create-codemodekit 0.3.0 → 0.5.0

package/dist/source-template.js

@@ -0,0 +1,356 @@
+export function renderSources(sources) {
+    const rendered = sources.map(renderSource);
+    const needsEnvironment = sources.some((source) => source.type === "mcp-http" &&
+        (source.bearerTokenEnv !== undefined ||
+            Object.keys(source.headerEnv ?? {}).length > 0));
+    return {
+        imports: [...new Set(rendered.flatMap((source) => source.imports))],
+        prelude: (needsEnvironment ? renderEnvironmentHelper() : "") +
+            rendered.map((source) => source.prelude).join(""),
+        expressions: rendered.map((source) => source.expression),
+    };
+}
+export function renderSource(source) {
+    switch (source.type) {
+        case "mcp-stdio":
+            return {
+                imports: ["mcp"],
+                prelude: "",
+                expression: `
+    mcp.stdio({
+      name: ${JSON.stringify(source.name)},
+      command: ${JSON.stringify(source.command.command)},
+      args: ${JSON.stringify(source.command.args)},
+    }),
+  `,
+            };
+        case "mcp-http": {
+            const headers = [
+                ...(source.bearerTokenEnv === undefined
+                    ? []
+                    : [
+                        `        authorization: "Bearer " + requiredEnvironment(${JSON.stringify(source.bearerTokenEnv)}),`,
+                    ]),
+                ...Object.entries(source.headerEnv ?? {})
+                    .sort(([left], [right]) => left.localeCompare(right))
+                    .map(([header, environment]) => `        ${JSON.stringify(header)}: requiredEnvironment(${JSON.stringify(environment)}),`),
+            ];
+            return {
+                imports: ["mcp"],
+                prelude: "",
+                expression: `
+    mcp.http({
+      name: ${JSON.stringify(source.name)},
+      url: ${JSON.stringify(source.url)},
+${headers.length === 0 ? "" : `      headers: {\n${headers.join("\n")}\n      },\n`}
+    }),
+  `,
+            };
+        }
+        case "weather":
+            return {
+                imports: ["defineTool", "local", "ToolError"],
+                prelude: renderWeatherPrelude(),
+                expression: `
+    local({
+      name: "weather",
+      tools: { findLocation, getCurrentWeather },
+    }),
+  `,
+            };
+    }
+}
+export function renderSourcesReadme(sources) {
+    if (sources.length === 1)
+        return renderSourceReadme(sources[0]);
+    return `It combines ${String(sources.length)} sources in one catalog:\n\n${sources
+        .map((source) => `### \`${sourceName(source)}\`\n\n${renderSourceReadme(source)}`)
+        .join("\n\n")}`;
+}
+function renderSourceReadme(source) {
+    switch (source.type) {
+        case "mcp-stdio":
+            return `It wraps the \`${source.name}\` MCP source using this shell-free process configuration:
+
+\`\`\`json
+${JSON.stringify(source.command, null, 2)}
+\`\`\``;
+        case "mcp-http": {
+            const environment = sourceEnvironmentVariables(source);
+            const authentication = environment.length === 0
+                ? ""
+                : ` Authentication headers are assembled at runtime from ${environment
+                    .map((name) => `\`${name}\``)
+                    .join(", ")}; their values are not written to source or plugin artifacts.`;
+            return `It wraps the \`${source.name}\` Streamable HTTP MCP source at \`${source.url}\`.${authentication}`;
+        }
+        case "weather":
+            return `This is the editable, keyless weather starter. It exposes two local tools—\`weather.findLocation\` and \`weather.getCurrentWeather\`—so an agent can compose geocoding and current-weather lookup inside one \`run_typescript\` call.
+
+It uses Open-Meteo's public endpoints by default. The free endpoint is intended for non-commercial use within Open-Meteo's published limits; review their terms before production use. Set \`OPEN_METEO_GEOCODING_URL\` and \`OPEN_METEO_FORECAST_URL\` to use customer or self-hosted endpoints.`;
+    }
+}
+export function renderEnvExample(sources) {
+    const sections = sources.map((source) => {
+        switch (source.type) {
+            case "weather":
+                return `# Optional Open-Meteo customer or self-hosted endpoints.
+# OPEN_METEO_GEOCODING_URL=https://geocoding-api.open-meteo.com/v1/search
+# OPEN_METEO_FORECAST_URL=https://api.open-meteo.com/v1/forecast
+`;
+            case "mcp-http": {
+                const variables = sourceEnvironmentVariables(source);
+                return variables.length === 0
+                    ? `# ${source.name}: add any environment required by the remote MCP source.\n`
+                    : `# ${source.name}: required HTTP authentication environment.\n${variables
+                        .map((name) => `${name}=`)
+                        .join("\n")}\n`;
+            }
+            case "mcp-stdio":
+                return `# ${source.name}: add any environment required by the upstream MCP process.\n`;
+        }
+    });
+    return sections.join("\n");
+}
+function sourceEnvironmentVariables(source) {
+    return [
+        ...(source.bearerTokenEnv === undefined ? [] : [source.bearerTokenEnv]),
+        ...Object.values(source.headerEnv ?? {}),
+    ].filter((value, index, values) => values.indexOf(value) === index);
+}
+function sourceName(source) {
+    return source.type === "weather" ? "weather" : source.name;
+}
+function renderEnvironmentHelper() {
+    return `function requiredEnvironment(name) {
+  const value = process.env[name];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error("Missing required environment variable: " + name);
+  }
+  return value;
+}
+
+`;
+}
+function renderWeatherPrelude() {
+    return `const geocodingEndpoint =
+  process.env.OPEN_METEO_GEOCODING_URL ??
+  "https://geocoding-api.open-meteo.com/v1/search";
+const forecastEndpoint =
+  process.env.OPEN_METEO_FORECAST_URL ??
+  "https://api.open-meteo.com/v1/forecast";
+
+const findLocation = defineTool({
+  description: "Find the best matching city and its coordinates",
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: {
+        type: "string",
+        minLength: 2,
+        maxLength: 200,
+        description: "City, postal code, or city and administrative area",
+      },
+    },
+    required: ["query"],
+    additionalProperties: false,
+  },
+  outputSchema: {
+    type: "object",
+    properties: {
+      name: { type: "string" },
+      country: { type: "string" },
+      latitude: { type: "number" },
+      longitude: { type: "number" },
+      timezone: { type: "string" },
+    },
+    required: ["name", "country", "latitude", "longitude", "timezone"],
+    additionalProperties: false,
+  },
+  annotations: {
+    title: "Find Location",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+  },
+  execute: async ({ query }, { signal }) => {
+    const url = new URL(geocodingEndpoint);
+    url.searchParams.set("name", query);
+    url.searchParams.set("count", "1");
+    url.searchParams.set("language", "en");
+    url.searchParams.set("format", "json");
+    const payload = await fetchJson(url, signal, "Location lookup");
+    const results = Array.isArray(payload.results) ? payload.results : [];
+    const match = asRecord(results[0]);
+    if (match === undefined) {
+      throw new ToolError("No matching location was found");
+    }
+    return {
+      name: stringField(match, "name", "Location lookup"),
+      country: optionalString(match.country),
+      latitude: numberField(match, "latitude", "Location lookup"),
+      longitude: numberField(match, "longitude", "Location lookup"),
+      timezone: optionalString(match.timezone),
+    };
+  },
+});
+
+const getCurrentWeather = defineTool({
+  description: "Get current weather for latitude and longitude",
+  inputSchema: {
+    type: "object",
+    properties: {
+      latitude: { type: "number", minimum: -90, maximum: 90 },
+      longitude: { type: "number", minimum: -180, maximum: 180 },
+    },
+    required: ["latitude", "longitude"],
+    additionalProperties: false,
+  },
+  outputSchema: {
+    type: "object",
+    properties: {
+      time: { type: "string" },
+      temperature: { type: "number" },
+      apparentTemperature: { type: "number" },
+      relativeHumidity: { type: "number" },
+      precipitation: { type: "number" },
+      weatherCode: { type: "number" },
+      condition: { type: "string" },
+      windSpeed: { type: "number" },
+      units: {
+        type: "object",
+        properties: {
+          temperature: { type: "string" },
+          precipitation: { type: "string" },
+          windSpeed: { type: "string" },
+        },
+        required: ["temperature", "precipitation", "windSpeed"],
+        additionalProperties: false,
+      },
+    },
+    required: [
+      "time",
+      "temperature",
+      "apparentTemperature",
+      "relativeHumidity",
+      "precipitation",
+      "weatherCode",
+      "condition",
+      "windSpeed",
+      "units",
+    ],
+    additionalProperties: false,
+  },
+  annotations: {
+    title: "Get Current Weather",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+  },
+  execute: async ({ latitude, longitude }, { signal }) => {
+    const url = new URL(forecastEndpoint);
+    url.searchParams.set("latitude", String(latitude));
+    url.searchParams.set("longitude", String(longitude));
+    url.searchParams.set(
+      "current",
+      "temperature_2m,apparent_temperature,relative_humidity_2m,precipitation,weather_code,wind_speed_10m",
+    );
+    url.searchParams.set("timezone", "auto");
+    const payload = await fetchJson(url, signal, "Weather lookup");
+    const current = requiredRecord(payload.current, "Weather lookup");
+    const units = requiredRecord(payload.current_units, "Weather lookup");
+    const weatherCode = numberField(current, "weather_code", "Weather lookup");
+    return {
+      time: stringField(current, "time", "Weather lookup"),
+      temperature: numberField(current, "temperature_2m", "Weather lookup"),
+      apparentTemperature: numberField(
+        current,
+        "apparent_temperature",
+        "Weather lookup",
+      ),
+      relativeHumidity: numberField(
+        current,
+        "relative_humidity_2m",
+        "Weather lookup",
+      ),
+      precipitation: numberField(current, "precipitation", "Weather lookup"),
+      weatherCode,
+      condition: weatherCondition(weatherCode),
+      windSpeed: numberField(current, "wind_speed_10m", "Weather lookup"),
+      units: {
+        temperature: stringField(units, "temperature_2m", "Weather lookup"),
+        precipitation: stringField(units, "precipitation", "Weather lookup"),
+        windSpeed: stringField(units, "wind_speed_10m", "Weather lookup"),
+      },
+    };
+  },
+});
+
+async function fetchJson(url, signal, label) {
+  try {
+    const response = await fetch(url, {
+      signal,
+      headers: { accept: "application/json" },
+    });
+    if (!response.ok) {
+      throw new ToolError(label + " returned HTTP " + response.status);
+    }
+    return requiredRecord(await response.json(), label);
+  } catch (error) {
+    if (signal.aborted || error instanceof ToolError) throw error;
+    throw new ToolError(label + " failed", { cause: error });
+  }
+}
+
+function requiredRecord(value, label) {
+  const record = asRecord(value);
+  if (record === undefined) {
+    throw new ToolError(label + " returned an unexpected response");
+  }
+  return record;
+}
+
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+}
+
+function stringField(record, key, label) {
+  const value = record[key];
+  if (typeof value !== "string") {
+    throw new ToolError(label + " returned an unexpected response");
+  }
+  return value;
+}
+
+function numberField(record, key, label) {
+  const value = record[key];
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new ToolError(label + " returned an unexpected response");
+  }
+  return value;
+}
+
+function optionalString(value) {
+  return typeof value === "string" ? value : "";
+}
+
+function weatherCondition(code) {
+  if (code === 0) return "clear sky";
+  if (code <= 3) return "partly cloudy";
+  if (code === 45 || code === 48) return "fog";
+  if (code <= 57) return "drizzle";
+  if (code <= 67) return "rain";
+  if (code <= 77) return "snow";
+  if (code <= 82) return "rain showers";
+  if (code <= 86) return "snow showers";
+  if (code >= 95) return "thunderstorm";
+  return "unknown";
+}
+
+`;
+}
+//# sourceMappingURL=source-template.js.map

package/dist/source-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-template.js","sourceRoot":"","sources":["../src/source-template.ts"],"names":[],"mappings":"AAiCA,MAAM,UAAU,aAAa,CAAC,OAAkC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,KAAK,UAAU;QAC1B,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;YAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CACpD,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,OAAO,EACL,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO;gBACL,OAAO,EAAE,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE;gBACX,UAAU,EAAE;;cAEN,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;iBACxB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;cACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;;GAE9C;aACI,CAAC;QACJ,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,0DAA0D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;qBACpG,CAAC;gBACN,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;qBACtC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;qBACpD,GAAG,CACF,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CACxB,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAC5F;aACJ,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE;gBACX,UAAU,EAAE;;cAEN,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;aAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;EACrC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;;GAEhF;aACI,CAAC;QACJ,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;gBACL,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC;gBAC7C,OAAO,EAAE,oBAAoB,EAAE;gBAC/B,UAAU,EAAE;;;;;GAKjB;aACI,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAkC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAmB,CAAC,CAAC;IAClF,OAAO,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,+BAA+B,OAAO;SAC/E,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,SAAS,UAAU,CAAC,MAAM,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CACnE;SACA,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAsB;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,kBAAkB,MAAM,CAAC,IAAI;;;EAGxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;OAClC,CAAC;QACJ,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,CAAC;gBACtB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,yDAAyD,WAAW;qBACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;qBAC5B,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAAC;YACnF,OAAO,kBAAkB,MAAM,CAAC,IAAI,sCAAsC,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QAC7G,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;;kSAEqR,CAAC;IACjS,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACZ,OAAO;;;CAGd,CAAC;YACI,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBACrD,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,4DAA4D;oBAC9E,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,gDAAgD,SAAS;yBACtE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;yBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,KAAK,WAAW;gBACd,OAAO,KAAK,MAAM,CAAC,IAAI,+DAA+D,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA8D;IAE9D,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACvE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;KACzC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB;IACxC,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;CAQR,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0NR,CAAC;AACF,CAAC"}

package/dist/verify-template.d.ts

@@ -0,0 +1,2 @@
+export declare function renderVerifyScript(sourceNames: readonly string[]): string;
+//# sourceMappingURL=verify-template.d.ts.map

package/dist/verify-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-template.d.ts","sourceRoot":"","sources":["../src/verify-template.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA+GzE"}

package/dist/verify-template.js

@@ -0,0 +1,113 @@
+export function renderVerifyScript(sourceNames) {
+    return `import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const client = new Client(
+  { name: "codemodekit-generated-verifier", version: "1.0.0" },
+  {
+    versionNegotiation: {
+      mode: "auto",
+      probe: { timeoutMs: 5_000, maxRetries: 0 },
+    },
+    inputRequired: { autoFulfill: false },
+  },
+);
+
+try {
+  await client.connect(
+    new StdioClientTransport({
+      command: process.execPath,
+      args: [fileURLToPath(new URL("../src/server.mjs", import.meta.url))],
+      cwd: root,
+      stderr: "pipe",
+    }),
+    { timeout: 15_000 },
+  );
+
+  const listed = await client.listTools();
+  assert.deepEqual(
+    listed.tools.map((tool) => tool.name).sort(),
+    ["run_typescript", "search_tools"],
+    "The server must expose exactly the two Code Mode tools",
+  );
+
+  for (const source of ${JSON.stringify(sourceNames)}) {
+    const search = await client.callTool({
+      name: "search_tools",
+      arguments: { query: source, source, detail: "summary", limit: 1 },
+    });
+    assert.notEqual(search.isError, true, "search_tools failed for " + source);
+    assert.equal(typeof search.structuredContent?.catalogRevision, "string");
+    assert.equal(typeof search.structuredContent?.returned, "number");
+  }
+
+  const isolation = await client.callTool({
+    name: "run_typescript",
+    arguments: {
+      code: \`return {
+        sum: [1, 2, 3].reduce((total, value) => total + value, 0),
+        process: typeof process,
+        require: typeof require,
+        fetch: typeof fetch,
+      };\`,
+    },
+  });
+  assert.equal(isolation.structuredContent?.ok, true);
+  assert.deepEqual(isolation.structuredContent?.value, {
+    sum: 6,
+    process: "undefined",
+    require: "undefined",
+    fetch: "undefined",
+  });
+  assert.deepEqual(isolation.structuredContent?.logs, []);
+
+  await expectToolError(
+    () => client.callTool({ name: "run_typescript", arguments: {} }),
+    /code|required/i,
+  );
+  await expectToolError(
+    () => client.callTool({ name: "not_a_code_mode_tool", arguments: {} }),
+    /tool|not found|unknown/i,
+  );
+
+  const liveFile = process.env.CODEMODEKIT_VERIFY_CODE_FILE;
+  if (liveFile !== undefined && liveFile.trim() !== "") {
+    const code = await readFile(liveFile, "utf8");
+    const live = await client.callTool({
+      name: "run_typescript",
+      arguments: { code },
+    });
+    assert.equal(live.structuredContent?.ok, true, "Live provider composition failed");
+    assert.equal(
+      live.structuredContent?.value?.verified,
+      true,
+      "Live verifier code must return an object containing verified: true",
+    );
+  }
+
+  process.stdout.write(
+    \`Verified Code Mode surface, ${String(sourceNames.length)} source(s), sandbox isolation\${liveFile ? ", and live composition" : ""}.\\n\`,
+  );
+} finally {
+  await client.close();
+}
+
+async function expectToolError(call, pattern) {
+  let result;
+  try {
+    result = await call();
+  } catch (error) {
+    assert.match(error instanceof Error ? error.message : String(error), pattern);
+    return;
+  }
+  assert.equal(result.isError, true, "Expected an MCP tool error result");
+  assert.match(JSON.stringify(result), pattern);
+}
+`;
+}
+//# sourceMappingURL=verify-template.js.map

package/dist/verify-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-template.js","sourceRoot":"","sources":["../src/verify-template.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAqCgB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAuDhB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;CAiB7D,CAAC;AACF,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-codemodekit",
-  "version": "0.3.0",
-  "description": "Scaffold runnable CodeModeKit servers and portable Agent Plugins from MCP commands.",
+  "version": "0.5.0",
+  "description": "Scaffold runnable CodeModeKit servers, Local Tool starters, and portable Agent Plugins.",
   "author": "Stephen Brown",
   "license": "Apache-2.0",
   "repository": {
@@ -33,8 +33,7 @@
   "files": [
     "dist/*.js",
     "dist/*.d.ts",
-    "dist/*.map",
-    "skills/**/*"
+    "dist/*.map"
   ],
   "keywords": [
     "code-mode",
@@ -48,6 +47,7 @@
     "access": "public"
   },
   "dependencies": {
-    "esbuild": "0.28.1"
+    "esbuild": "0.28.1",
+    "@codemodekit/skills": "0.2.0"
   }
 }

package/skills/build-codemodekit-plugin/SKILL.md

@@ -1,44 +0,0 @@
----
-name: build-codemodekit-plugin
-description: Scaffold, retrofit, or maintain CodeModeKit servers and portable Agent Plugins with companion runtime skills. Use when creating a Code Mode MCP wrapper from an MCP command, adding Agent Plugins 1.0 packaging, refreshing generated tool TypeScript, configuring tool policy, installing a plugin into Cursor, or diagnosing a generated CodeModeKit project.
----
-
-# Build a CodeModeKit Plugin
-
-Prefer CodeModeKit's generator and lifecycle commands over hand-writing manifests, bundles, or generated tool declarations.
-
-## Create a new project
-
-1. Identify a short source name and a shell-free MCP executable plus arguments.
-2. Run:
-
-   ```sh
-   npm create codemodekit@latest <directory> -- \
-     --mcp-name <source-name> \
-     --mcp-command '<executable> [args...]' \
-     --agent-plugin
-   ```
-
-3. Inspect `src/server.mjs`, `plugin.json`, `mcp.json`, and the generated runtime skill before changing defaults.
-4. Keep credentials outside committed files. Pass an env-file argument to the upstream executable when it supports one; do not embed secrets in `mcp.json`.
-5. Run `npm run plugin:sync` after credentials and the upstream MCP are available.
-6. Run `npm run plugin:build` to recreate the self-contained `dist/plugin` package.
-7. Test `npm start` through an MCP client and confirm both `run_typescript` and `search_tools` are advertised.
-
-Read [references/generator.md](references/generator.md) for flags and lifecycle commands.
-
-## Update an existing project
-
-Preserve the one-file server unless the integration genuinely needs more structure. Use `scaffoldAgentPlugin` for portable manifests and the companion skill, and use `syncAgentPluginSkill` with the project's `CodeMode` instance to refresh catalog-derived references. Never hand-edit `tools.d.ts`; it is generated output.
-
-Read [references/programmatic-api.md](references/programmatic-api.md) for the builder contracts and [references/plugin-layout.md](references/plugin-layout.md) for generated-file ownership.
-
-## Validate
-
-- Treat a failed dependency install or plugin build as a generator failure; do not report the project as ready.
-- Treat a failed catalog sync as recoverable when the upstream MCP merely needs credentials or connectivity. Keep the pending references and report the exact `npm run plugin:sync` follow-up.
-- Reject partial snapshots when any source is unavailable.
-- Keep `SKILL.md` procedural and compact. Put generated schemas, TypeScript declarations, result semantics, and examples in `references/`.
-- Tell runtime agents to search large declaration references for focused matches instead of loading an entire catalog into context.
-- Preserve `search_tools` as a live fallback for pending, stale, or dynamic catalogs.
-- Reinstall the Cursor copy after changing source, policy, metadata, or generated references.

package/skills/build-codemodekit-plugin/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Build CodeModeKit Plugin"
-  short_description: "Scaffold and maintain CodeModeKit Agent Plugins"
-  default_prompt: "Build or update a portable CodeModeKit Agent Plugin with a companion runtime skill."

package/skills/build-codemodekit-plugin/references/generator.md

@@ -1,42 +0,0 @@
-# Generator reference
-
-## Minimal server
-
-```sh
-npm create codemodekit@latest my-code-mode -- \
-  --mcp-name upstream \
-  --mcp-command 'uvx upstream-mcp'
-```
-
-Dependency installation is automatic. Use `--no-install` only when installation must happen later. The generator also installs this development-time skill at `.agents/skills/build-codemodekit-plugin`; use `--no-authoring-skill` to omit it.
-
-## Agent Plugin
-
-Add `--agent-plugin` to generate the portable manifests, companion Agent Skill, catalog references, and self-contained `dist/plugin` artifact. After installation, the generator attempts a live catalog sync. Use `--no-sync` to leave the references pending intentionally.
-
-The generated package includes:
-
-```json
-{
-  "scripts": {
-    "start": "node src/server.mjs",
-    "plugin:sync": "node src/server.mjs --sync-plugin",
-    "plugin:build": "codemodekit-plugin build",
-    "plugin:install:cursor": "codemodekit-plugin install cursor",
-    "plugin:status:cursor": "codemodekit-plugin status cursor",
-    "plugin:uninstall:cursor": "codemodekit-plugin uninstall cursor"
-  }
-}
-```
-
-`plugin:install:cursor` rebuilds the artifact, copies it into Cursor's local plugin directory, and resolves concrete Node and server paths for Cursor. Reload Cursor after install. Re-run the command after source or catalog changes.
-
-## Tool policy
-
-`--policy allow-all` is the runnable default. It allows every tool advertised by configured sources, subject to restrictions enforced by the upstream server itself.
-
-Use `--policy deny-all` when the generated server must begin closed. Replace the policy in `src/server.mjs` with an explicit application policy before expecting tool calls to succeed.
-
-## Command parsing
-
-`--mcp-command` is parsed into one executable and an argument array without a shell. Quotes and backslash escaping are supported. Pipes, redirects, command substitution, and leading environment assignments are rejected.

package/skills/build-codemodekit-plugin/references/plugin-layout.md

@@ -1,38 +0,0 @@
-# Generated plugin layout
-
-```text
-my-code-mode/
-├── .agents/skills/build-codemodekit-plugin/
-├── dist/plugin/
-│   ├── emscripten-module.wasm
-│   ├── mcp.json
-│   ├── plugin.json
-│   ├── server.mjs
-│   └── skills/
-├── package.json
-├── plugin.json
-├── mcp.json
-├── src/
-│   └── server.mjs
-└── skills/
-    └── use-upstream-codemode/
-        ├── SKILL.md
-        └── references/
-            ├── catalog-metadata.json
-            ├── examples.md
-            ├── result-contract.md
-            ├── runtime.md
-            └── tools.d.ts
-```
-
-## Ownership
-
-- The developer owns `src/server.mjs`, tool policy, provider configuration, and plugin metadata.
-- CodeModeKit owns generated `tools.d.ts`, `catalog-metadata.json`, and `dist/plugin`.
-- The generated runtime `SKILL.md` contains stable procedure and should stay small.
-- `runtime.md`, `result-contract.md`, and `examples.md` are scaffolded reference templates and may be tailored when an integration needs additional guidance.
-- `.agents/skills/build-codemodekit-plugin` is development-time authoring guidance and is intentionally excluded from the portable plugin artifact.
-
-`mcp.json` exposes the bundled Code Mode server to an Agent Plugins client. The upstream MCP remains configured inside `src/server.mjs`; it is not exposed as a second direct server that would bypass Code Mode policy and sandboxing.
-
-The portable `dist/plugin/mcp.json` uses `${PLUGIN_ROOT}` as required by Agent Plugins. Cursor installation produces a separate concrete copy because Cursor currently needs absolute executable and server paths for local plugins.