@zeroroot-ai/gibson-mcp 0.1.0

package/dist/build.js

@@ -0,0 +1,209 @@
+import { loadSettings } from "./config.js";
+import { DEFAULT_STREAM_LIMIT } from "./flags.js";
+import { log, TAG } from "./log.js";
+import { ToolRegistry } from "./registry.js";
+import { attachServer } from "./server.js";
+import { AnswerRouter, askTool } from "./ask.js";
+import { startDiscovery } from "./discovery.js";
+import { inboxAvailable, openInbox, routeAnswers } from "./inbox.js";
+import { helperToolsFor } from "./helpers/index.js";
+import { rpcTools } from "./rpc.js";
+import { createTurnController, TURN_GRANT_HEADER } from "./turn.js";
+import { ambientPrompt, ambientSource, resources } from "./resources.js";
+import { openGibson } from "./session.js";
+import { clearLive, stateDir, writeAmbient, writeLive } from "./state.js";
+import { connectTool, loginTool } from "./tools/connect.js";
+import { statusTool } from "./tools/status.js";
+export async function buildSurface(env, cwd, deps = {}) {
+    const settings = await loadSettings(env);
+    let gibson = await openGibson({ settings, log, env, ...deps.open });
+    const registry = new ToolRegistry();
+    const posture = registry.group();
+    const streamLimit = deps.streamLimit ?? DEFAULT_STREAM_LIMIT;
+    let discovery;
+    let closed = false;
+    // A posture that holds a task grant can serve turns: the grant it started
+    // with is the base, and a turn's grant replaces it for that turn's calls.
+    let turns;
+    let inbox;
+    const answers = new AnswerRouter();
+    let ambient = ambientSource(gibson, env);
+    if (gibson.live) {
+        turns = createTurnController({ base: gibson.live.harness, insecure: gibson.settings.callbackInsecure, log });
+        registry.use((ctx, next) => {
+            const raw = ctx.headers?.[TURN_GRANT_HEADER];
+            const grant = Array.isArray(raw) ? raw[0] : raw;
+            return turns.withGrant(grant, next);
+        });
+    }
+    /**
+     * The inbox is a lifetime RPC: it runs under the base grant, on the
+     * transport the launch opened, never under a turn's. It exists only where
+     * the daemon carries the inbox RPCs, so a member sandbox has an `ask` tool
+     * and an ordinary dispatched run does not.
+     */
+    if (gibson.live && inboxAvailable(gibson.live.harness)) {
+        inbox = routeAnswers(openInbox({ harness: gibson.live.harness, log }), answers, log);
+    }
+    const postureCtx = () => ({
+        env,
+        cwd,
+        streamLimit,
+        ...(deps.discoveryIntervalMs === undefined ? {} : { discoveryIntervalMs: deps.discoveryIntervalMs }),
+        ...(turns ? { taskTransport: turns.transport() } : {}),
+        ambient: { block: (q) => ambient.block(q) },
+        ...(inbox
+            ? {
+                ask: askTool({ jobId: () => turns?.current()?.jobId, inbox, answers, log }),
+            }
+            : {}),
+    });
+    const surface = {
+        registry,
+        current: () => gibson,
+        upgrade: async (next) => {
+            discovery?.stop();
+            discovery = undefined;
+            await registry.batchAsync(async () => {
+                posture.clear();
+                gibson = next;
+                // The block belongs to the connection it was read over. Keeping the
+                // old one after a connect would hand the model another tenant's
+                // context.
+                ambient = ambientSource(next, env);
+                discovery = await registerPosture(posture, next, postureCtx());
+            });
+        },
+        attach: (transport) => attachServer({
+            registry,
+            instructions: instructions(),
+            resources: resources(() => gibson, { block: (q) => ambient.block(q) }),
+            prompts: [ambientPrompt({ block: (q) => ambient.block(q) })],
+        }, transport),
+        health: () => ({ source: gibson.source, posture: gibson.mode, tools: registry.size(), ...(turns?.current() ? { job: turns.current().jobId } : {}) }),
+        ...(inbox ? { inbox } : {}),
+        ...(turns
+            ? {
+                turn: {
+                    set: (t) => turns.set({ jobId: t.jobId, grant: t.grant, endpoint: t.endpoint ?? gibson.live.harness.endpoint, insecure: t.insecure ?? gibson.settings.callbackInsecure }),
+                    clear: () => turns.clear(),
+                    current: () => {
+                        const c = turns.current();
+                        return c ? { jobId: c.jobId, endpoint: c.endpoint } : undefined;
+                    },
+                },
+            }
+            : {}),
+        close: async () => {
+            if (closed)
+                return;
+            closed = true;
+            discovery?.stop();
+            inbox?.stop();
+            turns?.close();
+            if (gibson.source !== "dispatched")
+                await clearLive(stateDir(env), cwd).catch(() => { });
+            await gibson.close();
+        },
+    };
+    registry.batch(() => {
+        registry.register(statusTool(() => gibson));
+        // A dispatched run is fully decided by its launch: there is nothing to
+        // log in to or connect, and no host key to write.
+        if (gibson.source !== "dispatched") {
+            registry.register(loginTool(surface, env, deps));
+            registry.register(connectTool(surface, env, cwd, deps));
+        }
+    });
+    discovery = await registry.batchAsync(() => registerPosture(posture, gibson, postureCtx()));
+    return surface;
+}
+/**
+ * Which transports this posture holds, for the generated RPC tools.
+ *
+ * `taskTransport` is the per-turn transport when there is one. The harness
+ * object is passed through whole, because the RPC tools also read its
+ * `context` to fill `ContextInfo`; only the transport is swapped.
+ */
+export function channelsOf(gibson, taskTransport) {
+    return {
+        ...(gibson.session ? { session: gibson.session.transport } : {}),
+        ...(gibson.live ? { task: taskTransport ? { ...gibson.live.harness, transport: taskTransport } : gibson.live.harness } : {}),
+    };
+}
+/**
+ * The tools a posture carries: one per RPC, one per SDK helper, one per
+ * checked-in platform tool.
+ *
+ * A standalone posture holds no transport, so it carries no RPC tools: a
+ * tool with no daemon behind it answers every call with a dial error, which
+ * reads to a model like a broken platform rather than an unconnected
+ * session. Its helper tools are the ones that need no platform.
+ *
+ * Returns the discovery poller when this posture has a catalog to poll, so
+ * the caller can stop it on upgrade or close.
+ */
+export async function registerPosture(group, gibson, ctx) {
+    for (const tool of helperToolsFor(gibson, ctx.cwd, ctx.env))
+        group.register(tool);
+    if (ctx.ask)
+        group.register(ctx.ask);
+    const channels = channelsOf(gibson, ctx.taskTransport);
+    if (channels.session || channels.task) {
+        for (const tool of rpcTools({ channels, streamLimit: ctx.streamLimit }))
+            group.register(tool);
+    }
+    await writeHandoff(gibson, ctx);
+    // Discovery reads the tenant catalog, which is a ComponentService call, so
+    // it needs the component check-in. A dispatched run has none.
+    if (!gibson.session)
+        return undefined;
+    const discovery = startDiscovery({
+        group,
+        session: gibson.session,
+        log,
+        ...(ctx.discoveryIntervalMs === undefined ? {} : { intervalMs: ctx.discoveryIntervalMs }),
+    });
+    try {
+        const outcome = await discovery.refresh();
+        log(outcome.note ? `${TAG} Gibson tool discovery: ${outcome.note}` : `${TAG} discovery: ${outcome.tools} tool(s), ${outcome.plugins} plugin(s) registered`);
+    }
+    catch (e) {
+        // Discovery is a convenience. gibson_call_tool is registered either way,
+        // so a failure here costs the per-tool wrappers only.
+        log(`${TAG} Gibson tool discovery failed: ${e.message}`);
+    }
+    return discovery;
+}
+/**
+ * The files a host's hook processes read.
+ *
+ * A hook runs as its own process and cannot reach this server, so the
+ * ambient block and the live-mission coordinates are written beside the host
+ * key, one pair per working directory. A dispatched run writes nothing: its
+ * launch decided everything, and there is no hook to hand anything to.
+ */
+async function writeHandoff(gibson, ctx) {
+    if (gibson.source === "dispatched")
+        return;
+    const dir = stateDir(ctx.env);
+    if (gibson.knowledge && ctx.ambient) {
+        const block = await ctx.ambient.block().catch(() => "");
+        if (block)
+            await writeAmbient(dir, ctx.cwd, block).catch((e) => log(`${TAG} ambient handoff failed: ${e.message}`));
+    }
+    if (gibson.live) {
+        await writeLive(dir, ctx.cwd, {
+            missionId: gibson.live.missionId,
+            workId: gibson.live.workId,
+            endpoint: gibson.live.harness.endpoint,
+            token: gibson.live.harness.token(),
+            insecure: gibson.settings.callbackInsecure,
+            writtenAt: Date.now(),
+        }).catch((e) => log(`${TAG} live handoff failed: ${e.message}`));
+    }
+}
+function instructions() {
+    return ("Gibson tools. Call gibson_status to see how this session is connected. " +
+        "Without a platform, call gibson_login and then gibson_connect to enroll this host and start a live mission.");
+}

package/dist/cli.d.ts

@@ -0,0 +1,88 @@
+import { type ChildProcess } from "node:child_process";
+/**
+ * The `gibson` CLI as the session's user. It holds the login session
+ * (`gibson login`, a browser device flow), so it is the one process on the
+ * host that can mint an enrollment token or create a target. The plugin
+ * drives it instead of asking a person to copy tokens between terminals.
+ */
+export type Spawn = (cmd: string, args: string[], opts: {
+    detached?: boolean;
+    env?: NodeJS.ProcessEnv;
+}) => ChildProcess;
+export interface CliOptions {
+    bin?: string;
+    env?: NodeJS.ProcessEnv;
+    spawn?: Spawn;
+    timeoutMs?: number;
+}
+export interface CliResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export declare function runGibson(args: string[], opts?: CliOptions): Promise<CliResult>;
+/** True when the CLI's failure reads as "no login session". */
+export declare function needsLogin(r: CliResult): boolean;
+/**
+ * `gibson agent enroll`: mint a one-time bootstrap token for a new machine
+ * identity, authenticated as the person who ran `gibson login`.
+ */
+/**
+ * The session capabilities an interactive coding agent needs in its
+ * credential's ceiling (ADR-0045): it starts its own live mission
+ * (gibson#1593 decision 9) and may hand sub-tasks to other agents.
+ */
+export declare const INTERACTIVE_AGENT_CAPABILITIES: readonly ["mission:originate", "mission:delegate"];
+export declare function enrollIdentity(name: string, opts?: CliOptions & {
+    gibsonURL?: string;
+    tenant?: string;
+    capabilities?: readonly string[];
+}): Promise<string>;
+export interface Target {
+    id: string;
+    name: string;
+    type: string;
+    status: string;
+}
+/** `gibson target list`, a tabwriter table: UUID NAME TYPE STATUS. */
+export declare function parseTargetList(stdout: string): Target[];
+export declare function listTargets(opts?: CliOptions & {
+    gibsonURL?: string;
+    tenant?: string;
+}): Promise<Target[]>;
+/**
+ * `gibson target create`: prints the new target id. The daemon refuses a
+ * target with neither a URL nor connection parameters, so the URL is
+ * required here: for a coding workspace it names the repository.
+ */
+export declare function createTarget(name: string, url: string, opts?: CliOptions & {
+    gibsonURL?: string;
+    tenant?: string;
+    type?: string;
+}): Promise<string>;
+export interface LoginPrompt {
+    url: string;
+    code: string;
+}
+/**
+ * `gibson login`: a browser device flow. The CLI prints a URL and a code, then
+ * waits for the approval. This starts it detached, returns the URL and code
+ * as soon as they appear, and leaves the CLI waiting so the session lands in
+ * `~/.gibson/auth/credentials` when the person approves.
+ */
+export declare function startLogin(opts?: CliOptions & {
+    gibsonURL?: string;
+}): Promise<LoginPrompt>;
+/**
+ * The person originates the session mission. A component may originate a
+ * mission only from inside one it was dispatched to (gibson ADR-0063), and an
+ * interactive session has no parent mission, so the definition goes through
+ * the CLI's login session: `gibson mission submit` validates it, registers it
+ * and runs it, then prints the mission id. The daemon dispatches the one AGENT
+ * node to this component, which must already be checked in.
+ */
+export declare function submitMission(definition: unknown, targetId: string, opts?: CliOptions & {
+    gibsonURL?: string;
+    tenant?: string;
+    dir?: string;
+}): Promise<string>;

package/dist/cli.js

@@ -0,0 +1,186 @@
+import { spawn as nodeSpawn } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export async function runGibson(args, opts = {}) {
+    const spawn = opts.spawn ?? nodeSpawn;
+    const child = spawn(opts.bin ?? opts.env?.GIBSON_CLI ?? "gibson", args, { env: opts.env ?? process.env });
+    return await new Promise((resolve, reject) => {
+        const out = [];
+        const err = [];
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error(`gibson ${args[0] ?? ""} ${args[1] ?? ""} timed out after ${opts.timeoutMs ?? 60_000}ms`));
+        }, opts.timeoutMs ?? 60_000);
+        child.stdout?.on("data", (d) => out.push(d.toString()));
+        child.stderr?.on("data", (d) => err.push(d.toString()));
+        child.on("error", (e) => {
+            clearTimeout(timer);
+            reject(new Error(`cannot run the gibson CLI (${e.message}). Install it: see https://github.com/zeroroot-ai/adk`));
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            resolve({ code: code ?? -1, stdout: out.join(""), stderr: err.join("") });
+        });
+    });
+}
+/** True when the CLI's failure reads as "no login session". */
+export function needsLogin(r) {
+    return /login|credentials|unauthenticated|token expired|not signed in/i.test(r.stderr + r.stdout);
+}
+/**
+ * `gibson agent enroll`: mint a one-time bootstrap token for a new machine
+ * identity, authenticated as the person who ran `gibson login`.
+ */
+/**
+ * The session capabilities an interactive coding agent needs in its
+ * credential's ceiling (ADR-0045): it starts its own live mission
+ * (gibson#1593 decision 9) and may hand sub-tasks to other agents.
+ */
+export const INTERACTIVE_AGENT_CAPABILITIES = ["mission:originate", "mission:delegate"];
+export async function enrollIdentity(name, opts = {}) {
+    const args = ["agent", "enroll", "--name", name, "--kind", "agent"];
+    for (const c of opts.capabilities ?? INTERACTIVE_AGENT_CAPABILITIES)
+        args.push("--capability", c);
+    if (opts.gibsonURL)
+        args.push("--gibson-url", opts.gibsonURL);
+    if (opts.tenant)
+        args.push("--tenant", opts.tenant);
+    const r = await runGibson(args, opts);
+    const m = /^bootstrap_token:\s*(\S+)/m.exec(r.stdout);
+    if (r.code !== 0 || !m) {
+        const why = (r.stderr || r.stdout).trim();
+        throw new Error(needsLogin(r)
+            ? `the gibson CLI has no login session (${why}). Call gibson_login first.`
+            : `gibson agent enroll failed (exit ${r.code}): ${why || "no bootstrap_token in the output"}`);
+    }
+    return m[1];
+}
+/** `gibson target list`, a tabwriter table: UUID NAME TYPE STATUS. */
+export function parseTargetList(stdout) {
+    return stdout
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l && !/^UUID\s+NAME/.test(l))
+        .map((l) => l.split(/\s{2,}|\t/))
+        .filter((cols) => cols.length >= 2)
+        .map(([id, name, type, status]) => ({ id: id, name: name ?? "", type: type ?? "", status: status ?? "" }));
+}
+export async function listTargets(opts = {}) {
+    const args = ["target", "list"];
+    if (opts.gibsonURL)
+        args.push("--gibson-url", opts.gibsonURL);
+    if (opts.tenant)
+        args.push("--tenant", opts.tenant);
+    const r = await runGibson(args, opts);
+    if (r.code !== 0) {
+        const why = (r.stderr || r.stdout).trim();
+        throw new Error(needsLogin(r) ? `the gibson CLI has no login session (${why}). Call gibson_login first.` : `gibson target list failed: ${why}`);
+    }
+    return parseTargetList(r.stdout);
+}
+/**
+ * `gibson target create`: prints the new target id. The daemon refuses a
+ * target with neither a URL nor connection parameters, so the URL is
+ * required here: for a coding workspace it names the repository.
+ */
+export async function createTarget(name, url, opts = {}) {
+    const args = ["target", "create", "--name", name, "--url", url, "--type", opts.type ?? "custom"];
+    if (opts.gibsonURL)
+        args.push("--gibson-url", opts.gibsonURL);
+    if (opts.tenant)
+        args.push("--tenant", opts.tenant);
+    const r = await runGibson(args, opts);
+    const id = r.stdout.trim().split("\n").pop()?.trim() ?? "";
+    if (r.code !== 0 || !id) {
+        const why = (r.stderr || r.stdout).trim();
+        throw new Error(needsLogin(r) ? `the gibson CLI has no login session (${why}). Call gibson_login first.` : `gibson target create failed: ${why}`);
+    }
+    return id;
+}
+/**
+ * `gibson login`: a browser device flow. The CLI prints a URL and a code, then
+ * waits for the approval. This starts it detached, returns the URL and code
+ * as soon as they appear, and leaves the CLI waiting so the session lands in
+ * `~/.gibson/auth/credentials` when the person approves.
+ */
+export async function startLogin(opts = {}) {
+    const spawn = opts.spawn ?? nodeSpawn;
+    const args = ["login"];
+    if (opts.gibsonURL)
+        args.push("--gibson-url", opts.gibsonURL);
+    const child = spawn(opts.bin ?? opts.env?.GIBSON_CLI ?? "gibson", args, { detached: true, env: opts.env ?? process.env });
+    return await new Promise((resolve, reject) => {
+        let buf = "";
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error(`gibson login printed no device code within ${opts.timeoutMs ?? 30_000}ms: ${buf.trim()}`));
+        }, opts.timeoutMs ?? 30_000);
+        const check = () => {
+            const url = /open:\s*\n?\s*(https?:\/\/\S+)/.exec(buf);
+            const code = /confirm this code:\s*(\S+)/.exec(buf);
+            if (url && code) {
+                clearTimeout(timer);
+                child.unref();
+                resolve({ url: url[1], code: code[1] });
+            }
+        };
+        child.stdout?.on("data", (d) => {
+            buf += d.toString();
+            check();
+        });
+        child.stderr?.on("data", (d) => {
+            buf += d.toString();
+            check();
+        });
+        child.on("error", (e) => {
+            clearTimeout(timer);
+            reject(new Error(`cannot run the gibson CLI (${e.message}). Install it: see https://github.com/zeroroot-ai/adk`));
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            reject(new Error(`gibson login exited with ${code} before printing a device code: ${buf.trim()}`));
+        });
+    });
+}
+const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g;
+/**
+ * The person originates the session mission. A component may originate a
+ * mission only from inside one it was dispatched to (gibson ADR-0063), and an
+ * interactive session has no parent mission, so the definition goes through
+ * the CLI's login session: `gibson mission submit` validates it, registers it
+ * and runs it, then prints the mission id. The daemon dispatches the one AGENT
+ * node to this component, which must already be checked in.
+ */
+export async function submitMission(definition, targetId, opts = {}) {
+    const dir = await mkdtemp(join(opts.dir ?? tmpdir(), "gibson-mcp-mission-"));
+    const file = join(dir, "session.json");
+    try {
+        await writeFile(file, JSON.stringify(definition), { mode: 0o600 });
+        // --detach: the CLI returns once the daemon started the run and prints the
+        // mission id. Without it the CLI holds the RunMission stream until the
+        // mission ends, which never happens: this process must go on to claim the
+        // dispatch, and the CLI's own deadline fires first.
+        const args = ["mission", "submit", file, "--format", "json", "--target", targetId, "--detach"];
+        if (opts.gibsonURL)
+            args.push("--gibson-url", opts.gibsonURL);
+        if (opts.tenant)
+            args.push("--tenant", opts.tenant);
+        const r = await runGibson(args, { ...opts, timeoutMs: opts.timeoutMs ?? 120_000 });
+        if (r.code !== 0) {
+            if (needsLogin(r))
+                throw new Error("the gibson CLI has no session; run gibson_login first");
+            if (/unknown flag: --detach/.test(r.stderr))
+                throw new Error("the gibson CLI is too old for mission submit --detach; update the gibson CLI (adk >= 0.109)");
+            throw new Error(`gibson mission submit failed (exit ${r.code}): ${(r.stderr || r.stdout).trim().slice(0, 400)}`);
+        }
+        const ids = r.stdout.match(UUID) ?? [];
+        const missionId = ids[ids.length - 1];
+        if (!missionId)
+            throw new Error(`gibson mission submit printed no mission id: ${r.stdout.trim().slice(0, 400)}`);
+        return missionId;
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Where a session learns how to reach Gibson, in precedence order:
+ *
+ *  1. the environment (`GIBSON_*`), for people who script it,
+ *  2. the config this server wrote after a `gibson_connect`,
+ *  3. the `gibson` CLI login session (`~/.gibson/auth/credentials`), which
+ *     already knows the platform URL, the active tenant and the private CA.
+ *
+ * So a person who ran `gibson login` once needs nothing else: the server
+ * finds the platform through the same session the CLI uses.
+ */
+export interface ServerConfig {
+    platformURL?: string;
+    daemonURL?: string;
+    targetId?: string;
+    caCertPath?: string;
+    callbackInsecure?: boolean;
+}
+export interface CliCredentials {
+    gibsonURL?: string;
+    tenant?: string;
+    caCertPath?: string;
+}
+export interface Settings {
+    platformURL?: string;
+    daemonURL?: string;
+    targetId?: string;
+    caCertPath?: string;
+    callbackInsecure: boolean;
+    bootstrapToken?: string;
+    hostKeyPath: string;
+    agentName: string;
+    tenant?: string;
+}
+/** The registered component name, and the `sub` of every grant minted for it. */
+export declare const DEFAULT_AGENT_NAME = "gibson-mcp";
+export declare function configPath(env: NodeJS.ProcessEnv): string;
+export declare function readConfig(env: NodeJS.ProcessEnv): Promise<ServerConfig>;
+/** Merge and persist. Only the keys given change. */
+export declare function writeConfig(env: NodeJS.ProcessEnv, patch: ServerConfig): Promise<ServerConfig>;
+export declare function cliCredentialsPath(env: NodeJS.ProcessEnv): string;
+/** The `gibson` CLI login session, addressing fields only. Tokens are never read. */
+export declare function cliCredentials(env: NodeJS.ProcessEnv): Promise<CliCredentials | undefined>;
+export declare function resolveSettings(env: NodeJS.ProcessEnv, cfg: ServerConfig, creds: CliCredentials | undefined): Settings;
+export declare function loadSettings(env: NodeJS.ProcessEnv): Promise<Settings>;

package/dist/config.js

@@ -0,0 +1,54 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { stateDir } from "./state.js";
+/** The registered component name, and the `sub` of every grant minted for it. */
+export const DEFAULT_AGENT_NAME = "gibson-mcp";
+export function configPath(env) {
+    return join(stateDir(env), "config.json");
+}
+export async function readConfig(env) {
+    try {
+        return JSON.parse(await readFile(configPath(env), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+/** Merge and persist. Only the keys given change. */
+export async function writeConfig(env, patch) {
+    const merged = { ...(await readConfig(env)), ...patch };
+    await mkdir(stateDir(env), { recursive: true, mode: 0o700 });
+    await writeFile(configPath(env), `${JSON.stringify(merged, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    return merged;
+}
+export function cliCredentialsPath(env) {
+    return env.GIBSON_CLI_CREDENTIALS ?? join(homedir(), ".gibson", "auth", "credentials");
+}
+/** The `gibson` CLI login session, addressing fields only. Tokens are never read. */
+export async function cliCredentials(env) {
+    try {
+        const raw = JSON.parse(await readFile(cliCredentialsPath(env), "utf8"));
+        const str = (k) => (typeof raw[k] === "string" && raw[k] ? raw[k] : undefined);
+        return { gibsonURL: str("gibson_url"), tenant: str("active_tenant"), caCertPath: str("ca_cert_path") };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function resolveSettings(env, cfg, creds) {
+    return {
+        platformURL: env.GIBSON_PLATFORM_URL ?? cfg.platformURL ?? creds?.gibsonURL,
+        daemonURL: env.GIBSON_DAEMON_URL ?? cfg.daemonURL,
+        targetId: env.GIBSON_TARGET_ID ?? cfg.targetId,
+        caCertPath: env.GIBSON_CA_CERT ?? cfg.caCertPath ?? creds?.caCertPath,
+        callbackInsecure: env.GIBSON_CALLBACK_INSECURE === "1" || cfg.callbackInsecure === true,
+        bootstrapToken: env.GIBSON_BOOTSTRAP_TOKEN,
+        hostKeyPath: env.GIBSON_HOST_KEY_PATH ?? join(homedir(), ".zerocool", "host.key"),
+        agentName: env.ZEROCOOL_AGENT_NAME ?? DEFAULT_AGENT_NAME,
+        tenant: creds?.tenant,
+    };
+}
+export async function loadSettings(env) {
+    return resolveSettings(env, await readConfig(env), await cliCredentials(env));
+}

package/dist/discovery.d.ts

@@ -0,0 +1,57 @@
+import { type GibsonPlugin, type GibsonSession, type GibsonTool } from "@zeroroot-ai/sdk";
+import { type Log } from "./log.js";
+import type { ToolDefinition, ToolGroup } from "./registry.js";
+/**
+ * Checked-in platform tools and plugins, discovered at runtime.
+ *
+ * The fleet changes while a session runs: a tool a person enrols now should
+ * be callable in the same session. So discovery repeats, and the registry's
+ * `tools/list_changed` notification is what tells every attached host to
+ * ask again.
+ *
+ * Each discovered tool registers on its own, named `gibson_<tool>`, so the
+ * model sees its description rather than one opaque dispatcher. The catalog
+ * carries no JSON Schema, only a proto message type name, so the wrapper
+ * takes one free-form `input` object and names the type it must match.
+ * `gibson_call_tool` stays registered either way: discovery answers
+ * `Unimplemented` on some daemons (gibson#1186).
+ */
+export declare const DISCOVERY_INTERVAL_MS = 60000;
+/** `gibson_<tool>`, with anything not legal in an MCP tool name replaced. */
+export declare function toolKey(name: string): string;
+export declare function pluginKey(name: string): string;
+export declare function discoveredTool(session: GibsonSession, t: GibsonTool): ToolDefinition;
+export declare function discoveredPlugin(session: GibsonSession, p: GibsonPlugin): ToolDefinition;
+export interface DiscoveryOutcome {
+    tools: number;
+    plugins: number;
+    /** Set when discovery could not run. The set is unchanged, and nothing failed. */
+    note?: string;
+    /** True when this pass added or removed something. */
+    changed: boolean;
+}
+export interface DiscoveryOptions {
+    /**
+     * Where discovered tools are registered. A group, not the registry, so
+     * they leave with the posture that discovered them.
+     */
+    group: ToolGroup;
+    session: GibsonSession;
+    log: Log;
+    /** How often to look again. `0` runs one pass and stops. */
+    intervalMs?: number;
+}
+export interface Discovery {
+    /** Run one pass now. */
+    refresh(): Promise<DiscoveryOutcome>;
+    /** Stop polling. Registered tools stay. */
+    stop(): void;
+}
+/**
+ * Poll the catalog and keep the registered set equal to it.
+ *
+ * A pass that cannot reach the catalog leaves the set alone. Dropping every
+ * discovered tool because one poll failed would take working tools away from
+ * a session mid-task over a transient fault.
+ */
+export declare function startDiscovery(opts: DiscoveryOptions): Discovery;