mandala-computer-mcp 0.3.0 → 0.5.0

package/dist/results.js

@@ -0,0 +1,263 @@
+import { APIError, CancelledError } from './errors.js';
+import { refused, withErrorMetadata } from './format.js';
+export const RETAINED_OPERATION_MS = 90000;
+export const PRESENTATION_DEFAULT = 4096, PRESENTATION_MAX = 16384, RETAINED_RESULT_MAX = 256 * 1024;
+export class RetainedValueError extends Error {
+    constructor() {
+        super('Invalid or unsupported retained response or request.');
+    }
+}
+export const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+export const integer = (v, min = 0, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(v) && v >= min && v <= max;
+export function requireValue(condition) {
+    if (!condition)
+        throw new RetainedValueError();
+}
+export const resultId = (v) => typeof v === 'string' && v.length === 36 && /^res_[a-f0-9]{32}$/.test(v);
+export const executionId = (v) => typeof v === 'string' && v.length === 37 && /^exec_[a-f0-9]{32}$/.test(v);
+export const scopeId = (v) => typeof v === 'string' && v.match(/^[A-Za-z0-9_-]{1,100}$/)?.[0] === v;
+export const digest = (v) => typeof v === 'string' && v.length === 64 && /^[a-f0-9]{64}$/.test(v);
+export function time(v) {
+    requireValue(typeof v === 'string' &&
+        v.endsWith('Z') &&
+        /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,9})?Z$/.test(v));
+    const parsed = Date.parse(v);
+    requireValue(Number.isFinite(parsed) && new Date(parsed).toISOString().slice(0, 19) === v.slice(0, 19));
+    return (BigInt(Math.floor(parsed / 1000)) * 1000000000n +
+        BigInt((v.split('.')[1]?.slice(0, -1) ?? '').padEnd(9, '0')));
+}
+export function retainOptions(v) {
+    requireValue(record(v) &&
+        Object.keys(v).every((k) => k === 'max_bytes_per_stream' || k === 'retention_seconds'));
+    const out = {};
+    if ('max_bytes_per_stream' in v) {
+        requireValue(integer(v.max_bytes_per_stream, 1, 4 * 1024 * 1024));
+        out.max_bytes_per_stream = v.max_bytes_per_stream;
+    }
+    if ('retention_seconds' in v) {
+        requireValue(integer(v.retention_seconds, 1, 604800));
+        out.retention_seconds = v.retention_seconds;
+    }
+    return out;
+}
+export function retainIntent(v, background) {
+    if (v === undefined || v === false)
+        return undefined;
+    requireValue(!background);
+    return v === true ? true : retainOptions(v);
+}
+export function resultMetadata(v, computer, id, execution, options) {
+    requireValue(record(v) &&
+        v.version === 1 &&
+        resultId(v.result_id) &&
+        (!id || v.result_id === id) &&
+        v.computer_id === computer &&
+        scopeId(v.computer_id) &&
+        scopeId(v.account_id) &&
+        (v.workspace_id === null || scopeId(v.workspace_id)) &&
+        v.state === 'ready');
+    const sync = v.kind === 'synchronous-output';
+    requireValue(sync || v.kind === 'background-output');
+    requireValue(sync
+        ? v.execution_id === null && v.source === 'exec_response'
+        : executionId(v.execution_id) && v.source === 'volatile_guest_files');
+    if (execution)
+        requireValue(!sync && v.execution_id === execution);
+    const start = time(v.capture_started_at), end = time(v.captured_at), expires = time(v.expires_at);
+    requireValue(end >= start && expires > end && expires - start <= 604800000000000n);
+    const o = v.execution_observation;
+    requireValue(record(o));
+    const observed = time(o.observed_at);
+    requireValue(observed >= start && observed <= end);
+    requireValue(o.status === 'exited'
+        ? integer(o.exit_code, -2147483648, 2147483647)
+        : !sync && o.status === 'running' && !('exit_code' in o));
+    const observation = {
+        status: o.status,
+        observed_at: o.observed_at,
+        ...(o.status === 'exited' ? { exit_code: o.exit_code } : {}),
+    };
+    const prefix = (p) => {
+        requireValue(record(p) &&
+            integer(p.bytes, 0, 4 * 1024 * 1024) &&
+            digest(p.sha256) &&
+            p.source_offset === 0 &&
+            p.next_source_offset === p.bytes);
+        if (sync)
+            requireValue(integer(p.source_response_bytes, p.bytes, 16 * 1024 * 1024) &&
+                typeof p.upstream_truncated === 'boolean' &&
+                p.end_reason === (p.bytes === p.source_response_bytes ? 'response_end' : 'byte_limit'));
+        else
+            requireValue(p.end_reason === 'observed_eof' || p.end_reason === 'byte_limit');
+        return {
+            bytes: p.bytes,
+            sha256: p.sha256,
+            source_offset: 0,
+            next_source_offset: p.bytes,
+            end_reason: p.end_reason,
+            ...(sync
+                ? {
+                    source_response_bytes: p.source_response_bytes,
+                    upstream_truncated: p.upstream_truncated,
+                }
+                : {}),
+        };
+    };
+    let diagnostic = null;
+    if (sync)
+        requireValue(v.diagnostic === null);
+    else {
+        const d = v.diagnostic;
+        requireValue(record(d) &&
+            integer(d.bytes, 0, 65536) &&
+            digest(d.sha256) &&
+            d.source === 'wrapper' &&
+            typeof d.diagnostic_truncated === 'boolean');
+        diagnostic = {
+            bytes: d.bytes,
+            sha256: d.sha256,
+            source: 'wrapper',
+            diagnostic_truncated: d.diagnostic_truncated,
+        };
+    }
+    if (options) {
+        requireValue(record(v.stdout) &&
+            record(v.stderr) &&
+            integer(v.stdout.bytes, 0, options.max_bytes_per_stream ?? 1048576) &&
+            integer(v.stderr.bytes, 0, options.max_bytes_per_stream ?? 1048576) &&
+            expires - start <= BigInt(options.retention_seconds ?? 86400) * 1000000000n);
+    }
+    return {
+        version: 1,
+        result_id: v.result_id,
+        kind: v.kind,
+        state: 'ready',
+        account_id: v.account_id,
+        computer_id: v.computer_id,
+        workspace_id: v.workspace_id,
+        execution_id: v.execution_id,
+        source: v.source,
+        capture_started_at: v.capture_started_at,
+        captured_at: v.captured_at,
+        expires_at: v.expires_at,
+        execution_observation: observation,
+        stdout: prefix(v.stdout),
+        stderr: prefix(v.stderr),
+        diagnostic,
+    };
+}
+export function resultQuery(stream, offset, limit = PRESENTATION_DEFAULT) {
+    requireValue(['stdout', 'stderr', 'diagnostic'].includes(stream) &&
+        integer(offset) &&
+        integer(limit, 1, PRESENTATION_MAX) &&
+        Number.isSafeInteger(offset + limit));
+    return { stream: stream, offset, limit };
+}
+export function binaryContent(bytes) {
+    try {
+        const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+        if (!bytes.some((byte) => byte === 127 || (byte < 32 && byte !== 9 && byte !== 10 && byte !== 13)) &&
+            Buffer.from(text, 'utf8').equals(Buffer.from(bytes)))
+            return { text };
+    }
+    catch {
+        /* exact binary follows */
+    }
+    return { base64: Buffer.from(bytes).toString('base64') };
+}
+export function resultPage(response, id, query) {
+    const h = response.headers, bytes = response.bytes;
+    const number = (name) => {
+        const raw = h[name];
+        requireValue(typeof raw === 'string' &&
+            /^(0|[1-9][0-9]*)$/.test(raw) &&
+            String(Number(raw)) === raw &&
+            integer(Number(raw)));
+        return Number(raw);
+    };
+    requireValue(h['content-type']?.split(';')[0].trim().toLowerCase() === 'application/octet-stream');
+    requireValue(number('content-length') === bytes.length &&
+        number('x-result-offset') === query.offset &&
+        number('x-result-next-offset') === query.offset + bytes.length &&
+        bytes.length <= query.limit);
+    requireValue(h['x-result-eof'] === 'true' || h['x-result-eof'] === 'false');
+    const eof = h['x-result-eof'] === 'true';
+    requireValue(eof || bytes.length === query.limit);
+    return {
+        result_id: id,
+        stream: query.stream,
+        offset: query.offset,
+        next_offset: query.offset + bytes.length,
+        eof,
+        bytes: bytes.length,
+        ...binaryContent(bytes),
+    };
+}
+/** One deadline for the whole callback, including metadata, bytes and presentation. */
+export async function retainedCall(parent, mutation, fn) {
+    const controller = new AbortController(), abort = () => controller.abort(parent.reason);
+    parent.addEventListener('abort', abort, { once: true });
+    if (parent.aborted)
+        abort();
+    const timer = setTimeout(() => controller.abort(), RETAINED_OPERATION_MS), signal = controller.signal, end = performance.now() + RETAINED_OPERATION_MS;
+    try {
+        if (signal.aborted)
+            throw new CancelledError('cancelled');
+        const result = await fn(signal);
+        if (signal.aborted || performance.now() >= end)
+            throw new CancelledError('cancelled');
+        requireValue(Buffer.byteLength(JSON.stringify(result)) <= RETAINED_RESULT_MAX);
+        if (signal.aborted || performance.now() >= end)
+            throw new CancelledError('cancelled');
+        return result;
+    }
+    catch (error) {
+        const suffix = mutation
+            ? ' Publication or deletion may have committed; its response is unconfirmed. Do not repeat a capture or command to recover this answer.'
+            : ' No fallback or command replay was attempted.';
+        if (signal.aborted || error instanceof CancelledError)
+            return refused(`Retained operation cancelled.${suffix}`);
+        if (error instanceof APIError)
+            return withErrorMetadata(refused(`Retained operation failed (HTTP ${error.status}). Current authorization, availability or server support could not be confirmed.${suffix}`), error);
+        return refused(`Retained operation could not be completed or validated.${suffix}`);
+    }
+    finally {
+        clearTimeout(timer);
+        parent.removeEventListener('abort', abort);
+        controller.abort();
+    }
+}
+/** Optional metadata must never change an already executed command's interpretation. */
+export function synchronousResultId(v, status) {
+    if (!record(v) ||
+        status !== 200 ||
+        !resultId(v.result_id) ||
+        v.timed_out !== false ||
+        !integer(v.exit_code, -2147483648, 2147483647) ||
+        typeof v.out_truncated !== 'boolean' ||
+        typeof v.err_truncated !== 'boolean')
+        return undefined;
+    for (const key of ['stdout_b64', 'stderr_b64']) {
+        const data = v[key];
+        if (typeof data !== 'string' || data.length > 22369624 || data.length % 4)
+            return undefined;
+        // Validate canonical padding without allocating the decoded large stream.
+        const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/', pad = data.endsWith('==') ? 2 : data.endsWith('=') ? 1 : 0;
+        for (let i = 0; i < data.length - pad; i++) {
+            const c = data.charCodeAt(i);
+            if (!((c >= 65 && c <= 90) ||
+                (c >= 97 && c <= 122) ||
+                (c >= 48 && c <= 57) ||
+                c === 43 ||
+                c === 47))
+                return undefined;
+        }
+        if (pad &&
+            (data.length < 4 || alphabet.indexOf(data[data.length - pad - 1]) & (pad === 2 ? 15 : 3)))
+            return undefined;
+        if ((data.length / 4) * 3 - pad > 16 * 1024 * 1024)
+            return undefined;
+    }
+    return v.result_id;
+}
+//# sourceMappingURL=results.js.map

package/dist/results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../src/results.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,EACtC,gBAAgB,GAAG,KAAK,EACxB,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AACnC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChE,CAAC;CACF;AACD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CACjE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAe,EAAE,CACzF,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAK,CAAY,IAAI,GAAG,IAAK,CAAY,IAAI,GAAG,CAAC;AAC1E,MAAM,UAAU,YAAY,CAAC,SAAkB;IAC7C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;AACjD,CAAC;AACD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAClD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAU,EAAe,EAAE,CACrD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CACjD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAe,EAAE,CAChD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,YAAY,CACV,OAAO,CAAC,KAAK,QAAQ;QACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QACf,iDAAiD,CAAC,IAAI,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,YAAY,CACV,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAC1F,CAAC;IACF,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,WAAW;QAC/C,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,YAAY,CACV,MAAM,CAAC,CAAC,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,mBAAmB,CAAC,CACzF,CAAC;IACF,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,sBAAsB,IAAI,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,oBAAoB,CAAC;IACpD,CAAC;IACD,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QAC7B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,UAAmB;IAC1D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACrD,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,CAAU,EACV,QAAgB,EAChB,EAAW,EACX,SAAkB,EAClB,OAAuB;IAEvB,YAAY,CACV,MAAM,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,OAAO,KAAK,CAAC;QACf,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACrB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,WAAW,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACtB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrB,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC,CAAC,KAAK,KAAK,OAAO,CACtB,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC;IAC7C,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IACrD,YAAY,CACV,IAAI;QACF,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;QACzD,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACvE,CAAC;IACF,IAAI,SAAS;QAAE,YAAY,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EACtC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EACzB,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/B,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC;IAClC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACrC,YAAY,CAAC,QAAQ,IAAI,KAAK,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC;IACnD,YAAY,CACV,CAAC,CAAC,MAAM,KAAK,QAAQ;QACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;QAC/C,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAC3D,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE;QAC5B,YAAY,CACV,MAAM,CAAC,CAAC,CAAC;YACP,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YACpC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAChB,CAAC,CAAC,aAAa,KAAK,CAAC;YACrB,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,KAAK,CACnC,CAAC;QACF,IAAI,IAAI;YACN,YAAY,CACV,OAAO,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;gBACzD,OAAO,CAAC,CAAC,kBAAkB,KAAK,SAAS;gBACzC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CACzF,CAAC;;YACC,YAAY,CAAC,CAAC,CAAC,UAAU,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC;QACpF,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,aAAa,EAAE,CAAC;YAChB,kBAAkB,EAAE,CAAC,CAAC,KAAK;YAC3B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;oBAC9C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;iBACzC;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,IAAI;QAAE,YAAY,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;SACzC,CAAC;QACJ,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACvB,YAAY,CACV,MAAM,CAAC,CAAC,CAAC;YACP,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAChB,CAAC,CAAC,MAAM,KAAK,SAAS;YACtB,OAAO,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAC9C,CAAC;QACF,UAAU,GAAG;YACX,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,SAAS;YACjB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CACV,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC;YACnE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC;YACnE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,GAAG,WAAW,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,qBAAqB,EAAE,WAAW;QAClC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAAe,EACf,MAAe,EACf,QAAiB,oBAAoB;IAErC,YAAY,CACV,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC;QACf,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,CACvC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtF,IACE,CAAC,KAAK,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAClF;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEpD,OAAO,EAAE,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,UAAU,CACxB,QAAsB,EACtB,EAAU,EACV,KAAqC;IAErC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EACxB,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,YAAY,CACV,OAAO,GAAG,KAAK,QAAQ;YACrB,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACvB,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,YAAY,CACV,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,0BAA0B,CACrF,CAAC;IACF,YAAY,CACV,MAAM,CAAC,gBAAgB,CAAC,KAAK,KAAK,CAAC,MAAM;QACvC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,CAAC,MAAM;QAC1C,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAC9D,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAC9B,CAAC;IACF,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC;IACzC,YAAY,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO;QACL,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QACxC,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,GAAG,aAAa,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AACD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,QAAiB,EACjB,EAAoD;IAEpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,EACtC,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,qBAAqB,CAAC,EACvE,MAAM,GAAG,UAAU,CAAC,MAAM,EAC1B,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACtF,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,sIAAsI;YACxI,CAAC,CAAC,+CAA+C,CAAC;QACpD,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,cAAc;YACnD,OAAO,OAAO,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,YAAY,QAAQ;YAC3B,OAAO,iBAAiB,CACtB,OAAO,CACL,mCAAmC,KAAK,CAAC,MAAM,mFAAmF,MAAM,EAAE,CAC3I,EACD,KAAK,CACN,CAAC;QACJ,OAAO,OAAO,CAAC,0DAA0D,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AACD,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,MAAc;IAC5D,IACE,CAAC,MAAM,CAAC,CAAC,CAAC;QACV,MAAM,KAAK,GAAG;QACd,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtB,CAAC,CAAC,SAAS,KAAK,KAAK;QACrB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;QAC9C,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QACpC,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAEpC,OAAO,SAAS,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5F,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,kEAAkE,EACjF,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IACE,CAAC,CACC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;gBACrB,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC,KAAK,EAAE;gBACR,CAAC,KAAK,EAAE,CACT;gBAED,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IACE,GAAG;YACH,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEzF,OAAO,SAAS,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,CAAC,SAAS,CAAC;AACrB,CAAC"}

package/dist/server.d.ts

@@ -1,9 +1,10 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { type SessionConfig } from './session.js';
+import { type ToolFilters } from './tool-filters.js';
 import type { ToolOptions } from './tools/types.js';
 export declare const SERVER_NAME = "mandala-computer";
-export declare const SERVER_VERSION = "0.3.0";
-export type ServerConfig = SessionConfig & Partial<ToolOptions> & {
+export declare const SERVER_VERSION = "0.5.0";
+export type ServerConfig = SessionConfig & ToolFilters & Partial<ToolOptions> & {
     /** Internal HTTP hook: hold a session active for the real tool callback lifetime. */
     activity?: () => () => void;
 };

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,UAAU,CAAC;AAoCtC,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,OAAO,CAAC,WAAW,CAAC,GAAG;IACrB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,MAAM,IAAI,CAAC;CAC7B,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAmDzD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,KAAK,WAAW,EAAc,MAAM,mBAAmB,CAAC;AAkBjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,UAAU,CAAC;AA6CtC,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,WAAW,GACX,OAAO,CAAC,WAAW,CAAC,GAAG;IACrB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,MAAM,IAAI,CAAC;CAC7B,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAmFzD"}

package/dist/server.js

@@ -1,15 +1,27 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from '@modelcontextprotocol/sdk/types.js';
 import { Session } from './session.js';
+import { toolFilter } from './tool-filters.js';
+import { registerAccount } from './tools/account.js';
+import { registerActivities } from './tools/activities.js';
 import { registerAgent } from './tools/agent.js';
+import { registerArtifacts } from './tools/artifacts.js';
+import { registerChat } from './tools/chat.js';
 import { registerComputers } from './tools/computers.js';
+import { registerDirectory } from './tools/directory.js';
 import { registerEvents } from './tools/events.js';
+import { registerExecutions } from './tools/executions.js';
 import { registerGuest } from './tools/guest.js';
 import { registerInput } from './tools/input.js';
+import { registerResults } from './tools/results.js';
+import { registerSecrets } from './tools/secrets.js';
+import { registerSignals } from './tools/signals.js';
 import { registerSnapshots } from './tools/snapshots.js';
+import { registerSSH } from './tools/ssh.js';
 import { registerTemplates } from './tools/templates.js';
 import { registerWebhooks } from './tools/webhooks.js';
 export const SERVER_NAME = 'mandala-computer';
-export const SERVER_VERSION = '0.3.0';
+export const SERVER_VERSION = '0.5.0';
 /**
  * Told to the client on connect, and shown to the model before any tool is
  * called. It is the only place to say the things that are true of the whole
@@ -40,8 +52,16 @@ Things that are true here and are not obvious:
 - Waiting for a FILE is its own call, because a directory has to be nominated before the machine reports anything under it: wait_for_file_change takes an absolute directory in the guest, makes sure the guest is genuinely watching it, and then blocks until something under it is created, changed or deleted. Use it for a build's output or a download landing, in place of running ls in a loop. Nominate the narrowest directory you care about — a home directory under a build reports one "too much changed" marker instead of the changes — and read that marker as "list the directory again", not as a failure.
 - list_windows tells you what is on the screen as data. It is how you distinguish an application that failed to start from one that has not painted yet, which a screenshot alone cannot do.
 - A computer suspends itself when nobody uses it — 30 minutes by default. Input, exec and file transfers all count as use and resume it. Screenshots deliberately do not, so a loop that only watches can see its own machine go down.
+- Who you are is checked again while a call is in flight, not only when it starts, so a long call can be refused after part of its work is already done. A 401 or a 403 means the credential or the role behind it stopped being accepted: re-authenticate, or say what was refused. Do not resend it, and never resend one that creates, starts, moves, writes or deletes without first checking what took effect. A 402 is the plan as it stands now rather than a fault on the computer, and waiting does not change it. Any of the three can arrive with completed work attached — read that before deciding what is left to do.
 - A 409 is not one thing, and retrying blindly is how a turn gets burned. Most describe a passing state and clear on their own: a guest still booting, a guest agent busy with another call. Some describe a DECISION about what you asked for — a size the host cannot run, a computer that has to be stopped first — and those answer the same way forever; the message says which, and usually says what to do instead. A 400 never clears.
 - Growing a computer past what its host can run is the refusal worth knowing by name: update_computer says a move is possible, and move_computer is how you take that up. It moves the machine to different hardware and copies its disk, so say what it costs before you call it.`;
+const filteredInstructions = `Mandala Computer gives you access to a Linux desktop in the cloud.
+
+This session exposes a filtered set of tools. Use only the tools in its tool list; some desktop workflows may be unavailable. Pass computer_id explicitly on computer-specific calls unless a computer was already bound to this session. A running VM does not imply that its guest desktop is ready.
+
+Read each available tool's description before calling it. Read-only access follows the tool's readOnlyHint annotation: a read that can resume or bill a computer is not read-only. A running computer still costs money, and passive observation does not prevent idle suspension.
+
+Who you are is checked again while a call is in flight. A 401 or 403 means the credential or role stopped being accepted; a 402 means the current plan refuses the work. Do not resend these calls. Inspect any completed work attached before deciding what remains. A 409 may describe either a temporary condition or a decision that will not change on retry; read its message. A 400 never clears.`;
 /**
  * One MCP server over one account's API key.
  *
@@ -50,16 +70,24 @@ Things that are true here and are not obvious:
  * transport builds exactly one and that is the same thing with n=1.
  */
 export function createServer(cfg) {
+    const filter = toolFilter(cfg);
     const session = new Session(cfg);
     const opts = { lifecycle: cfg.lifecycle ?? true };
-    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { logging: {} }, instructions: instructions(opts.lifecycle) });
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, {
+        capabilities: { logging: {}, tools: {} },
+        instructions: filter.filtered ? filteredInstructions : instructions(opts.lifecycle),
+    });
     // A cancelled Streamable HTTP response can let transport.handleRequest()
     // settle while the tool callback is still awaiting platform work. Wrap tool
     // registration once so the HTTP session lease follows that real lifetime.
-    // Stdio has no hook and pays no cost beyond this branch.
-    if (cfg.activity) {
-        const register = server.registerTool.bind(server);
-        server.registerTool = ((...args) => {
+    // Withheld tools never reach the SDK registry or acquire an activity lease.
+    const register = server.registerTool.bind(server);
+    let registered = false;
+    server.registerTool = ((...args) => {
+        const [name, config] = args;
+        if (!filter.allows(name, config.annotations))
+            return;
+        if (cfg.activity) {
             const handlerIndex = args.length - 1;
             const handler = args[handlerIndex];
             args[handlerIndex] = async (...handlerArgs) => {
@@ -71,17 +99,41 @@ export function createServer(cfg) {
                     release?.();
                 }
             };
-            return register(...args);
-        });
-    }
+        }
+        if (!registered) {
+            server.server.removeRequestHandler('tools/list');
+            server.server.removeRequestHandler('tools/call');
+        }
+        const tool = register(...args);
+        registered = true;
+        return tool;
+    });
+    registerAccount(server, session, opts);
     registerComputers(server, session, opts);
     registerInput(server, session, opts);
     registerGuest(server, session, opts);
+    registerExecutions(server, session, opts);
+    registerResults(server, session, opts);
+    registerArtifacts(server, session, opts);
     registerSnapshots(server, session, opts);
     registerTemplates(server, session, opts);
     registerEvents(server, session, opts);
     registerWebhooks(server, session, opts);
+    registerSSH(server, session, opts);
+    registerSecrets(server, session, opts);
     registerAgent(server, session, opts);
+    registerDirectory(server, session, opts);
+    registerActivities(server, session, opts);
+    registerSignals(server, session, opts);
+    registerChat(server, session, opts);
+    // The SDK installs tool handlers on the first registration. An empty
+    // selection still needs a valid tools/list response and must refuse calls.
+    if (!registered) {
+        server.server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [] }));
+        server.server.setRequestHandler(CallToolRequestSchema, () => {
+            throw new McpError(ErrorCode.InvalidParams, 'No tools are available in this session');
+        });
+    }
     // The event sockets outlive every tool call by design (OPL-3926), so nothing
     // in a tool can be the thing that closes them. This is the end of the
     // session, which is the lifetime they actually have — without it an HTTP

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,SAAkB,EAAE,EAAE,CAC1C;;;;KAIG,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,oBAAoB;;;;;;;;;;;;;;mRAckM,CAAC;AAQpR;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAC9E,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAoC,CAAC;QACrF,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAA2C,CAAC;YAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,GAAG,WAAsB,EAAE,EAAE;gBACvD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;gBACvC,CAAC;wBAAS,CAAC;oBACT,OAAO,EAAE,EAAE,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;YACF,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC,CAA+B,CAAC;IACnC,CAAC;IAED,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAErC,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,sBAAsB,EACtB,QAAQ,GAET,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAoB,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,SAAkB,EAAE,EAAE,CAC1C;;;;KAIG,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,oBAAoB;;;;;;;;;;;;;;;mRAekM,CAAC;AAEpR,MAAM,oBAAoB,GAAG;;;;;;yYAM4W,CAAC;AAS1Y;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;KACpF,CACF,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAoC,CAAC;IACrF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5C,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAmD,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO;QACrD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAA2C,CAAC;YAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,GAAG,WAAsB,EAAE,EAAE;gBACvD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;gBACvC,CAAC;wBAAS,CAAC;oBACT,OAAO,EAAE,EAAE,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/B,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAA+B,CAAC;IAEjC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpC,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC1D,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stdio.d.ts

@@ -1,4 +1,8 @@
 import { type ServerConfig } from './server.js';
+export type StdioConfig = Omit<ServerConfig, 'apiKey'> & {
+    apiKey?: string;
+    profile?: string;
+};
 /**
  * The local install: one process, one key, spawned by the MCP client.
  *
@@ -7,5 +11,5 @@ import { type ServerConfig } from './server.js';
  * here may ever write to stdout: that stream is the protocol, and one stray
  * console.log is a parse error at the other end. Diagnostics go to stderr.
  */
-export declare function runStdio(cfg: ServerConfig): Promise<void>;
+export declare function runStdio(cfg?: StdioConfig): Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC/D"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCnE"}

package/dist/stdio.js

@@ -1,5 +1,5 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { DEFAULT_BASE_URL } from './api.js';
+import { resolveCredentials } from './credentials.js';
 import { createServer } from './server.js';
 /**
  * The local install: one process, one key, spawned by the MCP client.
@@ -9,8 +9,14 @@ import { createServer } from './server.js';
  * here may ever write to stdout: that stream is the protocol, and one stray
  * console.log is a parse error at the other end. Diagnostics go to stderr.
  */
-export async function runStdio(cfg) {
-    const server = createServer(cfg);
+export async function runStdio(cfg = {}) {
+    const credentials = resolveCredentials(cfg);
+    const resolved = {
+        ...cfg,
+        apiKey: credentials.apiKey,
+        baseUrl: credentials.baseUrl,
+    };
+    const server = createServer(resolved);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     // The end of the client, and therefore the end of this process.
@@ -38,6 +44,6 @@ export async function runStdio(cfg) {
     const shutdown = () => void server.close().catch(() => { });
     process.stdin.once('end', shutdown);
     process.stdin.once('close', shutdown);
-    console.error(`mandala-computer-mcp on stdio → ${new URL(cfg.baseUrl ?? DEFAULT_BASE_URL).origin}`);
+    console.error(`mandala-computer-mcp on stdio → ${new URL(credentials.baseUrl).origin}`);
 }
 //# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,oEAAoE;IACpE,+EAA+E;IAC/E,iCAAiC;IACjC,EAAE;IACF,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CACX,mCAAmC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAI9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAmB,EAAE;IAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAiB;QAC7B,GAAG,GAAG;QACN,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;KAC7B,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,oEAAoE;IACpE,+EAA+E;IAC/E,iCAAiC;IACjC,EAAE;IACF,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/tool-filters.d.ts

@@ -0,0 +1,38 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+/** Tags describe capabilities, not whether calling a tool is safe. */
+export declare const TOOL_TAGS: {
+    readonly account: readonly ["get_account"];
+    readonly agent: readonly ["run_agent", "run_agent_chat"];
+    readonly activities: readonly ["list_activities", "get_activity", "get_activity_results"];
+    readonly signals: readonly ["read_signals"];
+    readonly artifacts: readonly ["publish_artifact", "get_artifact", "read_artifact", "delete_artifact"];
+    readonly computers: readonly ["list_computers", "get_computer", "use_computer", "wait_for_computer", "get_desktop_url", "list_sizes"];
+    readonly events: readonly ["wait_for_event", "poll_events", "wait_for_file_change"];
+    readonly executions: readonly ["get_execution", "read_execution_output"];
+    readonly files: readonly ["list_directory", "read_file", "write_file", "wait_for_file_change"];
+    readonly guest: readonly ["exec", "exec_poll", "exec_kill", "open_url", "list_windows", "window_action", "read_clipboard", "write_clipboard"];
+    readonly input: readonly ["screenshot", "click", "type_text", "press_key", "scroll", "drag", "move_mouse", "mouse_button", "cursor_position", "wait"];
+    readonly lifecycle: readonly ["create_computer", "start_computer", "stop_computer", "suspend_computer", "restart_computer", "update_computer", "clone_computer", "delete_computer", "move_computer", "list_moves"];
+    readonly results: readonly ["get_activity_results", "retain_execution_output", "get_result", "read_result_output", "delete_result"];
+    readonly snapshots: readonly ["list_snapshots", "snapshot_holdings", "create_snapshot", "restore_snapshot", "clone_snapshot", "snapshot_schedule", "get_retention", "delete_snapshot"];
+    readonly templates: readonly ["list_templates", "get_template_schema", "check_template", "publish_template", "get_template", "retire_template", "build_template", "list_builds", "get_build", "watch_build"];
+    readonly secrets: readonly ["get_computer_secrets", "set_computer_secrets"];
+    readonly ssh: readonly ["list_ssh_keys", "add_ssh_key", "remove_ssh_key", "get_computer_ssh", "set_computer_ssh"];
+    readonly usage: readonly ["get_usage"];
+    readonly webhooks: readonly ["list_webhooks", "create_webhook", "get_webhook", "update_webhook", "rotate_webhook_secret", "test_webhook", "list_webhook_deliveries", "delete_webhook"];
+};
+export type ToolTag = keyof typeof TOOL_TAGS;
+export type ToolFilters = {
+    /** Keep only tools whose existing readOnlyHint is exactly true. */
+    readOnly?: boolean;
+    /** Union of these tags; absent or empty means all tags. Names are lowercase. */
+    tags?: readonly string[];
+};
+export declare const VALID_TAGS: ToolTag[];
+export declare function parseToolTags(raw: string | undefined): ToolTag[];
+/** Validate before constructing the session; never infer read-only from a name or verb. */
+export declare function toolFilter(cfg: ToolFilters): {
+    filtered: boolean;
+    allows: (name: string, annotations?: ToolAnnotations) => boolean;
+};
+//# sourceMappingURL=tool-filters.d.ts.map

package/dist/tool-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filters.d.ts","sourceRoot":"","sources":["../src/tool-filters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,sEAAsE;AACtE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;CA6FZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,CAAC;AAC7C,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,UAAU,EAAoC,OAAO,EAAE,CAAC;AAcrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE,CAEhE;AAED,2FAA2F;AAC3F,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG;IAC5C,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC;CAClE,CAmBA"}