pi-cloudflare 0.5.5 → 0.6.0

package/README.md

@@ -1,7 +1,8 @@
 # pi-cloudflare
 
-One install for Cloudflare-driven agent work: **skills + MCP tools + setup
-helper** in a single pi package.
+One package for Cloudflare-driven agent work: **skills + MCP tools + setup
+helper**, distributed both as a native Pi package and an
+[Agent Plugins 1.0](https://agent-plugins.org/) package.
 
 - **Skills** (12 vendored from the official
   [cloudflare/skills](https://github.com/cloudflare/skills) repo: `cloudflare`,
@@ -21,26 +22,45 @@ helper** in a single pi package.
   | `cf_builds_*`   | Workers Builds insights                  |
   | `cf_obs_*`      | Workers logs/metrics/traces              |
 
-Requires pi with package support, Node 20.19+ (or 22.12+), and network
-access. No browser, wrangler CLI, or API token needed to install; the docs
-tools work immediately after install.
+Requires Node 20.19+ (or 22.12+) and network access. Native Pi installation
+also requires Pi package support. No browser, wrangler CLI, or API token is
+needed to install; the docs tools work immediately after install.
 
 ![Architecture](https://raw.githubusercontent.com/0xPlayerOne/pi-cloudflare/main/docs/assets/architecture.svg)
 
 ## Install
 
+### Pi
+
 ```bash
 pi install npm:pi-cloudflare
 ```
 
-Tools and skills register on the **next** session start. (`web-perf` is
-intentionally not vendored: keep a local customized copy instead, since the
-upstream version would clobber environment-specific rules.)
+Tools and skills register on the **next** session start.
+
+### Agent Plugins 1.0
+
+The published npm package is also a self-contained Agent Plugin. Its root
+`plugin.json` discovers `skills/`, while `mcp.json` launches the portable
+stdio gateway in `dist/mcp-server.js`.
+
+Agent Plugins deliberately leaves installation sources to each client. Install
+or unpack the npm package using the client-specific plugin flow, with the
+package root as `PLUGIN_ROOT`. A raw Git checkout must be built first with
+`npm ci && npm run build`; npm releases already contain `dist/`.
+
+The portable gateway exposes the same `cf_api_*`, `cf_docs_*`,
+`cf_bindings_*`, `cf_builds_*`, and `cf_obs_*` tool names as the native Pi
+adapter. OAuth state is stored under the client-managed `${PLUGIN_DATA}`
+directory rather than `~/.pi`.
+
+(`web-perf` is intentionally not vendored: keep a local customized copy
+instead, since the upstream version would clobber environment-specific rules.)
 
 ## Authenticate (one-time browser OAuth)
 
 ```bash
-npx -p pi-cloudflare pi-cloudflare-setup                    # authorize missing servers
+npx -p pi-cloudflare pi-cloudflare-setup                  # authorize missing servers
 npx -p pi-cloudflare pi-cloudflare-setup --only builds    # re-auth specific servers
 ```
 
@@ -50,9 +70,14 @@ you approve, and tokens (with refresh) are stored owner-only in
 `~/.pi/cloudflare-tokens.json`. The extension refreshes them silently
 before expiry, and setup skips servers that are still fresh. If a server
 later rejects its token, rerun setup (with `--only` for just that one).
+
+Agent Plugins clients use their own token file under `${PLUGIN_DATA}`. When
+authentication is missing or rejected, call the generated
+`cf_<server>_reauthenticate` tool and run the exact command it returns; that
+command includes the plugin-local setup script and the correct data path.
 Nothing is ever logged or committed.
 
-## Configure (optional)
+## Configure Pi (optional)
 
 In `~/.pi/agent/settings.json`:
 
@@ -67,12 +92,11 @@ In `~/.pi/agent/settings.json`:
 
 ## Persistent auth (a month and beyond)
 
-Browser OAuth access tokens live about an hour; the extension refreshes
-them silently on every session start and before every tool call, so daily
-use never re-authenticates. When refresh itself is rejected (revoked,
-rotated away by a parallel login, or expired), agents get an exact
-recovery command instead of a dead end — and a `cf_<server>_reauthenticate`
-tool appears with the same instructions.
+Browser OAuth access tokens live about an hour; both adapters refresh them
+silently before tool calls, so daily use normally does not re-authenticate.
+When refresh itself is rejected (revoked, rotated away by a parallel login,
+or expired), agents get an exact recovery command instead of a dead end — and
+a `cf_<server>_reauthenticate` tool appears with the same instructions.
 
 Two levers for longer-lived credentials:
 
@@ -83,11 +107,15 @@ Two levers for longer-lived credentials:
    ```jsonc
    {
      "pi-cloudflare": {
-       "apiToken": "${CLOUDFLARE_API_TOKEN}", // env expansion supported
+       "apiToken": "${CLOUDFLARE_API_TOKEN}", // native Pi
      },
    }
    ```
 
+   Agent Plugin hosts can supply `CLOUDFLARE_API_TOKEN` to the MCP subprocess
+   through their client-specific environment/secret mechanism. Agent Plugins
+   1.0 intentionally does not define a portable secret-reference field.
+
    Create one at dash.cloudflare.com → Manage Account → API Tokens with
    the scopes your agents need (exact template, additions, and account
    scoping in `docs/api-token.md`). Other servers stay on browser OAuth.
@@ -124,9 +152,9 @@ closed on scope). They complement; neither replaces the other.
 | Symptom                                      | Likely cause                            | Fix                                                                                                                  |
 | -------------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
 | `Browser connection failed` on session start | A server is down or its token expired   | The extension skips it with a warning and continues; rerun `pi-cloudflare-setup --only <server>` for the failing one |
-| OAuth tab never opens                        | Headless environment or blocked popup   | Copy the printed URL into any browser; tokens land in `~/.pi/cloudflare-tokens.json` either way                      |
-| `401` from one server only                   | That server's refresh token was revoked | `npx -p pi-cloudflare pi-cloudflare-setup --only <server>`                                                           |
-| Tools missing for a server                   | Disabled via `servers: { <id>: false }` | Re-enable in settings; tools register on next session start                                                          |
+| OAuth tab never opens                        | Headless environment or blocked popup   | Copy the printed URL into any browser; native Pi tokens land in `~/.pi/cloudflare-tokens.json`                       |
+| `401` from one server only                   | That server's refresh token was revoked | Call `cf_<server>_reauthenticate` for the host-correct recovery command                                              |
+| Tools missing for a server                   | Disabled in native Pi settings          | Re-enable it; tools register on next session start                                                                   |
 | Rate-limited API calls                       | Too many write calls in a loop          | Back off and batch; prefer one `cf_api_execute` with a precise query over paginated scans                            |
 
 ## Development

package/bin/setup.mjs

@@ -2,20 +2,30 @@
 /**
  * pi-cloudflare setup: one-time browser OAuth for every Cloudflare MCP
  * server. Each server is its own OAuth issuer, so approval happens once per
- * server (docs needs none). Tokens (with refresh) are stored owner-only in
- * ~/.pi/cloudflare-tokens.json and refreshed automatically afterwards.
+ * server (docs needs none).
+ *
+ * Native Pi defaults to ~/.pi/cloudflare-tokens.json. Agent Plugins clients
+ * pass --token-file with their ${PLUGIN_DATA} path so credentials remain
+ * client-local and do not require Pi to be installed.
  *
  * Usage:
- *   pi-cloudflare-setup                  # authorize missing/expired servers
- *   pi-cloudflare-setup --only builds    # re-auth specific servers
+ *   pi-cloudflare-setup
+ *   pi-cloudflare-setup --only builds
  *   pi-cloudflare-setup --only api,observability
+ *   pi-cloudflare-setup --token-file /path/to/cloudflare-tokens.json --only api
  *
  * Nothing secret is ever logged or written anywhere else.
  */
 import { connectAll } from '../dist/client.js'
 import { CLOUDFLARE_SERVERS } from '../dist/servers.js'
 import { runOAuthFlow } from '../dist/auth-flow.js'
-import { partitionServers, readTokenFile, writeTokenFile } from '../dist/token-store.js'
+import {
+  partitionServers,
+  readTokenFile,
+  readTokenFileAt,
+  writeTokenFile,
+  writeTokenFileAt,
+} from '../dist/token-store.js'
 
 const AUTHED_IDS = ['api', 'bindings', 'builds', 'observability']
 
@@ -39,9 +49,14 @@ function parseOnly() {
   return ids
 }
 
+const tokenFile = argValue('--token-file')
+const readStore = () => (tokenFile ? readTokenFileAt(tokenFile) : readTokenFile())
+const writeStore = (servers) =>
+  tokenFile ? writeTokenFileAt(servers, tokenFile) : writeTokenFile(servers)
+
 const only = parseOnly()
 const wanted = only ?? AUTHED_IDS
-const file = readTokenFile() ?? { version: 1, servers: {} }
+const file = readStore() ?? { version: 1, servers: {} }
 const { fresh, needed } = partitionServers(wanted, file.servers)
 
 if (fresh.length > 0) {
@@ -62,7 +77,7 @@ if (needed.length === 0) {
     try {
       const { tokens, clientId, tokenEndpoint } = await runOAuthFlow(definition)
       file.servers[id] = { ...tokens, clientId, tokenEndpoint }
-      writeTokenFile(file.servers)
+      writeStore(file.servers)
       console.log(`[${index}/${needed.length}] ${id}: authorized and stored\n`)
     } catch (error) {
       console.log(
@@ -73,7 +88,7 @@ if (needed.length === 0) {
 }
 
 console.log('Verifying all servers...\n')
-const stored = readTokenFile()
+const stored = readStore()
 let okCount = 0
 const failed = []
 for (const definition of CLOUDFLARE_SERVERS) {
@@ -98,6 +113,7 @@ for (const definition of CLOUDFLARE_SERVERS) {
 
 console.log(`\n${okCount}/5 servers working.`)
 if (failed.length > 0) {
-  console.log(`Re-authenticate with: pi-cloudflare-setup --only ${failed.join(',')}`)
+  const tokenArg = tokenFile ? ` --token-file ${JSON.stringify(tokenFile)}` : ''
+  console.log(`Re-authenticate with: pi-cloudflare-setup${tokenArg} --only ${failed.join(',')}`)
   process.exit(1)
 }

package/dist/index.d.ts

@@ -1,6 +1,4 @@
-import { type ServerConnection } from './client.js';
-import { type CloudflareServerDefinition } from './servers.js';
-import { type StoredServerTokens } from './token-store.js';
+export { isAuthFailure, reauthHint, syncFromFile } from './runtime.js';
 interface PiToolDefinition {
     name: string;
     label?: string;
@@ -12,36 +10,13 @@ interface PiHost {
     registerTool: (definition: PiToolDefinition) => void;
     on: (event: 'session_start' | 'session_shutdown', handler: (...args: never[]) => unknown) => void;
 }
-interface ServerEntry {
-    definition: CloudflareServerDefinition;
-    connection?: ServerConnection;
-    stored?: StoredServerTokens;
-    /** Static bearer token (api server only): never expires, never refreshes. */
-    staticToken?: string;
-    timeoutMs: number;
-    /** Access token the live connection was built with; drift triggers reconnect. */
-    connectedToken?: string;
-}
-/** Exact command that re-authorizes one server; shown to agents, never guessed. */
-export declare function reauthHint(serverId: string): string;
-/** True when a failure smells like rejected credentials rather than a broken server. */
-export declare function isAuthFailure(error: unknown): boolean;
-/**
- * Adopt rotations performed by sibling sessions: parallel Pi processes
- * share one token file, and refresh grants are single-use. If the file
- * holds a different grant than memory, the file wins without network I/O.
- */
-export declare function syncFromFile(entry: ServerEntry, home?: string): void;
 /**
- * pi-coding-agent extension entry point.
+ * Native pi-coding-agent adapter.
  *
- * Credentials come only from per-server browser OAuth (pi-cloudflare-setup
- * --oauth), stored owner-only in ~/.pi/cloudflare-tokens.json. The docs
- * server needs no credential. On session_start every enabled server is
- * connected independently and its tools registered with a `cf_<server>_`
- * prefix; unreachable servers are skipped with a re-auth hint instead of
- * failing the session. On session_shutdown all connections close.
+ * The Cloudflare runtime is host-independent; Pi contributes only settings,
+ * lifecycle hooks, and tool registration. This preserves the existing
+ * `pi install npm:pi-cloudflare` behavior while Agent Plugins clients use the
+ * stdio adapter in mcp.json.
  */
 export default function piCloudflareExtension(pi: PiHost): void;
-export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAIlE,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAA4C,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAEpG,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB;AAED,UAAU,MAAM;IACd,YAAY,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,CAAA;IACpD,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,IAAI,CAAA;CAClG;AAMD,UAAU,WAAW;IACnB,UAAU,EAAE,0BAA0B,CAAA;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AA4CD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKrD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAKpE;AAmCD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAwF9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEtE,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB;AAED,UAAU,MAAM;IACd,YAAY,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,CAAA;IACpD,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,IAAI,CAAA;CAClG;AAsCD;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAgB9D"}

package/dist/index.js

@@ -1,22 +1,8 @@
+import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
-import { Type } from 'typebox';
-import { connectServer } from './client.js';
-import { refreshAccessToken } from './oauth.js';
-import { resolveConfig } from './config.js';
-import { buildAllRegistrations } from './proxy.js';
-import { CLOUDFLARE_SERVERS } from './servers.js';
-import { isExpired, readTokenFile, writeTokenFile } from './token-store.js';
-async function reconnect(entry) {
-    await entry.connection?.close().catch(() => undefined);
-    const token = entry.staticToken ?? entry.stored?.accessToken;
-    entry.connection = await connectServer(entry.definition, {
-        apiToken: token,
-        timeoutMs: entry.timeoutMs,
-    });
-    entry.connectedToken = token;
-}
+import { CloudflareRuntime } from './runtime.js';
+export { isAuthFailure, reauthHint, syncFromFile } from './runtime.js';
 function expandEnvVars(value) {
     if (typeof value === 'string') {
         return value.replace(/\$\{([^}]+)\}/g, (_match, expr) => {
@@ -47,158 +33,27 @@ function loadUserConfig() {
 function warn(message) {
     console.warn(`[pi-cloudflare] ${message}`);
 }
-/** Exact command that re-authorizes one server; shown to agents, never guessed. */
-export function reauthHint(serverId) {
-    return (`${serverId} needs re-authentication (token expired, revoked, or never granted). ` +
-        `For temporary access, run in a terminal (approve in the browser when it opens): ` +
-        `npx -p pi-cloudflare pi-cloudflare-setup --only ${serverId}. ` +
-        `For persistent access across sessions, create an API token instead — ` +
-        `see the cloudflare-auth-setup skill (it asks once, then sets up either path).`);
-}
-/** True when a failure smells like rejected credentials rather than a broken server. */
-export function isAuthFailure(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return /\b401\b|\b403\b|unauthorized|invalid_token|invalid_grant|token refresh failed|expired|forbidden|authenticate/i.test(message);
-}
 /**
- * Adopt rotations performed by sibling sessions: parallel Pi processes
- * share one token file, and refresh grants are single-use. If the file
- * holds a different grant than memory, the file wins without network I/O.
- */
-export function syncFromFile(entry, home) {
-    const latest = readTokenFile(home)?.servers[entry.definition.id];
-    if (latest && latest.refreshToken !== entry.stored?.refreshToken) {
-        entry.stored = latest;
-    }
-}
-/** Refresh unconditionally (caller decided the token is rejected). Persists and reconnects. */
-async function refreshNow(entry) {
-    syncFromFile(entry);
-    const stored = entry.stored;
-    if (!stored?.refreshToken)
-        throw new Error(`${entry.definition.id}: no refresh token stored`);
-    const fresh = await refreshAccessToken({
-        tokenEndpoint: stored.tokenEndpoint,
-        clientId: stored.clientId,
-        refreshToken: stored.refreshToken,
-    });
-    entry.stored = { ...stored, ...fresh };
-    const file = readTokenFile() ?? { version: 1, servers: {} };
-    file.servers[entry.definition.id] = entry.stored;
-    writeTokenFile(file.servers);
-    await reconnect(entry);
-}
-/** Refresh an OAuth token that is expired (or nearly so), persisting the result. Static tokens skip refresh. */
-async function ensureFreshToken(entry) {
-    if (entry.staticToken)
-        return entry.staticToken;
-    syncFromFile(entry);
-    const stored = entry.stored;
-    if (!stored)
-        return undefined;
-    if (!isExpired(stored) || !stored.refreshToken) {
-        if (!entry.connection || entry.connectedToken !== stored.accessToken) {
-            await reconnect(entry);
-        }
-        return stored.accessToken;
-    }
-    await refreshNow(entry);
-    return entry.stored?.accessToken;
-}
-/**
- * pi-coding-agent extension entry point.
+ * Native pi-coding-agent adapter.
  *
- * Credentials come only from per-server browser OAuth (pi-cloudflare-setup
- * --oauth), stored owner-only in ~/.pi/cloudflare-tokens.json. The docs
- * server needs no credential. On session_start every enabled server is
- * connected independently and its tools registered with a `cf_<server>_`
- * prefix; unreachable servers are skipped with a re-auth hint instead of
- * failing the session. On session_shutdown all connections close.
+ * The Cloudflare runtime is host-independent; Pi contributes only settings,
+ * lifecycle hooks, and tool registration. This preserves the existing
+ * `pi install npm:pi-cloudflare` behavior while Agent Plugins clients use the
+ * stdio adapter in mcp.json.
  */
 export default function piCloudflareExtension(pi) {
-    let entries = [];
+    let runtime;
     pi.on('session_start', async () => {
-        for (const entry of entries) {
-            await entry.connection?.close().catch(() => undefined);
-        }
-        entries = [];
-        const userConfig = loadUserConfig() ?? {};
-        const config = resolveConfig(userConfig);
-        const file = readTokenFile();
-        const definitions = CLOUDFLARE_SERVERS.filter((server) => config.enabledServerIds.includes(server.id));
-        for (const definition of definitions) {
-            const entry = {
-                definition,
-                timeoutMs: config.connectTimeoutMs,
-                staticToken: definition.id === 'api' ? userConfig.apiToken : undefined,
-            };
-            try {
-                entry.stored = file?.servers[definition.id];
-                await ensureFreshToken(entry);
-                if (!entry.connection)
-                    await reconnect(entry);
-                const tools = (await entry.connection?.listTools()) ?? [];
-                const registrations = buildAllRegistrations([
-                    {
-                        prefix: definition.prefix,
-                        tools,
-                        callTool: async (name, params) => {
-                            if (!entry.connection)
-                                throw new Error(`${definition.id}: not connected`);
-                            return entry.connection.callTool(name, params);
-                        },
-                    },
-                ]);
-                for (const registration of registrations) {
-                    pi.registerTool({
-                        ...registration,
-                        execute: async (toolCallId, params, signal) => {
-                            await ensureFreshToken(entry);
-                            try {
-                                return await registration.execute(toolCallId, params, signal);
-                            }
-                            catch (error) {
-                                // Clock-fresh but server-rejected: one forced refresh plus
-                                // reconnect and retry before giving the agent a dead end.
-                                if (!isAuthFailure(error) || entry.staticToken || !entry.stored?.refreshToken) {
-                                    throw error;
-                                }
-                                try {
-                                    await refreshNow(entry);
-                                    return await registration.execute(toolCallId, params, signal);
-                                }
-                                catch {
-                                    const detail = error instanceof Error ? error.message : String(error);
-                                    throw new Error(`${definition.id}: request rejected (${detail}). ${reauthHint(definition.id)}`);
-                                }
-                            }
-                        },
-                    });
-                }
-                entries.push(entry);
-            }
-            catch (error) {
-                warn(`${definition.id}: unavailable (${error instanceof Error ? error.message : String(error)}).`);
-                if (isAuthFailure(error)) {
-                    // Agents rarely see process logs: register a stub they will find.
-                    pi.registerTool({
-                        name: `${definition.prefix}reauthenticate`,
-                        label: `${definition.prefix}reauthenticate`,
-                        description: `${definition.id} is not authenticated. Call this tool for exact re-authentication instructions.`,
-                        parameters: Type.Object({}),
-                        execute: async () => ({
-                            content: [{ type: 'text', text: reauthHint(definition.id) }],
-                        }),
-                    });
-                    warn(reauthHint(definition.id));
-                }
-                await entry.connection?.close().catch(() => undefined);
-            }
+        await runtime?.stop();
+        runtime = new CloudflareRuntime({ config: loadUserConfig() ?? {}, warn });
+        const registrations = await runtime.start();
+        for (const registration of registrations) {
+            pi.registerTool(registration);
         }
     });
     pi.on('session_shutdown', async () => {
-        await Promise.all(entries.map((entry) => entry.connection?.close().catch(() => undefined)));
-        entries = [];
+        await runtime?.stop();
+        runtime = undefined;
     });
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAE9B,OAAO,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAmC,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAA2B,MAAM,kBAAkB,CAAA;AAkCpG,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5D,KAAK,CAAC,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE;QACvD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,KAAK,CAAC,cAAc,GAAG,KAAK,CAAA;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;YAC9D,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC7D,OAAO,aAAa,CAAC,OAAO,CAAuB,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,CACL,GAAG,QAAQ,uEAAuE;QAClF,kFAAkF;QAClF,mDAAmD,QAAQ,IAAI;QAC/D,uEAAuE;QACvE,+EAA+E,CAChF,CAAA;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,+GAA+G,CAAC,IAAI,CACzH,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAkB,EAAE,IAAa;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QACjE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IACvB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,YAAY,CAAC,KAAK,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IACtC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;IAChD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,gHAAgH;AAChH,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IAChD,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC,WAAW,CAAA;IAC/C,YAAY,CAAC,KAAK,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACrE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAA;IAC3B,CAAC;IACD,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAU;IACtD,IAAI,OAAO,GAAkB,EAAE,CAAA;IAE/B,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,GAAG,EAAE,CAAA;QACZ,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAC5C,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAgB;gBACzB,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,gBAAgB;gBAClC,WAAW,EAAE,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aACvE,CAAA;YACD,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC3C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBAC7B,IAAI,CAAC,KAAK,CAAC,UAAU;oBAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC7C,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;gBACzD,MAAM,aAAa,GAAuB,qBAAqB,CAAC;oBAC9D;wBACE,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,KAAK;wBACL,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;4BAC/B,IAAI,CAAC,KAAK,CAAC,UAAU;gCAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAA;4BACzE,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;wBAChD,CAAC;qBACF;iBACF,CAAC,CAAA;gBACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;oBACzC,EAAE,CAAC,YAAY,CAAC;wBACd,GAAG,YAAY;wBACf,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;4BAC5C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;4BAC7B,IAAI,CAAC;gCACH,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;4BAC/D,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,2DAA2D;gCAC3D,0DAA0D;gCAC1D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;oCAC9E,MAAM,KAAK,CAAA;gCACb,CAAC;gCACD,IAAI,CAAC;oCACH,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;oCACvB,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;gCAC/D,CAAC;gCAAC,MAAM,CAAC;oCACP,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oCACrE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,CAAC,EAAE,uBAAuB,MAAM,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAA;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;qBACF,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CACF,GAAG,UAAU,CAAC,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC7F,CAAA;gBACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,kEAAkE;oBAClE,EAAE,CAAC,YAAY,CAAC;wBACd,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,gBAAgB;wBAC1C,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,gBAAgB;wBAC3C,WAAW,EAAE,GAAG,UAAU,CAAC,EAAE,iFAAiF;wBAC9G,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;yBAC7D,CAAC;qBACH,CAAC,CAAA;oBACF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjC,CAAC;gBACD,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC3F,OAAO,GAAG,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAuBtE,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;YAC9D,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC7D,OAAO,aAAa,CAAC,OAAO,CAAuB,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAU;IACtD,IAAI,OAAsC,CAAA;IAE1C,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,EAAE,IAAI,EAAE,CAAA;QACrB,OAAO,GAAG,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACzE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QAC3C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,OAAO,EAAE,IAAI,EAAE,CAAA;QACrB,OAAO,GAAG,SAAS,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/mcp-server.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/mcp-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":""}

package/dist/mcp-server.js

@@ -0,0 +1,106 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { CloudflareRuntime } from './runtime.js';
+import { tokenFilePath } from './token-store.js';
+function packageVersion() {
+    try {
+        const raw = readFileSync(new URL('../package.json', import.meta.url), 'utf8');
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === 'string' ? parsed.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+function positiveInteger(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
+}
+function runtimeConfig() {
+    const timeout = positiveInteger(process.env.PI_CLOUDFLARE_CONNECT_TIMEOUT_MS);
+    return {
+        apiToken: process.env.CLOUDFLARE_API_TOKEN,
+        connectTimeoutMs: timeout,
+    };
+}
+function portableTokenFile() {
+    if (process.env.PI_CLOUDFLARE_TOKEN_FILE)
+        return process.env.PI_CLOUDFLARE_TOKEN_FILE;
+    if (process.env.PLUGIN_DATA)
+        return join(process.env.PLUGIN_DATA, 'cloudflare-tokens.json');
+    return tokenFilePath();
+}
+function portableSetupScript() {
+    const root = process.env.PI_CLOUDFLARE_PLUGIN_ROOT ?? process.env.PLUGIN_ROOT;
+    return root ? join(root, 'bin', 'setup.mjs') : undefined;
+}
+async function main() {
+    const runtime = new CloudflareRuntime({
+        config: runtimeConfig(),
+        tokenFile: portableTokenFile(),
+        setupScript: portableSetupScript(),
+        warn: (message) => console.error(`[pi-cloudflare] ${message}`),
+    });
+    let registrationsPromise;
+    const registrations = () => {
+        registrationsPromise ??= runtime.start();
+        return registrationsPromise;
+    };
+    const server = new Server({ name: 'pi-cloudflare', version: packageVersion() }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const tools = await registrations();
+        return {
+            tools: tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+            })),
+        };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const tools = await registrations();
+        const tool = tools.find((candidate) => candidate.name === request.params.name);
+        if (!tool) {
+            return {
+                content: [{ type: 'text', text: `Unknown tool: ${request.params.name}` }],
+                isError: true,
+            };
+        }
+        try {
+            return await tool.execute('agent-plugin', request.params.arguments ?? {}, undefined);
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: error instanceof Error ? error.message : String(error),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    const shutdown = async () => {
+        await runtime.stop();
+        await server.close();
+    };
+    process.once('SIGINT', () => {
+        void shutdown().finally(() => process.exit(0));
+    });
+    process.once('SIGTERM', () => {
+        void shutdown().finally(() => process.exit(0));
+    });
+}
+main().catch((error) => {
+    console.error(`[pi-cloudflare] MCP server failed: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=mcp-server.js.map

package/dist/mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAA;AAI3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAA;QACvD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAA;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACpE,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;IAC7E,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC1C,gBAAgB,EAAE,OAAO;KAC1B,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAC3F,OAAO,aAAa,EAAE,CAAA;AACxB,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,MAAM,EAAE,aAAa,EAAE;QACvB,SAAS,EAAE,iBAAiB,EAAE;QAC9B,WAAW,EAAE,mBAAmB,EAAE;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,OAAO,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,IAAI,oBAA6D,CAAA;IACjE,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,oBAAoB,KAAK,OAAO,CAAC,KAAK,EAAE,CAAA;QACxC,OAAO,oBAAoB,CAAA;IAC7B,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EACpD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAA;IAED,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAQ,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAkC;aACrD,CAAC,CAAC;SACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QACzF,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzE,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC7D;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAE/B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAC3B,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CACX,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAA;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC,CAAC,CAAA"}

package/dist/proxy.d.ts

@@ -1,13 +1,14 @@
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import type { ServerConnection } from './client.js';
 export interface ToolRegistration {
     name: string;
     label: string;
     description: string;
+    /** Raw JSON Schema for MCP clients. */
+    inputSchema: Record<string, unknown>;
+    /** TypeBox view of inputSchema for the native Pi host. */
     parameters: unknown;
-    execute: (toolCallId: string, params: Record<string, unknown>, signal: AbortSignal | undefined) => Promise<{
-        content: unknown[];
-        isError?: boolean;
-    }>;
+    execute: (toolCallId: string, params: Record<string, unknown>, signal?: AbortSignal) => Promise<CallToolResult>;
 }
 interface UpstreamTool {
     name: string;
@@ -15,8 +16,8 @@ interface UpstreamTool {
     inputSchema: Record<string, unknown>;
 }
 /**
- * Build pi tool registrations for one upstream server. Pure function over
- * injected dependencies so it unit tests without network or a pi session.
+ * Build host-neutral tool registrations for one upstream server. The raw
+ * schema is retained for MCP while Pi receives the TypeBox representation.
  */
 export declare function buildToolRegistrations(prefix: string, tools: UpstreamTool[], callUpstream: (name: string, params: Record<string, unknown>) => Promise<unknown>): ToolRegistration[];
 /** Prefix every tool of every connected server; names stay unique per server. */