.riskTier !== 'safe') continue;\n    allowed.push({ name: tool.name, tool });\n  }\n  return allowed;\n}\n", "/**\n * Single source of truth for the package version reported to MCP clients.\n * Kept tiny so a build step never has to run before `pnpm --filter` tests\n * can read it.\n */\nimport { readFileSync } from 'node:fs';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, resolve } from 'node:path';\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst pkgPath = resolve(here, '..', 'package.json');\n\ninterface MinimalPackage {\n  name?: string;\n  version?: string;\n}\n\nlet cached: { name: string; version: string } | undefined;\nfunction readServerInfo(): { name: string; version: string } {\n  if (cached) return cached;\n  try {\n    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as MinimalPackage;\n    cached = {\n      name: pkg.name ?? '@wrongstack/sage-mcp',\n      version: pkg.version ?? '0.0.0',\n    };\n    return cached;\n  } catch {\n    cached = { name: '@wrongstack/sage-mcp', version: '0.0.0' };\n    return cached;\n  }\n}\n\nexport const SERVER_INFO = readServerInfo();\n"],
+  "mappings": ";AAqBA;AAAA,EACE;AAAA,OAIK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACKA,SAAS,mBACd,OACA,OAA6B,CAAC,GACR;AACtB,QAAM,UAAgC,CAAC;AACvC,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,eAAe,OAAQ;AAChC,QAAI,KAAK,aAAa,cAAe;AACrC,QAAI,KAAK,eAAe,QAAQ;AAC9B,UAAI,KAAK,aAAa,UAAU,KAAK,aAAa,MAAM;AACtD,gBAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,MACxC;AACA;AAAA,IACF;AAEA,QAAI,KAAK,aAAa,KAAM;AAC5B,QAAI,KAAK,aAAa,cAAc,KAAK,aAAa,OAAQ;AAC9D,YAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EACxC;AACA,SAAO;AACT;;;ACtDA,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AAEjC,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,QAAQ,MAAM,MAAM,cAAc;AAOlD,IAAI;AACJ,SAAS,iBAAoD;AAC3D,MAAI,OAAQ,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AACpD,aAAS;AAAA,MACP,MAAM,IAAI,QAAQ;AAAA,MAClB,SAAS,IAAI,WAAW;AAAA,IAC1B;AACA,WAAO;AAAA,EACT,QAAQ;AACN,aAAS,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AAC1D,WAAO;AAAA,EACT;AACF;AAEO,IAAM,cAAc,eAAe;;;AFiBnC,SAAS,mBAAmB,MAAmC;AACpE,QAAM,UAAU,eAAe,IAAI;AACnC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,sBACd,MACA,OAA+B,CAAC,GACb;AACnB,MAAI,CAAC,kBAAkB,GAAG;AAIxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,IAAI;AACvC,QAAM,WAAmB,gBAAgB,OAAO;AAChD,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,QAAM,gBAAgB,IAAI,IAAkB,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,CAAC;AAK5F,QAAM,MAAM,uBAAuB;AACnC,QAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAM,SAAS,GAAG;AAElB,WAAS,mBAAmB,QAA6C;AAIvE,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,YAA6B;AAC3B,aAAO,QAAQ;AAAA,QACb,CAAC,EAAE,MAAM,KAAK,OAAsB;AAAA,UAClC;AAAA,UACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,UAC5D,aAAa,mBAAmB,KAAK,WAAW;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,MAAc,MAA6D;AACxF,YAAM,OAAO,cAAc,IAAI,IAAI;AACnC,UAAI,CAAC,MAAM;AACT,eAAO;AAAA,UACL,SAAS,SAAS,IAAI;AAAA,UACtB,SAAS;AAAA,QACX;AAAA,MACF;AAKA,YAAM,WAAoC,EAAE,GAAG,KAAK;AACpD,UAAI,SAAS,cAAc,SAAS,kBAAkB,MAAM,QAAW;AACrE,iBAAS,kBAAkB,IAAI;AAAA,MACjC;AAKA,YAAM,WAAW,KAAK;AACtB,UAAI,OAAO,aAAa,YAAY;AAClC,cAAM,SAAS,MAAM,SAAS,QAAQ;AACtC,YAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,iBAAO,EAAE,SAAS,OAAO,KAAK,IAAI,GAAG,SAAS,KAAK;AAAA,QACrD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,QAAQ,UAAU,KAAK,EAAE,OAAO,CAAC;AAAA,MACvD,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,eAAO,EAAE,SAAS,SAAS,SAAS,KAAK;AAAA,MAC3C;AAOA,UAAI,OAAO,WAAW,SAAU,QAAO,EAAE,SAAS,QAAQ,SAAS,MAAM;AACzE,aAAO,EAAE,SAAS,QAAmB,SAAS,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEA,SAAS,yBAAkC;AAIzC,SAAO;AAAA,IACL,cAAc,CAAC;AAAA,IACf,KAAK,QAAQ,IAAI;AAAA,IACjB,aAAa,QAAQ,IAAI;AAAA,IACzB,yBAAyB;AAAA,IACzB,OAAO;AAAA,IACP,OAAO,CAAC;AAAA,IACR,MAAM,CAAC;AAAA,EACT;AACF;AAEO,SAAS,oBACd,MACA,OAA+B,CAAC,GACrB;AACX,QAAM,OAAO,sBAAsB,MAAM,IAAI;AAC7C,SAAO,IAAI,UAAU;AAAA,IACnB;AAAA,IACA,YAAY,EAAE,MAAM,uBAAuB,SAAS,YAAY,QAAQ;AAAA,EAC1E,CAAC;AACH;",
+  "names": []
+}

package/dist/policy.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Tool allowlist policy for the SAGE MCP server.
+ *
+ * Mirrors `packages/cli/src/mcp-serve.ts:217-236` (selectExposedTools).
+ *
+ * Tool permission model:
+ *   - Sage tools use `permission: 'confirm'` for any write/delete/update/
+ *     recover/backfill/verify/hygiene operation
+ *     (`packages/sage/src/tools/memory-tools.ts`), reserving
+ *     `permission: 'auto'` for read-only tools.
+ *   - `wstack mcp serve` (`packages/cli/src/mcp-serve.ts:217-236`)
+ *     decides auto-approval by routing through a host `PermissionPolicy`
+ *     (`AutoApprovePermissionPolicy` defaults to read-only).
+ *
+ * SAGE MCP chooses a simpler axis: MCP has no UI confirm flow, so a write
+ * tool surfaced over MCP cannot be approved inline — the MCP client (e.g.
+ * Claude Desktop) is expected to surface its own confirm UX before
+ * forwarding the call. Default policy is therefore "read-only", exposing
+ * only `permission: 'auto'` AND `riskTier === 'safe'` tools. Pass
+ * `--writable` to additionally expose `permission === 'confirm'` tools
+ * whose `riskTier !== 'destructive'`. The MCP client owns the user-facing
+ * confirmation gesture in that case.
+ *
+ * The tool's own `Tool.validate(input)` (see
+ * `packages/sage/src/tools/memory-tools.ts:276-283` and `:332-340`) remains
+ * the source of truth for per-call safety checks such as `force: true` on
+ * `memory_delete`. Policy only controls visibility.
+ */
+import type { Tool } from '@wrongstack/core/types';
+export interface SageMcpPolicyOptions {
+    writable?: boolean;
+}
+export interface SageMcpAllowedTool {
+    name: string;
+    tool: Tool;
+}
+export declare function selectAllowedTools(tools: Tool[], opts?: SageMcpPolicyOptions): SageMcpAllowedTool[];
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,EAAE,EACb,IAAI,GAAE,oBAAyB,GAC9B,kBAAkB,EAAE,CAiBtB"}

package/dist/version.d.ts

@@ -0,0 +1,5 @@
+export declare const SERVER_INFO: {
+    name: string;
+    version: string;
+};
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,WAAW;UAfW,MAAM;aAAW,MAAM;CAef,CAAC"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@wrongstack/sage-mcp",
+  "version": "0.296.2",
+  "license": "MIT",
+  "description": "WrongStack SAGE Memory as an MCP (Model Context Protocol) server: STDIO and loopback HTTP, additive to the existing SAGE IPC server.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WrongStack/WrongStack.git",
+    "directory": "packages/sage-mcp"
+  },
+  "homepage": "https://github.com/WrongStack/WrongStack#readme",
+  "bugs": {
+    "url": "https://github.com/WrongStack/WrongStack/issues"
+  },
+  "author": "ECOSTACK TECHNOLOGY OÜ",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "wstack-sage-mcp": "./dist/cli.js"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@wrongstack/core": "0.296.2",
+    "@wrongstack/sage": "0.296.2",
+    "@wrongstack/mcp": "0.296.2"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-package.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.test.json",
+    "test": "echo \"Run @wrongstack/sage-mcp tests from the workspace root: pnpm exec vitest run packages/sage-mcp/tests\"",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
+  }
+}