ctxr-cli 0.30.0 → 0.31.0

package/dist/core/mcp/ripgrep.js

@@ -0,0 +1,98 @@
+import { execFile } from 'node:child_process';
+/**
+ * serve-the-store-over-mcp design.md D12: the one module that spawns
+ * ripgrep, for the MCP surface's `Grep` and `Glob`. Claude Code's own Grep
+ * parameters map onto ripgrep's flags one for one, so they are passed through
+ * as an argument vector — never a shell — with `--` ahead of the pattern, so
+ * no pattern is ever read as a flag. Ripgrep's engine runs in time linear in
+ * its input, so no pattern can hang the server; the time and output limits
+ * here bound everything else.
+ */
+export const RIPGREP_TIMEOUT_MS = 5_000;
+export const RIPGREP_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+function strip(p) {
+    return p.replace(/^\.\//, '');
+}
+/** `--null` output: bare paths are NUL-separated; lines with content are `path NUL rest`, newline-separated. */
+function parse(stdout, barePaths) {
+    if (barePaths)
+        return stdout.split('\0').map((p) => p.trim()).filter((p) => p.length > 0).map((p) => ({ path: strip(p), rest: null }));
+    return stdout
+        .split('\n')
+        .filter((line) => line.length > 0)
+        .map((line) => {
+        const nul = line.indexOf('\0');
+        return nul === -1 ? { path: null, rest: line } : { path: strip(line.slice(0, nul)), rest: line.slice(nul + 1) };
+    });
+}
+function run(args, cwd, barePaths) {
+    return new Promise((resolve) => {
+        execFile('rg', [...args], { cwd, timeout: RIPGREP_TIMEOUT_MS, maxBuffer: RIPGREP_MAX_OUTPUT_BYTES, killSignal: 'SIGKILL' }, (err, stdout, stderr) => {
+            if (err === null) {
+                // Always searched from an explicit `.` (below), which ripgrep echoes back as a `./` prefix on every path.
+                resolve({ kind: 'ok', entries: parse(stdout, barePaths) });
+                return;
+            }
+            const e = err;
+            if (e.code === 1)
+                resolve({ kind: 'no-match' });
+            else if (e.code === 'ENOENT')
+                resolve({ kind: 'error', message: 'ripgrep (rg) is not installed where this server runs' });
+            else if (e.killed)
+                resolve({ kind: 'error', message: `the search took longer than ${RIPGREP_TIMEOUT_MS / 1000} seconds; narrow it with path or glob` });
+            else if (e.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER')
+                resolve({ kind: 'error', message: 'the search produced too much output; narrow it with path, glob or head_limit' });
+            else
+                resolve({ kind: 'error', message: stderr.trim().split('\n')[0] || `ripgrep failed (${String(e.code)})` });
+        });
+    });
+}
+/** `--glob '!<prefix>**'` for each path the tools must never read or return. */
+function exclusionArgs(hidden) {
+    return hidden.flatMap((prefix) => {
+        const trimmed = prefix.replace(/\/+$/, '');
+        return ['--glob', `!${trimmed}`, '--glob', `!${trimmed}/**`];
+    });
+}
+const BASE_ARGS = ['--no-config', '--color', 'never', '--sort', 'path', '--no-messages', '--null'];
+/** Claude Code's Grep, mapped flag for flag. `searchPath` is store-relative, already confined to the store. */
+export function grep(cwd, params, searchPath, hidden) {
+    const args = [...BASE_ARGS];
+    const mode = params.output_mode ?? 'files_with_matches';
+    if (mode === 'files_with_matches')
+        args.push('--files-with-matches');
+    else if (mode === 'count')
+        args.push('--count');
+    else if (params['-n'] !== false)
+        args.push('--line-number');
+    if (params['-i'] === true)
+        args.push('--ignore-case');
+    if (mode === 'content') {
+        const context = params['-C'] ?? params.context;
+        if (context !== undefined)
+            args.push('--context', String(context));
+        if (params['-A'] !== undefined)
+            args.push('--after-context', String(params['-A']));
+        if (params['-B'] !== undefined)
+            args.push('--before-context', String(params['-B']));
+    }
+    if (params.multiline === true)
+        args.push('--multiline', '--multiline-dotall');
+    if (params.glob !== undefined)
+        args.push('--glob', params.glob);
+    if (params.type !== undefined)
+        args.push('--type', params.type);
+    // Last: ripgrep lets a later --glob override an earlier one, so a caller's glob must never follow an exclusion.
+    args.push(...exclusionArgs(hidden));
+    // An explicit path always: given none and a stdin that is not a terminal, ripgrep searches stdin and waits.
+    args.push('--', params.pattern, searchPath ?? '.');
+    return run(args, cwd, mode === 'files_with_matches');
+}
+/** Claude Code's Glob: files matching `pattern`, under `searchPath`, sorted by path. */
+export function glob(cwd, pattern, searchPath, hidden) {
+    // Exclusions after the caller's pattern: a later --glob takes precedence in ripgrep.
+    const args = [...BASE_ARGS, '--files', '--glob', pattern, ...exclusionArgs(hidden)];
+    args.push('--', searchPath ?? '.');
+    return run(args, cwd, true);
+}
+//# sourceMappingURL=ripgrep.js.map

package/dist/core/mcp/ripgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ripgrep.js","sourceRoot":"","sources":["../../../src/core/mcp/ripgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AA6BxD,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,gHAAgH;AAChH,SAAS,KAAK,CAAC,MAAc,EAAE,SAAkB;IAC/C,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvI,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,GAAG,CAAC,IAAuB,EAAE,GAAW,EAAE,SAAkB;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,wBAAwB,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAClJ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,0GAA0G;gBAC1G,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,GAA2D,CAAC;YACtE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;iBAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;iBACrH,IAAI,CAAC,CAAC,MAAM;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,kBAAkB,GAAG,IAAI,uCAAuC,EAAE,CAAC,CAAC;iBACnJ,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;;gBACxK,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,EAAE,IAAI,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,OAAO,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;AAEnG,+GAA+G;AAC/G,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAkB,EAAE,UAAyB,EAAE,MAAyB;IACxG,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IACxD,IAAI,IAAI,KAAK,oBAAoB;QAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;SAChE,IAAI,IAAI,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC/C,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,gHAAgH;IAChH,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,4GAA4G;IAC5G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,GAAG,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,oBAAoB,CAAC,CAAC;AACvD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,OAAe,EAAE,UAAyB,EAAE,MAAyB;IACrG,qFAAqF;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/core/mcp/rwlock.d.ts

@@ -0,0 +1,16 @@
+/**
+ * serve-the-store-over-mcp design.md D8: every tool call reads one commit.
+ * Tool calls share the lock; a sync takes it exclusively. A waiting writer
+ * blocks new readers, so a steady stream of calls cannot postpone a sync
+ * forever, and a sync waits for the calls already in flight.
+ */
+export declare class ReadWriteLock {
+    private readers;
+    private writing;
+    private readonly waiting;
+    private canRead;
+    private wake;
+    read<T>(fn: () => Promise<T>): Promise<T>;
+    write<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=rwlock.d.ts.map

package/dist/core/mcp/rwlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rwlock.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/rwlock.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuD;IAE/E,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,IAAI;IAiBN,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS9C;IAEK,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS/C;CACF"}

package/dist/core/mcp/rwlock.js

@@ -0,0 +1,59 @@
+/**
+ * serve-the-store-over-mcp design.md D8: every tool call reads one commit.
+ * Tool calls share the lock; a sync takes it exclusively. A waiting writer
+ * blocks new readers, so a steady stream of calls cannot postpone a sync
+ * forever, and a sync waits for the calls already in flight.
+ */
+export class ReadWriteLock {
+    readers = 0;
+    writing = false;
+    waiting = [];
+    canRead() {
+        return !this.writing && !this.waiting.some((w) => w.kind === 'write');
+    }
+    wake() {
+        while (this.waiting.length > 0) {
+            const next = this.waiting[0];
+            if (next.kind === 'write') {
+                if (this.writing || this.readers > 0)
+                    return;
+                this.waiting.shift();
+                this.writing = true;
+                next.grant();
+                return;
+            }
+            if (this.writing)
+                return;
+            this.waiting.shift();
+            this.readers += 1;
+            next.grant();
+        }
+    }
+    async read(fn) {
+        if (this.canRead())
+            this.readers += 1;
+        else
+            await new Promise((grant) => this.waiting.push({ kind: 'read', grant }));
+        try {
+            return await fn();
+        }
+        finally {
+            this.readers -= 1;
+            this.wake();
+        }
+    }
+    async write(fn) {
+        if (!this.writing && this.readers === 0 && this.waiting.length === 0)
+            this.writing = true;
+        else
+            await new Promise((grant) => this.waiting.push({ kind: 'write', grant }));
+        try {
+            return await fn();
+        }
+        finally {
+            this.writing = false;
+            this.wake();
+        }
+    }
+}
+//# sourceMappingURL=rwlock.js.map

package/dist/core/mcp/rwlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rwlock.js","sourceRoot":"","sources":["../../../src/core/mcp/rwlock.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAChB,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IACP,OAAO,GAAoD,EAAE,CAAC;IAEvE,OAAO;QACb,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,IAAI;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC;oBAAE,OAAO;gBAC7C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,EAAoB;QAChC,IAAI,IAAI,CAAC,OAAO,EAAE;YAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;;YACjC,MAAM,IAAI,OAAO,CAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,EAAoB;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;;YACrF,MAAM,IAAI,OAAO,CAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/core/mcp/sessions.d.ts

@@ -0,0 +1,84 @@
+import type { StoreConfig } from '../../config/schema.js';
+import { type ForgeCredentials } from '../forge/credentials.js';
+import type { ForgeClient, PullRequest } from '../forge/github.js';
+import type { GitRunner } from '../git/exec.js';
+/**
+ * serve-the-store-over-mcp design.md D9, D13: the write side the MCP surface
+ * shares between `capture` and the member drafts. Everything it writes is an
+ * ordinary session — a worktree under the configured worktrees path, on a
+ * branch under the session prefix, with a pull request — so the approval page
+ * lists it and `ctxr land` lands it with no MCP-specific path anywhere.
+ */
+export interface WriteDeps {
+    git: GitRunner;
+    /** The store root `serve` was started on: where sessions are started, as `ctxr session start` starts them. */
+    canonicalRoot: string;
+    config: StoreConfig;
+    credentials: ForgeCredentials;
+    forge: ForgeClient;
+    env: Readonly<Record<string, string | undefined>>;
+    now(): Date;
+    /** `change_approval.recording_login`: the committer when the host has no git identity, as `ctxr land` does. */
+    recordingLogin: string;
+    /** `serve.base_url`, for the approval page address a tool returns. */
+    baseUrl: string;
+    /** The store root's path inside its repository, when the caller has already resolved it; asked of git otherwise. */
+    repoPrefix?: string;
+}
+export interface Session {
+    /** The worktree directory's name: the key the approval page addresses it by. */
+    name: string;
+    path: string;
+    branch: string;
+    label: string | null;
+}
+export type PullState = {
+    kind: 'open';
+    pull: PullRequest;
+} | {
+    kind: 'merged';
+} | {
+    kind: 'closed-unmerged';
+} | {
+    kind: 'none';
+};
+export declare class WriteRefusal extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: string, message: string, details?: Record<string, unknown> | undefined);
+}
+/** One write at a time across `capture`, `Edit` and `Write` (design.md D9, D13). */
+export declare class Mutex {
+    private tail;
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}
+export declare function approvalUrl(deps: WriteDeps, session: Session): string;
+/** The session worktrees on disk whose label starts with `labelPrefix`, with their branches. */
+export declare function sessionsLabelled(deps: WriteDeps, labelPrefix: string): Promise<Session[]>;
+/** What the forge says about the pull requests for `branch`: the open one, else merged, else closed, else none. */
+export declare function pullStateFor(deps: WriteDeps, branch: string): Promise<PullState>;
+/** A session whose pull request was closed without merging is removed: worktree and local branch (D9, D13). */
+export declare function removeSession(deps: WriteDeps, session: Session): Promise<void>;
+/** A new session from the freshly fetched default branch, exactly as `ctxr session start` names and places one. */
+export declare function startSession(deps: WriteDeps, label: string): Promise<Session>;
+/** The store-relative path's location inside the repository, for `git show <branch>:<path>`. */
+export declare function repoPathOf(deps: WriteDeps, storeRelative: string): Promise<string>;
+/**
+ * Stages `paths` and commits them authored by the member, with the store's
+ * hooks running as for any commit. On a refusal the worktree is restored to
+ * its tip — a draft never keeps a change its pull request does not carry —
+ * and the hook's output is the refusal (design.md D13).
+ */
+export declare function commitAs(deps: WriteDeps, session: Session, email: string, paths: readonly string[], subject: string, trailer: string): Promise<string>;
+export declare function restore(deps: WriteDeps, session: Session): Promise<void>;
+/**
+ * Publishes whatever the session holds that the forge does not: its branch,
+ * pushed when the remote lacks the local tip, and a pull request, found by
+ * head before one is opened. Idempotent, so a retry after any partial
+ * failure converges on exactly one pull request (design.md D9, D13).
+ */
+export declare function publish(deps: WriteDeps, session: Session, pull: {
+    title: string;
+    body: string;
+}): Promise<PullRequest>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/core/mcp/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3D;;;;;;GAMG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,SAAS,CAAC;IACf,8GAA8G;IAC9G,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,GAAG,IAAI,IAAI,CAAC;IACZ,+GAA+G;IAC/G,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oHAAoH;IACpH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,OAAO;IACtB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElI,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAH5C,YACW,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EAI3C;CACF;AAED,oFAAoF;AACpF,qBAAa,KAAK;IAChB,OAAO,CAAC,IAAI,CAAuC;IAEnD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAIvC;CACF;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAErE;AAED,gGAAgG;AAChG,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAY/F;AAED,mHAAmH;AACnH,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAOtF;AAED,+GAA+G;AAC/G,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpF;AAED,mHAAmH;AACnH,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnF;AASD,gGAAgG;AAChG,wBAAsB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxF;AAUD;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB5J;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB5H"}

package/dist/core/mcp/sessions.js

@@ -0,0 +1,154 @@
+import path from 'node:path';
+import { runRemoteGit } from '../forge/credentials.js';
+import { addWorktree, removeWorktree } from '../git/worktree.js';
+import { generateSessionBranchName, listSessionWorktreeDirs, sessionLabelFromDirName, sessionLabelSlug, worktreePathFor } from '../session.js';
+export class WriteRefusal extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'WriteRefusal';
+    }
+}
+/** One write at a time across `capture`, `Edit` and `Write` (design.md D9, D13). */
+export class Mutex {
+    tail = Promise.resolve();
+    run(fn) {
+        const next = this.tail.then(fn, fn);
+        this.tail = next.catch(() => undefined);
+        return next;
+    }
+}
+function firstLines(text, count = 6) {
+    return text.trim().split('\n').slice(0, count).join('\n');
+}
+export function approvalUrl(deps, session) {
+    return `${deps.baseUrl.replace(/\/+$/, '')}/approve/${encodeURIComponent(session.name)}`;
+}
+/** The session worktrees on disk whose label starts with `labelPrefix`, with their branches. */
+export async function sessionsLabelled(deps, labelPrefix) {
+    const root = path.join(deps.canonicalRoot, deps.config.session.worktrees_path);
+    const sessions = [];
+    for (const name of await listSessionWorktreeDirs(deps.canonicalRoot, deps.config)) {
+        const label = sessionLabelFromDirName(deps.config, name);
+        if (label === null || !label.startsWith(labelPrefix))
+            continue;
+        const dir = path.join(root, name);
+        const branch = (await deps.git.run(['symbolic-ref', '--short', 'HEAD'], { cwd: dir, allowFailure: true })).stdout.trim();
+        if (branch === '')
+            continue;
+        sessions.push({ name, path: dir, branch, label });
+    }
+    return sessions.sort((a, b) => (a.name < b.name ? -1 : 1));
+}
+/** What the forge says about the pull requests for `branch`: the open one, else merged, else closed, else none. */
+export async function pullStateFor(deps, branch) {
+    const pulls = await deps.forge.pullsForHead(branch);
+    const open = pulls.find((p) => p.state === 'open');
+    if (open !== undefined)
+        return { kind: 'open', pull: open };
+    if (pulls.some((p) => p.merged))
+        return { kind: 'merged' };
+    if (pulls.length > 0)
+        return { kind: 'closed-unmerged' };
+    return { kind: 'none' };
+}
+/** A session whose pull request was closed without merging is removed: worktree and local branch (D9, D13). */
+export async function removeSession(deps, session) {
+    await removeWorktree(deps.git, deps.canonicalRoot, session.path);
+    await deps.git.run(['branch', '-D', session.branch], { cwd: deps.canonicalRoot, allowFailure: true });
+}
+/** A new session from the freshly fetched default branch, exactly as `ctxr session start` names and places one. */
+export async function startSession(deps, label) {
+    const slug = sessionLabelSlug(label);
+    const defaultBranch = deps.config.git.default_branch;
+    await runRemoteGit(deps.git, deps.credentials, deps.env, ['fetch', '--quiet', 'origin', `+refs/heads/${defaultBranch}:refs/remotes/origin/${defaultBranch}`], {
+        cwd: deps.canonicalRoot,
+        allowFailure: true,
+    });
+    const hasRemote = (await deps.git.run(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${defaultBranch}`], { cwd: deps.canonicalRoot, allowFailure: true })).exitCode === 0;
+    // Names carry a timestamp to the second, and a closed pull request's branch stays on the remote: step past any taken name.
+    let branch = generateSessionBranchName(deps.config, deps.now(), slug);
+    for (let step = 1; step <= 60 && (await branchTaken(deps, branch)); step += 1) {
+        branch = generateSessionBranchName(deps.config, new Date(deps.now().getTime() + step * 1000), slug);
+    }
+    const dir = worktreePathFor({ root: deps.canonicalRoot, config: deps.config }, branch);
+    const added = await addWorktree(deps.git, deps.canonicalRoot, dir, branch, hasRemote ? `origin/${defaultBranch}` : defaultBranch, { allowFailure: true });
+    if (added.exitCode !== 0)
+        throw new WriteRefusal('mcp.session_not_started', `A session could not be started: ${firstLines(added.stderr)}`);
+    return { name: path.basename(dir), path: dir, branch, label: slug };
+}
+async function branchTaken(deps, branch) {
+    const local = await deps.git.run(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], { cwd: deps.canonicalRoot, allowFailure: true });
+    if (local.exitCode === 0)
+        return true;
+    const remote = await runRemoteGit(deps.git, deps.credentials, deps.env, ['ls-remote', '--exit-code', 'origin', `refs/heads/${branch}`], { cwd: deps.canonicalRoot, allowFailure: true });
+    return remote.exitCode === 0;
+}
+/** The store-relative path's location inside the repository, for `git show <branch>:<path>`. */
+export async function repoPathOf(deps, storeRelative) {
+    const prefix = deps.repoPrefix ?? (await deps.git.run(['rev-parse', '--show-prefix'], { cwd: deps.canonicalRoot, allowFailure: true })).stdout.trim();
+    return `${prefix}${storeRelative}`;
+}
+/** The committer: the host's git identity when it has one, else the recording login's noreply address, as `ctxr land` falls back. */
+async function committerEnv(deps, cwd) {
+    const email = (await deps.git.run(['config', '--get', 'user.email'], { cwd, allowFailure: true })).stdout.trim();
+    if (email !== '' || deps.env.GIT_COMMITTER_EMAIL || deps.env.EMAIL)
+        return {};
+    const address = `${deps.recordingLogin.replace(/\[bot\]$/, '')}@users.noreply.github.com`;
+    return { GIT_COMMITTER_NAME: deps.recordingLogin, GIT_COMMITTER_EMAIL: address };
+}
+/**
+ * Stages `paths` and commits them authored by the member, with the store's
+ * hooks running as for any commit. On a refusal the worktree is restored to
+ * its tip — a draft never keeps a change its pull request does not carry —
+ * and the hook's output is the refusal (design.md D13).
+ */
+export async function commitAs(deps, session, email, paths, subject, trailer) {
+    const run = (args, env) => deps.git.run(args, { cwd: session.path, allowFailure: true, ...(env ? { env } : {}) });
+    const added = await run(['add', '--', ...paths]);
+    if (added.exitCode !== 0) {
+        await restore(deps, session);
+        throw new WriteRefusal('mcp.commit_refused', `The change could not be staged: ${firstLines(added.stderr)}`);
+    }
+    const name = email.split('@')[0] ?? email;
+    const env = { ...deps.env, ...(await committerEnv(deps, session.path)), GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email };
+    const committed = await run(['commit', '--quiet', '-m', subject, '-m', `${trailer}: ${email}`], env);
+    if (committed.exitCode !== 0) {
+        await restore(deps, session);
+        throw new WriteRefusal('mcp.commit_refused', `The store refused the change: ${firstLines(`${committed.stdout}\n${committed.stderr}`, 12)}`);
+    }
+    return (await run(['rev-parse', 'HEAD'])).stdout.trim();
+}
+export async function restore(deps, session) {
+    await deps.git.run(['reset', '--quiet', '--hard', 'HEAD'], { cwd: session.path, allowFailure: true });
+    await deps.git.run(['clean', '-fdq'], { cwd: session.path, allowFailure: true });
+}
+/**
+ * Publishes whatever the session holds that the forge does not: its branch,
+ * pushed when the remote lacks the local tip, and a pull request, found by
+ * head before one is opened. Idempotent, so a retry after any partial
+ * failure converges on exactly one pull request (design.md D9, D13).
+ */
+export async function publish(deps, session, pull) {
+    const tip = (await deps.git.run(['rev-parse', 'HEAD'], { cwd: session.path })).stdout.trim();
+    const remote = await runRemoteGit(deps.git, deps.credentials, deps.env, ['ls-remote', 'origin', `refs/heads/${session.branch}`], { cwd: session.path, allowFailure: true });
+    if (remote.exitCode !== 0 || remote.stdout.split(/\s/)[0] !== tip) {
+        const pushed = await runRemoteGit(deps.git, deps.credentials, deps.env, ['push', '--quiet', 'origin', `HEAD:refs/heads/${session.branch}`], { cwd: session.path, allowFailure: true });
+        if (pushed.exitCode !== 0) {
+            throw new WriteRefusal('mcp.push_failed', `The change is saved in its session but could not be pushed yet (${firstLines(pushed.stderr, 2)}). Retry the same call to publish it.`, { session: session.name });
+        }
+    }
+    const state = await pullStateFor(deps, session.branch);
+    if (state.kind === 'open')
+        return state.pull;
+    try {
+        return await deps.forge.createPull({ head: session.branch, base: deps.config.git.default_branch, title: pull.title, body: pull.body });
+    }
+    catch (err) {
+        throw new WriteRefusal('mcp.pull_request_failed', `The change is pushed but its pull request could not be opened yet (${err instanceof Error ? firstLines(err.message, 2) : String(err)}). Retry the same call to open it.`, { session: session.name });
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/core/mcp/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/core/mcp/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAyB,MAAM,yBAAyB,CAAC;AAG9E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAqC/I,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B,IAAI;IAEJ,OAAO;IAHlB,YACW,IAAY,EACrB,OAAe,EACN,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;oBAJN,IAAI;uBAEJ,OAAO;QAGhB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,KAAK;IACR,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,GAAG,CAAI,EAAoB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAe,EAAE,OAAgB;IAC3D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAe,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,uBAAuB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzH,IAAI,MAAM,KAAK,EAAE;YAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,MAAc;IAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe,EAAE,OAAgB;IACnE,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IACrD,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,aAAa,wBAAwB,aAAa,EAAE,CAAC,EAAE;QAC5J,GAAG,EAAE,IAAI,CAAC,aAAa;QACvB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,uBAAuB,aAAa,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IACrL,2HAA2H;IAC3H,IAAI,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACtE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9E,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,aAAa,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1J,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,mCAAmC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3I,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAe,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAChJ,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACzL,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAe,EAAE,aAAqB;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtJ,OAAO,GAAG,MAAM,GAAG,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,qIAAqI;AACrI,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,GAAW;IACtD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjH,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAC1F,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe,EAAE,OAAgB,EAAE,KAAa,EAAE,KAAwB,EAAE,OAAe,EAAE,OAAe;IACzI,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAE,GAAwC,EAAsB,EAAE,CACpG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,mCAAmC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACzH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACrG,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,iCAAiC,UAAU,CAAC,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAe,EAAE,OAAgB;IAC7D,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAe,EAAE,OAAgB,EAAE,IAAqC;IACpG,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5K,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvL,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,mEAAmE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/M,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,yBAAyB,EACzB,sEAAsE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,EACzK,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/mcp/surface.d.ts

@@ -0,0 +1,42 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ApprovalServer } from '../browse/approve.js';
+import type { GitRunner } from '../git/exec.js';
+import type { Store } from '../store.js';
+/**
+ * serve-the-store-over-mcp design.md D3, D10 (remote-access spec): the MCP
+ * surface `ctxr serve` routes its MCP paths to. One per server, holding only
+ * what must outlive a configuration reload — the read view, the spent-code
+ * nonces, and the signer. Everything else is built per request from the
+ * state `serve` last loaded, so adding, changing or removing the `mcp` block
+ * takes effect on the next request with no restart.
+ */
+/** Every path the MCP surface answers; `serve` routes these here ahead of its own routes. */
+export declare function isMcpPath(pathname: string): boolean;
+export interface McpSurfaceState {
+    store: Store;
+    approval: ApprovalServer | null;
+    approvalError: string | null;
+}
+export interface McpSurfaceOptions {
+    git: GitRunner;
+    canonicalRoot: string;
+    env: Readonly<Record<string, string | undefined>>;
+    now(): Date;
+    log(line: string): void;
+}
+export declare class McpSurface {
+    private readonly options;
+    private readonly view;
+    private readonly spentCodes;
+    private readonly mutex;
+    private readonly signers;
+    private randomKey;
+    /** Derived once per credential: the key never changes while a credential object lives. */
+    private readonly derived;
+    private repoPrefix;
+    constructor(options: McpSurfaceOptions);
+    /** The App-derived key when there is an App; otherwise one random key for this process, said once. */
+    private signerFor;
+    handle(state: McpSurfaceState, req: IncomingMessage, res: ServerResponse, pathname: string): Promise<void>;
+}
+//# sourceMappingURL=surface.d.ts.map

package/dist/core/mcp/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AASzC;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,SAAS,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,GAAG,IAAI,IAAI,CAAC;IACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAeD,qBAAa,UAAU;IAUT,OAAO,CAAC,QAAQ,CAAC,OAAO;IATpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,SAAS,CAAqB;IACtC,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,UAAU,CAAqB;IAEvC,YAA6B,OAAO,EAAE,iBAAiB,EAEtD;IAED,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAmBX,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4E/G;CACF"}