klyro 1.0.5 → 1.0.7

package/dist/mcp/auth.js

@@ -0,0 +1,249 @@
+/**
+ * B2 — MCP OAuth/PKCE auth surface (remote MCP reach parity).
+ *
+ * Token-backed OAuth 2.0 Authorization Code flow with PKCE (RFC 7636) for
+ * remote MCP servers (Risk #7 / #3 residual: "OAuth absent"). Access tokens
+ * are cached at `~/.klyro/mcp-tokens.json` (mode 0600) and keyed by the
+ * server's URL + clientId, so a cached credential survives restarts and is
+ * reused (with lazy refresh) instead of re-prompting every run.
+ *
+ * The auth code flow runs against a short-lived loopback listener on
+ * 127.0.0.1 (RFC 8252 native-app redirect). In a headless context the flow
+ * prints the authorization URL and the user completes it by opening the
+ * link; the code is captured on the loopback redirect. Every function is
+ * fail-safe: network/server failures never throw raw into the MCP tool path
+ * — they surface a typed `AuthError`.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as http from 'node:http';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export class AuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthError';
+    }
+}
+export const TOKEN_STALE_MARGIN_S = 60;
+export const TOKENS_FILE = 'mcp-tokens.json';
+function tokensPath() {
+    const base = process.env.KLYRO_CONFIG_DIR ?? path.join(os.homedir() || process.cwd(), '.klyro');
+    return path.join(base, TOKENS_FILE);
+}
+/** Fully load the token cache as a plain object (missing/corrupt → {}). */
+export function loadMcpTokens() {
+    try {
+        const raw = fs.readFileSync(tokensPath(), 'utf-8');
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Persist a token to the 0600 cache. Merges by key so concurrent server
+ * writes don't clobber each other. A symlinked cache path is refused (the
+ * write would land outside the klyro config dir or be swapped mid-write).
+ */
+export function saveMcpToken(cacheKey, token) {
+    const p = tokensPath();
+    try {
+        if (fs.lstatSync(p).isSymbolicLink()) {
+            throw new AuthError(`refusing to write token cache through symlink: ${p}`);
+        }
+    }
+    catch (e) {
+        if (e instanceof AuthError)
+            throw e;
+        /* ENOENT — first write, fine */
+    }
+    const dir = path.dirname(p);
+    fs.mkdirSync(dir, { recursive: true });
+    const all = loadMcpTokens();
+    all[cacheKey] = token;
+    const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
+    fs.renameSync(tmp, p);
+}
+/** Stable cache key for a server URL + clientId. */
+export function mcpTokenCacheKey(url, clientId) {
+    return `${url}|${clientId}`;
+}
+/** True when a cached token is still usable (with a clock-skew margin). */
+export function tokenValid(t) {
+    if (!t || typeof t.access_token !== 'string' || !t.access_token)
+        return false;
+    // expires_at 0 = unknown lifetime — assume still valid.
+    return t.expires_at === 0 || t.expires_at > Date.now() / 1000 + TOKEN_STALE_MARGIN_S;
+}
+/** PKCE (RFC 7636 §4.1): cryptographically-random 43-128 char code verifier. */
+export function generateCodeVerifier() {
+    return crypto.randomBytes(64).toString('base64url'); // ~86 chars, within §4.1 range
+}
+/** PKCE §4.2: base64url SHA-256 challenge of the verifier. */
+export function codeChallengeFromVerifier(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Resolve auth headers for a server: reuse a valid cached token, else run
+ * the interactive Authorization Code + PKCE flow. Returns only the headers;
+ * failures surface as `AuthError` so callers (the MCP probe/connect path)
+ * can turn them into a clear error instead of a hang.
+ */
+export async function resolveAuth(auth, cacheKey) {
+    const cached = loadMcpTokens()[cacheKey];
+    if (cached && tokenValid(cached)) {
+        return { headers: { Authorization: `${cached.token_type || 'Bearer'} ${cached.access_token}` }, fromCache: true };
+    }
+    // No usable token — run the code flow.
+    const token = await runCodeFlow(auth);
+    if (!token)
+        throw new AuthError(`OAuth flow for "${auth.clientId}" returned no token`);
+    const expiryUnix = token.expires_in ? Math.floor(Date.now() / 1000 + token.expires_in) : 0;
+    const saved = {
+        access_token: token.access_token,
+        token_type: token.token_type ?? 'Bearer',
+        expires_at: expiryUnix,
+        refresh_token: token.refresh_token,
+        scope: token.scope,
+        cachedAtMs: Date.now(),
+    };
+    saveMcpToken(cacheKey, saved);
+    return { headers: { Authorization: `${saved.token_type} ${saved.access_token}` }, fromCache: false };
+}
+function resolveIssuer(auth, serverUrl) {
+    let issuer;
+    try {
+        issuer = new URL(auth.authorizationEndpoint ?? serverUrl);
+    }
+    catch {
+        throw new AuthError(`invalid OAuth issuer URL for "${auth.clientId}"`);
+    }
+    return issuer;
+}
+/**
+ * Run the Authorization Code flow with PKCE over a one-shot loopback
+ * redirect (RFC 8252). Best-effort and headless-friendly: on any failure it
+ * throws `AuthError` rather than leaving a stray listener. The token endpoint
+ * defaults to the OAuth metadata `token_endpoint` when the server advertises
+ * it, else the spec's `tokenEndpoint`.
+ */
+export async function runCodeFlow(auth, serverUrl) {
+    const issuer = resolveIssuer(auth, serverUrl ?? '');
+    const verifier = generateCodeVerifier();
+    const challenge = codeChallengeFromVerifier(verifier);
+    const listener = http.createServer();
+    const port = await new Promise((resolve, reject) => {
+        listener.once('error', reject);
+        listener.listen(0, '127.0.0.1', () => {
+            const addr = listener.address();
+            if (addr && typeof addr === 'object')
+                resolve(addr.port);
+            else
+                reject(new AuthError('could not bind loopback listener'));
+        });
+    });
+    let code = null;
+    const pending = new Promise((resolve, reject) => {
+        listener.on('request', (req, res) => {
+            const u = new URL(req.url ?? '/', 'http://127.0.0.1');
+            code = u.searchParams.get('code');
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end('You can close this tab and return to the terminal.');
+            if (code)
+                resolve(code);
+            else
+                reject(new AuthError('authorization redirect carried no code'));
+        });
+    });
+    try {
+        const redirectUri = auth.redirectUri ?? `http://127.0.0.1:${port}/callback`;
+        const authorizeUrl = buildAuthorizeUrl(auth, issuer, challenge, redirectUri);
+        process.stdout.write(`\nOpen this URL in your browser to authorize klyro for MCP server "${auth.clientId}":\n${authorizeUrl}\n`);
+        code = await pending;
+        return await exchangeCode(auth, issuer, code, verifier, redirectUri);
+    }
+    finally {
+        listener.close();
+    }
+}
+function buildAuthorizeUrl(auth, issuer, challenge, redirectUri) {
+    const u = new URL(auth.authorizationEndpoint || issuer.origin, issuer);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('client_id', auth.clientId);
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('code_challenge', challenge);
+    u.searchParams.set('code_challenge_method', 'S256');
+    u.searchParams.set('state', crypto.randomBytes(8).toString('base64url'));
+    if (auth.scopes)
+        u.searchParams.set('scope', auth.scopes);
+    return u.toString();
+}
+async function exchangeCode(auth, issuer, code, verifier, redirectUri) {
+    const tokenEndpoint = auth.tokenEndpoint || `${issuer.origin}/token`;
+    const res = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: auth.clientId,
+            code_verifier: verifier,
+        }),
+    });
+    if (!res.ok)
+        throw new AuthError(`token exchange failed: HTTP ${res.status}`);
+    const data = (await res.json());
+    if (!data.access_token)
+        throw new AuthError('token exchange returned no access_token');
+    return data;
+}
+/**
+ * Scrub credential-bearing headers from debug capture so `KLYRO_MCP_DEBUG`
+ * never writes a live access token to disk. Non-credential headers pass
+ * through untouched.
+ */
+export function scrubAuthHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() === 'authorization' || k.toLowerCase() === 'cookie' || k.toLowerCase() === 'x-api-key') {
+            out[k] = '[REDACTED]';
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+/** Refreshes a stale token when a refresh_token is cached (best-effort). */
+export async function tryRefresh(auth, cached) {
+    if (!cached.refresh_token || !auth.tokenEndpoint)
+        return null;
+    const res = await fetch(auth.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: cached.refresh_token,
+            client_id: auth.clientId,
+        }),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    if (!data.access_token)
+        return null;
+    return {
+        access_token: data.access_token,
+        token_type: data.token_type ?? cached.token_type,
+        expires_at: data.expires_in ? Math.floor(Date.now() / 1000 + data.expires_in) : cached.expires_at,
+        refresh_token: data.refresh_token ?? cached.refresh_token,
+        scope: data.scope ?? cached.scope,
+        cachedAtMs: Date.now(),
+    };
+}

package/dist/mcp/client.d.ts

@@ -9,6 +9,15 @@ export interface McpResource {
     name?: string;
     mimeType?: string;
 }
+export interface McpPromptDef {
+    name: string;
+    description?: string;
+    arguments?: Array<{
+        name: string;
+        description?: string;
+        required?: boolean;
+    }>;
+}
 export interface McpCallResult {
     /** Normalized text payload (content blocks joined). */
     text: string;
@@ -19,6 +28,8 @@ export interface McpClientLike {
     listTools(signal?: AbortSignal): Promise<McpToolDef[]>;
     callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;
     listResources(signal?: AbortSignal): Promise<McpResource[]>;
+    promptsList?(signal?: AbortSignal): Promise<McpPromptDef[]>;
+    promptsGet?(name: string, args?: Record<string, string>, signal?: AbortSignal): Promise<string>;
     close(): Promise<void>;
 }
 export declare class McpError extends Error {
@@ -43,6 +54,10 @@ export declare class McpClient implements McpClientLike {
     callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;
     listResources(signal?: AbortSignal): Promise<McpResource[]>;
     readResource(uri: string, signal?: AbortSignal): Promise<string>;
+    /** List prompts; servers without prompts support yield [] (not an error). */
+    promptsList(signal?: AbortSignal): Promise<McpPromptDef[]>;
+    /** Get a prompt's messages as text. Throws McpError when unsupported/unknown. */
+    promptsGet(name: string, args?: Record<string, string>, signal?: AbortSignal): Promise<string>;
     close(): Promise<void>;
     /** Test hook: number of in-flight JSON-RPC requests. */
     pendingCount(): number;

package/dist/mcp/client.js

@@ -2,7 +2,8 @@
  * P1 — MCP stdio client (r-11-17.md §3.1).
  *
  * Minimal JSON-RPC 2.0 over newline-delimited stdio: `initialize`,
- * `tools/list`, `tools/call`, `resources/list`, `resources/read`, `ping`.
+ * `tools/list`, `tools/call`, `resources/list`, `resources/read`,
+ * `prompts/list`, `prompts/get`, `ping`.
  * Every call is bound to an `AbortSignal` and a per-call timeout; spawn
  * failures and server errors surface as typed `McpError`s — never throws
  * raw across the boundary.
@@ -38,15 +39,22 @@ export class McpClient {
     constructor(name, spec) {
         this.name = name;
         this.spec = spec;
+        // URL specs route to RemoteMcpClient via makeMcpClient — direct
+        // construction without a command is a programming error, fail fast.
+        if (!spec.command)
+            throw new McpError(`mcp server "${name}" has no command (use url for remote servers)`, 'INVALID_SPEC');
     }
     async connect() {
         if (this.child)
             return;
+        const command = this.spec.command;
+        if (!command)
+            throw new McpError(`mcp server "${this.name}" has no command (use url for remote servers)`, 'INVALID_SPEC');
         const timeoutMs = this.spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         await new Promise((resolve, reject) => {
             let child;
             try {
-                child = spawn(this.spec.command, this.spec.args ?? [], {
+                child = spawn(command, this.spec.args ?? [], {
                     stdio: ['pipe', 'pipe', 'pipe'],
                     env: { ...process.env, ...(this.spec.env ?? {}) },
                     shell: false,
@@ -136,6 +144,38 @@ export class McpClient {
         const contents = Array.isArray(res.contents) ? res.contents : [];
         return contents.map((c) => (typeof c.text === 'string' ? c.text : JSON.stringify(c))).join('\n');
     }
+    /** List prompts; servers without prompts support yield [] (not an error). */
+    async promptsList(signal) {
+        this.assertLive();
+        let res;
+        try {
+            res = (await this.request('prompts/list', {}, this.timeout(), signal));
+        }
+        catch (err) {
+            if (err instanceof McpError && err.code === 'SERVER_ERROR' && err.details?.code === -32601) {
+                return [];
+            }
+            throw err;
+        }
+        return Array.isArray(res.prompts) ? res.prompts : [];
+    }
+    /** Get a prompt's messages as text. Throws McpError when unsupported/unknown. */
+    async promptsGet(name, args, signal) {
+        this.assertLive();
+        const res = (await this.request('prompts/get', { name, arguments: args ?? {} }, this.timeout(), signal));
+        const messages = Array.isArray(res.messages) ? res.messages : [];
+        const parts = [];
+        if (typeof res.description === 'string' && res.description)
+            parts.push(res.description);
+        for (const m of messages) {
+            const c = m.content;
+            if (c && typeof c.text === 'string')
+                parts.push(c.text);
+            else if (c !== undefined)
+                parts.push(JSON.stringify(c));
+        }
+        return parts.join('\n\n');
+    }
     async close() {
         // Idempotent vs the exit handler: closed is set FIRST (the on('exit')
         // callback checks it before failAll), and a second close() with no child

package/dist/mcp/config.d.ts

@@ -1,15 +1,45 @@
 import { z } from 'zod';
+/** MCP remote URL guard — https:// (or loopback http://) only. */
+export declare function assertSafeMcpUrl(url: string): void;
+/** True when the plain-HTTP MCP opt-in is set (env or persisted equivalent). */
+export declare function insecureMcpAllowed(): boolean;
 export declare const McpServerPolicySchema: z.ZodObject<{
     allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     denyTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     requireApproval: z.ZodOptional<z.ZodBoolean>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+/**
+ * B2 — optional OAuth/PKCE auth surface for remote (`url`) transports.
+ * Present ⇒ the probe/connect path resolves a bearer token and attaches
+ * `Authorization`; the debug capture scrubs it (see `scrubAuthHeaders`).
+ */
+export declare const McpServerAuthSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    tokenEndpoint: z.ZodOptional<z.ZodString>;
+    authorizationEndpoint: z.ZodOptional<z.ZodString>;
+    redirectUri: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type McpServerAuth = z.infer<typeof McpServerAuthSchema>;
 export type McpServerPolicy = z.infer<typeof McpServerPolicySchema>;
 export declare const McpServerSpecSchema: z.ZodObject<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    url: z.ZodOptional<z.ZodString>;
+    transport: z.ZodOptional<z.ZodEnum<{
+        streamable: "streamable";
+        sse: "sse";
+    }>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodString;
+        tokenEndpoint: z.ZodOptional<z.ZodString>;
+        authorizationEndpoint: z.ZodOptional<z.ZodString>;
+        redirectUri: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     disabled: z.ZodOptional<z.ZodBoolean>;
     policy: z.ZodOptional<z.ZodObject<{
         allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/mcp/config.js

@@ -12,18 +12,95 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { z } from 'zod';
+/** MCP remote URL guard — https:// (or loopback http://) only. */
+export function assertSafeMcpUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`invalid MCP server url: ${url}`);
+    }
+    if (parsed.protocol === 'https:')
+        return;
+    if (parsed.protocol === 'http:') {
+        const h = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        if (h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.'))
+            return;
+        throw new Error(`insecure MCP server url (plain HTTP) for host ${parsed.hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1`);
+    }
+    throw new Error(`unsupported MCP server url protocol: ${parsed.protocol}`);
+}
+/** True when the plain-HTTP MCP opt-in is set (env or persisted equivalent). */
+export function insecureMcpAllowed() {
+    return process.env.KLYRO_ALLOW_INSECURE_MCP === '1';
+}
 export const McpServerPolicySchema = z.object({
     allowTools: z.array(z.string()).optional(),
     denyTools: z.array(z.string()).optional(),
     requireApproval: z.boolean().optional(),
     timeoutMs: z.number().int().positive().optional(),
 });
+/**
+ * B2 — optional OAuth/PKCE auth surface for remote (`url`) transports.
+ * Present ⇒ the probe/connect path resolves a bearer token and attaches
+ * `Authorization`; the debug capture scrubs it (see `scrubAuthHeaders`).
+ */
+export const McpServerAuthSchema = z.object({
+    /** OAuth 2.0 client id registered with the authorization server. */
+    clientId: z.string().min(1),
+    /** Token endpoint; when absent, derived from the authorization issuer. */
+    tokenEndpoint: z.string().url().optional(),
+    /** Authorization endpoint / metadata issuer; defaults to the server URL. */
+    authorizationEndpoint: z.string().url().optional(),
+    /** Custom redirect URI; defaults to a loopback listener on 127.0.0.1. */
+    redirectUri: z.string().url().optional(),
+    /** Space-separated additional scopes. */
+    scopes: z.string().optional(),
+});
 export const McpServerSpecSchema = z.object({
-    command: z.string().min(1),
+    /** stdio transport: command to spawn. Required unless `url` is set. */
+    command: z.string().min(1).optional(),
     args: z.array(z.string()).optional(),
     env: z.record(z.string(), z.string()).optional(),
+    /** Remote transport: Streamable-HTTP JSON-RPC endpoint. Required unless `command` is set. */
+    url: z.string().url().optional(),
+    /**
+     * Remote transport flavor: `streamable` (default, POST per message) or
+     * `sse` (legacy HTTP+SSE: persistent GET event stream + message POST).
+     */
+    transport: z.enum(['streamable', 'sse']).optional(),
+    /** Extra HTTP headers for remote transport (`${env:VAR}` expanded). */
+    headers: z.record(z.string(), z.string()).optional(),
+    /** B2 — optional OAuth/PKCE auth surface; only valid on remote transports. */
+    auth: McpServerAuthSchema.optional(),
     disabled: z.boolean().optional(),
     policy: McpServerPolicySchema.optional(),
+}).superRefine((s, ctx) => {
+    if (s.auth && !s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server "auth" requires a remote "url" transport (stdio has no OAuth surface)' });
+    }
+    if (!s.command && !s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server needs either "command" (stdio) or "url" (remote HTTP)' });
+    }
+    if (s.command && s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server takes either "command" or "url", not both' });
+    }
+    if (s.url && !s.command) {
+        const u = s.url;
+        let parsed = null;
+        try {
+            parsed = new URL(u);
+        }
+        catch { /* invalid URL caught by z.string().url() */ }
+        if (parsed && parsed.protocol === 'http:') {
+            const h = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+            const loopback = h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.');
+            if (!loopback && process.env.KLYRO_ALLOW_INSECURE_MCP !== '1') {
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `insecure MCP server url (plain HTTP) for host ${parsed.hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1` });
+            }
+        }
+    }
 });
 /** Upper bound for per-server timeouts — larger values are clamped, not rejected. */
 export const MAX_MCP_TIMEOUT_MS = 600_000;
@@ -82,6 +159,12 @@ export function loadMcpServers(cwd) {
                     env[k] = expandEnv(v);
                 spec.env = env;
             }
+            if (spec.headers) {
+                const headers = {};
+                for (const [k, v] of Object.entries(spec.headers))
+                    headers[k] = expandEnv(v);
+                spec.headers = headers;
+            }
             servers[name] = spec;
             sources[name] = label;
         }

package/dist/mcp/registry.d.ts

@@ -30,6 +30,12 @@ export declare const MCP_SUCCESS_MAX_CHARS = 12000;
  * behind a plausible-looking name.
  */
 export declare function sanitizeMcpName(server: string, tool: string): string;
+/**
+ * Construct the right client for a spec: remote HTTP when `url` is set
+ * (`transport: 'sse'` selects the legacy event-stream flavor, default is
+ * Streamable HTTP), else stdio. Used by registration, probe, and prompts.
+ */
+export declare function makeMcpClient(name: string, spec: McpServerSpec): McpClientLike;
 export declare function registerMcpServers(cfg: {
     servers: Record<string, McpServerSpec>;
 }, opts: RegisterMcpOpts): Promise<McpRegisterResult>;
@@ -52,3 +58,16 @@ export declare function loadAndRegisterMcp(opts: {
         source: 'global' | 'project';
     }) => Promise<boolean>;
 }): Promise<McpRegisterResult>;
+/**
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh
+ * connection per invocation (no client lifecycle to manage), redacted
+ * output. Project servers need trust-store approval (see `klyro mcp
+ * trust`) — typing the prompt name is intent, not approval. Throws
+ * McpError / Error on unknown server, disabled server, or prompt failure.
+ */
+export declare function runMcpPrompt(cwd: string, server: string, prompt: string, tokens: string[], opts?: {
+    trust?: {
+        isTrusted: (name: string, hash: string) => boolean;
+    };
+    clientFactory?: (name: string, spec: McpServerSpec) => McpClientLike;
+}): Promise<string>;