machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/shared/foreground-timeout.mjs

@@ -0,0 +1,70 @@
+import relayContract from "./relay-contract.json" with { type: "json" };
+
+const CONFIGURABLE_FOREGROUND_TOOLS = new Set([
+  "exec_command", "run_process", "run_local_command", "open_local_application",
+  "inspect_local_application", "operate_local_application", "browser_list_tabs",
+  "browser_manage_tabs", "browser_wait", "browser_get_source", "browser_inspect_page",
+  "browser_action", "browser_fill_form", "browser_screenshot", "browser_upload_files",
+  "computer_observe", "computer_act",
+]);
+
+const REMOTE_DURABLE_PROCESS_TOOLS = new Set([
+  "exec_command", "run_process", "run_local_command",
+]);
+
+const REMOTE_FOREGROUND_DEFAULT_SECONDS_BY_TOOL = new Map([
+  ["computer_observe", 30],
+  ["computer_act", 30],
+]);
+
+export const REMOTE_FOREGROUND_TIMEOUT_SECONDS = Math.floor(
+  relayContract.maximumInteractiveExecutionTimeoutMs / 1000,
+);
+
+export const REMOTE_DURABLE_PROCESS_MAXIMUM_TIMEOUT_SECONDS = Math.floor(
+  relayContract.maximumDurableProcessExecutionTimeoutMs / 1000,
+);
+export const REMOTE_DURABLE_PROCESS_DEFAULT_TIMEOUT_SECONDS = REMOTE_DURABLE_PROCESS_MAXIMUM_TIMEOUT_SECONDS;
+
+export function isRemoteDurableProcessTool(name) {
+  return REMOTE_DURABLE_PROCESS_TOOLS.has(name);
+}
+
+export function remoteDurableProcessTimeoutSeconds(value) {
+  const parsed = value === undefined ? REMOTE_DURABLE_PROCESS_DEFAULT_TIMEOUT_SECONDS : value;
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > REMOTE_DURABLE_PROCESS_MAXIMUM_TIMEOUT_SECONDS) {
+    throw new RangeError(`durable process timeout must be an integer from 1 to ${REMOTE_DURABLE_PROCESS_MAXIMUM_TIMEOUT_SECONDS}`);
+  }
+  return parsed;
+}
+
+export function isConfigurableForegroundTool(name) {
+  return CONFIGURABLE_FOREGROUND_TOOLS.has(name);
+}
+
+export function remoteForegroundDefaultSeconds(name) {
+  if (CONFIGURABLE_FOREGROUND_TOOLS.has(name)) {
+    return REMOTE_FOREGROUND_DEFAULT_SECONDS_BY_TOOL.get(name) ?? 20;
+  }
+  return Math.min(60, remoteForegroundMaximumSeconds(name));
+}
+
+export function remoteForegroundMaximumSeconds(_name) {
+  return REMOTE_FOREGROUND_TIMEOUT_SECONDS;
+}
+
+export function effectiveForegroundTimeoutSeconds({
+  tool,
+  value,
+  remote,
+  localDefault,
+  localMaximum,
+}) {
+  const fallback = remote ? remoteForegroundDefaultSeconds(tool) : localDefault;
+  const maximum = remote ? remoteForegroundMaximumSeconds(tool) : localMaximum;
+  const parsed = value === undefined ? fallback : Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > maximum) {
+    throw new RangeError(`foreground timeout must be an integer from 1 to ${maximum}`);
+  }
+  return parsed;
+}

package/src/shared/log-redaction.d.mts

@@ -0,0 +1,9 @@
+export type PortableLogSanitizationOptions = {
+  maxChars: number;
+  homePaths?: string[];
+};
+
+export function sanitizePortableLogText(
+  value: unknown,
+  options: PortableLogSanitizationOptions,
+): string;

package/src/shared/log-redaction.mjs

@@ -0,0 +1,51 @@
+const SECRET_VALUE = /\b(?:account_admin|account_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
+const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
+const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
+const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g;
+const GITLAB_TOKEN = /\bglpat-[A-Za-z0-9_-]{20,}\b/g;
+const NPM_TOKEN = /\bnpm_[A-Za-z0-9]{30,}\b/g;
+const SLACK_TOKEN = /\bxox[aboprs]-[A-Za-z0-9-]{10,}\b/g;
+const GOOGLE_API_KEY = /\bAIza[A-Za-z0-9_-]{30,}\b/g;
+const PAYMENT_API_KEY = /\b(?:sk|rk|pk)_live_[A-Za-z0-9]{16,}\b/g;
+const JWT_VALUE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+const URL_CREDENTIALS = /https?:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@[^\s/"'<>]+/gi;
+const API_SECRET = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g;
+const PRIVATE_KEY_HEADER = /-----BEGIN\s+(?:(?:OPENSSH|RSA|EC|DSA)\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/g;
+
+export function sanitizePortableLogText(value, options = {}) {
+  let raw;
+  try { raw = String(value ?? ""); } catch { raw = "<unprintable>"; }
+  let sanitized = raw
+    .replace(SECRET_VALUE, "<redacted-secret>")
+    .replace(BEARER_VALUE, "Bearer <redacted>")
+    .replace(AWS_ACCESS_KEY, "<redacted-cloud-key>")
+    .replace(GITHUB_TOKEN, "<redacted-access-token>")
+    .replace(GITLAB_TOKEN, "<redacted-access-token>")
+    .replace(NPM_TOKEN, "<redacted-access-token>")
+    .replace(SLACK_TOKEN, "<redacted-access-token>")
+    .replace(GOOGLE_API_KEY, "<redacted-cloud-key>")
+    .replace(PAYMENT_API_KEY, "<redacted-api-secret>")
+    .replace(JWT_VALUE, "<redacted-bearer-token>")
+    .replace(URL_CREDENTIALS, "<redacted-credential-url>")
+    .replace(API_SECRET, "<redacted-api-secret>")
+    .replace(PRIVATE_KEY_HEADER, "<redacted-private-key-header>")
+    .replace(EMAIL_VALUE, "<redacted-email>");
+
+  const homePaths = Array.isArray(options.homePaths) ? options.homePaths : [];
+  for (const home of [...new Set(homePaths.filter(item => typeof item === "string" && item.length > 1))]
+    .sort((left, right) => right.length - left.length)) {
+    sanitized = sanitized.split(home).join("<home>");
+  }
+  sanitized = sanitized
+    .replace(/\/(?:Users|home)\/[^/\s"'<>]+(?=\/|$)/g, "<home>")
+    .replace(/\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?=\\|$)/g, "<home>")
+    .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
+    .replace(/[\r\n\t]/g, match => match === "\t" ? "\\t" : "\\n")
+    .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "?");
+
+  const numericLimit = Number(options.maxChars);
+  if (!Number.isFinite(numericLimit) || numericLimit <= 0) return "";
+  const limit = Math.max(16, numericLimit);
+  return sanitized.length > limit ? `${sanitized.slice(0, limit - 1)}…` : sanitized;
+}

package/src/shared/mcp-protocol.d.mts

@@ -0,0 +1,27 @@
+export const MCP_PROTOCOL_VERSION: "2026-07-28";
+export const MCP_PROTOCOL_VERSIONS: readonly string[];
+export const MCP_HEADER_MISMATCH: -32020;
+export const MCP_UNSUPPORTED_PROTOCOL_VERSION: -32022;
+export const MCP_REMOVED_PROTOCOL_MESSAGE: "MCP session protocol was removed; upgrade the client and use request-scoped metadata/server/discover";
+export class McpProtocolError extends Error {
+  code: number;
+  data?: unknown;
+  constructor(code: number, message: string, data?: unknown);
+}
+export function asMcpObject(value: unknown): Record<string, unknown>;
+export function requestProtocolVersion(value: unknown): string;
+export function assertBoundedMcpJsonStructure(value: unknown, label?: string): void;
+export function validateRequestMetadata(value: unknown, supportedVersions?: readonly string[]): {
+  version: string;
+  clientCapabilities: Record<string, unknown>;
+  clientInfo: Record<string, unknown> | null;
+  progressToken: unknown;
+  logLevel: unknown;
+};
+export function serverImplementation(input: { name: unknown; version: unknown; title?: unknown; description?: unknown }): Record<string, unknown>;
+export function completeResult(fields?: Record<string, unknown>, serverInfo?: Record<string, unknown>): Record<string, unknown>;
+export function cacheableResult(fields: Record<string, unknown>, options: { ttlMs: number; cacheScope: "public" | "private"; serverInfo?: Record<string, unknown> }): Record<string, unknown>;
+export function discoverResult(input: { supportedVersions: readonly string[]; capabilities: Record<string, unknown>; instructions?: string; ttlMs?: number; serverInfo?: Record<string, unknown> }): Record<string, unknown>;
+export function validateSubscriptionRequest(value: unknown): void;
+export function emptySubscriptionAcknowledgement(requestId: string | number): Record<string, unknown>;
+export function subscriptionCompleteResult(requestId: string | number, serverInfo?: Record<string, unknown>): Record<string, unknown>;

package/src/shared/mcp-protocol.mjs

@@ -0,0 +1,275 @@
+export const MCP_PROTOCOL_VERSION = "2026-07-28";
+export const MCP_PROTOCOL_VERSIONS = Object.freeze([MCP_PROTOCOL_VERSION]);
+export const MCP_HEADER_MISMATCH = -32020;
+export const MCP_UNSUPPORTED_PROTOCOL_VERSION = -32022;
+export const MCP_REMOVED_PROTOCOL_MESSAGE = "MCP session protocol was removed; upgrade the client and use request-scoped metadata/server/discover";
+const MCP_RESULT_COMPLETE = "complete";
+
+const PROTOCOL_VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
+const CLIENT_INFO_KEY = "io.modelcontextprotocol/clientInfo";
+const CLIENT_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+const SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
+const SUBSCRIPTION_ID_KEY = "io.modelcontextprotocol/subscriptionId";
+const LOG_LEVELS = new Set(["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"]);
+const META_KEY = /^(?:(?:[A-Za-z](?:[A-Za-z0-9-]*[A-Za-z0-9])?\.)*[A-Za-z](?:[A-Za-z0-9-]*[A-Za-z0-9])?\/)?(?:[A-Za-z0-9](?:[A-Za-z0-9_.-]*[A-Za-z0-9])?)?$/;
+const MAX_MCP_JSON_DEPTH = 32;
+const MAX_MCP_JSON_NODES = 4096;
+const MAX_MCP_JSON_KEY_LENGTH = 256;
+const MAX_RESOURCE_SUBSCRIPTIONS = 128;
+const MAX_RESOURCE_SUBSCRIPTION_URI_LENGTH = 4096;
+
+export class McpProtocolError extends Error {
+  constructor(code, message, data) {
+    super(message);
+    this.name = "McpProtocolError";
+    this.code = code;
+    this.data = data;
+  }
+}
+
+export function asMcpObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function requestMeta(value) {
+  return asMcpObject(asMcpObject(value).params)._meta;
+}
+
+export function requestProtocolVersion(value) {
+  const version = asMcpObject(requestMeta(value))[PROTOCOL_VERSION_KEY];
+  return typeof version === "string" ? version : "";
+}
+
+export function validateRequestMetadata(value, supportedVersions = MCP_PROTOCOL_VERSIONS) {
+  const params = asMcpObject(asMcpObject(value).params);
+  const meta = asMcpObject(params._meta);
+  assertBoundedMcpJsonStructure(meta, "request metadata");
+  const version = meta[PROTOCOL_VERSION_KEY];
+  if (typeof version !== "string" || !version) {
+    throw new McpProtocolError(-32602, `Missing required request metadata: ${PROTOCOL_VERSION_KEY}`);
+  }
+  if (!supportedVersions.includes(version)) {
+    throw new McpProtocolError(MCP_UNSUPPORTED_PROTOCOL_VERSION, "Unsupported protocol version", {
+      supported: [...supportedVersions],
+      requested: boundedProtocolVersion(version),
+    });
+  }
+  validateMetaKeys(meta);
+  const clientCapabilities = meta[CLIENT_CAPABILITIES_KEY];
+  if (!isPlainObject(clientCapabilities)) {
+    throw new McpProtocolError(-32602, `Missing required request metadata: ${CLIENT_CAPABILITIES_KEY}`);
+  }
+  validateClientCapabilities(clientCapabilities);
+  const clientInfo = meta[CLIENT_INFO_KEY];
+  if (clientInfo !== undefined && !isImplementation(clientInfo)) {
+    throw new McpProtocolError(-32602, `Invalid request metadata: ${CLIENT_INFO_KEY}`);
+  }
+  const progressToken = meta.progressToken;
+  if (progressToken !== undefined && !isProgressToken(progressToken)) {
+    throw new McpProtocolError(-32602, "Invalid request metadata: progressToken");
+  }
+  const logLevel = meta["io.modelcontextprotocol/logLevel"];
+  if (logLevel !== undefined && !LOG_LEVELS.has(logLevel)) {
+    throw new McpProtocolError(-32602, "Invalid request metadata: io.modelcontextprotocol/logLevel");
+  }
+  return {
+    version,
+    clientCapabilities,
+    clientInfo: clientInfo ?? null,
+    progressToken,
+    logLevel,
+  };
+}
+
+export function serverImplementation({ name, version, title, description }) {
+  const implementation = { name: String(name), version: String(version) };
+  if (title) implementation.title = String(title);
+  if (description) implementation.description = String(description);
+  return implementation;
+}
+
+export function completeResult(fields = {}, serverInfo) {
+  return result(MCP_RESULT_COMPLETE, fields, serverInfo);
+}
+
+export function cacheableResult(fields, { ttlMs, cacheScope, serverInfo }) {
+  const normalizedTtl = Number(ttlMs);
+  if (!Number.isFinite(normalizedTtl) || normalizedTtl < 0) throw new Error("ttlMs must be a non-negative number");
+  if (cacheScope !== "public" && cacheScope !== "private") throw new Error("cacheScope must be public or private");
+  return completeResult({ ...fields, ttlMs: normalizedTtl, cacheScope }, serverInfo);
+}
+
+export function discoverResult({ supportedVersions, capabilities, instructions, ttlMs = 0, serverInfo }) {
+  const fields = {
+    supportedVersions: [...supportedVersions],
+    capabilities: structuredClone(capabilities),
+  };
+  if (instructions) fields.instructions = String(instructions);
+  return cacheableResult(fields, { ttlMs, cacheScope: "public", serverInfo });
+}
+
+export function validateSubscriptionRequest(value) {
+  const notifications = asMcpObject(asMcpObject(value).params).notifications;
+  if (!isPlainObject(notifications)) {
+    throw new McpProtocolError(-32602, "subscriptions/listen requires a notifications object");
+  }
+  assertBoundedMcpJsonStructure(notifications, "subscription filter");
+  for (const key of ["toolsListChanged", "promptsListChanged", "resourcesListChanged"]) {
+    if (notifications[key] !== undefined && typeof notifications[key] !== "boolean") {
+      throw new McpProtocolError(-32602, `Invalid subscriptions/listen notification filter: ${key}`);
+    }
+  }
+  const resources = notifications.resourceSubscriptions;
+  if (resources === undefined) return;
+  if (!Array.isArray(resources) || resources.length > MAX_RESOURCE_SUBSCRIPTIONS
+      || resources.some((uri) => typeof uri !== "string" || !uri || uri.length > MAX_RESOURCE_SUBSCRIPTION_URI_LENGTH)) {
+    throw new McpProtocolError(-32602, "Invalid subscriptions/listen notification filter: resourceSubscriptions");
+  }
+}
+
+export function emptySubscriptionAcknowledgement(requestId) {
+  return {
+    jsonrpc: "2.0",
+    method: "notifications/subscriptions/acknowledged",
+    params: {
+      notifications: {},
+      _meta: { [SUBSCRIPTION_ID_KEY]: requestId },
+    },
+  };
+}
+
+export function subscriptionCompleteResult(requestId, serverInfo) {
+  const output = completeResult({}, serverInfo);
+  output._meta = { ...asMcpObject(output._meta), [SUBSCRIPTION_ID_KEY]: requestId };
+  return output;
+}
+
+function serverInfoMeta(serverInfo) {
+  return serverInfo ? { [SERVER_INFO_KEY]: structuredClone(serverInfo) } : undefined;
+}
+
+function result(resultType, fields, serverInfo) {
+  const output = { ...structuredClone(fields), resultType };
+  const meta = serverInfoMeta(serverInfo);
+  if (meta) output._meta = { ...asMcpObject(output._meta), ...meta };
+  return output;
+}
+
+export function assertBoundedMcpJsonStructure(value, label = "MCP value") {
+  const stack = [{ value, depth: 0 }];
+  let nodes = 0;
+  while (stack.length > 0) {
+    const current = stack.pop();
+    nodes += 1;
+    if (nodes > MAX_MCP_JSON_NODES || current.depth > MAX_MCP_JSON_DEPTH) {
+      throw new McpProtocolError(-32602, `${label} exceeds bounded structural limits`);
+    }
+    if (Array.isArray(current.value)) {
+      if (current.value.length > MAX_MCP_JSON_NODES - nodes - stack.length) {
+        throw new McpProtocolError(-32602, `${label} exceeds bounded structural limits`);
+      }
+      for (let index = 0; index < current.value.length; index += 1) {
+        stack.push({ value: current.value[index], depth: current.depth + 1 });
+      }
+      continue;
+    }
+    if (!current.value || typeof current.value !== "object") continue;
+    if (!isPlainObject(current.value)) throw new McpProtocolError(-32602, `${label} contains a non-JSON object`);
+    for (const key in current.value) {
+      if (!Object.hasOwn(current.value, key)) continue;
+      if (key.length > MAX_MCP_JSON_KEY_LENGTH || stack.length + nodes >= MAX_MCP_JSON_NODES) {
+        throw new McpProtocolError(-32602, `${label} exceeds bounded structural limits`);
+      }
+      stack.push({ value: current.value[key], depth: current.depth + 1 });
+    }
+  }
+}
+
+function validateMetaKeys(meta) {
+  for (const key in meta) {
+    if (!Object.hasOwn(meta, key)) continue;
+    if (key.length > MAX_MCP_JSON_KEY_LENGTH || !META_KEY.test(key)) {
+      throw new McpProtocolError(-32602, "Invalid request metadata key");
+    }
+  }
+}
+
+function validateClientCapabilities(value) {
+  validateCapabilityObject(value, "roots");
+  validateCapabilityMap(value, "experimental");
+  validateCapabilityFields(value, "sampling", ["context", "tools"]);
+  validateCapabilityFields(value, "elicitation", ["form", "url"]);
+  const extensions = value.extensions;
+  if (extensions === undefined) return;
+  if (!isPlainObject(extensions)) throw new McpProtocolError(-32602, "Invalid client capability: extensions");
+  for (const key in extensions) {
+    if (!Object.hasOwn(extensions, key)) continue;
+    const settings = extensions[key];
+    if (key.length > MAX_MCP_JSON_KEY_LENGTH || !key.includes("/") || !META_KEY.test(key) || !isPlainObject(settings)) {
+      throw new McpProtocolError(-32602, "Invalid client extension capability");
+    }
+  }
+}
+
+function validateCapabilityObject(value, key) {
+  if (value[key] !== undefined && !isPlainObject(value[key])) {
+    throw new McpProtocolError(-32602, `Invalid client capability: ${key}`);
+  }
+}
+
+function validateCapabilityMap(value, key) {
+  validateCapabilityObject(value, key);
+  if (value[key] === undefined) return;
+  for (const name in value[key]) {
+    if (!Object.hasOwn(value[key], name)) continue;
+    if (name.length > MAX_MCP_JSON_KEY_LENGTH || !isPlainObject(value[key][name])) {
+      throw new McpProtocolError(-32602, `Invalid client capability: ${key}`);
+    }
+  }
+}
+
+function validateCapabilityFields(value, key, fields) {
+  validateCapabilityObject(value, key);
+  if (value[key] === undefined) return;
+  for (const field of fields) {
+    if (value[key][field] !== undefined && !isPlainObject(value[key][field])) {
+      throw new McpProtocolError(-32602, `Invalid client capability: ${key}.${field}`);
+    }
+  }
+}
+
+function boundedProtocolVersion(value) {
+  return value.length <= 128 ? value : "<invalid-length>";
+}
+
+function isProgressToken(value) {
+  return typeof value === "string" || (typeof value === "number" && Number.isFinite(value));
+}
+
+function isImplementation(value) {
+  if (!isPlainObject(value) || typeof value.name !== "string" || typeof value.version !== "string") return false;
+  for (const field of ["title", "description"]) {
+    if (value[field] !== undefined && typeof value[field] !== "string") return false;
+  }
+  if (value.websiteUrl !== undefined && !isAbsoluteUri(value.websiteUrl)) return false;
+  if (value.icons !== undefined && (!Array.isArray(value.icons) || !value.icons.every(isIcon))) return false;
+  return true;
+}
+
+function isIcon(value) {
+  if (!isPlainObject(value) || !isAbsoluteUri(value.src)) return false;
+  if (value.mimeType !== undefined && typeof value.mimeType !== "string") return false;
+  if (value.sizes !== undefined && (!Array.isArray(value.sizes) || !value.sizes.every((size) => typeof size === "string"))) return false;
+  return value.theme === undefined || value.theme === "light" || value.theme === "dark";
+}
+
+function isAbsoluteUri(value) {
+  if (typeof value !== "string" || !value) return false;
+  try { return Boolean(new URL(value).protocol); } catch { return false; }
+}
+
+function isPlainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}

package/src/shared/project-overview-projection.d.mts

@@ -0,0 +1,4 @@
+export type ProjectOverviewDetail = "summary" | "full";
+
+export function projectOverviewDetail(args?: Record<string, unknown>): ProjectOverviewDetail;
+export function projectProjectOverview(value: unknown, detail?: ProjectOverviewDetail): unknown;

package/src/shared/project-overview-projection.mjs

@@ -0,0 +1,96 @@
+// @ts-check
+
+export function projectOverviewDetail(args = {}) {
+  return args?.detail === "summary" ? "summary" : "full";
+}
+
+export function projectProjectOverview(value, detail = "full") {
+  if (detail !== "summary" || !isRecord(value)) return value;
+  const authorization = record(value.authorization);
+  const summary = /** @type {Record<string, unknown>} */ ({
+    detail: "summary",
+    workspace: value.workspace ?? null,
+    workspaceName: value.workspaceName ?? null,
+    gitRoot: value.gitRoot ?? "",
+    policy: value.policy ?? null,
+    effectiveToolCount: numberOrLength(authorization.effective_tool_count, value.tools),
+    daemonPolicy: value.daemonPolicy ?? null,
+    daemonToolCount: numberOr(value.daemonToolCount, arrayLength(value.daemonTools)),
+    ...(value.daemonToolsHiddenByAuthority === true ? { daemonToolsHiddenByAuthority: true } : {}),
+    capabilityRouting: compactCapabilityRouting(value.capabilityRouting),
+    topLevel: compactTopLevel(value.topLevel),
+    topLevelTotal: numberOr(value.topLevelTotal, 0),
+    topLevelTruncated: value.topLevelTruncated === true,
+  });
+  if (typeof value.policyScope === "string") summary.policyScope = value.policyScope;
+  if (typeof value.toolsScope === "string") summary.toolsScope = value.toolsScope;
+  if (Object.keys(authorization).length) summary.authorization = compactAuthorization(authorization);
+  return summary;
+}
+
+function compactAuthorization(value) {
+  const account = record(value.account);
+  const execution = record(value.execution_model);
+  return {
+    account: Object.keys(account).length ? { role: account.role ?? null, version: account.version ?? null } : null,
+    effective_policy: value.effective_policy ?? null,
+    effective_tool_count: numberOr(value.effective_tool_count, 0),
+    account_role_is_owner: value.account_role_is_owner === true,
+    effective_profile_is_full: value.effective_profile_is_full === true,
+    execution_model: Object.keys(execution).length ? {
+      within_effective_authority: execution.within_effective_authority ?? null,
+      owner_ambient_authority: execution.owner_ambient_authority ?? null,
+    } : null,
+  };
+}
+
+function compactCapabilityRouting(value) {
+  const source = record(value);
+  if (source.activity_hidden_by_authority === true) return { activity_hidden_by_authority: true };
+  const last = record(source.last_task_resolution);
+  return {
+    bootstrap_observed: source.bootstrap_observed === true,
+    bootstrap_count: numberOr(source.bootstrap_count, 0),
+    task_resolution_observed: source.task_resolution_observed === true,
+    task_resolution_count: numberOr(source.task_resolution_count, 0),
+    last_task_resolution: Object.keys(last).length ? {
+      observed_at: last.observed_at ?? null,
+      selected_skill: last.selected_skill ?? null,
+      matched_skills: numberOr(last.matched_skills, 0),
+      matched_commands: numberOr(last.matched_commands, 0),
+      matched_applications: numberOr(last.matched_applications, 0),
+      recommended_tool_count: arrayLength(last.recommended_tools),
+      primary_route: last.primary_route ?? null,
+      routing_ambiguity: last.routing_ambiguity ?? "none",
+      routing_score_gap: numberOr(last.routing_score_gap, 0),
+    } : null,
+  };
+}
+
+function compactTopLevel(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => {
+    const entry = record(item);
+    return { name: entry.name ?? "", type: entry.type ?? "other" };
+  });
+}
+
+function arrayLength(value) {
+  return Array.isArray(value) ? value.length : 0;
+}
+
+function numberOr(value, fallback) {
+  return Number.isFinite(Number(value)) ? Number(value) : fallback;
+}
+
+function numberOrLength(value, array) {
+  return Number.isFinite(Number(value)) ? Number(value) : arrayLength(array);
+}
+
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function record(value) {
+  return isRecord(value) ? value : {};
+}

package/src/shared/relay-contract.json

@@ -0,0 +1,28 @@
+{
+  "reconnectGraceMs": 120000,
+  "newCallReconnectGraceMs": 15000,
+  "transportPingIntervalMs": 5000,
+  "transportPongTimeoutMs": 10000,
+  "daemonApplicationHeartbeatIntervalMs": 25000,
+  "daemonApplicationHeartbeatTimeoutMs": 75000,
+  "httpFallbackPollIntervalMs": 1000,
+  "httpFallbackMinimumRequestIntervalMs": 750,
+  "httpFallbackActivationDelayMs": 1500,
+  "httpFallbackRequestTimeoutMs": 7000,
+  "httpFallbackLivenessTimeoutMs": 12000,
+  "httpFallbackMaximumQueuedMessages": 64,
+  "httpFallbackMaximumQueuedBytes": 16777216,
+  "httpFallbackMaximumMessageBytes": 8388608,
+  "httpFallbackMaximumEnvelopeBytes": 8454144,
+  "streamHeartbeatMs": 5000,
+  "maximumExecutionTimeoutMs": 45000,
+  "defaultRemoteToolExecutionTimeoutMs": 20000,
+  "maximumInteractiveExecutionTimeoutMs": 45000,
+  "processSessionStartExecutionTimeoutMs": 10000,
+  "durableProcessAcceptanceTimeoutMs": 10000,
+  "maximumDurableProcessExecutionTimeoutMs": 600000,
+  "maximumManagedJobResourceAdmissionWaitMs": 1800000,
+  "maximumProcessReadWaitMs": 5000,
+  "workerSettlementOverheadMs": 5000,
+  "maximumRelayToolTimeoutMs": 50000
+}

package/src/shared/result-projection.d.mts

@@ -2,5 +2,6 @@ export const MCP_TEXT_PROJECTION_KEY: "$mcpText";
 export function mirroredResultText(value: unknown): string;
 export function projectMcpResult(value: unknown): {
   text: string;
-  structuredContent: Record<string, unknown> | null;
+  hasStructuredContent: boolean;
+  structuredContent: unknown;
 };

package/src/shared/result-projection.mjs

@@ -35,14 +35,25 @@ export function projectMcpResult(value) {
     const structuredContent = { ...object };
     const text = String(structuredContent[MCP_TEXT_PROJECTION_KEY]).slice(0, 4096);
     delete structuredContent[MCP_TEXT_PROJECTION_KEY];
-    return { text, structuredContent };
+    return { text, hasStructuredContent: true, structuredContent };
   }
   return {
     text: mirroredResultText(value),
-    structuredContent: value && typeof value === "object" && !Array.isArray(value) ? value : null,
+    hasStructuredContent: isJsonValue(value),
+    structuredContent: value,
   };
 }
 
+/** @param {unknown} value */
+function isJsonValue(value) {
+  return value === null
+    || typeof value === "string"
+    || typeof value === "boolean"
+    || (typeof value === "number" && Number.isFinite(value))
+    || Array.isArray(value)
+    || (value && typeof value === "object");
+}
+
 /** @param {unknown} value */
 function asObject(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};