nine-hundred 0.0.1

package/dist/agent/hooks/types.js

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+// 支持的 hook 事件名。
+// PreToolUse / PostToolUse 跑在 tool 调用前后；SessionStart / Stop 跟会话生命周期相关；
+// UserPromptSubmit 跑在用户消息进入 agent 之前。
+export const HOOK_EVENTS = [
+    'PreToolUse',
+    'PostToolUse',
+    'SessionStart',
+    'UserPromptSubmit',
+    'Stop',
+];
+// 单条 hook 配置。matcher 只在 PreToolUse/PostToolUse 有意义：
+//   '*' 或缺省 → 匹配所有 tool；
+//   其它字符串 → 对 tool.name 做 substring 匹配（区分大小写）。
+// timeoutMs 可覆盖默认 hook 超时。
+export const HookEntrySchema = z.object({
+    matcher: z.string().optional(),
+    command: z.string().min(1),
+    timeoutMs: z.number().int().positive().optional(),
+});
+// hooks.json 顶层结构。每个 event 是该事件下要跑的 hook 数组（按数组顺序执行）。
+export const HookConfigSchema = z.object({
+    hooks: z
+        .object({
+        PreToolUse: z.array(HookEntrySchema).optional(),
+        PostToolUse: z.array(HookEntrySchema).optional(),
+        SessionStart: z.array(HookEntrySchema).optional(),
+        UserPromptSubmit: z.array(HookEntrySchema).optional(),
+        Stop: z.array(HookEntrySchema).optional(),
+    })
+        .strict(),
+});

package/dist/agent/index.js

@@ -0,0 +1,465 @@
+import * as crypto from 'node:crypto';
+import { AIMessage, AIMessageChunk, HumanMessage, SystemMessage, ToolMessage, } from '@langchain/core/messages';
+import { Annotation, Command, END, interrupt, messagesStateReducer, START, StateGraph, } from '@langchain/langgraph';
+import { buildLlmInputMessages, getMessagesToCompress, KEEP_RECENT, summarizeMessages, } from './context/compress.js';
+import { systemPrompt } from './prompt/index.js';
+import { checkpointer } from '../db/index.js';
+import { getModel } from './llm/index.js';
+import { getToolsForRunMode, maybePersistedOutput, registerSubagentRunner, } from './tools.js';
+import { logToolCall } from './tools/tool_logger.js';
+import { checkExecPermission } from './permission/exec.js';
+import { checkNetworkPermission } from './permission/network.js';
+import { checkReadPermission } from './permission/read.js';
+import { checkWritePermission } from './permission/write.js';
+import { runPostToolUseHooks, runPreToolUseHooks, runSessionStartHook, runStopHook, } from './hooks/index.js';
+const systemMessage = new SystemMessage(systemPrompt);
+function createAgentRuntimeConfig(options) {
+    const mode = options.mode ?? 'main';
+    return {
+        configurable: {
+            thread_id: options.threadId,
+            agent_mode: mode,
+            disable_context_compression: options.disableContextCompression ?? mode === 'subagent',
+        },
+        signal: options.signal,
+    };
+}
+function resolveAgentRuntime(config) {
+    const mode = config.configurable?.agent_mode === 'subagent' ? 'subagent' : 'main';
+    return {
+        mode,
+        tools: getToolsForRunMode(mode),
+        systemMessage,
+        disableContextCompression: config.configurable?.disable_context_compression === true,
+    };
+}
+// messages 是持久化的真历史；llmInputMessages 是每轮 preprocess 重建的「模型这一轮看的视图」。
+// 视图 reducer 用覆盖语义：写入即整体替换，便于 preprocess 自由重组（压缩、翻译、删条等）。
+// 下方三个 summary / summarizedIndex / compressionCount 是上下文压缩专用 channel:
+// 标准 Annotation,覆盖式 reducer,由 SqliteSaver 自动持久化,跨进程重启可读;
+// default 兜底旧 checkpoint 缺字段场景,加载时拿 null/0/0,不抛错。
+const StateAnnotation = Annotation.Root({
+    messages: Annotation({
+        reducer: messagesStateReducer,
+        default: () => [],
+    }),
+    llmInputMessages: Annotation({
+        reducer: (_, update) => messagesStateReducer([], update),
+        default: () => [],
+    }),
+    summary: Annotation({
+        reducer: (_, update) => update,
+        default: () => null,
+    }),
+    summarizedIndex: Annotation({
+        reducer: (_, update) => update,
+        default: () => 0,
+    }),
+    compressionCount: Annotation({
+        reducer: (_, update) => update,
+        default: () => 0,
+    }),
+    hookStopMessage: Annotation({
+        reducer: (_, update) => update,
+        default: () => null,
+    }),
+});
+// 已执行过的 tool_call_id 不再重跑——给未来在工具循环里加 preprocess 或断点恢复留幂等保护。
+export async function toolNode(state, config) {
+    const runtime = resolveAgentRuntime(config);
+    const messages = state.messages;
+    const repliedIds = new Set(messages.filter((m) => m instanceof ToolMessage).map((m) => m.tool_call_id));
+    let aiMessage;
+    for (let i = messages.length - 1; i >= 0; i--) {
+        if (messages[i] instanceof AIMessage || messages[i] instanceof AIMessageChunk) {
+            aiMessage = messages[i];
+            break;
+        }
+    }
+    if (!aiMessage) {
+        throw new Error('toolNode requires an AIMessage in state.');
+    }
+    const toolCalls = aiMessage.tool_calls?.filter((c) => c.id == null || !repliedIds.has(c.id)) ?? [];
+    const outputs = [];
+    for (let callIndex = 0; callIndex < toolCalls.length; callIndex++) {
+        const call = toolCalls[callIndex];
+        const tool = runtime.tools.find((t) => t.name === call.name);
+        if (!tool) {
+            outputs.push(new ToolMessage({
+                content: `Error: Tool "${call.name}" not found.`,
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+            continue;
+        }
+        // read / write 工具的 filepath 三级决策:allow 跳过 interrupt、block
+        // 返回 ToolMessage 给 LLM、ask 落回原有 interrupt 流程;exec 工具额外
+        // 阻断 cwd 切到子目录或命令中含 cd / pushd 的调用;network 工具对
+        // 安全域名 allow、对陌生 URL ask。
+        // 未匹配到 case 的 permission 级别(目前是 db 以及将来新加的级别)
+        // 直接 allow —— 既然没专门的检查逻辑,就视为可信,让工具跑。
+        const toolArgs = (call.args ?? {});
+        let filepathDecision;
+        switch (tool.permission_level) {
+            case 'read':
+                filepathDecision = await checkReadPermission(toolArgs);
+                break;
+            case 'write':
+                filepathDecision = await checkWritePermission(toolArgs);
+                break;
+            case 'exec':
+                filepathDecision = await checkExecPermission(toolArgs);
+                break;
+            case 'network':
+                filepathDecision = await checkNetworkPermission(toolArgs);
+                break;
+            case 'mcp':
+                filepathDecision = { action: 'ask' };
+                break;
+            default:
+                filepathDecision = { action: 'allow' };
+        }
+        if (filepathDecision.action === 'block') {
+            outputs.push(new ToolMessage({
+                content: filepathDecision.message,
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+            continue;
+        }
+        const approved = filepathDecision.action === 'allow'
+            ? true
+            : interrupt({
+                toolName: call.name,
+                args: call.args,
+                description: tool.description,
+            }).approved;
+        if (!approved) {
+            outputs.push(new ToolMessage({
+                content: '用户拒绝了该操作',
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+            continue;
+        }
+        // PreToolUse hook: 在硬编码安全层之上多加一道用户配置的拦截。
+        // 硬编码 block 已经在上面的 switch 里短路，所以这里只会看到 allow / ask（已确认）。
+        const threadId = config.configurable?.thread_id ?? 'default-session';
+        const preHook = await runPreToolUseHooks({
+            event: 'PreToolUse',
+            threadId,
+            tool: { name: call.name, permissionLevel: tool.permission_level },
+            args: toolArgs,
+        });
+        if (preHook.block) {
+            const blockMessage = preHook.block.message;
+            outputs.push(new ToolMessage({
+                content: blockMessage,
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+            for (const skippedCall of toolCalls.slice(callIndex + 1)) {
+                outputs.push(new ToolMessage({
+                    content: `Skipped because a PreToolUse hook blocked execution: ${blockMessage}`,
+                    tool_call_id: skippedCall.id ?? '',
+                    name: skippedCall.name,
+                }));
+            }
+            return new Command({
+                update: { messages: outputs, hookStopMessage: blockMessage },
+                goto: END,
+            });
+        }
+        try {
+            logToolCall(call.name, JSON.stringify(call.args));
+            const output = await tool.invoke({ ...call, type: 'tool_call' }, config);
+            const content = typeof output === 'string' ? output : JSON.stringify(output);
+            const toolContent = await maybePersistedOutput(content, call.id ?? '');
+            outputs.push(new ToolMessage({
+                content: toolContent,
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+            // PostToolUse hook: 工具成功返回后再观察一次。exit 1 此时无意义（tool 已跑），
+            // runner 内部已经 warn-log，这里不再处理；只收 exit 2 注入的上下文。
+            const postHook = await runPostToolUseHooks({
+                event: 'PostToolUse',
+                threadId,
+                tool: { name: call.name },
+                args: toolArgs,
+                result: toolContent,
+                isError: false,
+            });
+            if (postHook.additionalContext) {
+                outputs.push(new HumanMessage(`[hook PostToolUse output]\n${postHook.additionalContext}`));
+            }
+        }
+        catch (e) {
+            outputs.push(new ToolMessage({
+                content: `Error: ${e.message}\n Please fix your mistakes.`,
+                tool_call_id: call.id ?? '',
+                name: call.name,
+            }));
+        }
+        // PreToolUse 的 exit 2 注入：tool 还没跑、context 怎么放都别扭，
+        // 选最朴素的方案——和 PostToolUse 一样在 ToolMessage 之后再追加一条 HumanMessage。
+        if (preHook.additionalContext) {
+            outputs.push(new HumanMessage(`[hook PreToolUse output]\n${preHook.additionalContext}`));
+        }
+    }
+    return { messages: outputs };
+}
+// preprocess 基于真历史 messages 生成本轮 llmInputMessages 视图。
+// 默认使用摘要+最近消息；subagent 显式关闭压缩视图时直接使用完整独立历史。
+async function preprocess(state, config) {
+    const runtime = resolveAgentRuntime(config);
+    const llmInputMessages = runtime.disableContextCompression
+        ? state.messages
+        : buildLlmInputMessages({
+            messages: state.messages,
+            summary: state.summary,
+        });
+    return { llmInputMessages, hookStopMessage: null };
+}
+async function callModel(state, config) {
+    const runtime = resolveAgentRuntime(config);
+    // preprocess 已经全权负责了 llmInputMessages 的构建（全部历史或摘要+最近 6 条），
+    // 这里直接使用它，不再回退到 state.messages，避免异常时跳过摘要导致 token 爆掉。
+    const input = state.llmInputMessages;
+    const response = await getModel()
+        .bindTools(runtime.tools)
+        .invoke([runtime.systemMessage, ...input]);
+    return { messages: [response] };
+}
+function shouldContinue(state) {
+    const last = state.messages.at(-1);
+    if (last?.tool_calls && last.tool_calls.length > 0) {
+        return 'tools';
+    }
+    return END;
+}
+export const agent = new StateGraph(StateAnnotation)
+    .addNode('preprocess', preprocess)
+    .addNode('model_request', callModel)
+    .addNode('tools', toolNode)
+    .addEdge(START, 'preprocess')
+    .addEdge('preprocess', 'model_request')
+    .addConditionalEdges('model_request', shouldContinue, ['tools', END])
+    .addEdge('tools', 'preprocess')
+    .compile({ checkpointer });
+/**
+ * 对指定会话的历史消息执行压缩摘要。
+ * 压缩结果写入内存缓存，供下一轮 preprocess 构建 llmInputMessages 时使用。
+ * @param threadId 会话 ID
+ * @returns 若产生了新压缩返回 CompressionResult；否则返回 null（无新消息可压或压缩失败）
+ */
+export async function compressContext(threadId) {
+    const config = { configurable: { thread_id: threadId } };
+    try {
+        const snapshot = await agent.getState(config);
+        const state = snapshot.values;
+        const toCompress = getMessagesToCompress({
+            messages: state.messages,
+            summarizedIndex: state.summarizedIndex,
+        });
+        if (toCompress.length === 0)
+            return null;
+        const newSummary = await summarizeMessages(toCompress);
+        const summary = state.summary
+            ? `${state.summary}\n\n--- 后续摘要 ---\n\n${newSummary}`
+            : newSummary;
+        const compressionCount = state.compressionCount + 1;
+        const summarizedIndex = state.messages.length - KEEP_RECENT;
+        await agent.updateState(config, { summary, compressionCount, summarizedIndex });
+        return { compressed: true, compressionCount };
+    }
+    catch {
+        return null;
+    }
+}
+export async function runAgentStream(userMessage, onContent, threadId = 'default-session', options = {}) {
+    return runAgentWithPrompt(userMessage, onContent, {
+        threadId,
+        signal: options.signal,
+        onConfirm: options.onConfirm,
+        mode: options.mode,
+        disableContextCompression: options.disableContextCompression,
+    });
+}
+export async function runAgentWithPrompt(userMessage, onContent, options) {
+    const config = createAgentRuntimeConfig(options);
+    const threadId = options.threadId;
+    const thinkFilter = createThinkFilter();
+    let fullResponse = '';
+    let lastUsage = null;
+    let isResume = false;
+    let resumeValue;
+    // 跟踪本轮是否被用户 ESC 中断——Stop hook 的 reason 用。
+    let stopReason = 'completed';
+    // SessionStart hook：只在非 resume（也就是 runAgentWithPrompt 第一次被调、不是 interrupt 恢复）
+    // 时跑一次；resume 路径代表"这条 thread 还在继续"，不应再触发 SessionStart。
+    // additionalContext 拼到 userMessage 顶部，作为额外的 HumanMessage 上下文。
+    const startInput = { event: 'SessionStart', threadId, cwd: process.cwd() };
+    const sessionStart = await runSessionStartHook(startInput);
+    const effectiveUserMessage = sessionStart.additionalContext
+        ? `${sessionStart.additionalContext}\n\n${userMessage}`
+        : userMessage;
+    try {
+        while (true) {
+            const input = isResume
+                ? new Command({ resume: resumeValue })
+                : { messages: [new HumanMessage(effectiveUserMessage)] };
+            const stream = await agent.stream(input, { ...config, streamMode: 'messages' });
+            for await (const chunk of stream) {
+                const message = chunk[0];
+                const metadata = chunk[1];
+                if (metadata?.langgraph_node !== 'model_request')
+                    continue;
+                // usage_metadata 通常出现在末尾的 content 为空的 chunk 上，必须在下面的过滤之前抓。
+                // 工具循环会有多次 model_request，取最后一个 pass 的 usage 反映「本轮结束后的上下文体量」。
+                const usage = message.usage_metadata;
+                if (usage)
+                    lastUsage = usage;
+                // AIMessageChunk 的 content 在 message.content 属性上，不在 kwargs.content
+                const content = message.content ?? message.kwargs?.content ?? '';
+                const toolCallChunks = message.tool_call_chunks ?? [];
+                if (!content || toolCallChunks.length > 0)
+                    continue;
+                const visible = thinkFilter(content);
+                if (!visible)
+                    continue;
+                onContent(visible);
+                fullResponse += visible;
+            }
+            // stream 结束后检查是否被 interrupt，或是否被 hook 主动停止。
+            const snapshot = await agent.getState(config);
+            const interruptInfo = snapshot.tasks?.[0]?.interrupts?.[0];
+            if (!interruptInfo) {
+                const hookStopMessage = snapshot.values.hookStopMessage;
+                if (hookStopMessage) {
+                    onContent(hookStopMessage);
+                    fullResponse += hookStopMessage;
+                }
+                break;
+            }
+            const approved = (await options.onConfirm?.(interruptInfo.value)) ?? true;
+            resumeValue = { approved };
+            isResume = true;
+        }
+    }
+    catch (err) {
+        // ESC 中断走的也是 throw——区分一下，让 Stop hook 拿到正确的 reason。
+        if (options.signal?.aborted) {
+            stopReason = 'aborted';
+        }
+        else {
+            throw err;
+        }
+    }
+    finally {
+        // Stop hook：本轮会话结束（包括 ESC 中断）就跑一次。CLI 侧的 /new / exit
+        // 不走 runAgentStream，由 cli/index.ts 单独调 runStopHook 传不同的 reason。
+        await runStopHook({ event: 'Stop', threadId, reason: stopReason });
+    }
+    return { response: fullResponse, usage: lastUsage };
+}
+function createSubagentThreadId(parentThreadId) {
+    const id = crypto.randomUUID();
+    return parentThreadId ? `${parentThreadId}-subagent-${id}` : `subagent-session-${id}`;
+}
+registerSubagentRunner(async ({ prompt, parentThreadId }) => {
+    const threadId = createSubagentThreadId(parentThreadId);
+    const result = await runAgentWithPrompt(prompt, () => { }, {
+        threadId,
+        mode: 'subagent',
+        disableContextCompression: true,
+    });
+    return result.response;
+});
+// 流式过滤 <think>...</think> 块。
+//
+// 难点：标签可能跨 chunk 切开（如 chunk A 结尾 "<thi"、chunk B 开头 "nk>"），
+// 简单的 chunk.replace 会漏；而等全部 token 收齐再过滤又破坏流式体验。
+// 解决方案：两状态机 + 尾部前缀缓冲。
+//
+// - mode: 当前光标在 think 块内还是块外
+// - buffer: 上一 chunk 尾部"可能是 <think> / </think> 前缀"的未决字符，
+//           不输出也不丢弃，与下一 chunk 拼接后再判断
+// - swallowLeadingWs: 刚关闭 think 块时置位，吃掉紧随的换行/空白
+//           （模型常输出 "</think>\n\nHi"，不吃会留下空行）
+function createThinkFilter() {
+    const OPEN = '<think>';
+    const CLOSE = '</think>';
+    let mode = 'outside';
+    let buffer = '';
+    let swallowLeadingWs = false;
+    // s 是 tag 的真前缀（短于 tag 且能匹配开头），用于判断尾部是否未决
+    const isPrefixOf = (s, tag) => s.length < tag.length && tag.startsWith(s);
+    return (chunk) => {
+        let input = buffer + chunk;
+        buffer = '';
+        let out = '';
+        while (input.length > 0) {
+            if (mode === 'outside') {
+                const openIdx = input.indexOf(OPEN);
+                if (openIdx !== -1) {
+                    // 完整 <think> 在 input 中：输出标签前的正文，进入 inside
+                    let head = input.slice(0, openIdx);
+                    if (swallowLeadingWs) {
+                        head = head.replace(/^\s+/, '');
+                        if (head.length > 0)
+                            swallowLeadingWs = false;
+                    }
+                    out += head;
+                    input = input.slice(openIdx + OPEN.length);
+                    mode = 'inside';
+                    continue;
+                }
+                // 没有完整 <think>，但尾部可能是它的前缀（如 "<", "<t", "<thi"）。
+                // 用 lastIndexOf('<') 找到最后一个候选起点；如果从那里到末尾正好
+                // 是 OPEN 的真前缀，就把这段存入 buffer，等下一 chunk 再裁决。
+                const lt = input.lastIndexOf('<');
+                if (lt !== -1 && isPrefixOf(input.slice(lt), OPEN)) {
+                    let head = input.slice(0, lt);
+                    if (swallowLeadingWs) {
+                        head = head.replace(/^\s+/, '');
+                        if (head.length > 0)
+                            swallowLeadingWs = false;
+                    }
+                    out += head;
+                    buffer = input.slice(lt);
+                    input = '';
+                }
+                else {
+                    // 整段都不可能是标签前缀，直接透传
+                    if (swallowLeadingWs) {
+                        input = input.replace(/^\s+/, '');
+                        if (input.length > 0)
+                            swallowLeadingWs = false;
+                    }
+                    out += input;
+                    input = '';
+                }
+            }
+            else {
+                const closeIdx = input.indexOf(CLOSE);
+                if (closeIdx !== -1) {
+                    // 完整 </think>：丢弃从开始到标签结束的所有内容（think 块内容不输出），
+                    // 切回 outside 并置位 swallowLeadingWs，吃掉接下来的换行/空格
+                    input = input.slice(closeIdx + CLOSE.length);
+                    mode = 'outside';
+                    swallowLeadingWs = true;
+                    continue;
+                }
+                // inside 模式下整段都不输出，但仍要把"可能是 </think> 前缀"的尾部
+                // 留到 buffer —— 否则下一 chunk 来时，缺了前缀就匹配不到完整 CLOSE
+                const lt = input.lastIndexOf('<');
+                if (lt !== -1 && isPrefixOf(input.slice(lt), CLOSE)) {
+                    buffer = input.slice(lt);
+                }
+                input = '';
+            }
+        }
+        return out;
+    };
+}

package/dist/agent/llm/index.js

@@ -0,0 +1,35 @@
+import { ChatOpenAI } from '@langchain/openai';
+import { getModelConfig } from '../config/index.js';
+let modelInstance;
+export function getModel() {
+    if (!modelInstance) {
+        const modelConfig = getModelConfig();
+        modelInstance = new ChatOpenAI({
+            model: modelConfig.model,
+            apiKey: modelConfig.apiKey,
+            configuration: {
+                baseURL: modelConfig.baseURL,
+            },
+            streaming: true,
+            modelKwargs: {
+                thinking: { type: 'disabled' },
+            },
+        });
+    }
+    return modelInstance;
+}
+let compressModelInstance;
+export function getCompressModel() {
+    if (!compressModelInstance) {
+        const modelConfig = getModelConfig();
+        compressModelInstance = new ChatOpenAI({
+            model: modelConfig.model,
+            apiKey: modelConfig.apiKey,
+            configuration: {
+                baseURL: modelConfig.baseURL,
+            },
+            streaming: false,
+        });
+    }
+    return compressModelInstance;
+}

package/dist/agent/mcp/client.js

@@ -0,0 +1,87 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { isHttpConfig, isStdioConfig } from './config.js';
+export class McpServerClient {
+    serverName;
+    params;
+    client;
+    transport;
+    tools = [];
+    connected = false;
+    constructor(serverName, params) {
+        this.serverName = serverName;
+        this.params = params;
+        this.client = new Client({ name: `900-mcp-${serverName}`, version: '1.0.0' });
+        this.transport = this.createTransport(params);
+        this.transport.onerror = (err) => {
+            console.warn(`[MCP ${serverName}] transport error: ${err.message}`);
+        };
+        this.transport.onclose = () => {
+            if (this.connected) {
+                console.warn(`[MCP ${serverName}] connection closed.`);
+                this.connected = false;
+                this.tools = [];
+            }
+        };
+    }
+    createTransport(params) {
+        if (isHttpConfig(params)) {
+            return new StreamableHTTPClientTransport(new URL(params.url), {
+                requestInit: params.headers
+                    ? { headers: params.headers }
+                    : undefined,
+            });
+        }
+        if (isStdioConfig(params)) {
+            return new StdioClientTransport({
+                command: params.command,
+                args: params.args,
+                env: params.env,
+                stderr: 'pipe',
+            });
+        }
+        throw new Error('Unsupported MCP server configuration');
+    }
+    async connect() {
+        await this.client.connect(this.transport);
+        const result = await this.client.listTools();
+        this.tools = result.tools.map((t) => ({
+            name: t.name,
+            description: t.description ?? `MCP tool from server "${this.serverName}"`,
+            inputSchema: t.inputSchema,
+        }));
+        this.connected = true;
+    }
+    async disconnect() {
+        try {
+            await this.transport.close();
+        }
+        catch {
+            // ignore
+        }
+        this.connected = false;
+        this.tools = [];
+    }
+    getTools() {
+        return this.tools;
+    }
+    async callTool(name, args) {
+        if (!this.connected) {
+            throw new Error(`MCP server "${this.serverName}" is not connected.`);
+        }
+        const result = await this.client.callTool({ name, arguments: args }, CallToolResultSchema);
+        const contents = result.content;
+        const texts = [];
+        for (const item of contents) {
+            if (item.type === 'text' && typeof item.text === 'string') {
+                texts.push(item.text);
+            }
+            else {
+                texts.push(`[${item.type}]: ${JSON.stringify(item)}`);
+            }
+        }
+        return texts.join('\n\n');
+    }
+}

package/dist/agent/mcp/config.js

@@ -0,0 +1,51 @@
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { CONFIG_FILE } from '../config/index.js';
+const McpServerConfigSchema = z
+    .object({
+    command: z.string().optional(),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    url: z.string().url().optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+})
+    .refine((data) => {
+    const hasCommand = data.command !== undefined;
+    const hasUrl = data.url !== undefined;
+    return (hasCommand || hasUrl) && !(hasCommand && hasUrl);
+}, {
+    message: 'MCP server config must have either "command" (stdio) or "url" (HTTP), not both or neither',
+});
+const McpConfigSchema = z.object({
+    mcpServers: z.record(z.string(), McpServerConfigSchema),
+});
+export function isStdioConfig(config) {
+    return 'command' in config && config.command !== undefined;
+}
+export function isHttpConfig(config) {
+    return 'url' in config && config.url !== undefined;
+}
+export async function readMcpConfig() {
+    let raw;
+    try {
+        raw = await readFile(CONFIG_FILE, 'utf8');
+    }
+    catch (err) {
+        if (err instanceof Error && 'code' in err && err.code === 'ENOENT') {
+            return { mcpServers: {} };
+        }
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Invalid JSON in ${CONFIG_FILE}: ${err.message}`);
+    }
+    const mcpServers = parsed?.mcpServers;
+    if (!mcpServers) {
+        return { mcpServers: {} };
+    }
+    return McpConfigSchema.parse({ mcpServers });
+}