grain-tools 0.10.16 → 0.10.17

package/out/server/standalone.js

@@ -19663,10 +19663,10 @@ function toolRuleFor(profile, tool) {
   return profile.policy?.rules?.[TOOL_RESOURCE_CLASS[tool]] ?? "allow";
 }
 function refusalNextStep(tool) {
-  return REFUSAL_NEXT_STEP[TOOL_RESOURCE_CLASS[tool]] ?? DEFAULT_REFUSAL_NEXT_STEP;
+  return REFUSAL_NEXT_STEP[tool] ?? `The '${tool}' call requires a profile that permits '${TOOL_RESOURCE_CLASS[tool]}' actions.`;
 }
 function toolRefusalMessage(profile, tool) {
-  return `Tool '${tool}' is not permitted for the '${profile.name}' profile: its resource class '${TOOL_RESOURCE_CLASS[tool]}' is refused by policy. The tool exists and is advertised; this call was declined, not lost. Next step: ${refusalNextStep(tool)}`;
+  return `Tool '${tool}' is not permitted for the '${profile.name}' profile: its resource class '${TOOL_RESOURCE_CLASS[tool]}' is refused by policy. The tool exists and is advertised; this call was declined, not lost. ${refusalNextStep(tool)}`;
 }
 function toolRefusalResult(profile, tool) {
   return {
@@ -19765,7 +19765,7 @@ function createToolProfileResolver(explicit, onUnknownEnvValue) {
     }
   };
 }
-var ALL_TOOLS, READ_ONLY_TOOLS, TOOL_RESOURCE_CLASS, TOOL_PROFILES, REFUSAL_NEXT_STEP, DEFAULT_REFUSAL_NEXT_STEP, WEB_PROXIED_TOOLS, toolNameSets;
+var ALL_TOOLS, READ_ONLY_TOOLS, TOOL_RESOURCE_CLASS, TOOL_PROFILES, REFUSAL_NEXT_STEP, WEB_PROXIED_TOOLS, toolNameSets;
 var init_toolProfiles = __esm({
   "src/common/toolProfiles.ts"() {
     "use strict";
@@ -19855,11 +19855,11 @@ var init_toolProfiles = __esm({
       }
     };
     REFUSAL_NEXT_STEP = {
-      "connection-config": "Call create_connection_draft with whatever details you know, leave the rest blank, and give the user the returned URL to finish setup in Grain. Ask the user for details; do not search local files or other repositories for them.",
-      credential: "Agents cannot request stored credentials here. Ask the user to enter the password in Grain (VS Code: Grain panel > Settings > Connections > the connection). Never ask for a password in chat.",
-      "workspace-write": "Ask the user to save it from Grain."
+      save_connection: "Draft connections are available through create_connection_draft; setup is completed in Grain using details supplied by the user. Grain does not read connection details from local files or other repositories.",
+      delete_connection: "Deleting connections is only available in the Grain workspace (open the connection, then Delete).",
+      request_connection_credentials: "Connection credentials are entered in Grain (VS Code: Grain panel > Settings > Connections > the connection), never in chat.",
+      save_chart: "Charts can be saved from the Grain workspace."
     };
-    DEFAULT_REFUSAL_NEXT_STEP = "Tell the user this action is not available to agents in Grain.";
     WEB_PROXIED_TOOLS = [
       "list_connectors",
       "list_connections",
@@ -22031,6 +22031,121 @@ var init_applicationPayload = __esm({
   }
 });
 
+// src/common/ipcEndpoint.ts
+function posixSocketPathFits(directory) {
+  return Buffer.byteLength(path22.posix.join(directory, SOCKET_BASENAME)) <= UNIX_SOCKET_PATH_MAX_BYTES && Buffer.byteLength(
+    path22.posix.join(directory, `.${"9".repeat(PRIVATE_SOCKET_BASENAME_LENGTH)}`)
+  ) <= UNIX_SOCKET_PATH_MAX_BYTES;
+}
+function relocatedSocketDirectory(configDir) {
+  const key = (0, import_crypto3.createHash)("sha1").update(path22.resolve(configDir)).digest("hex").slice(0, 16);
+  return path22.join(os4.homedir(), ".grain", "s", key);
+}
+function isWindowsNamedPipe(endpoint) {
+  return endpoint.startsWith("\\\\.\\pipe\\") || endpoint.startsWith("\\\\?\\pipe\\");
+}
+function daemonIpcEndpoint(configDir) {
+  if (process.platform === "win32") {
+    const key = (0, import_crypto3.createHash)("sha1").update(path22.resolve(configDir).toLowerCase()).digest("hex").slice(0, 8);
+    return `\\\\.\\pipe\\sql-preview-${key}`;
+  }
+  if (posixSocketPathFits(configDir)) {
+    return path22.posix.join(configDir, SOCKET_BASENAME);
+  }
+  const directory = relocatedSocketDirectory(configDir);
+  const endpoint = path22.posix.join(directory, SOCKET_BASENAME);
+  if (!posixSocketPathFits(directory)) {
+    throw new Error(
+      `IPC socket path exceeds the ${UNIX_SOCKET_PATH_MAX_BYTES}-byte limit (${Buffer.byteLength(endpoint)} bytes) for ${configDir}.`
+    );
+  }
+  return endpoint;
+}
+function daemonControlEndpoint(configDir) {
+  const key = (0, import_crypto3.createHash)("sha1").update(path22.resolve(configDir).toLowerCase()).digest("hex").slice(0, 16);
+  return `\\\\.\\pipe\\grain-control-${key}`;
+}
+function isRelocatedDaemonIpcEndpoint(configDir, endpoint) {
+  return process.platform !== "win32" && endpoint === path22.posix.join(relocatedSocketDirectory(configDir), SOCKET_BASENAME);
+}
+function endpointExists(endpoint) {
+  if (isWindowsNamedPipe(endpoint)) {
+    return true;
+  }
+  return fs18.existsSync(endpoint);
+}
+var fs18, os4, path22, import_crypto3, UNIX_SOCKET_PATH_MAX_BYTES, SOCKET_BASENAME, PRIVATE_SOCKET_BASENAME_LENGTH;
+var init_ipcEndpoint = __esm({
+  "src/common/ipcEndpoint.ts"() {
+    "use strict";
+    fs18 = __toESM(require("fs"));
+    os4 = __toESM(require("os"));
+    path22 = __toESM(require("path"));
+    import_crypto3 = require("crypto");
+    UNIX_SOCKET_PATH_MAX_BYTES = 104;
+    SOCKET_BASENAME = "srv.sock";
+    PRIVATE_SOCKET_BASENAME_LENGTH = 24;
+  }
+});
+
+// src/common/requestDaemonControlStop.ts
+function requestDaemonControlStop(endpoint, token) {
+  return new Promise((resolve12) => {
+    const socket = net.createConnection(endpoint);
+    const timeout = setTimeout(() => settle2(false), 2e3);
+    const settle2 = (accepted) => {
+      clearTimeout(timeout);
+      socket.destroy();
+      resolve12(accepted);
+    };
+    socket.once("error", () => settle2(false));
+    socket.once(
+      "connect",
+      () => socket.write(JSON.stringify({ method: "graceful-stop", token }) + "\n")
+    );
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString();
+      if (Buffer.byteLength(buffer) > CONTROL_MESSAGE_LIMIT) {
+        settle2(false);
+        return;
+      }
+      const newline = buffer.indexOf("\n");
+      if (newline === -1) {
+        return;
+      }
+      try {
+        settle2(JSON.parse(buffer.slice(0, newline)).accepted === true);
+      } catch {
+        settle2(false);
+      }
+    });
+  });
+}
+var net, CONTROL_MESSAGE_LIMIT;
+var init_requestDaemonControlStop = __esm({
+  "src/common/requestDaemonControlStop.ts"() {
+    "use strict";
+    net = __toESM(require("net"));
+    CONTROL_MESSAGE_LIMIT = 8 * 1024;
+  }
+});
+
+// src/server/config/drainStopBudget.ts
+function drainStopBudgetMs(configDir) {
+  const drainTimeoutMs = configDir ? new ConfigLoader({ configDir, createDefaultFile: false }).load().config.server.drainTimeoutMs : DEFAULT_CONFIG.server.drainTimeoutMs;
+  return drainTimeoutMs + DRAIN_STOP_MARGIN_MS;
+}
+var DRAIN_STOP_MARGIN_MS;
+var init_drainStopBudget = __esm({
+  "src/server/config/drainStopBudget.ts"() {
+    "use strict";
+    init_ConfigLoader();
+    init_DaemonConfig();
+    DRAIN_STOP_MARGIN_MS = 2e3;
+  }
+});
+
 // src/server/install/supervisorAdapter.ts
 function createCommandRunner() {
   return {
@@ -22062,6 +22177,14 @@ function isUserServicesForbidden(platform2, output) {
   }
   return /access is denied|0x80070005|error_access_denied/.test(normalized);
 }
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error52) {
+    return error52.code !== "ESRCH";
+  }
+}
 async function runRegistration(platform2, runner, command, args) {
   const result = await runner.run(command, args);
   if (result.exitCode === 0) {
@@ -22085,7 +22208,7 @@ async function probeRegistration(runner, command, args) {
 function isCommandMissing(error52) {
   return error52?.code === "ENOENT";
 }
-function createSupervisorAdapter(platform2, runner, uid) {
+function createSupervisorAdapter(platform2, runner, uid, configHome) {
   if (platform2 === "darwin") {
     const target = (domain2, identifier) => `${domain2}/${uid}/${identifier}`;
     const registeredTarget = async (identifier) => {
@@ -22173,7 +22296,28 @@ function createSupervisorAdapter(platform2, runner, uid) {
       "/F"
     ]),
     unregister: async (identifier) => {
-      await runner.run("schtasks", ["/End", "/TN", identifier]);
+      let exited = false;
+      const pid = configHome ? readDaemonEndpoint(configHome)?.pid : void 0;
+      if (configHome) {
+        const token = readDaemonAuthToken(configHome);
+        if (pid && token && await requestDaemonControlStop(daemonControlEndpoint(configHome), token)) {
+          const deadline = Date.now() + drainStopBudgetMs(configHome);
+          while (Date.now() < deadline) {
+            if (!isPidAlive(pid)) {
+              exited = true;
+              break;
+            }
+            await new Promise((resolve12) => setTimeout(resolve12, 250));
+          }
+        }
+      }
+      if (!exited) {
+        const args = ["/End", "/TN", identifier];
+        const result = await runner.run("schtasks", args);
+        if (result.exitCode !== 0 && pid && isPidAlive(pid)) {
+          throw new RegistrationError("schtasks", args, result.exitCode, result.output);
+        }
+      }
       await runRegistration(platform2, runner, "schtasks", ["/Delete", "/TN", identifier, "/F"]);
     },
     start: (identifier) => runStart(runner, "schtasks", ["/Run", "/TN", identifier])
@@ -22184,6 +22328,11 @@ var init_supervisorAdapter = __esm({
   "src/server/install/supervisorAdapter.ts"() {
     "use strict";
     import_child_process3 = require("child_process");
+    init_daemonEndpointFile();
+    init_DaemonAuthToken();
+    init_ipcEndpoint();
+    init_requestDaemonControlStop();
+    init_drainStopBudget();
     UserServicesForbiddenError = class extends Error {
     };
     ServiceManagerMissingError = class extends UserServicesForbiddenError {
@@ -22205,7 +22354,7 @@ var require_package = __commonJS({
       name: "grain",
       displayName: "Grain SQL",
       description: "Run SQL in VS Code and expose safe, visible MCP database tools for Claude, Cursor, and other AI agents.",
-      version: "0.10.16",
+      version: "0.10.17",
       license: "UNLICENSED",
       mcpName: "io.github.pattrnlabs/grain",
       publisher: "pattrnlabs",
@@ -24690,7 +24839,7 @@ function readRegistry(configDir) {
   }
 }
 function tokenDigest(token) {
-  return import_crypto3.default.createHash("sha256").update(token, "utf8").digest("base64url");
+  return import_crypto4.default.createHash("sha256").update(token, "utf8").digest("base64url");
 }
 function digestsMatch(provided, expected) {
   const a = Buffer.from(provided, "utf8");
@@ -24698,7 +24847,7 @@ function digestsMatch(provided, expected) {
   if (a.length !== b.length) {
     return false;
   }
-  return import_crypto3.default.timingSafeEqual(a, b);
+  return import_crypto4.default.timingSafeEqual(a, b);
 }
 function assertIdAvailable(registry2, id) {
   if (registry2.clients.some((client) => client.id === id)) {
@@ -24727,7 +24876,7 @@ function registerClient2(configDir, registration) {
   ensureConfigDirMode2(configDir);
   let registry2 = readRegistry(configDir);
   assertIdAvailable(registry2, registration.id);
-  const token = import_crypto3.default.randomBytes(TOKEN_BYTES3).toString("base64url");
+  const token = import_crypto4.default.randomBytes(TOKEN_BYTES3).toString("base64url");
   const entry = { ...registration, tokenDigest: tokenDigest(token) };
   const registryPath = clientRegistryPath(configDir);
   try {
@@ -24782,11 +24931,11 @@ function removeClient(configDir, id) {
   writeExistingRegistry(configDir, registry2);
   return true;
 }
-var import_crypto3, import_fs4, import_path5, CLIENT_REGISTRY_FILENAME, TOKEN_BYTES3, REGISTRY_FILE_MODE, CONFIG_DIR_MODE3;
+var import_crypto4, import_fs4, import_path5, CLIENT_REGISTRY_FILENAME, TOKEN_BYTES3, REGISTRY_FILE_MODE, CONFIG_DIR_MODE3;
 var init_ClientRegistry = __esm({
   "src/server/auth/ClientRegistry.ts"() {
     "use strict";
-    import_crypto3 = __toESM(require("crypto"));
+    import_crypto4 = __toESM(require("crypto"));
     import_fs4 = __toESM(require("fs"));
     import_path5 = __toESM(require("path"));
     init_toolProfiles();
@@ -24853,45 +25002,45 @@ async function startCommand(configDir = resolveGrainHome(), spawner = import_chi
     console.log(`Grain is already running at ${formatUserFacingLocalUrl(host, port)}`);
     return 0;
   }
-  const lockPath = path27.join(configDir, "start.lock");
+  const lockPath = path28.join(configDir, "start.lock");
   let claimedLock = false;
   try {
-    const content = fs22.readFileSync(lockPath, "utf8");
+    const content = fs23.readFileSync(lockPath, "utf8");
     const parts = content.split("\n");
     const pidStr = parts[0];
     const tsStr = parts[1];
     if (pidStr === void 0 || tsStr === void 0) {
-      fs22.unlinkSync(lockPath);
+      fs23.unlinkSync(lockPath);
     } else {
       const lockPid = parseInt(pidStr, 10);
       const lockTs = parseInt(tsStr, 10);
       if (!isNaN(lockTs) && clock.now() - lockTs > 2e4) {
-        fs22.unlinkSync(lockPath);
+        fs23.unlinkSync(lockPath);
       } else if (!isNaN(lockPid)) {
         try {
           process.kill(lockPid, 0);
         } catch {
-          fs22.unlinkSync(lockPath);
+          fs23.unlinkSync(lockPath);
         }
       }
     }
   } catch {
   }
   try {
-    const fd = fs22.openSync(lockPath, "wx");
-    fs22.writeSync(fd, `${process.pid}
+    const fd = fs23.openSync(lockPath, "wx");
+    fs23.writeSync(fd, `${process.pid}
 ${clock.now()}`);
-    fs22.closeSync(fd);
+    fs23.closeSync(fd);
     claimedLock = true;
   } catch (e2) {
     if (e2.code !== "EEXIST") {
       throw e2;
     }
   }
-  const logPath = path27.join(configDir, "daemon.log");
+  const logPath = path28.join(configDir, "daemon.log");
   if (claimedLock) {
-    const out2 = fs22.openSync(logPath, "a");
-    const err = fs22.openSync(logPath, "a");
+    const out2 = fs23.openSync(logPath, "a");
+    const err = fs23.openSync(logPath, "a");
     const child = spawner(process.execPath, [process.argv[1] ?? ""], {
       detached: true,
       stdio: ["ignore", out2, err],
@@ -24926,20 +25075,20 @@ ${clock.now()}`);
   } finally {
     if (claimedLock) {
       try {
-        fs22.unlinkSync(lockPath);
+        fs23.unlinkSync(lockPath);
       } catch {
       }
     }
   }
 }
-var import_child_process4, fs22, path27, http5, OWNERSHIP_PROBE_PATH;
+var import_child_process4, fs23, path28, http5, OWNERSHIP_PROBE_PATH;
 var init_startCommand = __esm({
   "src/server/cli/startCommand.ts"() {
     "use strict";
     import_child_process4 = require("child_process");
     init_onboardingHandoff();
-    fs22 = __toESM(require("fs"));
-    path27 = __toESM(require("path"));
+    fs23 = __toESM(require("fs"));
+    path28 = __toESM(require("path"));
     http5 = __toESM(require("http"));
     init_grainHome();
     init_statusCommand();
@@ -25019,10 +25168,10 @@ var init_localBrowserPaths = __esm({
 function findPackageRoot(startDir) {
   let dir3 = startDir;
   for (let i = 0; i < 8; i++) {
-    if (fs23.existsSync(path28.join(dir3, "package.json"))) {
+    if (fs24.existsSync(path29.join(dir3, "package.json"))) {
       return dir3;
     }
-    const parent = path28.dirname(dir3);
+    const parent = path29.dirname(dir3);
     if (parent === dir3) {
       break;
     }
@@ -25032,19 +25181,19 @@ function findPackageRoot(startDir) {
 }
 function readDaemonVersion() {
   try {
-    const pkgPath = path28.join(findPackageRoot(__dirname), "package.json");
-    const pkg = JSON.parse(fs23.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path29.join(findPackageRoot(__dirname), "package.json");
+    const pkg = JSON.parse(fs24.readFileSync(pkgPath, "utf8"));
     return pkg.version ?? null;
   } catch {
     return null;
   }
 }
-var fs23, path28;
+var fs24, path29;
 var init_daemonVersion = __esm({
   "src/server/daemonVersion.ts"() {
     "use strict";
-    fs23 = __toESM(require("fs"));
-    path28 = __toESM(require("path"));
+    fs24 = __toESM(require("fs"));
+    path29 = __toESM(require("path"));
   }
 });
 
@@ -33703,7 +33852,7 @@ async function stopCommand(configDir = resolveGrainHome(), clock = Date, process
   process.platform,
   createCommandRunner(),
   process.getuid?.() ?? 0
-), isProcessAlive = defaultIsProcessAlive) {
+), isProcessAlive = defaultIsProcessAlive, platform2 = process.platform, requestStop = requestDaemonControlStop) {
   if (await adapter2.isRegistered(DAEMON_SERVICE_IDENTITY)) {
     console.error(
       "Grain is installed as a background service. Run `grain uninstall` to remove it."
@@ -33720,8 +33869,12 @@ async function stopCommand(configDir = resolveGrainHome(), clock = Date, process
     console.error("Could not determine Grain daemon PID.");
     return 1;
   }
+  const token = platform2 === "win32" ? readDaemonAuthToken(configDir) : void 0;
+  const accepted = token ? await requestStop(daemonControlEndpoint(configDir), token) : false;
   try {
-    processKiller(pid, "SIGTERM");
+    if (!accepted) {
+      processKiller(pid, "SIGTERM");
+    }
   } catch (error52) {
     const code = error52.code;
     if (code !== "ESRCH") {
@@ -33730,7 +33883,7 @@ async function stopCommand(configDir = resolveGrainHome(), clock = Date, process
     }
   }
   const startMs = clock.now();
-  const timeoutMs = 1e4;
+  const timeoutMs = accepted ? drainStopBudgetMs(configDir) : 1e4;
   while (clock.now() - startMs < timeoutMs) {
     const currentStatus = await readGrainServiceStatus(configDir);
     if (!isRunningGrainService(currentStatus) && !isProcessAlive(pid)) {
@@ -33739,7 +33892,7 @@ async function stopCommand(configDir = resolveGrainHome(), clock = Date, process
     }
     await new Promise((resolve12) => setTimeout(resolve12, 250));
   }
-  console.error("Grain did not stop within 10 seconds.");
+  console.error(`Grain did not stop within ${timeoutMs / 1e3} seconds.`);
   return 1;
 }
 var init_stopCommand = __esm({
@@ -33750,6 +33903,10 @@ var init_stopCommand = __esm({
     init_statusCommand();
     init_supervisorAdapter();
     init_daemonRecordInstance();
+    init_ipcEndpoint();
+    init_DaemonAuthToken();
+    init_requestDaemonControlStop();
+    init_drainStopBudget();
   }
 });
 
@@ -89674,67 +89831,10 @@ var require_express2 = __commonJS({
   }
 });
 
-// src/common/ipcEndpoint.ts
-function posixSocketPathFits(directory) {
-  return Buffer.byteLength(path30.posix.join(directory, SOCKET_BASENAME)) <= UNIX_SOCKET_PATH_MAX_BYTES && Buffer.byteLength(
-    path30.posix.join(directory, `.${"9".repeat(PRIVATE_SOCKET_BASENAME_LENGTH)}`)
-  ) <= UNIX_SOCKET_PATH_MAX_BYTES;
-}
-function relocatedSocketDirectory(configDir) {
-  const key = (0, import_crypto5.createHash)("sha1").update(path30.resolve(configDir)).digest("hex").slice(0, 16);
-  return path30.join(os7.homedir(), ".grain", "s", key);
-}
-function isWindowsNamedPipe(endpoint) {
-  return endpoint.startsWith("\\\\.\\pipe\\") || endpoint.startsWith("\\\\?\\pipe\\");
-}
-function daemonIpcEndpoint(configDir) {
-  if (process.platform === "win32") {
-    const key = (0, import_crypto5.createHash)("sha1").update(path30.resolve(configDir).toLowerCase()).digest("hex").slice(0, 8);
-    return `\\\\.\\pipe\\sql-preview-${key}`;
-  }
-  if (posixSocketPathFits(configDir)) {
-    return path30.posix.join(configDir, SOCKET_BASENAME);
-  }
-  const directory = relocatedSocketDirectory(configDir);
-  const endpoint = path30.posix.join(directory, SOCKET_BASENAME);
-  if (!posixSocketPathFits(directory)) {
-    throw new Error(
-      `IPC socket path exceeds the ${UNIX_SOCKET_PATH_MAX_BYTES}-byte limit (${Buffer.byteLength(endpoint)} bytes) for ${configDir}.`
-    );
-  }
-  return endpoint;
-}
-function daemonControlEndpoint(configDir) {
-  const key = (0, import_crypto5.createHash)("sha1").update(path30.resolve(configDir).toLowerCase()).digest("hex").slice(0, 16);
-  return `\\\\.\\pipe\\grain-control-${key}`;
-}
-function isRelocatedDaemonIpcEndpoint(configDir, endpoint) {
-  return process.platform !== "win32" && endpoint === path30.posix.join(relocatedSocketDirectory(configDir), SOCKET_BASENAME);
-}
-function endpointExists(endpoint) {
-  if (isWindowsNamedPipe(endpoint)) {
-    return true;
-  }
-  return fs26.existsSync(endpoint);
-}
-var fs26, os7, path30, import_crypto5, UNIX_SOCKET_PATH_MAX_BYTES, SOCKET_BASENAME, PRIVATE_SOCKET_BASENAME_LENGTH;
-var init_ipcEndpoint = __esm({
-  "src/common/ipcEndpoint.ts"() {
-    "use strict";
-    fs26 = __toESM(require("fs"));
-    os7 = __toESM(require("os"));
-    path30 = __toESM(require("path"));
-    import_crypto5 = require("crypto");
-    UNIX_SOCKET_PATH_MAX_BYTES = 104;
-    SOCKET_BASENAME = "srv.sock";
-    PRIVATE_SOCKET_BASENAME_LENGTH = 24;
-  }
-});
-
 // src/common/tcpPortAvailability.ts
 function isTcpPortAvailable(port, host = "127.0.0.1") {
   return new Promise((resolve12) => {
-    const server = net.createServer();
+    const server = net2.createServer();
     const finish = (available) => {
       server.removeAllListeners();
       resolve12(available);
@@ -89745,11 +89845,11 @@ function isTcpPortAvailable(port, host = "127.0.0.1") {
     });
   });
 }
-var net;
+var net2;
 var init_tcpPortAvailability = __esm({
   "src/common/tcpPortAvailability.ts"() {
     "use strict";
-    net = __toESM(require("net"));
+    net2 = __toESM(require("net"));
   }
 });
 
@@ -112272,7 +112372,11 @@ var init_QueryOperationRunner = __esm({
         try {
           const hooks = {
             ...enforceReadOnly !== void 0 ? { enforceReadOnly } : {},
-            onProfileResolved: (profileType) => {
+            onProfileResolved: (profileType, profile) => {
+              if (profile) {
+                tab.connectionId = profile.id;
+                tab.connectionName = profile.name;
+              }
               connector = normalizeTelemetryConnector(profileType);
               emitQueryRequested();
             }
@@ -112522,14 +112626,16 @@ var init_CredentialRequestService = __esm({
   "src/server/CredentialRequestService.ts"() {
     "use strict";
     import_crypto8 = __toESM(require("crypto"));
+    init_AppError();
     DEFAULT_TTL_MS = 10 * 60 * 1e3;
     SECRET_KEY_PATTERN = /password|secret|credential|privatekeypassphrase|^privatekey$|authheader|token|apikey/i;
     CredentialRequestService = class {
-      constructor(connectionManager, getBaseUrl, ttlMs = DEFAULT_TTL_MS, connectorRegistry) {
+      constructor(connectionManager, getBaseUrl, ttlMs = DEFAULT_TTL_MS, connectorRegistry, telemetry) {
         this.connectionManager = connectionManager;
         this.getBaseUrl = getBaseUrl;
         this.ttlMs = ttlMs;
         this.connectorRegistry = connectorRegistry;
+        this.telemetry = telemetry;
         this.requests = /* @__PURE__ */ new Map();
         this.requestConsents = /* @__PURE__ */ new Map();
       }
@@ -112632,12 +112738,36 @@ var init_CredentialRequestService = __esm({
         )) {
           throw new Error("Setup fields include a protected field.");
         }
-        await this.connectionManager.saveProfile({
-          ...profile,
-          ...fields,
-          draft: false,
-          ...input.password !== void 0 ? { password: input.password } : {}
-        });
+        try {
+          await this.connectionManager.saveProfile({
+            ...profile,
+            ...fields,
+            draft: false,
+            ...input.password !== void 0 ? { password: input.password } : {}
+          });
+          if (request2.kind === "draft") {
+            this.telemetry?.capture(
+              "first_value_step",
+              { step: "connection_saved", outcome: "success", state: "mcp_server" },
+              clientConsent
+            );
+          }
+        } catch (e2) {
+          if (request2.kind !== "draft") {
+            throw e2;
+          }
+          this.telemetry?.capture(
+            "first_value_step",
+            {
+              step: "connection_saved",
+              outcome: "failure",
+              error_id: errorIdOf(e2) ?? "connection_save_unknown",
+              state: "mcp_server"
+            },
+            clientConsent
+          );
+          throw e2;
+        }
         this.requests.delete(id);
         this.requestConsents.delete(id);
         return request2;
@@ -112713,7 +112843,7 @@ async function createConnectionDraft(deps, args, clientConsent) {
     content: [
       {
         type: "text",
-        text: `Give the user this Grain setup URL: ${request2.url}. Retry once the user says setup is done.`
+        text: `Draft connection '${name}' (id ${connectionId}) created. Setup page: ${request2.url} (expires ${new Date(request2.expiresAt).toISOString()}).`
       }
     ]
   };
@@ -113431,7 +113561,7 @@ function buildSetupRequiredResult(request2, browserOpened) {
     content: [
       {
         type: "text",
-        text: `Connection '${request2.connectionName}' needs setup before this can run. Give the user this Grain setup URL: ${request2.url}. Retry after the user says setup is done. The link expires at ${expiresAt}.`
+        text: `Connection '${request2.connectionName}' (id ${request2.connectionId}) is a draft and has no credentials yet. Setup page: ${request2.url} (expires ${expiresAt}). Queries on this connection will work once setup is saved.`
       }
     ],
     structuredContent: {
@@ -113640,6 +113770,22 @@ function isWhitespace(code) {
 function splitSqlQueries(text, options = {}) {
   return [...iterateSqlStatements(text, options)].map(({ statement }) => statement);
 }
+function firstExecutableOffset(text, options = {}) {
+  for (const token of iterateSqlTokens(text, options)) {
+    if (token.kind === "line_comment" || token.kind === "block_comment" || token.kind === "statement_separator") {
+      continue;
+    }
+    const raw = text.slice(token.start, token.end);
+    if (raw.trim().length === 0) {
+      continue;
+    }
+    return token.start + (raw.length - raw.trimStart().length);
+  }
+  return -1;
+}
+function hasExecutableSql(text, options = {}) {
+  return firstExecutableOffset(text, options) !== -1;
+}
 var CHAR_NEWLINE, CHAR_ASTERISK, CHAR_SLASH, CHAR_DASH, CHAR_SINGLE_QUOTE, CHAR_DOUBLE_QUOTE, CHAR_DOLLAR, CHAR_SEMICOLON, CHAR_BACKSLASH, CHAR_TAB, CHAR_CR, CHAR_SPACE, CHAR_NBSP, CHAR_HASH, CHAR_UPPER_E, CHAR_LOWER_E;
 var init_querySplitter = __esm({
   "src/utils/querySplitter.ts"() {
@@ -194647,9 +194793,7 @@ ${query.sql}`).join("\n\n")
           content: [
             {
               type: "text",
-              text: browserOpened ? `I opened a one-time Grain setup page for '${request2.connectionName}' in your browser. Give the user this URL if it did not open: ${request2.url}. Retry after the user says setup is done. The link expires at ${new Date(request2.expiresAt).toISOString()}.` : `Give the user this one-time Grain setup URL for '${request2.connectionName}': ${request2.url}. Retry after the user says setup is done. The link expires at ${new Date(
-                request2.expiresAt
-              ).toISOString()}.`
+              text: `One-time Grain setup page for '${request2.connectionName}' (id ${request2.connectionId}): ${request2.url} (expires ${new Date(request2.expiresAt).toISOString()}). ${browserOpened ? "The page was opened in the browser." : "The page was not opened in the browser."} Connection setup takes effect once saved.`
             }
           ]
         };
@@ -195765,6 +195909,10 @@ var init_ConnectorProcessPool = __esm({
 });
 
 // src/server/DaemonQueryExecutor.ts
+function withoutTerminalSeparator(query) {
+  const statements = splitSqlQueries(query).filter((statement) => hasExecutableSql(statement));
+  return statements.length === 1 && statements[0] ? statements[0] : query;
+}
 var path39, DaemonQueryExecutor;
 var init_DaemonQueryExecutor = __esm({
   "src/server/DaemonQueryExecutor.ts"() {
@@ -195776,6 +195924,7 @@ var init_DaemonQueryExecutor = __esm({
     init_AppError();
     init_optionalDrivers();
     init_sqlPolicy();
+    init_querySplitter();
     init_classifyQueryError();
     init_TelemetrySchema();
     init_DaemonConfig();
@@ -196007,7 +196156,7 @@ var init_DaemonQueryExecutor = __esm({
             "config"
           );
         }
-        hooks?.onProfileResolved?.(profile.type);
+        hooks?.onProfileResolved?.(profile.type, profile);
         const maxRows = maxRowsOverride ?? this.queryConfig.maxRows;
         const connectorConfig = {
           ...profile,
@@ -196037,7 +196186,13 @@ var init_DaemonQueryExecutor = __esm({
         });
         const querySignal = this.createQuerySignal(abortSignal);
         try {
-          const generator = connector.runQuery(query, connectorConfig, authHeader, querySignal.signal);
+          const executableQuery = withoutTerminalSeparator(query);
+          const generator = connector.runQuery(
+            executableQuery,
+            connectorConfig,
+            authHeader,
+            querySignal.signal
+          );
           for await (const page of generator) {
             yield {
               ...page,
@@ -203546,12 +203701,14 @@ function registerConnectionSetupRoutes(app, context2) {
       res.status(400).json({ error: "Setup fields include a protected field." });
       return;
     }
+    const profile = { ...state.profile };
+    delete profile["draft"];
     const result = await context2.toolManager.handleToolCall(
       "test_connection",
       {
         type: state.profile["type"],
         connectionProfile: {
-          ...state.profile,
+          ...profile,
           ...fields,
           ...typeof body.password === "string" ? { password: body.password } : {}
         }
@@ -204069,7 +204226,7 @@ function registerDaemonHttpRoutes(context2, mcpHttpSurface) {
         await context2.credentialRequestService.fulfill(id, token, password);
         res.send(
           renderCredentialPage({
-            success: "Saved. Go back to your agent \u2014 it will retry."
+            success: "Saved. Go back to your agent, and it will retry."
           })
         );
       } catch (err) {
@@ -204214,7 +204371,9 @@ data: ${Date.now()}
           sourceFileUri: t.sourceFileUri,
           wasTruncated: t.wasTruncated,
           totalRowsInFirstBatch: t.totalRowsInFirstBatch,
-          executedAt: t.executedAt
+          executedAt: t.executedAt,
+          connectionId: t.connectionId,
+          connectionName: t.connectionName
         }))
       );
     } catch (err) {
@@ -235242,12 +235401,12 @@ var init_ExtensionConnectionTracker = __esm({
 });
 
 // src/server/surfaces/DaemonSocketSurface.ts
-var fs41, net2, path41, bindSequence, DaemonSocketSurface;
+var fs41, net3, path41, bindSequence, DaemonSocketSurface;
 var init_DaemonSocketSurface = __esm({
   "src/server/surfaces/DaemonSocketSurface.ts"() {
     "use strict";
     fs41 = __toESM(require("fs"));
-    net2 = __toESM(require("net"));
+    net3 = __toESM(require("net"));
     path41 = __toESM(require("path"));
     init_ipcEndpoint();
     init_ConsoleLogger();
@@ -235306,7 +235465,7 @@ var init_DaemonSocketSurface = __esm({
             logger.warn("Failed to clean up socket:", e2);
           }
         }
-        this.server = net2.createServer(async (socket) => {
+        this.server = net3.createServer(async (socket) => {
           this.sockets.add(socket);
           logger.info("Client connected via Socket");
           this.options.refreshActivity();
@@ -235451,45 +235610,14 @@ var init_DaemonSocketSurface = __esm({
 });
 
 // src/server/surfaces/DaemonControlSurface.ts
-function requestDaemonControlStop(endpoint, token) {
-  return new Promise((resolve12) => {
-    const socket = net3.createConnection(endpoint);
-    const timeout = setTimeout(() => settle2(false), 2e3);
-    const settle2 = (accepted) => {
-      clearTimeout(timeout);
-      socket.destroy();
-      resolve12(accepted);
-    };
-    socket.once("error", () => settle2(false));
-    socket.once(
-      "connect",
-      () => socket.write(JSON.stringify({ method: "graceful-stop", token }) + "\n")
-    );
-    let buffer = "";
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString();
-      if (Buffer.byteLength(buffer) > CONTROL_MESSAGE_LIMIT) {
-        settle2(false);
-        return;
-      }
-      const newline = buffer.indexOf("\n");
-      if (newline === -1)
-        return;
-      try {
-        settle2(JSON.parse(buffer.slice(0, newline)).accepted === true);
-      } catch {
-        settle2(false);
-      }
-    });
-  });
-}
-var net3, CONTROL_MESSAGE_LIMIT, DaemonControlSurface;
+var net4, CONTROL_MESSAGE_LIMIT2, DaemonControlSurface;
 var init_DaemonControlSurface = __esm({
   "src/server/surfaces/DaemonControlSurface.ts"() {
     "use strict";
-    net3 = __toESM(require("net"));
+    net4 = __toESM(require("net"));
     init_DaemonAuthToken();
-    CONTROL_MESSAGE_LIMIT = 8 * 1024;
+    init_requestDaemonControlStop();
+    CONTROL_MESSAGE_LIMIT2 = 8 * 1024;
     DaemonControlSurface = class {
       constructor(options) {
         this.options = options;
@@ -235499,13 +235627,13 @@ var init_DaemonControlSurface = __esm({
         const enabled = this.options.platformEnabled ?? process.platform === "win32";
         if (!enabled)
           return;
-        this.server = net3.createServer((socket) => {
+        this.server = net4.createServer((socket) => {
           this.sockets.add(socket);
           socket.once("close", () => this.sockets.delete(socket));
           let buffer = "";
           socket.on("data", (chunk) => {
             buffer += chunk.toString();
-            if (Buffer.byteLength(buffer) > CONTROL_MESSAGE_LIMIT) {
+            if (Buffer.byteLength(buffer) > CONTROL_MESSAGE_LIMIT2) {
               socket.destroy();
               return;
             }
@@ -252899,7 +253027,8 @@ var init_Daemon = __esm({
           this.connectionManager,
           () => this.getHttpBaseUrl(),
           void 0,
-          this.connectorRegistry
+          this.connectorRegistry,
+          this.telemetryService
         );
         this.toolManager = new DaemonMcpToolManager(
           this.sessionManager,
@@ -254366,9 +254495,9 @@ ${line}
 
 // src/server/install/installCommand.ts
 var crypto8 = __toESM(require("crypto"));
-var fs18 = __toESM(require("fs"));
-var os4 = __toESM(require("os"));
-var path22 = __toESM(require("path"));
+var fs19 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
+var path23 = __toESM(require("path"));
 init_grainHome();
 init_daemonRecordInstance();
 init_AppError();
@@ -255105,8 +255234,8 @@ function unitFor(platform2, launcher, configHome, nodePath) {
     nodePath,
     configHome,
     serviceIdentifier: GRAIN_SERVICE_LABEL,
-    stdoutPath: path22.join(configHome, "grain-daemon.out.log"),
-    stderrPath: path22.join(configHome, "grain-daemon.err.log")
+    stdoutPath: path23.join(configHome, "grain-daemon.out.log"),
+    stderrPath: path23.join(configHome, "grain-daemon.err.log")
   };
   if (platform2 === "darwin") {
     return generateLaunchAgent(descriptor);
@@ -255117,7 +255246,7 @@ function unitFor(platform2, launcher, configHome, nodePath) {
   return generateWindowsStartupTask(descriptor);
 }
 function platformLauncherPath(platform2, configHome) {
-  return platform2 === "win32" ? path22.join(configHome, "grain-daemon-launcher.cmd") : launcherPath(configHome);
+  return platform2 === "win32" ? path23.join(configHome, "grain-daemon-launcher.cmd") : launcherPath(configHome);
 }
 function writeLauncher(fileSystem, platform2, configHome, nodePath) {
   const scriptPath = launcherPath(configHome);
@@ -255219,15 +255348,15 @@ function registerCliPayload(fileSystem, configHome, standalonePath, writeOutput)
     if (!fileSystem.existsSync(standalonePath)) {
       return;
     }
-    const installedEntry = path22.join(configHome, "app", version3, "standalone.js");
-    const manifestPath = path22.join(configHome, "app", version3, "package.json");
+    const installedEntry = path23.join(configHome, "app", version3, "standalone.js");
+    const manifestPath = path23.join(configHome, "app", version3, "package.json");
     const payloadUnchanged = fileSystem.existsSync(installedEntry) && fileSystem.existsSync(manifestPath) && fileSystem.readFileSync(installedEntry).equals(fileSystem.readFileSync(standalonePath));
     if (!payloadUnchanged) {
       installApplicationPayload({ configHome, version: version3, sourceEntry: standalonePath });
     }
-    const versionsDir = path22.join(configHome, "versions");
+    const versionsDir = path23.join(configHome, "versions");
     fileSystem.mkdirSync(versionsDir, { recursive: true });
-    const pointerPath2 = path22.join(versionsDir, `${version3}.json`);
+    const pointerPath2 = path23.join(versionsDir, `${version3}.json`);
     const pointerContents = JSON.stringify({ path: installedEntry, version: version3 });
     if (!fileSystem.existsSync(pointerPath2) || fileSystem.readFileSync(pointerPath2, "utf8") !== pointerContents) {
       writeAtomicPointer(fileSystem, pointerPath2, pointerContents);
@@ -255242,11 +255371,11 @@ async function installCommand(deps = {}) {
     throw new Error(`Grain does not support supervised installation on ${platform2}.`);
   }
   const configHome = deps.configHome ?? resolveGrainHome();
-  const homeDirectory = deps.homeDirectory ?? os4.homedir();
+  const homeDirectory = deps.homeDirectory ?? os5.homedir();
   const uid = deps.uid ?? process.getuid?.() ?? 0;
-  const fileSystem = deps.fileSystem ?? fs18;
+  const fileSystem = deps.fileSystem ?? fs19;
   const runner = deps.commandRunner ?? createCommandRunner();
-  const adapter2 = deps.adapter ?? createSupervisorAdapter(platform2, runner, uid);
+  const adapter2 = deps.adapter ?? createSupervisorAdapter(platform2, runner, uid, configHome);
   const readStatus = deps.readStatus ?? readGrainServiceStatus;
   const wait = deps.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
   const writeOutput = deps.writeOutput ?? ((message) => console.log(message));
@@ -255292,7 +255421,7 @@ async function installCommand(deps = {}) {
   });
   const launcher = platformLauncherPath(platform2, configHome);
   const unit = unitFor(platform2, launcher, configHome, nodePath);
-  const unitPath = path22.join(homeDirectory, unit.destination);
+  const unitPath = path23.join(homeDirectory, unit.destination);
   const healthy = isRunningGrainService(await readStatus());
   const unitExists = fileSystem.existsSync(unitPath);
   const unitChanged = unitExists && String(fileSystem.readFileSync(unitPath, { encoding: unit.encoding })) !== unit.content;
@@ -255304,7 +255433,7 @@ async function installCommand(deps = {}) {
     return 0;
   }
   writeLauncher(fileSystem, platform2, configHome, nodePath);
-  fileSystem.mkdirSync(path22.dirname(unitPath), { recursive: true });
+  fileSystem.mkdirSync(path23.dirname(unitPath), { recursive: true });
   fileSystem.writeFileSync(unitPath, unit.content, { encoding: unit.encoding, mode: 384 });
   if (registered && unitChanged) {
     await adapter2.unregister(GRAIN_SERVICE_LABEL);
@@ -255381,7 +255510,7 @@ async function installCommand(deps = {}) {
     await flushTelemetry(telemetry);
     writeOutput(
       `Fatal error: Grain service did not become reachable at its published endpoint after installation.
-Check the supervisor logs at ${path22.join(configHome, "grain-daemon.out.log")} and ${path22.join(configHome, "grain-daemon.err.log")}`
+Check the supervisor logs at ${path23.join(configHome, "grain-daemon.out.log")} and ${path23.join(configHome, "grain-daemon.err.log")}`
     );
     return 1;
   }
@@ -255391,9 +255520,9 @@ Check the supervisor logs at ${path22.join(configHome, "grain-daemon.out.log")}
 }
 
 // src/server/install/uninstallCommand.ts
-var fs20 = __toESM(require("fs"));
-var os5 = __toESM(require("os"));
-var path25 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var os6 = __toESM(require("os"));
+var path26 = __toESM(require("path"));
 var import_readline = require("readline");
 init_grainHome();
 init_applicationPayload();
@@ -255416,7 +255545,7 @@ function reportKept(fileSystem, configHome, writeOutput) {
       return;
     }
     lines = fileSystem.readdirSync(configHome).sort().map((name) => {
-      const isDirectory = fileSystem.lstatSync(path25.join(configHome, name)).isDirectory();
+      const isDirectory = fileSystem.lstatSync(path26.join(configHome, name)).isDirectory();
       return `  - ${name}${isDirectory ? "/" : ""}`;
     });
   } catch {
@@ -255465,16 +255594,16 @@ async function uninstallCommand(deps = {}) {
     throw new Error(`Grain does not support supervised installation on ${platform2}.`);
   }
   const configHome = deps.configHome ?? resolveGrainHome();
-  const homeDirectory = deps.homeDirectory ?? os5.homedir();
+  const homeDirectory = deps.homeDirectory ?? os6.homedir();
   const uid = deps.uid ?? process.getuid?.() ?? 0;
   const nodePath = deps.nodePath ?? "";
-  const fileSystem = deps.fileSystem ?? fs20;
+  const fileSystem = deps.fileSystem ?? fs21;
   const runner = deps.commandRunner ?? createCommandRunner();
-  const adapter2 = deps.adapter ?? createSupervisorAdapter(platform2, runner, uid);
+  const adapter2 = deps.adapter ?? createSupervisorAdapter(platform2, runner, uid, configHome);
   const writeOutput = deps.writeOutput ?? ((message) => console.log(message));
   if (deps.purge) {
-    const resolvedHome = path25.resolve(configHome);
-    if (resolvedHome === path25.resolve(homeDirectory) || resolvedHome === path25.parse(resolvedHome).root) {
+    const resolvedHome = path26.resolve(configHome);
+    if (resolvedHome === path26.resolve(homeDirectory) || resolvedHome === path26.parse(resolvedHome).root) {
       writeOutput(`Refusing to purge ${configHome}: it is a home directory or filesystem root.`);
       return 1;
     }
@@ -255493,13 +255622,13 @@ async function uninstallCommand(deps = {}) {
   }
   const launcher = platformLauncherPath(platform2, configHome);
   const unit = unitFor(platform2, launcher, configHome, nodePath);
-  const grainCommand = path25.join(configHome, "bin", platform2 === "win32" ? "grain.cmd" : "grain");
+  const grainCommand = path26.join(configHome, "bin", platform2 === "win32" ? "grain.cmd" : "grain");
   const ownedPaths = [
     grainCommand,
     launcherPath(configHome),
     launcher,
     applicationDir(configHome, ""),
-    path25.join(configHome, "runtime", "node")
+    path26.join(configHome, "runtime", "node")
   ];
   const registered = await adapter2.isRegistered(GRAIN_SERVICE_LABEL);
   if (registered) {
@@ -255532,16 +255661,16 @@ async function uninstallCommand(deps = {}) {
     return 0;
   }
   const retainedVersions = retainedApplicationVersions(configHome);
-  removeIfExists(fileSystem, path25.join(homeDirectory, unit.destination));
+  removeIfExists(fileSystem, path26.join(homeDirectory, unit.destination));
   removeIfExists(fileSystem, launcherPath(configHome));
   removeIfExists(fileSystem, grainCommand);
   if (platform2 === "win32") {
     removeIfExists(fileSystem, launcher);
-    removeIfExists(fileSystem, path25.join(configHome, "bin", "grain.ps1"));
+    removeIfExists(fileSystem, path26.join(configHome, "bin", "grain.ps1"));
   }
   removeDirectoryIfExists(fileSystem, applicationDir(configHome, ""));
-  removeDirectoryIfExists(fileSystem, path25.join(configHome, "versions"));
-  removeDirectoryIfExists(fileSystem, path25.join(configHome, "runtime", "node"));
+  removeDirectoryIfExists(fileSystem, path26.join(configHome, "versions"));
+  removeDirectoryIfExists(fileSystem, path26.join(configHome, "runtime", "node"));
   const filesToRemove = [
     "endpoint.json",
     "grain-daemon.out.log",
@@ -255549,14 +255678,14 @@ async function uninstallCommand(deps = {}) {
     "service-mode.json"
   ];
   for (const file4 of filesToRemove) {
-    removeIfExists(fileSystem, path25.join(configHome, file4));
+    removeIfExists(fileSystem, path26.join(configHome, file4));
   }
   try {
     if (fileSystem.existsSync(configHome)) {
       const allFiles = fileSystem.readdirSync(configHome);
       for (const file4 of allFiles) {
         if (/^server-\d+\.pid$/.test(file4)) {
-          removeIfExists(fileSystem, path25.join(configHome, file4));
+          removeIfExists(fileSystem, path26.join(configHome, file4));
         }
       }
     }
@@ -255564,7 +255693,7 @@ async function uninstallCommand(deps = {}) {
   }
   const dirsToRemoveIfEmpty = ["bin", "runtime"];
   for (const dirName of dirsToRemoveIfEmpty) {
-    const dirPath = path25.join(configHome, dirName);
+    const dirPath = path26.join(configHome, dirName);
     try {
       if (fileSystem.existsSync(dirPath)) {
         const contents = fileSystem.readdirSync(dirPath);
@@ -255590,7 +255719,7 @@ async function uninstallCommand(deps = {}) {
 }
 
 // src/server/cli/clientsCommand.ts
-var import_crypto4 = __toESM(require("crypto"));
+var import_crypto5 = __toESM(require("crypto"));
 init_grainHome();
 init_toolProfiles();
 init_ClientRegistry();
@@ -255659,7 +255788,7 @@ async function clientsCommand(args, configDir = resolveGrainHome()) {
       return 1;
     }
     if (!id) {
-      id = import_crypto4.default.randomBytes(8).toString("hex");
+      id = import_crypto5.default.randomBytes(8).toString("hex");
     }
     const registration = {
       id,
@@ -255817,7 +255946,7 @@ async function openCommand(configDir = resolveGrainHome(), runner = createComman
 init_daemonVersion();
 
 // src/server/cli/toolCommands.ts
-var fs24 = __toESM(require("fs"));
+var fs25 = __toESM(require("fs"));
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
 init_protocol();
@@ -256777,7 +256906,7 @@ ${dataCommandHelp()}
     parsed = parseCommand(
       command,
       words,
-      deps.readFile ?? ((file4) => fs24.readFileSync(file4 === "-" ? 0 : file4, "utf8"))
+      deps.readFile ?? ((file4) => fs25.readFileSync(file4 === "-" ? 0 : file4, "utf8"))
     );
   } catch (error52) {
     stderr(`${error52.message}