@xenosystem/capability-mcp 0.1.31

package/README.md

@@ -0,0 +1,82 @@
+# @xenosystem/capability-mcp
+
+**The conversation inherits the tools of the applications you have open.**
+
+Every XENO application already exposes what it can do over an authenticated loopback HTTP
+surface (`XENO AGENT CAPABILITY - SPEC.md` §10.1). The agent conversation already accepts
+extra tools — as MCP. Nothing translated between the two, so an agent running inside Canvas
+could not draw a rectangle while Canvas exposed 73 operations three inches away.
+
+This is that translation: one adapter, an MCP stdio server, that discovers every running XENO
+application and presents its capabilities as tools named `<app>_<domain>_<verb>`.
+
+```
+  Canvas / Pixel / Motion / Browser / Workflow / Engine / …
+        │  GET /capabilities · POST /capabilities/<name>   (bearer token, loopback only)
+        ▼
+  xeno-capability-mcp        ← this package
+        │  MCP over stdio
+        ▼
+  PluginMcpManagerService    ← the existing seam, with its existing approval gate
+        │
+        ▼
+  the agent
+```
+
+## Try it
+
+```bash
+node dist/bin.js --list        # what is running right now, and what is not
+npm run smoke:live             # spawn the real binary, drive a real app, assert it changed
+```
+
+`--list` against a machine with Canvas open:
+
+```
+73 capabilities from 1 running app(s): canvas
+  not available: motion — not running (stale descriptor, pid 188488)
+  …
+```
+
+## Five things that are deliberate
+
+**1. Discovery is live, and re-run on every `tools/list`.** A descriptor in
+`~/.xeno/capability-servers/` outlives the process that wrote it, so the *steady state* of
+that directory is stale — measured 2026-09-08, all eight descriptors named dead pids. An
+adapter that trusted the file would offer an agent operations that cannot run.
+
+**2. A closed application is ABSENT, not FAILING.** `canvas is not available: not running.
+Ask the user to open canvas, then retry` and `no such tool` lead to opposite next actions, and
+an agent told only the second concludes the capability does not exist.
+
+**3. The application's own refusal stays a refusal.** The §8 envelope is passed through
+uninterpreted and `isError` is derived from it. Returning `{ ok: false }` as a successful tool
+result is the fabricated-success shape that let `xeno-workflow` ship 41 nodes reporting
+success while doing nothing.
+
+**4. The token never leaves this process.** Descriptors are `0600` and carry a per-launch
+bearer token. It goes on the wire and into no tool result — asserted by a test.
+
+**5. `inputSchema` is a COMPLETE JSON Schema**, per the MCP spec. `@xenosystem/agent-sdk` used
+to read it as a bare properties map, so every MCP tool in every XENO product reached the model
+with parameters named `type`, `properties` and `required` and the real ones invisible. Fixed
+in that repo's `src/mcp/tool-adapter.ts`; do not "fix" this end to match an old client.
+
+## The envelope divergence this absorbs
+
+Measured across the eight shipped capability servers on 2026-09-08:
+
+| application | `GET /capabilities` body | schema field |
+|---|---|---|
+| canvas, motion, pixel, workflow, sound, docs | `{ capabilities: [...] }` | `argsSchema` |
+| engine | `{ ok: true, capabilities: [...] }` | `inputSchema` |
+
+Eight applications each growing their own MCP endpoint would be eight places to absorb that,
+drifting independently. Here it is one function — and any future application that merely has a
+capability server is covered without writing anything.
+
+## Ports
+
+Read the port from the descriptor, never from `XENO PORT ALLOCATIONS.md`. That document
+records a *preference*; an application that cannot get its preferred port binds another and
+publishes what it actually obtained. Canvas has been observed on 7333, 7395 and 30611.

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * The stdio entry point `PluginMcpManagerService` spawns.
+ *
+ * `--list` prints what is reachable right now and exits, because the first question anyone
+ * asks of this thing is "is anything running", and answering it should not require speaking
+ * JSON-RPC by hand.
+ */
+import { discover } from './catalogue.js';
+import { serve } from './mcpServer.js';
+const argv = process.argv.slice(2);
+if (argv.includes('--list')) {
+    const catalogue = await discover();
+    const apps = [...new Set(catalogue.entries.map((entry) => entry.app))];
+    process.stdout.write(`${catalogue.entries.length} capabilities from ${apps.length} running app(s): ${apps.join(', ') || 'none'}\n`);
+    for (const { app, reason } of catalogue.unreachable)
+        process.stdout.write(`  not available: ${app} — ${reason}\n`);
+    process.exit(0);
+}
+await serve();
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,sBAAsB,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,CAAA;IACnI,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,WAAW;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,MAAM,MAAM,IAAI,CAAC,CAAA;IAClH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,MAAM,KAAK,EAAE,CAAA"}

package/dist/capabilityClient.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Talking to one XENO application's capability server.
+ *
+ * `GET /capabilities` and `POST /capabilities/<name>` are the whole surface
+ * (`XENO AGENT CAPABILITY - SPEC.md` §10.1), and every app bearer-authenticates with the
+ * per-launch token from its descriptor.
+ *
+ * 🔴 **The eight shipped servers do NOT agree on the response envelope, and that divergence
+ * is the reason ONE adapter is the right shape.** Measured 2026-09-08:
+ *
+ * | app | `GET /capabilities` body | schema field |
+ * |---|---|---|
+ * | canvas, motion, pixel, workflow, sound, docs | `{ capabilities: [...] }` | `argsSchema` |
+ * | engine | `{ ok: true, capabilities: [...] }` | `inputSchema` |
+ *
+ * Eight apps each growing their own MCP endpoint would be eight places to absorb that; here
+ * it is one function, and every future app that merely has a capability server is covered
+ * without writing anything.
+ *
+ * This deliberately does NOT reconcile the divergence upstream: `XENO AGENT CAPABILITY -
+ * SPEC.md` §15 makes *exposing* the product's job and *driving* somebody else's, and the
+ * products are shipping. Normalising here is the driving half doing its job.
+ */
+import type { CapabilityDescriptor } from './descriptors.js';
+/** One operation an application offers, normalised across the envelope divergence above. */
+export interface Capability {
+    name: string;
+    description: string;
+    /** A JSON Schema for the arguments. `{ type: 'object', properties: {} }` when absent. */
+    schema: {
+        type: 'object';
+        properties: Record<string, unknown>;
+        required?: string[] | undefined;
+    };
+    /** `safe` | `undoable` | `irreversible` when the app declares it. */
+    reversibility?: string | undefined;
+}
+export interface CapabilityClientOptions {
+    fetchImpl?: typeof fetch | undefined;
+    timeoutMs?: number | undefined;
+}
+/**
+ * Pull the capability array out of whatever envelope this app answered with.
+ *
+ * Returns `undefined` rather than `[]` when nothing recognisable is there. That difference
+ * is load-bearing: an empty array says "this app has no capabilities" and an unreadable body
+ * says "this is not one of our servers" — and the second is how a descriptor whose port has
+ * been recycled by an unrelated process gets refused instead of advertised.
+ */
+export declare function extractCapabilities(body: unknown): unknown[] | undefined;
+/** Normalise one descriptor entry. `argsSchema` and `inputSchema` are both in the wild. */
+export declare function normalizeCapability(entry: unknown): Capability | undefined;
+export declare class CapabilityUnavailable extends Error {
+    readonly app: string;
+    constructor(app: string, message: string);
+}
+/** A thin, tolerant client for one app's capability server. */
+export declare class CapabilityClient {
+    readonly descriptor: CapabilityDescriptor;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(descriptor: CapabilityDescriptor, options?: CapabilityClientOptions);
+    private request;
+    /**
+     * What can this app do right now?
+     *
+     * This IS the liveness check. A pid says a process exists; only a successful, correctly
+     * shaped answer says this app is up, is ours, and honours the token we hold.
+     */
+    listCapabilities(): Promise<Capability[]>;
+    /**
+     * Run one capability and return its raw §8 envelope.
+     *
+     * The envelope is returned UNINTERPRETED. It already distinguishes success from failure
+     * with a code the agent can act on, and re-deciding that here would put two opinions in
+     * the path that can disagree — the shape that produced `{ success: true }` with nothing
+     * done in xeno-workflow's 41 fabricated nodes.
+     */
+    invoke(name: string, args: Record<string, unknown>): Promise<unknown>;
+}
+//# sourceMappingURL=capabilityClient.d.ts.map

package/dist/capabilityClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityClient.d.ts","sourceRoot":"","sources":["../src/capabilityClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,yFAAyF;IACzF,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAA;IAChG,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B;AAUD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,SAAS,CAUxE;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAkB1E;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,GAAG,EAAE,MAAM;gBAAX,GAAG,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM;CAKlB;AAED,+DAA+D;AAC/D,qBAAa,gBAAgB;IAKzB,QAAQ,CAAC,UAAU,EAAE,oBAAoB;IAJ3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;gBAGvB,UAAU,EAAE,oBAAoB,EACzC,OAAO,GAAE,uBAA4B;YAMzB,OAAO;IAoBrB;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAkC/C;;;;;;;OAOG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CA2B5E"}

package/dist/capabilityClient.js

@@ -0,0 +1,174 @@
+/**
+ * Talking to one XENO application's capability server.
+ *
+ * `GET /capabilities` and `POST /capabilities/<name>` are the whole surface
+ * (`XENO AGENT CAPABILITY - SPEC.md` §10.1), and every app bearer-authenticates with the
+ * per-launch token from its descriptor.
+ *
+ * 🔴 **The eight shipped servers do NOT agree on the response envelope, and that divergence
+ * is the reason ONE adapter is the right shape.** Measured 2026-09-08:
+ *
+ * | app | `GET /capabilities` body | schema field |
+ * |---|---|---|
+ * | canvas, motion, pixel, workflow, sound, docs | `{ capabilities: [...] }` | `argsSchema` |
+ * | engine | `{ ok: true, capabilities: [...] }` | `inputSchema` |
+ *
+ * Eight apps each growing their own MCP endpoint would be eight places to absorb that; here
+ * it is one function, and every future app that merely has a capability server is covered
+ * without writing anything.
+ *
+ * This deliberately does NOT reconcile the divergence upstream: `XENO AGENT CAPABILITY -
+ * SPEC.md` §15 makes *exposing* the product's job and *driving* somebody else's, and the
+ * products are shipping. Normalising here is the driving half doing its job.
+ */
+const DEFAULT_TIMEOUT_MS = 15_000;
+function asObject(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * Pull the capability array out of whatever envelope this app answered with.
+ *
+ * Returns `undefined` rather than `[]` when nothing recognisable is there. That difference
+ * is load-bearing: an empty array says "this app has no capabilities" and an unreadable body
+ * says "this is not one of our servers" — and the second is how a descriptor whose port has
+ * been recycled by an unrelated process gets refused instead of advertised.
+ */
+export function extractCapabilities(body) {
+    const root = asObject(body);
+    if (!root)
+        return Array.isArray(body) ? body : undefined;
+    if (Array.isArray(root['capabilities']))
+        return root['capabilities'];
+    // A manifest object carrying the list one level down.
+    const nested = asObject(root['capabilities']);
+    if (nested && Array.isArray(nested['capabilities']))
+        return nested['capabilities'];
+    const data = asObject(root['data']);
+    if (data && Array.isArray(data['capabilities']))
+        return data['capabilities'];
+    return undefined;
+}
+/** Normalise one descriptor entry. `argsSchema` and `inputSchema` are both in the wild. */
+export function normalizeCapability(entry) {
+    const record = asObject(entry);
+    const name = record?.['name'];
+    if (typeof name !== 'string' || !name)
+        return undefined;
+    const rawSchema = asObject(record?.['argsSchema']) ?? asObject(record?.['inputSchema']) ?? asObject(record?.['schema']);
+    const properties = asObject(rawSchema?.['properties']) ?? {};
+    const rawRequired = rawSchema?.['required'];
+    const required = Array.isArray(rawRequired)
+        ? rawRequired.filter((value) => typeof value === 'string')
+        : undefined;
+    return {
+        name,
+        description: typeof record?.['description'] === 'string' ? record['description'] : name,
+        schema: { type: 'object', properties, ...(required && required.length ? { required } : {}) },
+        reversibility: typeof record?.['reversibility'] === 'string' ? record['reversibility'] : undefined,
+    };
+}
+export class CapabilityUnavailable extends Error {
+    app;
+    constructor(app, message) {
+        super(message);
+        this.app = app;
+        this.name = 'CapabilityUnavailable';
+    }
+}
+/** A thin, tolerant client for one app's capability server. */
+export class CapabilityClient {
+    descriptor;
+    fetchImpl;
+    timeoutMs;
+    constructor(descriptor, options = {}) {
+        this.descriptor = descriptor;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async request(path, init) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            return await this.fetchImpl(`${this.descriptor.url}${path}`, {
+                ...init,
+                signal: controller.signal,
+                headers: {
+                    ...init?.headers,
+                    // The token stays in this process. It is read from a 0600 descriptor and put on
+                    // the wire; it is never part of a tool result, so it cannot reach a renderer or a
+                    // model transcript.
+                    authorization: `Bearer ${this.descriptor.token}`,
+                },
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * What can this app do right now?
+     *
+     * This IS the liveness check. A pid says a process exists; only a successful, correctly
+     * shaped answer says this app is up, is ours, and honours the token we hold.
+     */
+    async listCapabilities() {
+        let response;
+        try {
+            response = await this.request('/capabilities');
+        }
+        catch (error) {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} is not answering on ${this.descriptor.url}: ${error.message}`);
+        }
+        if (!response.ok) {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} answered ${response.status} for GET /capabilities.`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} answered with non-JSON.`);
+        }
+        const entries = extractCapabilities(body);
+        if (!entries) {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} answered a body with no capability list — the port may belong to something else now.`);
+        }
+        return entries
+            .map((entry) => normalizeCapability(entry))
+            .filter((capability) => capability !== undefined);
+    }
+    /**
+     * Run one capability and return its raw §8 envelope.
+     *
+     * The envelope is returned UNINTERPRETED. It already distinguishes success from failure
+     * with a code the agent can act on, and re-deciding that here would put two opinions in
+     * the path that can disagree — the shape that produced `{ success: true }` with nothing
+     * done in xeno-workflow's 41 fabricated nodes.
+     */
+    async invoke(name, args) {
+        let response;
+        try {
+            response = await this.request(`/capabilities/${encodeURIComponent(name)}`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ args }),
+            });
+        }
+        catch (error) {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} is not answering: ${error.message}`);
+        }
+        const text = await response.text();
+        if (!response.ok && !text) {
+            throw new CapabilityUnavailable(this.descriptor.app, `${this.descriptor.app} answered ${response.status}.`);
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { ok: false, error: { code: 'internal', message: text.slice(0, 2000) } };
+        }
+    }
+}
+//# sourceMappingURL=capabilityClient.js.map

package/dist/capabilityClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityClient.js","sourceRoot":"","sources":["../src/capabilityClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAmBH,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAc,CAAA;IACjF,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAc,CAAA;IAC/F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACnC,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAc,CAAA;IACzF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IACvD,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvG,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,SAAS,EAAE,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC3E,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,aAAa,CAAY,CAAC,CAAC,CAAC,IAAI;QACnG,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC5F,aAAa,EACX,OAAO,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS;KAClG,CAAA;AACH,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IADX,YACW,GAAW,EACpB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,QAAG,GAAH,GAAG,CAAQ;QAIpB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,gBAAgB;IAKhB;IAJM,SAAS,CAAc;IACvB,SAAS,CAAQ;IAElC,YACW,UAAgC,EACzC,UAAmC,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAsB;QAGzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IAC1D,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAkB;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE;gBAC3D,GAAG,IAAI;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACP,GAAI,IAAI,EAAE,OAA8C;oBACxD,gFAAgF;oBAChF,kFAAkF;oBAClF,oBAAoB;oBACpB,aAAa,EAAE,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE;iBACjD;aACF,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,wBAAwB,IAAI,CAAC,UAAU,CAAC,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CACjG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,yBAAyB,CAC5E,CAAA;QACH,CAAC;QACD,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,0BAA0B,CAAC,CAAA;QACxG,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,uFAAuF,CAC9G,CAAA;QACH,CAAC;QACD,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,UAAU,EAA4B,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,CAAA;IAC/E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAA6B;QACtD,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACzE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,sBAAuB,KAAe,CAAC,OAAO,EAAE,CACvE,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,GAAG,CACtD,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;CACF"}

package/dist/catalogue.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Every capability of every RUNNING XENO application, as one tool list.
+ *
+ * Discovery is deliberately re-run on every `tools/list`. An app the user opens after the
+ * conversation started must appear, and an app they close must disappear — a catalogue
+ * cached at startup is exactly how an agent ends up offering operations that cannot run.
+ */
+import { type Capability } from './capabilityClient.js';
+import { type CapabilityDescriptor } from './descriptors.js';
+export interface CatalogueEntry {
+    app: string;
+    capability: Capability;
+    /** The MCP tool name. App-qualified, and safe for every MCP client. */
+    toolName: string;
+}
+export interface Catalogue {
+    entries: CatalogueEntry[];
+    /**
+     * Apps found on disk that could not be reached, with the reason.
+     *
+     * Kept rather than discarded: "Canvas is not running" and "Canvas has no such capability"
+     * are different instructions for an agent, and only the first is recoverable by asking the
+     * user to open the app.
+     */
+    unreachable: {
+        app: string;
+        reason: string;
+    }[];
+}
+/**
+ * MCP tool name for one capability.
+ *
+ * The name is app-qualified so two apps cannot collide and so the agent can say WHICH app it
+ * is acting on. Capability names are already qualified in every shipped app
+ * (`canvas.document.create`), so the prefix is added only when it is missing — otherwise the
+ * tool would read `canvas_canvas_document_create`.
+ *
+ * Dots become underscores. The consuming SDK's sanitiser permits dots
+ * (`/[^A-Za-z0-9_.-]+/`), but Anthropic's tool-name rule is `^[a-zA-Z0-9_-]{1,64}$` and this
+ * server is meant to work with any MCP client, so the conservative alphabet is the one that
+ * cannot be wrong somewhere else.
+ */
+export declare function toolNameFor(app: string, capabilityName: string): string;
+export interface DiscoverOptions {
+    dir?: string | undefined;
+    fetchImpl?: typeof fetch | undefined;
+    timeoutMs?: number | undefined;
+    /** Injected so the liveness rule can be tested without spawning processes. */
+    isAlive?: ((pid: number | undefined) => boolean) | undefined;
+}
+/** Descriptors whose publishing process still exists. Cheap, and never the whole answer. */
+export declare function candidateDescriptors(options?: DiscoverOptions): {
+    candidates: CapabilityDescriptor[];
+    dead: {
+        app: string;
+        reason: string;
+    }[];
+};
+/** Build the live catalogue. Apps are probed in parallel; one being down never blocks another. */
+export declare function discover(options?: DiscoverOptions): Promise<Catalogue>;
+/** The description a model sees. It has to carry the app and the risk, not just the verb. */
+export declare function describeEntry(entry: CatalogueEntry): string;
+//# sourceMappingURL=catalogue.d.ts.map

package/dist/catalogue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.d.ts","sourceRoot":"","sources":["../src/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAChG,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE7F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,UAAU,CAAA;IACtB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;;OAMG;IACH,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC/C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAA;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;CAC7D;AAED,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,eAAoB,GAAG;IACnE,UAAU,EAAE,oBAAoB,EAAE,CAAA;IAClC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACxC,CASA;AAED,kGAAkG;AAClG,wBAAsB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAmChF;AAED,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAM3D"}

package/dist/catalogue.js

@@ -0,0 +1,82 @@
+/**
+ * Every capability of every RUNNING XENO application, as one tool list.
+ *
+ * Discovery is deliberately re-run on every `tools/list`. An app the user opens after the
+ * conversation started must appear, and an app they close must disappear — a catalogue
+ * cached at startup is exactly how an agent ends up offering operations that cannot run.
+ */
+import { CapabilityClient, CapabilityUnavailable } from './capabilityClient.js';
+import { processIsAlive, readDescriptors } from './descriptors.js';
+/**
+ * MCP tool name for one capability.
+ *
+ * The name is app-qualified so two apps cannot collide and so the agent can say WHICH app it
+ * is acting on. Capability names are already qualified in every shipped app
+ * (`canvas.document.create`), so the prefix is added only when it is missing — otherwise the
+ * tool would read `canvas_canvas_document_create`.
+ *
+ * Dots become underscores. The consuming SDK's sanitiser permits dots
+ * (`/[^A-Za-z0-9_.-]+/`), but Anthropic's tool-name rule is `^[a-zA-Z0-9_-]{1,64}$` and this
+ * server is meant to work with any MCP client, so the conservative alphabet is the one that
+ * cannot be wrong somewhere else.
+ */
+export function toolNameFor(app, capabilityName) {
+    const qualified = capabilityName.startsWith(`${app}.`) ? capabilityName : `${app}.${capabilityName}`;
+    return qualified.replace(/[^A-Za-z0-9_-]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 64);
+}
+/** Descriptors whose publishing process still exists. Cheap, and never the whole answer. */
+export function candidateDescriptors(options = {}) {
+    const isAlive = options.isAlive ?? processIsAlive;
+    const candidates = [];
+    const dead = [];
+    for (const descriptor of readDescriptors(options.dir)) {
+        if (isAlive(descriptor.pid))
+            candidates.push(descriptor);
+        else
+            dead.push({ app: descriptor.app, reason: `not running (stale descriptor, pid ${descriptor.pid})` });
+    }
+    return { candidates, dead };
+}
+/** Build the live catalogue. Apps are probed in parallel; one being down never blocks another. */
+export async function discover(options = {}) {
+    const { candidates, dead } = candidateDescriptors(options);
+    const entries = [];
+    const unreachable = [...dead];
+    const probes = candidates.map(async (descriptor) => {
+        const client = new CapabilityClient(descriptor, {
+            fetchImpl: options.fetchImpl,
+            timeoutMs: options.timeoutMs,
+        });
+        try {
+            const capabilities = await client.listCapabilities();
+            return { descriptor, capabilities };
+        }
+        catch (error) {
+            const reason = error instanceof CapabilityUnavailable ? error.message : `unreachable: ${error.message}`;
+            unreachable.push({ app: descriptor.app, reason });
+            return undefined;
+        }
+    });
+    for (const probe of await Promise.all(probes)) {
+        if (!probe)
+            continue;
+        for (const capability of probe.capabilities) {
+            entries.push({
+                app: probe.descriptor.app,
+                capability,
+                toolName: toolNameFor(probe.descriptor.app, capability.name),
+            });
+        }
+    }
+    entries.sort((a, b) => a.toolName.localeCompare(b.toolName));
+    unreachable.sort((a, b) => a.app.localeCompare(b.app));
+    return { entries, unreachable };
+}
+/** The description a model sees. It has to carry the app and the risk, not just the verb. */
+export function describeEntry(entry) {
+    const risk = entry.capability.reversibility && entry.capability.reversibility !== 'safe'
+        ? ` [${entry.capability.reversibility}]`
+        : '';
+    return `[${entry.app}]${risk} ${entry.capability.description}`;
+}
+//# sourceMappingURL=catalogue.js.map

package/dist/catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.js","sourceRoot":"","sources":["../src/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAmB,MAAM,uBAAuB,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,eAAe,EAA6B,MAAM,kBAAkB,CAAA;AAqB7F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,cAAsB;IAC7D,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,cAAc,EAAE,CAAA;IACpG,OAAO,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxF,CAAC;AAUD,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,UAA2B,EAAE;IAIhE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAA;IACjD,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAsC,EAAE,CAAA;IAClD,KAAK,MAAM,UAAU,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,sCAAsC,UAAU,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAA2B,EAAE;IAC1D,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAE7B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAA;YACpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GACV,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAiB,KAAe,CAAC,OAAO,EAAE,CAAA;YACrG,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YACjD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;gBACzB,UAAU;gBACV,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;aAC7D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5D,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AACjC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,IAAI,GACR,KAAK,CAAC,UAAU,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,KAAK,MAAM;QACzE,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,GAAG;QACxC,CAAC,CAAC,EAAE,CAAA;IACR,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAA;AAChE,CAAC"}

package/dist/descriptors.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Finding the XENO applications that are running right now.
+ *
+ * Every XENO app that opens a capability server publishes `{ url, token, pid }` to
+ * `~/.xeno/capability-servers/<app>.json` (`XENO AGENT CAPABILITY - SPEC.md` §10.1). That
+ * directory is discovery, and it is the ONLY trustworthy source for where an app is: the
+ * documented port block in `XENO PORT ALLOCATIONS.md` is a *preference*, and an app that
+ * loses its preferred port binds another and publishes the one it actually got. Measured
+ * 2026-09-08: Canvas's descriptor said 7395 against a documented 7333, and five of eight
+ * apps sat outside the documented block entirely.
+ *
+ * 🔴 **A descriptor is not a running server.** The file outlives the process that wrote it,
+ * so the STEADY STATE of that directory is stale, not live — on 2026-09-08 all eight
+ * descriptors named dead pids. Anything that reads a descriptor and concludes the app is up
+ * will offer an agent tools that cannot run, and the agent will report the app broken.
+ * {@link liveDescriptors} exists so that mistake is not available.
+ */
+/** Where every XENO app publishes itself. */
+export declare const CAPABILITY_SERVER_DIR: string;
+export interface CapabilityDescriptor {
+    /** The app's slug, taken from the FILE NAME — `canvas.json` is `canvas`. */
+    app: string;
+    url: string;
+    token: string;
+    pid?: number | undefined;
+    path: string;
+}
+/** Read every descriptor on disk. Says nothing about whether any of them is alive. */
+export declare function readDescriptors(dir?: string): CapabilityDescriptor[];
+/**
+ * Is the process that published this descriptor still alive?
+ *
+ * `kill(pid, 0)` sends no signal; it asks whether the pid can be signalled. **`EPERM` means
+ * the process EXISTS** and belongs to someone else, so treating any throw as "dead" would
+ * report a running app as gone. A descriptor with no pid is not evidence of death either —
+ * it is absence of evidence, and the HTTP probe decides.
+ */
+export declare function processIsAlive(pid: number | undefined): boolean;
+//# sourceMappingURL=descriptors.d.ts.map

package/dist/descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.d.ts","sourceRoot":"","sources":["../src/descriptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,6CAA6C;AAC7C,eAAO,MAAM,qBAAqB,QAAiD,CAAA;AAEnF,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAA8B,GAAG,oBAAoB,EAAE,CA8B3F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQ/D"}

package/dist/descriptors.js

@@ -0,0 +1,78 @@
+/**
+ * Finding the XENO applications that are running right now.
+ *
+ * Every XENO app that opens a capability server publishes `{ url, token, pid }` to
+ * `~/.xeno/capability-servers/<app>.json` (`XENO AGENT CAPABILITY - SPEC.md` §10.1). That
+ * directory is discovery, and it is the ONLY trustworthy source for where an app is: the
+ * documented port block in `XENO PORT ALLOCATIONS.md` is a *preference*, and an app that
+ * loses its preferred port binds another and publishes the one it actually got. Measured
+ * 2026-09-08: Canvas's descriptor said 7395 against a documented 7333, and five of eight
+ * apps sat outside the documented block entirely.
+ *
+ * 🔴 **A descriptor is not a running server.** The file outlives the process that wrote it,
+ * so the STEADY STATE of that directory is stale, not live — on 2026-09-08 all eight
+ * descriptors named dead pids. Anything that reads a descriptor and concludes the app is up
+ * will offer an agent tools that cannot run, and the agent will report the app broken.
+ * {@link liveDescriptors} exists so that mistake is not available.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Where every XENO app publishes itself. */
+export const CAPABILITY_SERVER_DIR = join(homedir(), '.xeno', 'capability-servers');
+/** Read every descriptor on disk. Says nothing about whether any of them is alive. */
+export function readDescriptors(dir = CAPABILITY_SERVER_DIR) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        // No directory means no XENO app has ever opened a capability port here. That is a
+        // legitimate empty answer, not a failure to report.
+        return [];
+    }
+    const descriptors = [];
+    for (const entry of entries) {
+        if (!entry.endsWith('.json'))
+            continue;
+        const path = join(dir, entry);
+        try {
+            const parsed = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof parsed.url !== 'string' || typeof parsed.token !== 'string')
+                continue;
+            descriptors.push({
+                app: entry.slice(0, -'.json'.length),
+                url: parsed.url.replace(/\/+$/, ''),
+                token: parsed.token,
+                pid: typeof parsed.pid === 'number' ? parsed.pid : undefined,
+                path,
+            });
+        }
+        catch {
+            // A half-written or corrupt descriptor is one app being unreachable, never a reason
+            // to hide the others.
+            continue;
+        }
+    }
+    return descriptors.sort((a, b) => a.app.localeCompare(b.app));
+}
+/**
+ * Is the process that published this descriptor still alive?
+ *
+ * `kill(pid, 0)` sends no signal; it asks whether the pid can be signalled. **`EPERM` means
+ * the process EXISTS** and belongs to someone else, so treating any throw as "dead" would
+ * report a running app as gone. A descriptor with no pid is not evidence of death either —
+ * it is absence of evidence, and the HTTP probe decides.
+ */
+export function processIsAlive(pid) {
+    if (pid === undefined)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+//# sourceMappingURL=descriptors.js.map

package/dist/descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.js","sourceRoot":"","sources":["../src/descriptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,6CAA6C;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAA;AAWnF,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,MAAc,qBAAqB;IACjE,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;QACnF,oDAAoD;QACpD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAA2B,EAAE,CAAA;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkC,CAAA;YACtF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YAChF,WAAW,CAAC,IAAI,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;gBACpC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,IAAI;aACL,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,oFAAoF;YACpF,sBAAsB;YACtB,SAAQ;QACV,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './descriptors.js';
+export * from './capabilityClient.js';
+export * from './catalogue.js';
+export * from './mcpServer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from './descriptors.js';
+export * from './capabilityClient.js';
+export * from './catalogue.js';
+export * from './mcpServer.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA"}

package/dist/mcpServer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * An MCP server over stdio that serves every running XENO application's capabilities.
+ *
+ * ## Why stdio and why no MCP SDK
+ *
+ * `PluginMcpManagerService` supports `stdio` and `sse`, and stdio is the right one here: the
+ * adapter must hold each app's bearer token, and a stdio child of the privileged host holds
+ * it in a process the renderer cannot reach. An `sse` server would be a second local HTTP
+ * port with its own auth story, to reach local HTTP ports that already have one.
+ *
+ * The wire protocol is JSON-RPC 2.0, newline-delimited, and the three methods a tool server
+ * needs are `initialize`, `tools/list` and `tools/call`. That is small enough that adding a
+ * dependency to get it would cost more than it saves — and this package is spawned by a
+ * signed host, so its dependency graph is part of what has to be trusted.
+ *
+ * 🔴 **`tools/list` reports `inputSchema` as a COMPLETE JSON Schema**, per the MCP spec. The
+ * consuming SDK used to read it as a bare properties map and corrupt every tool's parameters
+ * (fixed in `xeno-agent-sdk` `src/mcp/tool-adapter.ts`). Do not "fix" this end to match an
+ * old client: a spec-shaped payload is the thing that is correct for every other client too.
+ */
+import { Readable, Writable } from 'node:stream';
+import { type Catalogue, type DiscoverOptions } from './catalogue.js';
+export declare const PROTOCOL_VERSION = "2024-11-05";
+export declare const SERVER_NAME = "xeno-capabilities";
+interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id?: string | number | null;
+    method: string;
+    params?: Record<string, unknown>;
+}
+type JsonRpcResponse = {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    result: unknown;
+} | {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    error: {
+        code: number;
+        message: string;
+    };
+};
+export interface McpServerOptions extends DiscoverOptions {
+    /** Injected so the whole request/response cycle can be exercised without a real app. */
+    discoverImpl?: ((options: DiscoverOptions) => Promise<Catalogue>) | undefined;
+}
+/**
+ * Handle one JSON-RPC request.
+ *
+ * Exported because this is where the protocol behaviour lives; a test that drives it through
+ * two pipes proves the plumbing, and a test that calls this proves the answers.
+ */
+export declare function handleRequest(request: JsonRpcRequest, options?: McpServerOptions): Promise<JsonRpcResponse | undefined>;
+/** Run the server against a pair of streams until the input ends. */
+export declare function serve(input?: Readable, output?: Writable, options?: McpServerOptions): Promise<void>;
+export {};
+//# sourceMappingURL=mcpServer.d.ts.map

package/dist/mcpServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpServer.d.ts","sourceRoot":"","sources":["../src/mcpServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAIhD,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE9F,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAC5C,eAAO,MAAM,WAAW,sBAAsB,CAAA;AAE9C,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAA;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,KAAK,eAAe,GAChB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAE5F,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,wFAAwF;IACxF,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS,CAAA;CAC9E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAgHtC;AAED,qEAAqE;AACrE,wBAAgB,KAAK,CACnB,KAAK,GAAE,QAAwB,EAC/B,MAAM,GAAE,QAAyB,EACjC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA8Cf"}

package/dist/mcpServer.js

@@ -0,0 +1,182 @@
+/**
+ * An MCP server over stdio that serves every running XENO application's capabilities.
+ *
+ * ## Why stdio and why no MCP SDK
+ *
+ * `PluginMcpManagerService` supports `stdio` and `sse`, and stdio is the right one here: the
+ * adapter must hold each app's bearer token, and a stdio child of the privileged host holds
+ * it in a process the renderer cannot reach. An `sse` server would be a second local HTTP
+ * port with its own auth story, to reach local HTTP ports that already have one.
+ *
+ * The wire protocol is JSON-RPC 2.0, newline-delimited, and the three methods a tool server
+ * needs are `initialize`, `tools/list` and `tools/call`. That is small enough that adding a
+ * dependency to get it would cost more than it saves — and this package is spawned by a
+ * signed host, so its dependency graph is part of what has to be trusted.
+ *
+ * 🔴 **`tools/list` reports `inputSchema` as a COMPLETE JSON Schema**, per the MCP spec. The
+ * consuming SDK used to read it as a bare properties map and corrupt every tool's parameters
+ * (fixed in `xeno-agent-sdk` `src/mcp/tool-adapter.ts`). Do not "fix" this end to match an
+ * old client: a spec-shaped payload is the thing that is correct for every other client too.
+ */
+import { createInterface } from 'node:readline';
+import { Readable, Writable } from 'node:stream';
+import { CapabilityClient, CapabilityUnavailable } from './capabilityClient.js';
+import { readDescriptors } from './descriptors.js';
+import { describeEntry, discover } from './catalogue.js';
+export const PROTOCOL_VERSION = '2024-11-05';
+export const SERVER_NAME = 'xeno-capabilities';
+/**
+ * Handle one JSON-RPC request.
+ *
+ * Exported because this is where the protocol behaviour lives; a test that drives it through
+ * two pipes proves the plumbing, and a test that calls this proves the answers.
+ */
+export async function handleRequest(request, options = {}) {
+    const id = request.id ?? null;
+    // A notification (no id) gets no reply, ever. Replying to `notifications/initialized` with
+    // an id of null is a protocol violation some clients treat as fatal.
+    const isNotification = request.id === undefined;
+    switch (request.method) {
+        case 'initialize':
+            return {
+                jsonrpc: '2.0',
+                id,
+                result: {
+                    protocolVersion: PROTOCOL_VERSION,
+                    capabilities: { tools: { listChanged: false } },
+                    serverInfo: { name: SERVER_NAME, version: '0.1.30' },
+                    instructions: 'Tools here drive XENO applications that are running on this machine right now. '
+                        + 'A tool named <app>_<domain>_<verb> acts on that application. If an application is '
+                        + 'not running its tools are absent, not failing — ask the user to open it.',
+                },
+            };
+        case 'ping':
+            return { jsonrpc: '2.0', id, result: {} };
+        case 'tools/list': {
+            const catalogue = await (options.discoverImpl ?? discover)(options);
+            return {
+                jsonrpc: '2.0',
+                id,
+                result: {
+                    tools: catalogue.entries.map((entry) => ({
+                        name: entry.toolName,
+                        description: describeEntry(entry),
+                        inputSchema: entry.capability.schema,
+                    })),
+                },
+            };
+        }
+        case 'tools/call': {
+            const name = typeof request.params?.['name'] === 'string' ? request.params['name'] : '';
+            const args = request.params?.['arguments'] && typeof request.params['arguments'] === 'object'
+                ? request.params['arguments']
+                : {};
+            const catalogue = await (options.discoverImpl ?? discover)(options);
+            const entry = catalogue.entries.find((candidate) => candidate.toolName === name);
+            if (!entry) {
+                /*
+                 * A refusal has to say WHICH failure this is. "No such tool" and "the app that owns
+                 * that tool is closed" lead to opposite next actions, and an agent told only the
+                 * first will conclude the capability does not exist and stop trying.
+                 */
+                const app = name.split('_')[0] ?? '';
+                const down = catalogue.unreachable.find((candidate) => candidate.app === app);
+                const message = down
+                    ? `${app} is not available: ${down.reason}. Ask the user to open ${app}, then retry.`
+                    : `No tool named ${name}. Running applications: ${[...new Set(catalogue.entries.map((candidate) => candidate.app))].join(', ') || 'none'}.`;
+                return { jsonrpc: '2.0', id, result: { isError: true, content: [{ type: 'text', text: message }] } };
+            }
+            const descriptor = readDescriptors(options.dir).find((candidate) => candidate.app === entry.app);
+            if (!descriptor) {
+                return {
+                    jsonrpc: '2.0',
+                    id,
+                    result: {
+                        isError: true,
+                        content: [{ type: 'text', text: `${entry.app} stopped publishing itself between listing and this call.` }],
+                    },
+                };
+            }
+            const client = new CapabilityClient(descriptor, {
+                fetchImpl: options.fetchImpl,
+                timeoutMs: options.timeoutMs,
+            });
+            try {
+                const result = await client.invoke(entry.capability.name, args);
+                /*
+                 * `isError` is derived from the application's own §8 envelope rather than assumed
+                 * false. A refusal returned as a success is the fabricated-success shape this
+                 * ecosystem keeps shipping, and here it would be invisible: the model would read a
+                 * failure body as a result and carry on.
+                 */
+                const envelope = result;
+                const failed = envelope?.ok === false || envelope?.success === false || envelope?.isError === true;
+                return {
+                    jsonrpc: '2.0',
+                    id,
+                    result: {
+                        ...(failed ? { isError: true } : {}),
+                        content: [{ type: 'text', text: JSON.stringify(result) }],
+                    },
+                };
+            }
+            catch (error) {
+                const message = error instanceof CapabilityUnavailable
+                    ? error.message
+                    : `${entry.app} failed: ${error.message}`;
+                return { jsonrpc: '2.0', id, result: { isError: true, content: [{ type: 'text', text: message }] } };
+            }
+        }
+        default:
+            if (isNotification)
+                return undefined;
+            return { jsonrpc: '2.0', id, error: { code: -32601, message: `Method not found: ${request.method}` } };
+    }
+}
+/** Run the server against a pair of streams until the input ends. */
+export function serve(input = process.stdin, output = process.stdout, options = {}) {
+    const lines = createInterface({ input, crlfDelay: Infinity });
+    /*
+     * Requests are answered in order. MCP allows concurrency, but these tools drive a user's
+     * open document: two overlapping edits arriving in an order nobody chose is worse than one
+     * being slightly slower, and the applications themselves serialise anyway.
+     */
+    let queue = Promise.resolve();
+    lines.on('line', (line) => {
+        const text = line.trim();
+        if (!text)
+            return;
+        queue = queue.then(async () => {
+            let request;
+            try {
+                request = JSON.parse(text);
+            }
+            catch {
+                output.write(`${JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } })}\n`);
+                return;
+            }
+            try {
+                const response = await handleRequest(request, options);
+                if (response)
+                    output.write(`${JSON.stringify(response)}\n`);
+            }
+            catch (error) {
+                // A throw escaping here would leave the client waiting on an id forever, which reads
+                // as a hang rather than a failure it can act on.
+                if (request.id !== undefined) {
+                    output.write(`${JSON.stringify({
+                        jsonrpc: '2.0',
+                        id: request.id ?? null,
+                        error: { code: -32603, message: error.message },
+                    })}\n`);
+                }
+            }
+        });
+    });
+    return new Promise((resolve) => {
+        lines.on('close', () => {
+            queue.then(() => resolve()).catch(() => resolve());
+        });
+    });
+}
+//# sourceMappingURL=mcpServer.js.map

package/dist/mcpServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpServer.js","sourceRoot":"","sources":["../src/mcpServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAwC,MAAM,gBAAgB,CAAA;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAA;AAkB9C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAuB,EACvB,UAA4B,EAAE;IAE9B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAA;IAC7B,2FAA2F;IAC3F,qEAAqE;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,EAAE,KAAK,SAAS,CAAA;IAE/C,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,YAAY;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE;gBACF,MAAM,EAAE;oBACN,eAAe,EAAE,gBAAgB;oBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE;oBACpD,YAAY,EACV,iFAAiF;0BAC/E,oFAAoF;0BACpF,0EAA0E;iBAC/E;aACF,CAAA;QAEH,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAE3C,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAA;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE;gBACF,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACvC,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;wBACjC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;qBACrC,CAAC,CAAC;iBACJ;aACF,CAAA;QACH,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAA;YACnG,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ;gBAC9E,CAAC,CAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAA6B;gBAC1D,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAEhF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX;;;;mBAIG;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACpC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;gBAC7E,MAAM,OAAO,GAAG,IAAI;oBAClB,CAAC,CAAC,GAAG,GAAG,sBAAsB,IAAI,CAAC,MAAM,0BAA0B,GAAG,eAAe;oBACrF,CAAC,CAAC,iBAAiB,IAAI,2BACnB,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAClF,GAAG,CAAA;gBACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAA;YACtG,CAAC;YAED,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAA;YAChG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,2DAA2D,EAAE,CAAC;qBAC3G;iBACF,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE;gBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAA;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC/D;;;;;mBAKG;gBACH,MAAM,QAAQ,GAAG,MAAgE,CAAA;gBACjF,MAAM,MAAM,GAAG,QAAQ,EAAE,EAAE,KAAK,KAAK,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAA;gBAClG,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;qBAC1D;iBACF,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;oBACpC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,YAAa,KAAe,CAAC,OAAO,EAAE,CAAA;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAA;YACtG,CAAC;QACH,CAAC;QAED;YACE,IAAI,cAAc;gBAAE,OAAO,SAAS,CAAA;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAA;IAC1G,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,KAAK,CACnB,QAAkB,OAAO,CAAC,KAAK,EAC/B,SAAmB,OAAO,CAAC,MAAM,EACjC,UAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D;;;;OAIG;IACH,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE5C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACxB,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,OAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CACV,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CACrG,CAAA;gBACD,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACtD,IAAI,QAAQ;oBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qFAAqF;gBACrF,iDAAiD;gBACjD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,CACV,GAAG,IAAI,CAAC,SAAS,CAAC;wBAChB,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI;wBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE;qBAC3D,CAAC,IAAI,CACP,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@xenosystem/capability-mcp",
+  "version": "0.1.31",
+  "license": "UNLICENSED",
+  "description": "Presents every running XENO application's capability server to an agent as MCP tools.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "xeno-capability-mcp": "./dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./bin": {
+      "types": "./dist/bin.d.ts",
+      "import": "./dist/bin.js",
+      "default": "./dist/bin.js"
+    }
+  },
+  "files": [
+    "dist",
+    "scripts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XENO-CORPORATION/xeno-agent-interface.git",
+    "directory": "packages/capability-mcp"
+  },
+  "scripts": {
+    "prepack": "tsc -b",
+    "smoke:live": "node scripts/smoke-live-app.mjs"
+  }
+}

package/scripts/smoke-live-app.mjs

@@ -0,0 +1,125 @@
+/**
+ * The gate that decides whether tool inheritance actually works.
+ *
+ * Unit tests over a fake capability server prove the translation and never the connection —
+ * "built, tested, unreachable" is the defect this ecosystem has recorded seven times. So this
+ * spawns the REAL adapter binary as a child process, speaks REAL newline-delimited JSON-RPC
+ * to its stdin, and asserts a REAL XENO application changed as a result.
+ *
+ *   node packages/capability-mcp/scripts/smoke-live-app.mjs
+ *
+ * It requires a XENO application to be running with its capability server open, e.g.
+ *   XENO_CANVAS_CAPABILITY_SERVER=1 electron . --capability-server
+ *
+ * 🔴 It REFUSES rather than passes when nothing is running. A smoke test that reports success
+ * because it found nothing to test is the shape that let four uninstallable releases ship.
+ */
+
+import { spawn } from 'node:child_process'
+import { createInterface } from 'node:readline'
+import { fileURLToPath } from 'node:url'
+
+const BIN = fileURLToPath(new URL('../dist/bin.js', import.meta.url))
+
+const gates = []
+function gate(name, ok, detail = '') {
+  gates.push({ name, ok, detail })
+  process.stdout.write(`  ${ok ? 'ok  ' : 'FAIL'} ${name}${detail ? ` — ${detail}` : ''}\n`)
+}
+
+const child = spawn(process.execPath, [BIN], { stdio: ['pipe', 'pipe', 'inherit'] })
+const lines = createInterface({ input: child.stdout })
+const pending = new Map()
+lines.on('line', (line) => {
+  if (!line.trim()) return
+  const message = JSON.parse(line)
+  const resolve = pending.get(message.id)
+  if (resolve) {
+    pending.delete(message.id)
+    resolve(message)
+  }
+})
+
+let nextId = 1
+function call(method, params) {
+  const id = nextId++
+  return new Promise((resolve, reject) => {
+    pending.set(id, resolve)
+    // A hang is a failure, not a wait: without this the script blocks forever on a child
+    // that stopped answering, and a run that neither passes nor fails gets retried instead
+    // of investigated.
+    setTimeout(() => {
+      if (pending.delete(id)) reject(new Error(`${method} did not answer in 60s`))
+    }, 60_000)
+    child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`)
+  })
+}
+
+const text = (response) => response.result?.content?.[0]?.text ?? ''
+
+try {
+  const init = await call('initialize', { protocolVersion: '2024-11-05', capabilities: {} })
+  gate('the adapter completes an MCP handshake', Boolean(init.result?.protocolVersion), init.result?.serverInfo?.name)
+
+  const listed = await call('tools/list', {})
+  const tools = listed.result?.tools ?? []
+  const apps = [...new Set(tools.map((tool) => tool.name.split('_')[0]))]
+  gate('a running application is discovered', tools.length > 0, `${tools.length} tools from ${apps.join(', ') || 'nothing'}`)
+  if (tools.length === 0) {
+    console.error('\nNo XENO application is running with a capability server open.')
+    console.error('This is a REFUSAL, not a pass: nothing was proven.')
+    process.exit(2)
+  }
+
+  const withSchema = tools.find((tool) => Object.keys(tool.inputSchema?.properties ?? {}).length > 0)
+  gate(
+    'a tool arrives with a COMPLETE JSON Schema, not a properties map',
+    withSchema?.inputSchema?.type === 'object' && !('properties' in (withSchema.inputSchema.properties ?? {})),
+    withSchema?.name,
+  )
+
+  const has = (name) => tools.some((tool) => tool.name === name)
+  gate('the application exposes what this proof needs', has('canvas_document_create') && has('canvas_node_create_rectangle') && has('canvas_node_find'))
+
+  // 🔴 The gate that matters: an agent-side tool call must CHANGE the running application.
+  await call('tools/call', { name: 'canvas_document_create', arguments: {} })
+  const label = `mcp-smoke-${Date.now()}`
+  const created = await call('tools/call', {
+    name: 'canvas_node_create_rectangle',
+    arguments: { x: 24, y: 24, width: 120, height: 80, name: label },
+  })
+  gate('a tool call is not an error', created.result?.isError !== true, text(created).slice(0, 160))
+
+  const found = await call('tools/call', { name: 'canvas_node_find', arguments: { name: label } })
+  const body = text(found)
+  gate('the application actually changed — the node is there when read back', body.includes(label), body.slice(0, 200))
+
+  /*
+   * The refusal half, against an operation the application GENUINELY rejects.
+   *
+   * The first version of this gate asked for a node by an id that does not exist — Canvas
+   * answers `{ok:true, data:[]}` to that, so the assertion could not discriminate and passed
+   * on a working and a broken adapter alike. `page.set_current` with an unknown page really
+   * does answer `ok:false`, which is what makes the check able to fail.
+   */
+  const refused = await call('tools/call', { name: 'canvas_page_set_current', arguments: { pageId: 'not-a-page' } })
+  gate(
+    "the application's own refusal arrives as isError, not as a result",
+    refused.result?.isError === true && /ok":false/.test(text(refused)),
+    text(refused).slice(0, 140),
+  )
+
+  const missing = await call('tools/call', { name: 'motion_timeline_play', arguments: {} })
+  gate(
+    'a closed application is named as CLOSED, not as a missing tool',
+    /not available|No tool named/.test(text(missing)),
+    text(missing).slice(0, 140),
+  )
+} finally {
+  child.stdin.end()
+  child.kill()
+}
+
+const failed = gates.filter((entry) => !entry.ok)
+process.stdout.write(`\n${gates.length - failed.length}/${gates.length} gates passed\n`)
+process.exit(failed.length ? 1 : 0)