agentlas 0.9.10 → 1.0.2

package/engine/hub/plugins.cjs

@@ -0,0 +1,213 @@
+"use strict";
+/*
+ * hub/plugins — Hub 플러그인 매니페스트 조회 + MCP 행 정규화 + 멱등 설치.
+ *
+ * 배경(v1 주석 승계): 서버는 처음부터 준비돼 있었다 — /api/plugins/<slug>가
+ * agentlas.plugin/v1 매니페스트를 주고, 그 라우트 주석이 이 CLI
+ * (`agentlas plugin add <slug>`)를 소비자로 지목한다. 그런데 이 명령이 구현된 적이
+ * 없어서, 카탈로그 146개가 전부 "존재하지 않는 설치 명령"을 광고하고 있었다.
+ * (`agentlas install`은 marketplace.get_manifest{kind:"agent"} 고정이라 플러그인엔 안 먹는다.)
+ *
+ * 이 파일의 transport 정규화 규칙은 런타임 전멸 사고들의 근본수리다 — 약화 금지:
+ *  - 2026-07-23: 레포/홈페이지 HTML URL이 transport:"http" MCP 행으로 등록되어
+ *    "절대 연결될 수 없는 MCP 서버"가 생기던 사고.
+ *  - codex config.toml: 원격은 URL, stdio는 실행 커맨드. 둘을 섞으면 스키마 위반으로
+ *    런타임이 통째로 죽는다(Runtime Doctor가 반복해서 잡던 사고 계열).
+ */
+const crypto = require("node:crypto");
+const { callHubTool, fetchHub, parseHubJson, webBaseUrl } = require("../cloud/hub-client.cjs");
+
+// 레포/홈페이지 HTML 페이지는 문서지 MCP 연결이 아니다. 이 URL들을 transport:"http"로
+// 등록하면 "절대 연결될 수 없는 MCP 서버"가 생긴다(2026-07-23 근본수리 계열).
+const PLUGIN_CODE_HOSTING_HTML_RE = /^https?:\/\/(www\.)?(github\.com|gitlab\.com|bitbucket\.org)\//i;
+
+// 데스크탑 hub-plugin-bridge.ts:38 REPO_PAGE_HOSTS 동형 — 저장소/패키지 HTML 페이지
+// 호스트. 데스크탑은 npm/pypi 패키지 페이지도 엔드포인트가 아니라고 본다.
+const PLUGIN_REPO_PAGE_HOSTS = new Set([
+  "github.com",
+  "www.github.com",
+  "gitlab.com",
+  "www.gitlab.com",
+  "bitbucket.org",
+  "www.bitbucket.org",
+  "npmjs.com",
+  "www.npmjs.com",
+  "pypi.org",
+]);
+
+/**
+ * 데스크탑 isLikelyRemoteMcpEndpoint 동형 (electron/mcp-tools/hub-plugin-bridge.ts:61):
+ * https 필수, 저장소/패키지 HTML 페이지 호스트는 거부. v1 터미널은 http://도 원격
+ * 엔드포인트로 수용했지만 현 데스크탑 모델은 평문 원격 MCP 등록을 허용하지 않는다.
+ */
+function pluginIsLikelyRemoteMcpEndpoint(rawUrl) {
+  let url;
+  try {
+    url = new URL(String(rawUrl || ""));
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  if (PLUGIN_REPO_PAGE_HOSTS.has(url.hostname.toLowerCase())) return false;
+  return true;
+}
+
+/** Hub 플러그인 매니페스트 조회. 404 → null, 스키마 불일치/HTTP 오류 → throw. */
+async function fetchPluginManifest(slug, { fetch: fetchImpl } = {}) {
+  const resp = await fetchHub(`${webBaseUrl()}/api/plugins/${encodeURIComponent(slug)}`, {
+    headers: { accept: "application/json" },
+  }, { fetch: fetchImpl });
+  if (resp.status === 404) return null;
+  if (!resp.ok) throw new Error(`plugin lookup failed with HTTP ${resp.status}`);
+  const manifest = parseHubJson(resp, "plugin manifest");
+  if (!manifest || manifest.schema !== "agentlas.plugin/v1") {
+    throw new Error(`Unexpected plugin manifest schema for ${slug}.`);
+  }
+  return manifest;
+}
+
+/**
+ * 휴리스틱: 명시적 transport 선언이 없는 레거시 source URL이 진짜 MCP 엔드포인트로 보이는가.
+ * 데스크탑 hub-plugin-bridge.ts:94 동형 — https 엔드포인트이면서 경로가 명시적으로
+ * MCP(/mcp, /sse)를 가리킬 때만 신뢰한다. v1의 "mcp.* 호스트면 경로 없이 수용" 완화는
+ * 데스크탑 모델에 없다(호스트명만으로 엔드포인트를 추정하지 않는다).
+ */
+function pluginLooksLikeMcpEndpoint(rawUrl) {
+  if (!pluginIsLikelyRemoteMcpEndpoint(rawUrl)) return false;
+  return /\/(mcp|sse)(?:$|[/?#])/.test(String(rawUrl));
+}
+
+/**
+ * 매니페스트의 mcp[] 항목을 mcp_servers 행으로 정규화. stdio(command)와 remote(url)를 구분한다.
+ * 반환: { row } | { refused: { name, source, reason } } | null(빈 항목).
+ *
+ * 규칙(근본수리): 레포 URL은 어떤 경우에도 transport:"http" 행으로 쓰이지 않는다.
+ *  - transport:"stdio" + command 명시 → stdio 행 (mcp_servers는 command/args_json을 이미 지원).
+ *  - transport:"http" + url 명시 → http 행. 단 코드호스팅 HTML 페이지(github.com/…)면 거부.
+ *  - 레거시 {name, source}: http(s)면 MCP 엔드포인트로 보일 때만(…/mcp, …/sse, mcp.* 호스트) 수용,
+ *    아니면 거부. 비-URL 문자열은 기존대로 stdio 실행 커맨드로 해석.
+ */
+function pluginMcpRow(slug, entry, index) {
+  const name = (typeof entry?.name === "string" && entry.name.trim()) || `${slug}-${index + 1}`;
+  const source = typeof entry?.source === "string" ? entry.source.trim() : "";
+  const transport = typeof entry?.transport === "string" ? entry.transport.trim().toLowerCase() : "";
+  const envKeys = Array.isArray(entry?.envKeys)
+    ? entry.envKeys.filter((key) => typeof key === "string")
+    : entry?.env && typeof entry.env === "object"
+      ? Object.keys(entry.env)
+      : [];
+  const makeRow = (fields) => ({
+    row: {
+      id: crypto.randomUUID(),
+      catalogId: `hub:${slug}:${name}`,
+      name,
+      envKeysJson: JSON.stringify(envKeys),
+      ...fields,
+    },
+  });
+  const refuse = (reason) => ({ refused: { name, source: source || (typeof entry?.url === "string" ? entry.url : ""), reason } });
+
+  if (transport === "stdio") {
+    const command = typeof entry?.command === "string" ? entry.command.trim() : "";
+    if (!command) return refuse("stdio row without a launch command");
+    const args = Array.isArray(entry?.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    return makeRow({ transport: "stdio", command, argsJson: JSON.stringify(args), url: null });
+  }
+  if (transport === "http" || transport === "sse") {
+    const url = typeof entry?.url === "string" && entry.url.trim() ? entry.url.trim() : source;
+    if (!/^https?:\/\//i.test(url)) return refuse("http row without a usable endpoint URL");
+    if (PLUGIN_CODE_HOSTING_HTML_RE.test(url)) {
+      return refuse("URL is a code-hosting HTML page (docs), not an MCP endpoint");
+    }
+    // 명시 선언이어도 데스크탑과 동일하게 isLikelyRemoteMcpEndpoint를 통과해야 한다
+    // (hub-plugin-bridge.ts:90) — https 필수, 저장소/패키지 페이지 호스트 거부.
+    if (!pluginIsLikelyRemoteMcpEndpoint(url)) {
+      return refuse("URL is not a usable remote MCP endpoint (https required; repo/package pages are docs)");
+    }
+    return makeRow({ transport: "http", command: null, argsJson: "[]", url });
+  }
+  if (transport) return refuse(`unsupported transport "${transport}"`);
+
+  // ── 레거시 {name, source} 행 ──
+  if (!source) return null;
+  if (/^https?:\/\//i.test(source)) {
+    if (!pluginLooksLikeMcpEndpoint(source)) {
+      return refuse(
+        PLUGIN_CODE_HOSTING_HTML_RE.test(source)
+          ? "URL is a code-hosting HTML page (docs), not an MCP endpoint"
+          : "URL does not look like an MCP endpoint (no /mcp, /sse, or mcp.* host, and no declared transport)",
+      );
+    }
+    return makeRow({ transport: "http", command: null, argsJson: "[]", url: source });
+  }
+  // 원격은 URL, stdio는 실행 커맨드다. 둘을 섞으면 codex config.toml 스키마 위반으로
+  // 런타임이 통째로 죽는다(Runtime Doctor가 반복해서 잡던 사고 계열).
+  const argv = source.split(/\s+/).filter(Boolean);
+  return makeRow({ transport: "stdio", command: argv[0] ?? null, argsJson: JSON.stringify(argv.slice(1)), url: null });
+}
+
+/** 매니페스트 전체를 설치 계획으로 정규화: 등록할 행과, 정직하게 거부한 항목을 분리한다. */
+function planPluginMcpInstall(slug, manifest) {
+  const entries = Array.isArray(manifest?.mcp) ? manifest.mcp : [];
+  const rows = [];
+  const refused = [];
+  entries.forEach((entry, index) => {
+    const normalized = pluginMcpRow(slug, entry, index);
+    if (!normalized) return;
+    if (normalized.row) rows.push(normalized.row);
+    else if (normalized.refused) refused.push(normalized.refused);
+  });
+  return { rows, refused };
+}
+
+/**
+ * 정규화된 행들을 로컬 mcp_servers 스키마에 멱등 삽입.
+ * { installed, reused, needsApproval } 반환.
+ *
+ * 데스크탑 hub-plugin-bridge.ts:209-228 동형(자율 경계, 2026-07-23 재설계):
+ * stdio(로컬 프로세스 실행 = 원격 메타데이터발 코드 실행)는 절대 자동 활성화하지
+ * 않는다 — enabled=0으로 등록하고 승인 필요로 정직하게 표면화한다. 이 테이블은
+ * 데스크탑과 공유되므로, 터미널이 enabled=1로 넣으면 데스크탑 런타임 구성이
+ * 승인 게이트 없이 그 로컬 프로세스를 실행하게 된다. http/sse 원격 연결만
+ * 자동 활성화한다(네트워크 연결일 뿐 로컬 실행이 없다).
+ */
+function installPluginMcpRows(db, rows) {
+  let installed = 0;
+  let reused = 0;
+  const needsApproval = [];
+  for (const row of rows) {
+    const stdioNeedsApproval = row.transport === "stdio";
+    const existing = db.prepare("SELECT id FROM mcp_servers WHERE catalog_id = ? LIMIT 1").get(row.catalogId);
+    if (existing) { reused += 1; continue; } // 멱등: 재설치가 중복 행을 만들지 않는다
+    db.prepare(
+      `INSERT INTO mcp_servers (id, catalog_id, name, name_en, transport, command, args_json, url, env_keys_json, enabled, installed_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(
+      row.id, row.catalogId, row.name, row.name, row.transport,
+      row.command, row.argsJson, row.url, row.envKeysJson,
+      stdioNeedsApproval ? 0 : 1, new Date().toISOString(),
+    );
+    installed += 1;
+    if (stdioNeedsApproval) needsApproval.push(row.name);
+  }
+  return { installed, reused, needsApproval };
+}
+
+/** Hub 플러그인 카탈로그 목록 (marketplace.list_plugins). 실패는 그대로 throw — 폴백 카탈로그 금지. */
+async function listHubPlugins({ callTool } = {}) {
+  const call = callTool || callHubTool;
+  const result = await call("marketplace.list_plugins", {});
+  return (result && (result.plugins || result.results)) || [];
+}
+
+module.exports = {
+  PLUGIN_CODE_HOSTING_HTML_RE,
+  PLUGIN_REPO_PAGE_HOSTS,
+  fetchPluginManifest,
+  pluginIsLikelyRemoteMcpEndpoint,
+  pluginLooksLikeMcpEndpoint,
+  pluginMcpRow,
+  planPluginMcpInstall,
+  installPluginMcpRows,
+  listHubPlugins,
+};

package/engine/mcp/consent.cjs

@@ -0,0 +1,289 @@
+"use strict";
+/*
+ * mcp/consent — 1회(one-pass) 동의 프롬프트 + 동의 영수증 저장소 + 런타임 allowlist 해소.
+ *
+ * 계약(v1 그대로):
+ *  - 동의 상태(<userData>/terminal/mcp-consents-v1.json)에는 정체성과 지문만 담는다.
+ *    명령/인자/자격증명 등 실행 재료는 절대 저장하지 않는다.
+ *  - "enabled" 레지스트리 행이라는 사실만으로는 ordinary turn에 attach할 권한이
+ *    생기지 않는다 — 정확한 consentFingerprint가 일치하는 영수증이 있어야 한다.
+ *  - 런타임 정의가 조금이라도 드리프트하면(명령/인자/키이름 변경) 지문이 갈리고
+ *    기존 동의는 자동 무효가 된다. 손상된 동의 상태는 fail-closed(빈 목록).
+ */
+const readline = require("node:readline");
+const fs = require("node:fs");
+const path = require("node:path");
+const {
+  MAX_APPROVED_MCP_PER_BUILD,
+  MAX_JSON_BYTES,
+  ID_RE,
+  assertExactKeys,
+  assertId,
+  assertIsoDateOrNull,
+  safeCatalogId,
+  writePrivateJsonAtomic,
+  withPrivateStateLock,
+  parseIdList,
+} = require("./contract.cjs");
+const { materializeTrustedSystemMcpServer, readApprovedSystemMcpServer } = require("./inventory.cjs");
+const {
+  MCP_PROBE_CONCURRENCY,
+  MCP_PROBE_PER_SERVER_TIMEOUT_MS,
+  MCP_PROBE_TOTAL_TIMEOUT_MS,
+  probeSystemMcpServerConnection,
+} = require("./probe.cjs");
+
+const MCP_CONSENT_STATE_SCHEMA = "agentlas.terminal-mcp-consents.v1";
+const MCP_CONSENT_RECEIPT_SCHEMA = "agentlas.terminal-mcp-consent.v1";
+
+function mcpConsentStatePath(userDataDir) {
+  return path.join(userDataDir, "terminal", "mcp-consents-v1.json");
+}
+
+function emptyMcpConsentState() {
+  return { schemaVersion: MCP_CONSENT_STATE_SCHEMA, updatedAt: null, receipts: [] };
+}
+
+function validateMcpConsentReceipt(receipt, index) {
+  const label = `Terminal MCP consent.receipts[${index}]`;
+  const keys = ["schemaVersion", "catalogId", "registryServerId", "consentFingerprint", "source", "consentedAt"];
+  assertExactKeys(receipt, new Set(keys), keys, label);
+  if (receipt.schemaVersion !== MCP_CONSENT_RECEIPT_SCHEMA) throw new Error(`${label}.schemaVersion is invalid`);
+  assertId(receipt.catalogId, `${label}.catalogId`);
+  assertId(receipt.registryServerId, `${label}.registryServerId`);
+  if (!/^[0-9a-f]{64}$/.test(String(receipt.consentFingerprint || ""))) throw new Error(`${label}.consentFingerprint is invalid`);
+  if (receipt.source !== "terminal-build-one-pass") throw new Error(`${label}.source is invalid`);
+  if (typeof receipt.consentedAt !== "string" || !receipt.consentedAt) throw new Error(`${label}.consentedAt is invalid`);
+  assertIsoDateOrNull(receipt.consentedAt, `${label}.consentedAt`);
+  return receipt;
+}
+
+function loadMcpConsentState(userDataDir) {
+  const file = mcpConsentStatePath(userDataDir);
+  if (!fs.existsSync(file)) return emptyMcpConsentState();
+  const stat = fs.lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size <= 0 || stat.size > MAX_JSON_BYTES) {
+    throw new Error("Terminal MCP consent state is unsafe or too large");
+  }
+  const state = JSON.parse(fs.readFileSync(file, "utf8"));
+  assertExactKeys(state, new Set(["schemaVersion", "updatedAt", "receipts"]), ["schemaVersion", "updatedAt", "receipts"], "Terminal MCP consent state");
+  if (state.schemaVersion !== MCP_CONSENT_STATE_SCHEMA || !Array.isArray(state.receipts) || state.receipts.length > 256) {
+    throw new Error("Terminal MCP consent state schema is invalid");
+  }
+  assertIsoDateOrNull(state.updatedAt, "Terminal MCP consent state.updatedAt");
+  state.receipts.forEach(validateMcpConsentReceipt);
+  return state;
+}
+
+function withMcpConsentStateLock(userDataDir, action) {
+  return withPrivateStateLock(mcpConsentStatePath(userDataDir), {
+    unsafe: "Terminal MCP consent lock is unsafe",
+    busy: "Terminal MCP consent state is busy; retry the command",
+  }, action);
+}
+
+function persistMcpConsentReceipts(userDataDir, servers) {
+  if (!userDataDir || !(servers || []).length) return false;
+  withMcpConsentStateLock(userDataDir, () => {
+    const state = loadMcpConsentState(userDataDir);
+    const now = new Date().toISOString();
+    for (const server of servers) {
+      if (!server || !ID_RE.test(String(server.id || "")) || !safeCatalogId(server.catalog_id) || !/^[0-9a-f]{64}$/.test(String(server.consentFingerprint || ""))) continue;
+      const receipt = {
+        schemaVersion: MCP_CONSENT_RECEIPT_SCHEMA,
+        catalogId: server.catalog_id,
+        registryServerId: server.id,
+        consentFingerprint: server.consentFingerprint,
+        source: "terminal-build-one-pass",
+        consentedAt: now,
+      };
+      const existing = state.receipts.findIndex((item) => item.catalogId === receipt.catalogId && item.registryServerId === receipt.registryServerId);
+      if (existing >= 0) state.receipts[existing] = receipt;
+      else state.receipts.push(receipt);
+    }
+    state.receipts.sort((a, b) => String(b.consentedAt).localeCompare(String(a.consentedAt)) || a.catalogId.localeCompare(b.catalogId));
+    state.receipts = state.receipts.slice(0, 256);
+    state.updatedAt = now;
+    writePrivateJsonAtomic(mcpConsentStatePath(userDataDir), state);
+  });
+  return true;
+}
+
+function readConsentedSystemMcpServers(db, options = {}) {
+  let state;
+  try { state = loadMcpConsentState(options.userDataDir); }
+  catch { return []; }
+  const servers = [];
+  const seen = new Set();
+  for (const receipt of state.receipts) {
+    if (seen.has(receipt.catalogId)) continue;
+    let row = null;
+    try {
+      row = db.prepare(
+        "SELECT id, catalog_id, name, name_en, transport, command, args_json, env_keys_json, enabled FROM mcp_servers WHERE id=? LIMIT 1",
+      ).get(receipt.registryServerId);
+    } catch { continue; }
+    const server = materializeTrustedSystemMcpServer(row, options);
+    if (
+      !server || server.id !== receipt.registryServerId || server.catalog_id !== receipt.catalogId ||
+      server.consentFingerprint !== receipt.consentFingerprint
+    ) continue;
+    seen.add(receipt.catalogId);
+    servers.push(server);
+  }
+  return servers;
+}
+
+function normalizeConsentAnswer(answer, availableIds) {
+  const text = String(answer || "").trim();
+  if (/^(?:y|yes|all|전체)$/i.test(text)) return [...availableIds];
+  if (!text || /^(?:n|no|none|없이|아니)$/i.test(text)) return [];
+  const requested = parseIdList(text);
+  const allowed = new Set(availableIds);
+  return requested.filter((id) => allowed.has(id));
+}
+
+function askMcpConsentOnce(plan, options = {}) {
+  const input = options.input || process.stdin;
+  const output = options.output || process.stderr;
+  // TTY가 아니면(파이프/자동화) 묻지 않고 빈 승인 — 조용한 전체 승인 금지.
+  if (!input.isTTY || !output.isTTY || !plan.availableCatalogIds.length) return Promise.resolve([]);
+  const rl = readline.createInterface({ input, output, terminal: true });
+  return new Promise((resolve) => {
+    rl.question("Attach the available MCP recommendations? [y=all / n=none / comma-separated ids] ", (answer) => {
+      rl.close();
+      resolve(normalizeConsentAnswer(answer, plan.availableCatalogIds));
+    });
+  });
+}
+
+async function resolveApprovedMcpRuntimeAllowlist(options) {
+  const approved = new Set(options.approvedIds || []);
+  const selectedGroups = (options.plan?.entries || []).map((entry) => {
+    if (entry.status !== "available") return null;
+    const candidates = Array.isArray(entry.runtimeCandidates) && entry.runtimeCandidates.length
+      ? entry.runtimeCandidates
+      : [{
+          resolvedCatalogId: entry.resolvedCatalogId,
+          registryServerId: entry.registryServerId,
+          credentialKeyFingerprint: entry.credentialKeyFingerprint,
+        }];
+    const approvedCandidates = candidates.filter(
+      (candidate) => candidate.resolvedCatalogId && approved.has(candidate.resolvedCatalogId),
+    );
+    return approvedCandidates.length ? { entry, candidates: approvedCandidates } : null;
+  }).filter(Boolean);
+  const probe = options.probeServer || ((server, probeOptions = {}) => probeSystemMcpServerConnection(server, {
+    cwd: options.cwd,
+    env: options.env,
+    userDataDir: options.userDataDir,
+    timeoutMs: probeOptions.timeoutMs,
+    signal: probeOptions.signal,
+  }));
+  const bounded = (value, fallback, min, max) => {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? Math.max(min, Math.min(max, Math.trunc(parsed))) : fallback;
+  };
+  const concurrency = bounded(options.probeConcurrency, MCP_PROBE_CONCURRENCY, 1, MAX_APPROVED_MCP_PER_BUILD);
+  const perServerTimeoutMs = bounded(options.probeTimeoutMs, MCP_PROBE_PER_SERVER_TIMEOUT_MS, 50, 30_000);
+  const totalTimeoutMs = bounded(options.totalProbeTimeoutMs, MCP_PROBE_TOTAL_TIMEOUT_MS, 50, 60_000);
+  const deadline = Date.now() + totalTimeoutMs;
+  const outcomes = new Array(selectedGroups.length);
+  let nextIndex = 0;
+
+  const probeCandidate = async (candidate) => {
+    let server = null;
+    try { server = readApprovedSystemMcpServer(options.db, candidate, { userDataDir: options.userDataDir }); }
+    catch { /* one unsafe/unwritable runtime boundary excludes only this server */ }
+    if (!server) return { candidate, server: null, status: { connected: false, reason: "registry_row_unavailable" } };
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) return { candidate, server, status: { connected: false, reason: "probe_total_deadline" } };
+    const timeoutMs = Math.min(perServerTimeoutMs, remainingMs);
+    const controller = new AbortController();
+    let timer = null;
+    let status;
+    try {
+      status = await Promise.race([
+        Promise.resolve(probe(server, { timeoutMs, signal: controller.signal })),
+        new Promise((resolve) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            resolve({ connected: false, reason: "connection_timeout" });
+          }, timeoutMs);
+        }),
+      ]);
+    } catch {
+      status = { connected: false, reason: "connection_failed" };
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    return { candidate, server, status };
+  };
+
+  // Different requirements use a small worker pool. Alternatives for one
+  // requirement are deliberately sequential so a failed primary cannot fan
+  // out package-manager processes or affect unrelated server groups.
+  const work = async () => {
+    while (true) {
+      const index = nextIndex++;
+      if (index >= selectedGroups.length) return;
+      const group = selectedGroups[index];
+      const attempts = [];
+      for (const candidate of group.candidates) {
+        const outcome = await probeCandidate(candidate);
+        attempts.push(outcome);
+        if (outcome.status?.connected) break;
+      }
+      outcomes[index] = { entry: group.entry, attempts };
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, selectedGroups.length) }, () => work()));
+
+  const attached = [];
+  const failed = [];
+  const servers = [];
+  for (let index = 0; index < outcomes.length; index += 1) {
+    const outcome = outcomes[index] || {
+      entry: selectedGroups[index]?.entry,
+      attempts: [],
+    };
+    for (const attempt of outcome.attempts) {
+      const catalogId = attempt.candidate.resolvedCatalogId;
+      if (!attempt.status?.connected) {
+        failed.push({ catalogId, reason: safeCatalogId(attempt.status?.reason) || "connection_failed" });
+        continue;
+      }
+      attached.push({ catalogId, registryServerId: attempt.server.id, status: "connected" });
+      servers.push(attempt.server);
+      break;
+    }
+  }
+  let consentPersisted = servers.length === 0;
+  if (servers.length) {
+    try { consentPersisted = persistMcpConsentReceipts(options.userDataDir, servers); }
+    catch { consentPersisted = false; }
+  }
+  const receipt = {
+    schemaVersion: "agentlas.terminal-mcp-runtime-allowlist.v1",
+    planId: options.plan?.planId || null,
+    approvedCatalogIds: [...approved].sort(),
+    attached,
+    failed,
+    emptyMode: attached.length === 0,
+    consentPersisted,
+  };
+  Object.defineProperty(receipt, "servers", { value: servers, enumerable: false });
+  return receipt;
+}
+
+module.exports = {
+  MCP_CONSENT_STATE_SCHEMA,
+  MCP_CONSENT_RECEIPT_SCHEMA,
+  mcpConsentStatePath,
+  loadMcpConsentState,
+  persistMcpConsentReceipts,
+  readConsentedSystemMcpServers,
+  normalizeConsentAnswer,
+  askMcpConsentOnce,
+  resolveApprovedMcpRuntimeAllowlist,
+};