@yagni-app/code 1.0.5 → 1.0.6

package/dist/otel.d.ts

@@ -43,13 +43,23 @@ export interface OtelLaunchConfig {
     extensionPath: string;
     /**
      * Where the enablement signal came from. "workspace" additionally carries
-     * protocol/headers/serviceName, delivered as env to the session (the other
-     * sources leave those to whatever the user/repo already configured).
+     * protocol/headers/serviceName, delivered as env to the session; "env" may
+     * carry a protocol when the endpoint arrived via the per-signal
+     * `OTEL_EXPORTER_OTLP_TRACES_(ENDPOINT|PROTOCOL)` bridge (pi-otel reads only
+     * the generic var, so the child env translates); "project-settings" leaves
+     * those to whatever the user/repo already configured.
      */
     source: "env" | "workspace" | "project-settings";
+    /**
+     * The env var the endpoint actually came from — the generic
+     * `OTEL_EXPORTER_OTLP_ENDPOINT` or the per-signal
+     * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. Doctor surfaces it so a user who set
+     * the per-signal var sees their own var named, not the generic one.
+     */
+    envVar?: "OTEL_EXPORTER_OTLP_ENDPOINT" | "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT";
     /** The configured OTLP endpoint (for doctor display; env for workspace source). */
     endpoint: string;
-    /** Workspace-configured OTLP protocol (workspace source only). */
+    /** OTLP protocol: workspace config, or a per-signal env bridge. */
     protocol?: string;
     /** Workspace-configured collector headers (workspace source only; carries secrets). */
     headers?: Record<string, string>;
@@ -72,6 +82,15 @@ export interface WorkspaceOtelConfig {
  * Decide whether this launch exports OTel traces, and with which pi-otel entry.
  * Returns undefined when export stays off: no endpoint configured anywhere,
  * `PI_OTEL_DISABLED` set, or the pi-otel package unresolvable (never fatal).
+ *
+ * Env sources, in precedence order: the generic `OTEL_EXPORTER_OTLP_ENDPOINT`,
+ * then the per-signal `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. pi-otel only reads
+ * the generic var, so the per-signal one (the standard OTel env shape, and
+ * what Claude Code setups configure — e.g. Updater's) is bridged: the traces
+ * endpoint becomes the generic one, and a per-signal TRACES_PROTOCOL carries
+ * over the same way. Logs/metrics per-signal vars are deliberately NOT read:
+ * sessions export traces only, and pi-otel's metrics/logs signals are opt-in
+ * elsewhere.
  */
 export declare function resolveOtelLaunch(opts: {
     env: NodeJS.ProcessEnv;
@@ -80,13 +99,21 @@ export declare function resolveOtelLaunch(opts: {
     resolveExtension?: () => string;
     readFile?: typeof readFileSync;
 }): OtelLaunchConfig | undefined;
-/**
- * Absolute path to pi-otel's extension entry (its package main IS the pi
+/** Absolute path to pi-otel's extension entry (its package main IS the pi
  * extension entry, `dist/index.js`). Resolved ESM-native like `paths.ts` does
  * for pi itself. Throws when the package is missing — callers treat that as
  * "export off", not an error.
  */
 export declare function resolveOtelExtensionPath(): string;
+/**
+ * TCP reachability probe for an OTLP endpoint URL, with scheme-default ports:
+ * WHATWG `URL` strips `:443`/`:80` as defaults, so an https endpoint with no
+ * port probes 443 (the agentless SaaS shape). Returns false on any parse or
+ * connect failure — reachability is advisory, never fatal. Mirrors the probe
+ * inside (patched) pi-otel but lives here so `doctor` can use it without
+ * importing the extension's SDK graph.
+ */
+export declare function probeOtelEndpoint(endpoint: string, timeoutMs?: number): Promise<boolean>;
 /**
  * The env keys an OTel-exporting child must carry. `PI_OTEL_CAPTURE_CONTENT`
  * is pinned unconditionally (policy 2 above); the service name only fills in
@@ -125,10 +152,12 @@ export declare function fetchWorkspaceOtel(creds: {
     token: string;
 }, profileName: string, deps?: WorkspaceOtelFetchDeps): Promise<WorkspaceOtelConfig | null>;
 /**
- * Full launch-time resolution, all three sources in precedence order:
+ * Full launch-time resolution, all four sources in precedence order:
  *
  *   1. `PI_OTEL_DISABLED`      — personal kill switch, beats everything.
- *   2. env `OTEL_EXPORTER_OTLP_ENDPOINT` — the user's own setup, untouched.
+ *   2. env `OTEL_EXPORTER_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`
+ *                              — the user's own setup, untouched (generic wins
+ *                              over per-signal).
  *   3. workspace config        — admin-set in the web app, fetched/cached.
  *   4. repo `.pi/settings.json` — committed per-repo config.
  *

package/dist/otel.js

@@ -29,6 +29,7 @@
  * missing package or unreadable settings file resolves to "disabled".
  */
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createConnection } from "node:net";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { credentialsDir } from "./credentials.js";
@@ -71,16 +72,25 @@ function envDisabled(env) {
  * Decide whether this launch exports OTel traces, and with which pi-otel entry.
  * Returns undefined when export stays off: no endpoint configured anywhere,
  * `PI_OTEL_DISABLED` set, or the pi-otel package unresolvable (never fatal).
+ *
+ * Env sources, in precedence order: the generic `OTEL_EXPORTER_OTLP_ENDPOINT`,
+ * then the per-signal `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. pi-otel only reads
+ * the generic var, so the per-signal one (the standard OTel env shape, and
+ * what Claude Code setups configure — e.g. Updater's) is bridged: the traces
+ * endpoint becomes the generic one, and a per-signal TRACES_PROTOCOL carries
+ * over the same way. Logs/metrics per-signal vars are deliberately NOT read:
+ * sessions export traces only, and pi-otel's metrics/logs signals are opt-in
+ * elsewhere.
  */
 export function resolveOtelLaunch(opts) {
     const { env, cwd } = opts;
     if (envDisabled(env))
         return undefined;
     const envEndpoint = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-    const settingsEndpoint = envEndpoint
-        ? undefined
-        : projectOtelEndpoint(cwd, opts.readFile ?? readFileSync);
-    if (!envEndpoint && !settingsEndpoint)
+    const tracesEndpoint = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+    const usingPerSignal = !envEndpoint && !!tracesEndpoint;
+    const settingsEndpoint = envEndpoint || tracesEndpoint ? undefined : projectOtelEndpoint(cwd, opts.readFile ?? readFileSync);
+    if (!envEndpoint && !tracesEndpoint && !settingsEndpoint)
         return undefined;
     let extensionPath;
     try {
@@ -89,12 +99,28 @@ export function resolveOtelLaunch(opts) {
     catch {
         return undefined;
     }
-    return envEndpoint
-        ? { extensionPath, source: "env", endpoint: envEndpoint }
-        : { extensionPath, source: "project-settings", endpoint: settingsEndpoint };
+    if (envEndpoint) {
+        return {
+            extensionPath,
+            source: "env",
+            envVar: "OTEL_EXPORTER_OTLP_ENDPOINT",
+            endpoint: envEndpoint,
+        };
+    }
+    if (usingPerSignal) {
+        return {
+            extensionPath,
+            source: "env",
+            envVar: "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+            endpoint: tracesEndpoint,
+            ...(env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL?.trim()
+                ? { protocol: env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL.trim() }
+                : {}),
+        };
+    }
+    return { extensionPath, source: "project-settings", endpoint: settingsEndpoint };
 }
-/**
- * Absolute path to pi-otel's extension entry (its package main IS the pi
+/** Absolute path to pi-otel's extension entry (its package main IS the pi
  * extension entry, `dist/index.js`). Resolved ESM-native like `paths.ts` does
  * for pi itself. Throws when the package is missing — callers treat that as
  * "export off", not an error.
@@ -106,6 +132,45 @@ export function resolveOtelExtensionPath() {
     }
     return path;
 }
+/**
+ * TCP reachability probe for an OTLP endpoint URL, with scheme-default ports:
+ * WHATWG `URL` strips `:443`/`:80` as defaults, so an https endpoint with no
+ * port probes 443 (the agentless SaaS shape). Returns false on any parse or
+ * connect failure — reachability is advisory, never fatal. Mirrors the probe
+ * inside (patched) pi-otel but lives here so `doctor` can use it without
+ * importing the extension's SDK graph.
+ */
+export async function probeOtelEndpoint(endpoint, timeoutMs = 1_000) {
+    let host;
+    let port;
+    try {
+        const u = new URL(endpoint);
+        host = u.hostname;
+        port = u.port
+            ? Number(u.port)
+            : u.protocol === "https:"
+                ? 443
+                : u.protocol === "http:"
+                    ? 80
+                    : null;
+    }
+    catch {
+        return false;
+    }
+    if (!host || !port)
+        return false;
+    return new Promise((resolve) => {
+        const sock = createConnection({ host, port });
+        const done = (ok) => {
+            sock.destroy();
+            resolve(ok);
+        };
+        sock.setTimeout(timeoutMs);
+        sock.once("connect", () => done(true));
+        sock.once("timeout", () => done(false));
+        sock.once("error", () => done(false));
+    });
+}
 /**
  * The env keys an OTel-exporting child must carry. `PI_OTEL_CAPTURE_CONTENT`
  * is pinned unconditionally (policy 2 above); the service name only fills in
@@ -135,6 +200,17 @@ export function otelChildEnv(config, baseEnv) {
             workspace.OTEL_SERVICE_NAME = config.serviceName;
         }
     }
+    else if (config.source === "env" && config.protocol) {
+        // The per-signal bridge: the endpoint came from
+        // OTEL_EXPORTER_OTLP_TRACES_ENDPOINT (+ TRACES_PROTOCOL), which pi-otel
+        // does not read — deliver them as the generic vars the extension resolves.
+        if (!baseEnv.OTEL_EXPORTER_OTLP_ENDPOINT) {
+            workspace.OTEL_EXPORTER_OTLP_ENDPOINT = config.endpoint;
+        }
+        if (!baseEnv.OTEL_EXPORTER_OTLP_PROTOCOL) {
+            workspace.OTEL_EXPORTER_OTLP_PROTOCOL = config.protocol;
+        }
+    }
     return {
         ...workspace,
         [OTEL_EXTENSION_PATH_ENV]: config.extensionPath,
@@ -235,10 +311,12 @@ function readWorkspaceOtelCache(cachePath) {
     }
 }
 /**
- * Full launch-time resolution, all three sources in precedence order:
+ * Full launch-time resolution, all four sources in precedence order:
  *
  *   1. `PI_OTEL_DISABLED`      — personal kill switch, beats everything.
- *   2. env `OTEL_EXPORTER_OTLP_ENDPOINT` — the user's own setup, untouched.
+ *   2. env `OTEL_EXPORTER_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`
+ *                              — the user's own setup, untouched (generic wins
+ *                              over per-signal).
  *   3. workspace config        — admin-set in the web app, fetched/cached.
  *   4. repo `.pi/settings.json` — committed per-repo config.
  *
@@ -249,7 +327,7 @@ export async function resolveOtelLaunchWithWorkspace(opts) {
     if (envDisabled(env))
         return undefined;
     // Source 2: the user's own env config short-circuits — no fetch needed.
-    if (env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim()) {
+    if (env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim()) {
         return resolveOtelLaunch({
             env,
             cwd,

package/dist/upgrade.d.ts

@@ -16,7 +16,9 @@
  */
 export declare const PACKAGE_NAME: string;
 export declare const UPDATE_CHECK_DISABLE_ENV = "YAGNI_DISABLE_UPDATE_CHECK";
-export type InstallMethod = "npm" | "pnpm" | "bun";
+export type InstallMethod = "npm" | "pnpm" | "bun" | "brew";
+/** Fully qualified so `brew upgrade` can never resolve someone else's `yagni`. */
+export declare const BREW_FORMULA = "yagni-app/tap/yagni";
 /**
  * The CLI's own version, read from this package's package.json. Resolved
  * relative to the module (src/ and dist/ both sit one level below the package
@@ -70,8 +72,15 @@ export declare function maybeNudgeAndRefresh(deps: NudgeDeps): Promise<{
 }>;
 /**
  * Which global installer owns the running bin, from its (real) path. The
- * heuristic covers the three installers the package supports; `--method` is
+ * heuristic covers the four installers the package supports; `--method` is
  * the escape hatch when a layout defeats it.
+ *
+ * The path is realpath'd first because Homebrew is invisible in argv[1]:
+ * `/opt/homebrew/bin/yagni` is a symlink chain into the Cellar, and only the
+ * resolved path contains the `/Cellar/` segment (macOS, Intel /usr/local,
+ * and Linuxbrew all share it). Detecting brew matters: running `npm install
+ * -g` over a brew install creates a shadowing parallel copy — or the exact
+ * managed-Mac EACCES the brew channel exists to avoid.
  */
 export declare function detectInstallMethod(binPath: string): InstallMethod;
 export type ParsedUpgradeArgs = {

package/dist/upgrade.js

@@ -15,7 +15,7 @@
  * `yagni upgrade` still works there.
  */
 import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -26,7 +26,9 @@ export const UPDATE_CHECK_DISABLE_ENV = "YAGNI_DISABLE_UPDATE_CHECK";
 const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const FETCH_TIMEOUT_MS = 5_000;
 const SEMVER_RE = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-const INSTALL_METHODS = ["npm", "pnpm", "bun"];
+const INSTALL_METHODS = ["npm", "pnpm", "bun", "brew"];
+/** Fully qualified so `brew upgrade` can never resolve someone else's `yagni`. */
+export const BREW_FORMULA = "yagni-app/tap/yagni";
 /**
  * The CLI's own version, read from this package's package.json. Resolved
  * relative to the module (src/ and dist/ both sit one level below the package
@@ -188,18 +190,34 @@ export async function maybeNudgeAndRefresh(deps) {
 // ── `yagni upgrade` ─────────────────────────────────────────────────────────
 /**
  * Which global installer owns the running bin, from its (real) path. The
- * heuristic covers the three installers the package supports; `--method` is
+ * heuristic covers the four installers the package supports; `--method` is
  * the escape hatch when a layout defeats it.
+ *
+ * The path is realpath'd first because Homebrew is invisible in argv[1]:
+ * `/opt/homebrew/bin/yagni` is a symlink chain into the Cellar, and only the
+ * resolved path contains the `/Cellar/` segment (macOS, Intel /usr/local,
+ * and Linuxbrew all share it). Detecting brew matters: running `npm install
+ * -g` over a brew install creates a shadowing parallel copy — or the exact
+ * managed-Mac EACCES the brew channel exists to avoid.
  */
 export function detectInstallMethod(binPath) {
-    const normalized = binPath.replaceAll("\\", "/").toLowerCase();
+    let resolved = binPath;
+    try {
+        resolved = realpathSync(binPath);
+    }
+    catch {
+        // Nonexistent or unreadable (tests, exotic layouts): judge the raw path.
+    }
+    const normalized = resolved.replaceAll("\\", "/").toLowerCase();
+    if (normalized.includes("/cellar/"))
+        return "brew";
     if (normalized.includes("/.bun/"))
         return "bun";
     if (normalized.includes("pnpm"))
         return "pnpm";
     return "npm";
 }
-const UPGRADE_USAGE = `Usage: ${DISTRIBUTION.commandName} upgrade [version] [--method npm|pnpm|bun]`;
+const UPGRADE_USAGE = `Usage: ${DISTRIBUTION.commandName} upgrade [version] [--method npm|pnpm|bun|brew]`;
 export function parseUpgradeArgs(args) {
     let target;
     let method;
@@ -232,9 +250,22 @@ export function parseUpgradeArgs(args) {
     return { ok: true, target, method };
 }
 function installArgv(method, target) {
+    // brew upgrades to whatever the tap formula publishes; it cannot pin a
+    // version, so `target` only tells us an upgrade is worthwhile.
+    if (method === "brew")
+        return ["upgrade", BREW_FORMULA];
     const spec = `${PACKAGE_NAME}@${target}`;
     return method === "npm" ? ["install", "-g", spec] : ["add", "-g", spec];
 }
+function failureHint(method) {
+    if (method === "brew") {
+        return `Try \`brew update\` and \`brew reinstall ${BREW_FORMULA}\`, or \`brew doctor\` if that fails too.`;
+    }
+    // Never suggest sudo: on managed machines the fix is a user-writable
+    // prefix, which the installer sets up automatically.
+    return ("If it was a permissions error, the installer repairs the global prefix without sudo: " +
+        "curl -fsSL https://yagni.app/install.sh | sh");
+}
 function defaultRunInstall(command, args) {
     return new Promise((resolve) => {
         // npm/pnpm/bun are .cmd shims on Windows; a shell is required to run them.
@@ -256,6 +287,11 @@ export async function upgradeCommand(args, deps) {
     }
     const env = deps.env ?? process.env;
     const method = parsed.method ?? detectInstallMethod(deps.binPath ?? process.argv[1] ?? "");
+    if (method === "brew" && parsed.target !== undefined) {
+        logError("Homebrew installs track the tap formula and cannot pin a version. " +
+            `Run \`${DISTRIBUTION.commandName} upgrade\` for the newest release.`);
+        return 1;
+    }
     const fetchLatest = deps.fetchLatest ?? (() => fetchLatestVersion({ env }));
     const target = parsed.target ?? (await fetchLatest());
     if (!target) {
@@ -272,13 +308,17 @@ export async function upgradeCommand(args, deps) {
     const runInstall = deps.runInstall ?? defaultRunInstall;
     const code = await runInstall(method, installArgv(method, target));
     if (code !== 0) {
-        logError(`Upgrade failed (${method} exited ${code}). ` +
-            `If it was a permissions error, fix your ${method} global prefix or retry with elevated permissions.`);
+        logError(`Upgrade failed (${method} exited ${code}). ${failureHint(method)}`);
         return 1;
     }
     // Keep the nudge honest: the freshly installed version is the known latest.
     await writeUpdateCache(target).catch(() => undefined);
-    log(`${DISTRIBUTION.displayName} ${target} installed. Run \`${DISTRIBUTION.commandName} version\` to confirm.`);
+    // brew lands on whatever the formula publishes, which can trail the
+    // registry briefly, so only the package managers that pin get the
+    // version-specific claim.
+    log(method === "brew"
+        ? `${DISTRIBUTION.displayName} upgraded via Homebrew. Run \`${DISTRIBUTION.commandName} version\` to confirm.`
+        : `${DISTRIBUTION.displayName} ${target} installed. Run \`${DISTRIBUTION.commandName} version\` to confirm.`);
     return 0;
 }
 //# sourceMappingURL=upgrade.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -36,10 +36,11 @@
   "dependencies": {
     "@earendil-works/pi-coding-agent": "0.84.1",
     "@earendil-works/pi-tui": "0.84.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "pi-otel": "0.1.0",
     "smol-toml": "^1.8.0",
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "5bd359dcd98d8104d425f698a65ed60d780df0af"
+  "yagniSourceSha": "09cd57add6ba5c3028cc4f971459d5c7f9d4da97"
 }

package/dist/extension/mcpTools.d.ts

@@ -1,57 +0,0 @@
-/**
- * Workspace MCP servers in YAGNI Code (YAG-446).
- *
- * The workspace's registered MCP servers (Connections → MCP Servers) are
- * the config source: at session start we fetch the list from the backend
- * and register one pi tool per enabled server tool, named with the same
- * `mcp_<slug>__<tool>` wire shape the backend executor parses. Calls
- * execute THROUGH the backend (`POST /api/yagni-code/mcp/call`), so
- * credentials never reach this machine and the backend's egress guard,
- * autonomy gate, per-user credential policy, and audit trail all apply.
- *
- * Everything here is fail-soft against an older backend or an
- * un-rescoped token: a 403/404/network failure on the list fetch means
- * no MCP tools and no startup error.
- */
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-export interface McpToolInfo {
-    name: string;
-    description: string | null;
-    inputSchema: unknown;
-    riskClass: string;
-}
-export interface McpServerInfo {
-    slug: string;
-    name: string;
-    tools: McpToolInfo[];
-    viewerCredential: {
-        source: "user" | "workspace";
-    };
-}
-export interface McpClientOpts {
-    baseUrl: string;
-    getToken: () => string | undefined;
-    fetchImpl?: typeof fetch;
-}
-export declare function mcpWireToolName(slug: string, tool: string): string;
-/**
- * Fetch the workspace's MCP servers. Fail-soft by design: any non-OK
- * response (older backend without the endpoints, token minted before the
- * `yagni_code:mcp` scope existed) or transport error returns `[]`.
- */
-export declare function fetchMcpServers(opts: McpClientOpts): Promise<McpServerInfo[]>;
-/**
- * Register every reachable MCP tool. Returns the wire names of MUTATING
- * tools so the caller can extend the permission-gate policy — plan mode
- * holds them, review mode confirms them, exactly like write/edit/bash.
- */
-export declare function registerMcpTools(pi: ExtensionAPI, servers: McpServerInfo[], opts: McpClientOpts): {
-    mutatingToolNames: string[];
-};
-/** Render the /mcp listing (pure, for tests). */
-export declare function renderMcpListing(servers: McpServerInfo[], baseUrl: string): string;
-/** Wire the `/mcp` command: list servers, tools, and credential status. */
-export declare function registerMcpCommand(pi: ExtensionAPI, servers: McpServerInfo[], opts: {
-    baseUrl: string;
-}): void;
-//# sourceMappingURL=mcpTools.d.ts.map

package/dist/extension/mcpTools.js

@@ -1,132 +0,0 @@
-import { Type } from "typebox";
-import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
-export function mcpWireToolName(slug, tool) {
-    return `mcp_${slug}__${tool}`;
-}
-/**
- * Fetch the workspace's MCP servers. Fail-soft by design: any non-OK
- * response (older backend without the endpoints, token minted before the
- * `yagni_code:mcp` scope existed) or transport error returns `[]`.
- */
-export async function fetchMcpServers(opts) {
-    try {
-        const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/mcp/servers`, {
-            method: "GET",
-            headers: { authorization: `Bearer ${opts.getToken() ?? ""}` },
-        }, { fetchImpl: opts.fetchImpl });
-        if (!res.ok)
-            return [];
-        const data = (await res.json());
-        if (!Array.isArray(data.servers))
-            return [];
-        return data.servers;
-    }
-    catch {
-        return [];
-    }
-}
-function schemaFor(tool) {
-    const schema = tool.inputSchema;
-    if (schema !== null &&
-        typeof schema === "object" &&
-        !Array.isArray(schema) &&
-        Object.keys(schema).length > 0) {
-        // MCP inputSchemas are plain JSON Schema objects, which is exactly what
-        // TypeBox schemas are at runtime — pass the server's schema through so
-        // the model sees real parameter shapes.
-        return schema;
-    }
-    return Type.Object({}, { additionalProperties: true });
-}
-function makeMcpTool(server, tool, opts) {
-    const wireName = mcpWireToolName(server.slug, tool.name);
-    return {
-        name: wireName,
-        label: `${server.name}: ${tool.name}`,
-        description: `${tool.description ?? `MCP tool ${tool.name}`} ` +
-            `(MCP server "${server.name}", risk: ${tool.riskClass}; runs through YAGNI)`,
-        parameters: schemaFor(tool),
-        async execute(_toolCallId, params, signal) {
-            const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/mcp/call`, {
-                method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    authorization: `Bearer ${opts.getToken() ?? ""}`,
-                },
-                body: JSON.stringify({
-                    slug: server.slug,
-                    tool: tool.name,
-                    args: params ?? {},
-                }),
-            }, { fetchImpl: opts.fetchImpl, signal, policy: METERED_POST_FETCH_POLICY });
-            if (!res.ok) {
-                throw new Error(await friendlyFetchError(wireName, res));
-            }
-            const result = (await res.json());
-            if (!result.success) {
-                const suffix = result.errorCode === "user_credential_required"
-                    ? ` Bind your token at ${opts.baseUrl}/services/mcp.`
-                    : "";
-                throw new Error(`${result.error ?? "MCP tool call failed"}${suffix}`);
-            }
-            const text = typeof result.result === "string"
-                ? result.result
-                : JSON.stringify(result.result ?? null, null, 2);
-            return {
-                content: [{ type: "text", text }],
-                details: { riskClass: tool.riskClass },
-            };
-        },
-    };
-}
-/**
- * Register every reachable MCP tool. Returns the wire names of MUTATING
- * tools so the caller can extend the permission-gate policy — plan mode
- * holds them, review mode confirms them, exactly like write/edit/bash.
- */
-export function registerMcpTools(pi, servers, opts) {
-    const mutatingToolNames = [];
-    for (const server of servers) {
-        for (const tool of server.tools) {
-            pi.registerTool(makeMcpTool(server, tool, opts));
-            if (tool.riskClass !== "read_only") {
-                mutatingToolNames.push(mcpWireToolName(server.slug, tool.name));
-            }
-        }
-    }
-    return { mutatingToolNames };
-}
-/** Render the /mcp listing (pure, for tests). */
-export function renderMcpListing(servers, baseUrl) {
-    if (servers.length === 0) {
-        return [
-            "No MCP servers connected for this workspace.",
-            `An admin can register one under Connections: ${baseUrl}/services/mcp`,
-        ].join("\n");
-    }
-    const lines = ["Workspace MCP servers:"];
-    for (const server of servers) {
-        const mutating = server.tools.filter((t) => t.riskClass !== "read_only").length;
-        const credential = server.viewerCredential.source === "user"
-            ? "connected as you"
-            : "workspace credential";
-        lines.push(`  ${server.name} (${server.slug}) — ${server.tools.length} tool${server.tools.length === 1 ? "" : "s"}` +
-            `${mutating > 0 ? ` (${mutating} mutating)` : ""} · ${credential}`);
-        for (const tool of server.tools) {
-            lines.push(`    ${mcpWireToolName(server.slug, tool.name)} [${tool.riskClass}]`);
-        }
-    }
-    lines.push(`Bind a personal token (writes carry your authority): ${baseUrl}/services/mcp`);
-    return lines.join("\n");
-}
-/** Wire the `/mcp` command: list servers, tools, and credential status. */
-export function registerMcpCommand(pi, servers, opts) {
-    pi.registerCommand("mcp", {
-        description: "List this workspace's MCP servers, their tools, and your credential status.",
-        handler: async (_args, ctx) => {
-            if (ctx.hasUI)
-                ctx.ui.notify(renderMcpListing(servers, opts.baseUrl), "info");
-        },
-    });
-}
-//# sourceMappingURL=mcpTools.js.map