premanmcp 0.16.2 → 1.0.0

package/dist/server.js

@@ -1,1875 +1,141 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-import { registerUserAuthFlowTools } from "./user_auth_flow.js";
-import { shareAuthFlowToUi } from "./auth_flow_ui.js";
-import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import fs from "node:fs/promises";
-import path from "node:path";
-import os from "node:os";
-import { fileURLToPath } from "node:url";
-import { randomUUID } from "node:crypto";
-import { MCP_PREVIEW_RESOURCE_URI, RESOURCE_URI_META_KEY, buildConversionPanelHtml, writeMcpPreviewFile, } from "./mcp-preview-panel.js";
-let REPO_CONFIG = null;
-function applyRepoPremanConfig() {
-    const candidates = [
-        path.join(process.cwd(), ".cursor", "preman-mcp.config.json"),
-        path.join(process.cwd(), "preman-mcp.config.json"),
-    ];
-    for (const p of candidates) {
-        try {
-            if (!existsSync(p))
-                continue;
-            const j = JSON.parse(readFileSync(p, "utf8"));
-            const override = j.PREMAN_CONFIG_OVERRIDE === true || j.PREMAN_CONFIG_OVERRIDE === "true";
-            const applied = [];
-            for (const [key, val] of Object.entries(j)) {
-                if (!key.startsWith("PREMAN_") || key === "PREMAN_CONFIG_OVERRIDE")
-                    continue;
-                if (typeof val !== "string" || !val.trim())
-                    continue;
-                if (!override && process.env[key])
-                    continue;
-                process.env[key] = val.trim();
-                applied.push(key);
-            }
-            REPO_CONFIG = { path: p, override, applied };
-            return;
-        }
-        catch {
-            /* try next path */
-        }
-    }
-}
-applyRepoPremanConfig();
-const BACKEND_URL = process.env.PREMAN_BACKEND || "https://api.preman.live";
-const FRONTEND_URL = process.env.PREMAN_FRONTEND || "https://app.preman.live";
-let API_KEY = process.env.PREMAN_API_KEY || "";
-/**
- * Where the URLs this process is using came from.
+/** Transparent stdio -> hosted Streamable HTTP MCP bridge.
  *
- * Reported by `preman_status` because the most confusing failure in setup is a
- * server that works perfectly against the wrong backend: the key is fine, the
- * config on disk is fine, and every call still 401s. Naming the file that
- * redirected it turns that into a one-line diagnosis.
+ * This process deliberately defines no tools or schemas. Initialization,
+ * discovery, notifications, and calls are forwarded byte-for-byte at the JSON-
+ * RPC layer so the Python service remains the sole public contract authority.
  */
-function configSource() {
-    return {
-        backend_url: BACKEND_URL,
-        repo_config: REPO_CONFIG
-            ? { path: REPO_CONFIG.path, override: REPO_CONFIG.override, applied: REPO_CONFIG.applied }
-            : null,
-    };
-}
-function detectCodingAgent() {
-    const forced = (process.env.PREMAN_CODING_AGENT || "").trim().toLowerCase();
-    if (forced)
-        return forced.replace("-", "_");
-    if (process.env.CLAUDECODE || process.env.CLAUDE_CODE)
-        return "claude_code";
-    if (process.env.CODEX_HOME || process.env.OPENAI_CODEX)
-        return "codex";
-    if (process.env.CURSOR_AGENT || process.env.CURSOR_TRACE_ID || process.env.CURSOR_SESSION_ID) {
-        return "cursor";
-    }
-    return "cursor";
-}
-/** Prove this MCP session is live to the workbench coding-agent link. */
-async function heartbeatWorkbenchLink() {
-    if (!API_KEY)
-        return null;
-    try {
-        const resp = await fetch(`${BACKEND_URL}/workbench/coding-agent/heartbeat`, {
-            method: "POST",
-            signal: AbortSignal.timeout(5000),
-            headers: {
-                Authorization: `Bearer ${API_KEY}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-                pair_code: process.env.PREMAN_PAIR_CODE || undefined,
-                agent: detectCodingAgent(),
-                project_path: process.cwd(),
-                client_label: "premanmcp",
-                source: "preman_status",
-            }),
-        });
-        const text = await resp.text();
-        let data = {};
-        try {
-            data = text ? JSON.parse(text) : {};
-        }
-        catch {
-            data = { detail: text };
-        }
-        if (!resp.ok) {
-            return {
-                ok: false,
-                status: resp.status,
-                detail: data.detail || data.message || text,
-            };
-        }
-        return { ok: true, ...data };
-    }
-    catch (err) {
+import { createInterface } from "node:readline";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+let sessionId = "";
+let protocolVersion = "2025-06-18";
+async function credentials() {
+    if (process.env.PREMAN_API_KEY) {
         return {
-            ok: false,
-            detail: err instanceof Error ? err.message : String(err),
+            api_key: process.env.PREMAN_API_KEY,
+            backend_url: process.env.PREMAN_BACKEND,
         };
     }
-}
-const PREMAN_CONTROL_PLANE_HOSTS = new Set([
-    "api.preman.live",
-    "preman.live",
-    "www.preman.live",
-    "app.preman.live",
-]);
-function urlOrigin(value) {
-    if (typeof value !== "string" || !value.trim())
-        return "";
     try {
-        const u = new URL(value);
-        return u.origin.replace(/\/+$/, "");
+        const file = path.join(os.homedir(), ".preman", "credentials.json");
+        return JSON.parse(await readFile(file, "utf8"));
     }
     catch {
-        return "";
+        return {};
     }
 }
-function isPreManControlPlaneUrl(value) {
-    if (typeof value !== "string" || !value.trim())
-        return false;
-    try {
-        return PREMAN_CONTROL_PLANE_HOSTS.has(new URL(value).hostname.toLowerCase());
-    }
-    catch {
-        return false;
-    }
+function endpoint(stored) {
+    const exact = (process.env.PREMAN_MCP_URL || "").trim();
+    if (exact)
+        return exact.replace(/\/+$/, "");
+    const backend = (process.env.PREMAN_BACKEND || stored.backend_url || "https://api.preman.live").replace(/\/+$/, "");
+    return `${backend}/mcp`;
+}
+function write(message) {
+    process.stdout.write(`${JSON.stringify(message)}\n`);
 }
-function inferUpstreamBaseUrlFromEndpoints(endpoints) {
-    if (!Array.isArray(endpoints))
-        return "";
-    const candidates = [];
-    for (const endpoint of endpoints) {
-        if (!endpoint || typeof endpoint !== "object" || Array.isArray(endpoint))
+function rpcError(message, code, detail) {
+    if (message.id === undefined)
+        return;
+    write({
+        jsonrpc: "2.0",
+        id: message.id,
+        error: { code, message: detail.slice(0, 500) },
+    });
+}
+function parseSse(body) {
+    const messages = [];
+    for (const block of body.split(/\r?\n\r?\n/)) {
+        const data = block
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trimStart())
+            .join("\n");
+        if (!data)
             continue;
-        const row = endpoint;
-        for (const key of ["base_url", "upstream_base_url"]) {
-            if (typeof row[key] === "string" && row[key].trim()) {
-                candidates.push(row[key].trim().replace(/\/+$/, ""));
-            }
+        try {
+            messages.push(JSON.parse(data));
         }
-        const ref = row._endpoint_ref;
-        if (ref && typeof ref === "object" && !Array.isArray(ref)) {
-            const base = ref.base_url;
-            if (typeof base === "string" && base.trim()) {
-                candidates.push(base.trim().replace(/\/+$/, ""));
-            }
+        catch {
+            // A malformed upstream event is a transport error, not stdout chatter.
         }
-        const origin = urlOrigin(row.url);
-        if (origin)
-            candidates.push(origin);
     }
-    const unique = [...new Set(candidates.filter(Boolean))];
-    const nonControl = unique.filter((u) => !isPreManControlPlaneUrl(u));
-    if (nonControl.length === 1)
-        return nonControl[0];
-    if (unique.length === 1)
-        return unique[0];
-    return "";
-}
-function normalizeFrontendBaseUrl(url) {
-    return url.replace(/\/+$/, "");
-}
-/** Origin only (no path). */
-const FRONTEND_BASE = normalizeFrontendBaseUrl(FRONTEND_URL);
-/**
- * Static hosts often 404 on `/endpoints` because only `/` maps to index.html.
- * Cold-load the SPA shell at `/` and pass the client route in the query so the first request always hits index.html.
- */
-const AGENT_ROUTE_PARAM = "ot_agent_route";
-function buildAgentDashboardUrlForBase(baseUrl, routePath) {
-    const base = normalizeFrontendBaseUrl(baseUrl);
-    const u = new URL(`${base}/`);
-    u.searchParams.set("agent_session", AGENT_SESSION_ID);
-    const p = routePath.startsWith("/") ? routePath : `/${routePath}`;
-    u.searchParams.set(AGENT_ROUTE_PARAM, p);
-    return u.toString();
-}
-function buildAgentDashboardUrl(routePath) {
-    return buildAgentDashboardUrlForBase(FRONTEND_BASE, routePath);
+    return messages;
 }
-/** Stable per-process ID the dashboard subscribes to for live follow-along. */
-const AGENT_SESSION_ID = randomUUID();
-// ── Credential Storage ────────────────────────────────────────────────
-const CREDENTIALS_DIR = path.join(os.homedir(), ".preman");
-const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
-async function loadStoredCredentials() {
-    try {
-        const raw = await fs.readFile(CREDENTIALS_FILE, "utf-8");
-        const creds = JSON.parse(raw);
-        if (creds.api_key && creds.api_key.startsWith("pm_live_"))
-            return creds;
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function saveCredentials(creds) {
-    await fs.mkdir(CREDENTIALS_DIR, { recursive: true, mode: 0o700 });
-    await fs.writeFile(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 0o600 });
-    console.error(`[PreMan] Credentials saved to ${CREDENTIALS_FILE}`);
-}
-async function clearCredentials() {
-    try {
-        await fs.unlink(CREDENTIALS_FILE);
-        console.error("[PreMan] Credentials cleared");
-    }
-    catch {
-        // file didn't exist, that's fine
-    }
-}
-async function verifyApiKey(key) {
-    try {
-        const resp = await fetch(`${BACKEND_URL}/mcp/whoami`, {
-            headers: { Authorization: `Bearer ${key}` },
-        });
-        if (!resp.ok)
-            return { valid: false, reachable: true };
-        const data = await resp.json();
-        return { valid: true, reachable: true, email: data.email, key_name: data.key_name };
-    }
-    catch {
-        return { valid: false, reachable: false };
-    }
-}
-async function initAuth() {
-    if (API_KEY) {
-        console.error("[PreMan] Using API key from PREMAN_API_KEY env var");
+async function forward(message) {
+    const stored = await credentials();
+    const apiKey = (stored.api_key || "").trim();
+    if (!apiKey) {
+        rpcError(message, -32001, "PreMan login required; run `preman login` first");
         return;
     }
-    const creds = await loadStoredCredentials();
-    if (!creds) {
-        console.error("[PreMan] No stored credentials. Run `npm exec -y premanmcp@latest -- login` or use preman_login to authenticate.");
-        return;
+    if (message.method === "initialize") {
+        const requested = message.params?.protocolVersion;
+        if (typeof requested === "string" && requested)
+            protocolVersion = requested;
     }
-    const check = await verifyApiKey(creds.api_key);
-    if (check.valid) {
-        API_KEY = creds.api_key;
-        console.error(`[PreMan] Authenticated as ${creds.user_email ?? "unknown"} (stored credentials)`);
-    }
-    else if (!check.reachable) {
-        API_KEY = creds.api_key;
-        console.error("[PreMan] Backend unreachable — using stored credentials (will verify on first call)");
-    }
-    else {
-        console.error("[PreMan] Stored credentials are invalid or expired. Run `npm exec -y premanmcp@latest -- login` or use preman_login to re-authenticate.");
-        await clearCredentials();
-    }
-}
-// Panel HTML: ./mcp-preview-panel.ts (also used by scripts/emit-mcp-preview.mjs)
-// ── Backend proxy ─────────────────────────────────────────────────────
-function requireAuth() {
-    if (!API_KEY) {
-        throw new Error("Not authenticated. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.");
-    }
-}
-async function callBackend(toolName, args) {
-    requireAuth();
     const headers = {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${API_KEY}`,
+        authorization: `Bearer ${apiKey}`,
+        accept: "application/json, text/event-stream",
+        "content-type": "application/json",
+        "mcp-protocol-version": protocolVersion,
     };
-    const resp = await fetch(`${BACKEND_URL}/mcp/call-tool`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({ tool: toolName, arguments: args }),
-    });
-    if (!resp.ok) {
-        const text = await resp.text();
-        throw new Error(`Backend error: ${resp.status} ${text}`);
+    if (sessionId)
+        headers["mcp-session-id"] = sessionId;
+    let response;
+    try {
+        response = await fetch(endpoint(stored), {
+            method: "POST",
+            headers,
+            body: JSON.stringify(message),
+            signal: AbortSignal.timeout(360_000),
+        });
     }
-    return resp.json();
-}
-function emitActivity(eventType, data) {
-    fetch(`${BACKEND_URL}/agent/activity/${AGENT_SESSION_ID}`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ event_type: eventType, data }),
-    }).catch((err) => {
-        console.error(`[PreMan] emitActivity(${eventType}) failed: ${err.message}`);
-    });
-}
-/** Build the `_agent_session` block included in every tool response. */
-function agentSessionPayload(dashboardPath = "/endpoints") {
-    return {
-        _agent_session: {
-            session_id: AGENT_SESSION_ID,
-            dashboard_url: buildAgentDashboardUrl(dashboardPath),
-        },
-    };
-}
-/**
- * Return a structured MCP error response that agents can reliably parse.
- *
- * Every error has the same shape: ``{ error, error_code, _agent_hints }``.
- */
-function toolError(message, code = "backend_error", hints) {
-    const payload = {
-        error: message,
-        error_code: code,
-    };
-    if (hints) {
-        payload._agent_hints = hints;
+    catch (error) {
+        rpcError(message, -32000, `Hosted PreMan MCP is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        return;
     }
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload) }],
-        isError: true,
-    };
-}
-/** Infer an ``ErrorCode`` from an error message for common patterns. */
-function inferErrorCode(msg) {
-    const lower = msg.toLowerCase();
-    if (lower.includes("401") || lower.includes("unauthorized") || lower.includes("not authenticated"))
-        return "auth_required";
-    if (lower.includes("404") || lower.includes("not found"))
-        return "not_found";
-    if (lower.includes("400") || lower.includes("invalid") || lower.includes("missing"))
-        return "invalid_input";
-    return "backend_error";
-}
-// ── Helper: attach PreMan frontend URL to every tool response ────────
-/** Merge backend payload with `ui.url` pointing at the Endpoints page (for get_endpoints JSON without a separate panel). */
-function enrichEndpointsBrowserUrl(payload) {
-    const prevUi = typeof payload.ui === "object" && payload.ui !== null
-        ? payload.ui
-        : {};
-    return {
-        ...payload,
-        ui: {
-            ...prevUi,
-            url: buildAgentDashboardUrl("/endpoints"),
-            note: "Use Agent Browser: browser_navigate to `ui.url` to open the PreMan Endpoints page (sign in if prompted). Prefer this over the site homepage.",
-        },
-    };
-}
-function withFrontendUrl(payload, path) {
-    const p = path ?? "/endpoints";
-    const prevUi = typeof payload.ui === "object" && payload.ui !== null
-        ? payload.ui
-        : {};
-    return {
-        content: [{
-                type: "text",
-                text: JSON.stringify({
-                    ...payload,
-                    ui: {
-                        ...prevUi,
-                        url: buildAgentDashboardUrl(p),
-                        note: "Open this URL in Agent Browser (browser_navigate) to see the PreMan Endpoints page first (sign in if prompted). Prefer this link over the site homepage.",
-                    },
-                }),
-            }],
-    };
-}
-// ── MCP Server ────────────────────────────────────────────────────────
-export function createServer() {
-    const server = new McpServer({ name: "PreMan", version: "1.0.0" }, {
-        instructions: [
-            "PreMan is an API testing platform. It discovers, tests, and monitors API endpoints.",
-            "",
-            "## Tool taxonomy",
-            "- **Read tools** (no side effects): get_endpoints, get_coverage, detect_drift, preman_status, list_collections, get_collection, list_runs",
-            "- **Action tools** (execute tests / mutate state): test_api, generate_tests, generate_endpoint_tests, run_stress_test, start_test_campaign, import_collection, test_endpoint_by_id, register_discovered_endpoints, run_tests, delete_collection",
-            "- **Create-then-delete contracts**: propose_lifecycle_contracts (propose a POST/DELETE pairing), approve_lifecycle_contracts (user decision — ask first)",
-            "- **MCP conversion tools**: discover_endpoints_from_codebase, verify_endpoints_live, mcp_preview (returns inline two-pane panel), mcp_deploy, mcp_list_deployed, mcp_mint_consumer_token, mcp_revoke_consumer_token",
-            "- **SDK tools**: generate_sdk (builds a client from endpoints PreMan already discovered - takes no OpenAPI file), get_sdk_generation (poll a run), get_sdk_languages (roster + whether the toolchain is present)",
-            "- **Auth (API key / PreMan)**: preman_create_api_key (JWT -> saved pm_live_ key), preman_login, preman_login_complete, preman_logout",
-            "- **Auth (app JWT — email/OTP/password on your API)**: user_auth_start_signup, user_auth_signup, user_auth_verify_otp, user_auth_login, user_auth_needs_password, user_auth_resend_otp, user_auth_forgot_password, user_auth_set_password, user_auth_me, user_auth_change_password, user_auth_delete_account (HTTP to PREMAN_BACKEND /auth/*; no pm_live_ key required)",
-            "- **Auth to PreMan Playground**: share_user_auth_flow_with_ui pushes signup, verify-otp, login, resend-otp with JSON schemas to the signed-in Playground. Requires preman_login / PREMAN_API_KEY so the session appears in the user's dashboard.",
-            "",
-            "## Routing — pick the right tool for what the user said",
-            "- 'scan / discover / find / list my endpoints' (codebase): use discover_endpoints_from_codebase. NEVER use get_endpoints for this — that returns inventory already saved in PreMan, not source code.",
-            "- 'list endpoints already saved in my PreMan dashboard': use get_endpoints. NEVER use discover_endpoints_from_codebase for this.",
-            "- 'preview my MCP before deploying': mcp_preview (read-only). 'actually deploy': mcp_deploy.",
-            "- 'generate an SDK / client library for my API', 'I use Speakeasy / Fern': generate_sdk. Do NOT ask the user for an OpenAPI file or run a spec export first - PreMan builds the spec from the endpoints it already discovered, and needing a file is the chore this replaces. Pass open_pr=true only when the user asks for a pull request rather than a download.",
-            "- 'test the login endpoint' / 'hit POST /auth/login with body': test_api with the full URL. Use test_endpoint_by_id ONLY when the user references a saved endpoint by id/uuid.",
-            "- 'import my Postman/OpenAPI/Bruno/curl collection': import_collection.",
-            "- 'migrate / move / switch from Postman', 'bring my Postman workspace over': migrate_from_postman — it imports AND creates scheduled suites, environments and alerts in one call. Prefer it over import_collection whenever the user frames this as leaving Postman.",
-            "- 'generate tests for endpoint X' / 'write unit tests for X and run them': generate_endpoint_tests (set include_code=true and write the returned code_artifacts to disk when the user wants test files).",
-            "- 'stress / load test X': run_stress_test. Read-only unless the user explicitly authorises writes — never set allow_writes yourself.",
-            "- After discover_endpoints_from_codebase, call register_discovered_endpoints with the JSON array it asked for. That streams endpoints to the Playground and starts a read-safe test campaign. Then verify_endpoints_live if you need a live probe.",
-            "- 'why aren't my POSTs tested?' / 'test the creates too': POSTs are skipped because nothing undoes them. Read the code, pair each POST with the DELETE that reverses it via propose_lifecycle_contracts, then ask the user to approve. Approve once and every campaign creates and deletes a real record. Never call approve_lifecycle_contracts without the user saying yes.",
-            "- App-auth flows (signup, OTP, login, change_password) live under the user_auth_* tools and do not need an pm_live_ key.",
-            "- PREMAN_BACKEND / backend_url is the PreMan control plane. It is NOT the target API upstream for a generated MCP unless the user's own API is PreMan. Prefer base_url from verify_endpoints_live results.",
-            "",
-            "## Defaults for agents",
-            '- Always use format="json" (the default) for structured data. Only use format="text" if the user explicitly asks for human-readable output.',
-            "- Do NOT set open_ui=true unless the user asks to see the dashboard.",
-            "- endpoints_dashboard is DEPRECATED. Use get_endpoints(include_sessions=true, include_collections=true) instead.",
-            "- When opening the PreMan app in a browser, use **ui.url** from tool results (SPA entry `/?agent_session=...&ot_agent_route=/endpoints`, not a bare `/endpoints` path on static hosting). Do **not** start at the site homepage without `ot_agent_route` unless the user explicitly asked for it.",
-            "",
-            "## Common workflows",
-            "1. **Discover then test**: get_endpoints -> pick untested/failing -> test_api for each.",
-            "2. **Import then generate**: import_collection (Postman/OpenAPI/curl) -> generate_tests -> test_api to run them.",
-            '3. **Coverage audit**: get_coverage on a collection -> generate_tests(coverage_level="comprehensive") for gaps.',
-            "4. **Drift detection**: detect_drift with a collection + base_url -> test_api on drifted endpoints.",
-            "5. **Postman migration**: migrate_from_postman -> review next_steps (base URLs, secrets needing values) -> re-run with activate=true -> failures open fix tasks you collect with preman_get_fix_task.",
-            "",
-            "## Auth",
-            "PreMan API tools (get_endpoints, test_api, …) need an pm_live_ key. Preferred no-browser flow: user_auth_start_signup -> user_auth_set_password -> preman_create_api_key, or user_auth_login -> preman_create_api_key. Browser fallback: preman_login -> preman_login_complete.",
-            "To drive the backend's **email/JWT** auth (signup, OTP, login, /auth/me), use the user_auth_* tools — they call PREMAN_BACKEND /auth/* directly and do not use the API key.",
-        ].join("\n"),
-    });
-    // ── test_api ──────────────────────────────────────────────────────
-    server.tool("test_api", "Execute an HTTP request against an API endpoint. Returns structured JSON: status_code, response_time_ms, body, assertions results, and extracted variables. The endpoint is automatically registered in the PreMan registry.", {
-        method: z.string().describe("HTTP method (GET, POST, PUT, PATCH, DELETE)"),
-        url: z.string().describe("Full URL to test"),
-        headers: z.record(z.string()).optional().describe("Request headers"),
-        body: z.any().optional().describe("JSON request body"),
-        assertions: z.array(z.any()).optional().describe("List of assertions"),
-        project_id: z.string().optional().describe("Scope endpoint registration to a project"),
-    }, async (args) => {
-        try {
-            emitActivity("test_started", { method: args.method, url: args.url });
-            const result = await callBackend("test_api", args);
-            const runId = result?.run_id != null ? String(result.run_id) : "";
-            const dashPath = `/endpoints?id=${runId}`;
-            emitActivity("test_complete", {
-                run_id: runId,
-                method: args.method,
-                url: args.url,
-                status_code: result?.status_code,
-                passed: result?.status_code >= 200 && result?.status_code < 300,
-                response_time_ms: result?.response_time_ms,
-                path: dashPath,
-            });
-            return withFrontendUrl({
-                ...result,
-                ...agentSessionPayload(dashPath),
-                _request: { method: args.method, url: args.url, headers: args.headers, body: args.body },
-            }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Verify the URL and method are correct, then retry. Call get_endpoints to check available endpoints."],
-                related_tools: ["get_endpoints"],
-            });
-        }
-    });
-    // ── test_endpoint_by_id ───────────────────────────────────────────
-    server.tool("test_endpoint_by_id", "Run test_api against a saved registry endpoint by UUID from get_endpoints (no manual URL assembly). Optional body/headers override the defaults for that call.", {
-        endpoint_id: z.string().describe("UUID from get_endpoints endpoints[].id"),
-        headers: z.record(z.string()).optional().describe("Request headers"),
-        body: z.any().optional().describe("JSON request body (e.g. login credentials)"),
-        assertions: z.array(z.any()).optional().describe("List of assertions"),
-        extract: z.record(z.string()).optional().describe("json_path -> variable name for chaining"),
-    }, async (args) => {
-        try {
-            emitActivity("test_started", { endpoint_id: args.endpoint_id });
-            const result = await callBackend("test_endpoint_by_id", args);
-            const runId = result?.run_id != null ? String(result.run_id) : "";
-            const dashPath = runId ? `/endpoints?id=${runId}` : "/endpoints";
-            emitActivity("test_complete", {
-                run_id: runId,
-                endpoint_id: args.endpoint_id,
-                method: result?.method,
-                url: result?.resolved_url,
-                status_code: result?.status_code,
-                passed: result?.status_code >= 200 && result?.status_code < 300,
-                response_time_ms: result?.response_time_ms,
-                path: dashPath,
-            });
-            return withFrontendUrl({
-                ...result,
-                ...agentSessionPayload(dashPath),
-                _request: {
-                    endpoint_id: args.endpoint_id,
-                    resolved_url: result?.resolved_url,
-                    headers: args.headers,
-                    body: args.body,
-                },
-            }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Verify the endpoint_id exists by calling get_endpoints first."],
-                related_tools: ["get_endpoints", "test_api"],
-            });
-        }
-    });
-    // ── generate_endpoint_tests ───────────────────────────────────────
-    server.tool("generate_endpoint_tests", "Generate scenario tests for one endpoint (happy path, auth, validation, boundaries, plus user-described scenarios) and run them by default. Pass a workbench request_id, a registry endpoint_id, or target to let PreMan resolve either. Set include_code=true for ready-to-write pytest/jest files in code_artifacts.", {
-        request_id: z.string().optional().describe("Saved workbench request id"),
-        endpoint_id: z.string().optional().describe("Registry endpoint UUID from get_endpoints"),
-        target: z.string().optional().describe("Either kind of id; PreMan resolves it"),
-        scenarios: z.array(z.string()).optional().describe("The user's scenario descriptions, one per entry"),
-        run: z.boolean().optional().default(true).describe("Execute the generated cases now (read-only by default)"),
-        allow_writes: z.boolean().optional().default(false).describe("Permit mutating cases — only when the user authorised it"),
-        persist_suite: z.boolean().optional().default(false).describe("Also save as a recurring auto-test suite (paid feature)"),
-        max_cases: z.number().optional().default(10).describe("Max generated cases (1-25)"),
-        include_code: z.boolean().optional().default(false).describe("Return unit-test files in code_artifacts"),
-        test_framework: z.enum(["pytest", "jest"]).optional().default("pytest").describe("Framework for code_artifacts"),
-    }, async (args) => {
+    const returnedSession = response.headers.get("mcp-session-id");
+    if (returnedSession)
+        sessionId = returnedSession;
+    const body = await response.text();
+    if (!response.ok) {
+        let detail = `Hosted PreMan MCP returned HTTP ${response.status}`;
         try {
-            const result = await callBackend("generate_endpoint_tests", args);
-            return withFrontendUrl(result, "/endpoints");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Call get_endpoints (include_workbench=true) to find a valid request or endpoint id."],
-                related_tools: ["get_endpoints", "run_stress_test"],
-            });
-        }
-    });
-    // ── run_stress_test ───────────────────────────────────────────────
-    server.tool("run_stress_test", "Bounded load test against one endpoint: paced requests for a fixed duration, reporting p50/p95/p99 latency, error rate, throughput, and a failure-classification mix. Read-only endpoints unless the user explicitly authorised writes; destructive endpoints always refused. Paid feature; server-side caps apply.", {
-        request_id: z.string().optional().describe("Saved workbench request id"),
-        endpoint_id: z.string().optional().describe("Registry endpoint UUID from get_endpoints"),
-        target: z.string().optional().describe("Either kind of id; PreMan resolves it"),
-        duration_seconds: z.number().optional().default(15).describe("Run length (server caps apply)"),
-        rps: z.number().optional().default(5).describe("Target requests per second (server caps apply)"),
-        concurrency: z.number().optional().default(5).describe("Max in-flight requests (server caps apply)"),
-        allow_writes: z.boolean().optional().default(false).describe("Only when the user authorised stressing a write endpoint"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("run_stress_test", args);
-            return withFrontendUrl(result, "/endpoints");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Call get_endpoints (include_workbench=true) to find a valid request or endpoint id."],
-                related_tools: ["get_endpoints", "generate_endpoint_tests"],
-            });
-        }
-    });
-    // ── register_discovered_endpoints ─────────────────────────────────
-    server.tool("register_discovered_endpoints", "Save discovered endpoints into PreMan, stream them to the Playground, and start a read-safe test campaign. Use after discover_endpoints_from_codebase. Mutating endpoints stay skipped until start_test_campaign(allow_writes=true).", {
-        endpoints: z.array(z.record(z.any())).optional().describe("Discovery-shaped endpoint objects (method, path_template, schemas, confidence, …); max 100"),
-        endpoint_ids: z.array(z.string()).optional().describe("Alternatively, existing registry ids to set up as runnable requests"),
-        project_id: z.string().optional().describe("Scope registration to a project"),
-        base_url: z.string().optional().describe("Applied to endpoints that carry none"),
-        setup_workbench: z.boolean().optional().default(true).describe("Also create saved workbench requests (default true)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("register_discovered_endpoints", args);
-            return withFrontendUrl(result, "/try");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Run discover_endpoints_from_codebase first and pass its endpoints array here."],
-                related_tools: ["discover_endpoints_from_codebase", "start_test_campaign", "verify_endpoints_live"],
-            });
-        }
-    });
-    server.tool("start_test_campaign", "Fan out tests across registered endpoints: functional scenarios, GET-only stress, and security-lite negatives (missing auth / empty body). Read-only by default. Not a scanner or exploit runner.", {
-        endpoint_ids: z.array(z.string()).optional().describe("Registry ids from register_discovered_endpoints"),
-        allow_writes: z.boolean().optional().default(false).describe("Permit POST/PUT/PATCH functional jobs; DELETE stays skipped"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("start_test_campaign", args);
-            return withFrontendUrl(result, "/try");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Call register_discovered_endpoints first, then pass its endpoint_ids."],
-                related_tools: ["register_discovered_endpoints", "get_endpoints"],
-            });
-        }
-    });
-    // ── create-then-delete contracts ──────────────────────────────────
-    server.tool("propose_lifecycle_contracts", "Propose that a POST be tested for real by deleting what it creates. You read the customer's routes and response models, so you know which DELETE undoes which POST and where the new id appears. PreMan re-checks eligibility itself: billing-, auth- and notification-shaped creates are always rejected because a DELETE cannot claw back money or unsend an email. Proposals do nothing until the user approves them.", {
-        contracts: z
-            .array(z.object({
-            create_endpoint_id: z.string().describe("Registry id of the POST"),
-            cleanup_endpoint_id: z.string().describe("Registry id of the DELETE that undoes it"),
-            id_source: z.string().optional().describe("Where the new id sits in the create response, e.g. 'json.id' or 'json.data.id'"),
-            evidence: z.string().optional().describe("Why this pairing is correct (route/model you read)"),
-        }))
-            .describe("Pairings to propose; max 100"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("propose_lifecycle_contracts", args);
-            return withFrontendUrl(result, "/try");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Register the endpoints first so both ids exist, then propose the pairing."],
-                related_tools: ["register_discovered_endpoints", "approve_lifecycle_contracts"],
-            });
-        }
-    });
-    server.tool("approve_lifecycle_contracts", "Approve (or reject) create-then-delete contracts. ASK THE USER FIRST — never approve on their behalf. An approved create runs for real on every campaign from then on, teardown included; the teardown is scoped to the id that run just created and can never delete anything else.", {
-        contract_ids: z.array(z.string()).describe("Ids from propose_lifecycle_contracts or register_discovered_endpoints' lifecycle_proposals"),
-        approve: z.boolean().optional().default(true).describe("False records a rejection so the pairing stops being re-proposed"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("approve_lifecycle_contracts", args);
-            return withFrontendUrl(result, "/try");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Confirm with the user which POST endpoints they want exercised for real, then retry."],
-                related_tools: ["propose_lifecycle_contracts", "start_test_campaign"],
-            });
-        }
-    });
-    // ── get_endpoints ─────────────────────────────────────────────────
-    server.tool("get_endpoints", "Return endpoint inventory (registry, optionally MCP sessions and collections). Default: structured JSON for agents. Pass format='text' for deprecated human-friendly output, or open_ui=true for the visual dashboard. Schemas stripped by default to save tokens; set include_schemas=true when needed.", {
-        status: z.string().optional().describe("Filter: tested, needed, draft"),
-        method: z.string().optional().describe("Filter by HTTP method"),
-        include_sessions: z.boolean().optional().default(false).describe("Include recent MCP session test results"),
-        include_collections: z.boolean().optional().default(false).describe("Include imported collection endpoints"),
-        include_schemas: z.boolean().optional().default(false).describe("Include request/response schemas per endpoint (default false to save tokens)"),
-        include_workbench: z.boolean().optional().default(false).describe("Also list the default workspace's saved runnable requests"),
-        limit: z.number().optional().default(50).describe("Max endpoints per page (default 50)"),
-        offset: z.number().optional().default(0).describe("Pagination offset"),
-        project_id: z.string().optional().describe("Scope to a specific project"),
-        format: z.enum(["json", "text"]).optional().default("json").describe("'json' (default, structured) or 'text' (deprecated human-friendly)"),
-        open_ui: z.boolean().optional().default(false).describe("Also open the visual dashboard (default: false)"),
-    }, async (args) => {
-        try {
-            emitActivity("navigate", { path: "/endpoints", query_params: { status: args.status, method: args.method } });
-            const result = await callBackend("get_endpoints", args);
-            const asRecord = result;
-            if (args.open_ui) {
-                return withFrontendUrl(enrichEndpointsBrowserUrl(asRecord), "/endpoints");
-            }
-            if (args.format === "text" && typeof result === "string") {
-                return { content: [{ type: "text", text: result }] };
-            }
-            const enriched = typeof result === "object" && result !== null && !Array.isArray(result)
-                ? { ...enrichEndpointsBrowserUrl(asRecord), ...agentSessionPayload("/endpoints") }
-                : result;
-            return {
-                content: [{
-                        type: "text",
-                        text: typeof enriched === "string" ? enriched : JSON.stringify(enriched),
-                    }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["If authentication failed, call preman_login first. Otherwise check that the backend is running."],
-                related_tools: ["preman_login"],
-            });
-        }
-    });
-    // ── generate_tests ────────────────────────────────────────────────
-    server.tool("generate_tests", "Generate a .ot.yaml test suite from a natural language description. Returns the YAML content, parsed collection spec, and a collection_id if saved to the dashboard. Use get_coverage afterwards to check gaps.", {
-        description: z.string().describe("What to test in natural language"),
-        endpoint_url: z.string().optional().describe("Optional: full URL of the endpoint to test"),
-        method: z.string().optional().describe("HTTP method (GET, POST, PUT, PATCH, DELETE)"),
-        coverage_level: z.enum(["standard", "comprehensive", "security"]).optional().default("standard").describe("Coverage depth"),
-        project_id: z.string().optional().describe("Scope generated collection to a project"),
-        endpoint_ids: z.array(z.string()).optional().describe("Registry endpoint UUIDs to generate tests for (overrides endpoint_url/method)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("generate_tests", args);
-            const payload = typeof result === "string" ? JSON.parse(result) : result;
-            const collectionId = payload?.collection_id ?? "";
-            const dashPath = collectionId ? `/collections?id=${collectionId}` : "/collections";
-            emitActivity("navigate", { path: dashPath });
-            emitActivity("data_refresh", { scope: "collections" });
-            return withFrontendUrl({ ...payload, ...agentSessionPayload(dashPath) }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Provide a more specific description, or use endpoint_ids for registry-based generation."],
-                related_tools: ["import_collection", "test_api"],
-            });
-        }
-    });
-    // ── get_coverage ──────────────────────────────────────────────────
-    server.tool("get_coverage", "Analyze API test coverage for a collection. Returns overall_score and top_priorities by default. Set include_endpoint_details=true for per-endpoint breakdown.", {
-        collection_yaml: z.string().optional().describe("Raw .ot.yaml content to analyze"),
-        collection_id: z.string().optional().describe("ID of a saved collection from the dashboard"),
-        include_endpoint_details: z.boolean().optional().default(false).describe("Include per-endpoint analysis (default false to save tokens)"),
-    }, async (args) => {
-        try {
-            const collectionId = args.collection_id ?? "";
-            const dashPath = collectionId ? `/collections?id=${collectionId}&view=coverage` : "/collections";
-            emitActivity("navigate", { path: dashPath });
-            const result = await callBackend("get_coverage", args);
-            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Provide a collection_id or collection_yaml. Call list_collections to find available collections."],
-                related_tools: ["import_collection", "list_collections"],
-            });
-        }
-    });
-    // ── generate_sdk ──────────────────────────────────────────────────
-    //
-    // Straight to the REST API rather than through /mcp/call-tool, because the
-    // SDK endpoints take the same pm_live_ key and adding a backend tool wrapper
-    // would buy nothing. The spec is deliberately not a parameter: PreMan already
-    // holds one for every connected repository, and asking an agent to supply the
-    // document describing the API PreMan has been scanning is the exact chore
-    // this feature exists to remove.
-    async function sdkFetch(method, path, body) {
-        requireAuth();
-        const resp = await fetch(`${BACKEND_URL}${path}`, {
-            method,
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${API_KEY}`,
-            },
-            body: body === undefined ? undefined : JSON.stringify(body),
-        });
-        const text = await resp.text();
-        let parsed = null;
-        try {
-            parsed = text ? JSON.parse(text) : null;
+            const parsed = JSON.parse(body);
+            detail = String(parsed.error_description || parsed.detail || detail);
         }
         catch {
-            parsed = { raw: text };
-        }
-        if (!resp.ok) {
-            const detail = (parsed && (parsed.detail?.[0]?.msg || parsed.detail)) || text || resp.statusText;
-            throw new Error(`${resp.status} ${typeof detail === "string" ? detail : JSON.stringify(detail)}`);
-        }
-        return parsed;
-    }
-    /** Resolve a repo name like "acme/api" to a connected integration id. */
-    async function resolveIntegration(hint) {
-        const rows = await sdkFetch("GET", "/integrations/github");
-        if (!Array.isArray(rows) || rows.length === 0) {
-            throw new Error("no GitHub repository is connected; connect one before generating an SDK");
-        }
-        if (!hint) {
-            if (rows.length === 1)
-                return rows[0];
-            const names = rows.map((r) => r.repo_url).join(", ");
-            throw new Error(`several repositories are connected, so name one with repo: ${names}`);
+            // Never echo arbitrary HTML or credentials from an upstream failure.
         }
-        const needle = hint.toLowerCase();
-        const hit = rows.find((r) => String(r.id) === hint) ||
-            rows.find((r) => String(r.repo_url || "").toLowerCase().includes(needle));
-        if (!hit) {
-            throw new Error(`no connected repository matches "${hint}"; connected: ${rows
-                .map((r) => r.repo_url)
-                .join(", ")}`);
-        }
-        return hit;
+        rpcError(message, -32000, detail);
+        return;
     }
-    server.tool("generate_sdk", "Generate a client SDK from the endpoints PreMan already discovered for a connected repository. Takes no OpenAPI file - PreMan builds the spec itself. Returns a download URL. Use open_pr=true to open a pull request instead of producing an archive.", {
-        repo: z
-            .string()
-            .optional()
-            .describe("Which connected repository, as an integration id or any part of the repo URL such as 'acme/api'. Optional when only one is connected."),
-        languages: z
-            .array(z.string())
-            .optional()
-            .describe("Languages to generate. Defaults to ['python']. Call get_sdk_languages for the roster."),
-        halves: z
-            .array(z.enum(["client", "server"]))
-            .optional()
-            .describe("Client, server, or both. Defaults to ['client'], which is what a consumer of the API needs."),
-        open_pr: z
-            .boolean()
-            .optional()
-            .default(false)
-            .describe("Open a pull request against the repository instead of returning an archive. Requires the repository to have opted in to automatic pull requests."),
-        wait_seconds: z
-            .number()
-            .optional()
-            .default(150)
-            .describe("How long to wait for the run before handing back an id to poll. 0 returns immediately."),
-    }, async (args) => {
-        try {
-            const integration = await resolveIntegration(args.repo);
-            const integrationId = String(integration.id);
-            // Read the spec first so an empty or fully excluded surface is reported
-            // as that, rather than as a generation which fails a minute later.
-            const preview = await sdkFetch("GET", `/sdk/integrations/${integrationId}/spec`);
-            const run = await sdkFetch("POST", "/sdk/generate", {
-                integration_id: integrationId,
-                languages: args.languages ?? ["python"],
-                halves: args.halves ?? ["client"],
-                open_pr: args.open_pr ?? false,
-            });
-            const dashPath = "/endpoints";
-            emitActivity("navigate", { path: dashPath });
-            const deadline = Date.now() + Math.max(0, args.wait_seconds ?? 150) * 1000;
-            let current = run;
-            while (Date.now() < deadline &&
-                !["succeeded", "failed", "cancelled"].includes(String(current.status))) {
-                await new Promise((r) => setTimeout(r, 5000));
-                current = await sdkFetch("GET", `/sdk/generations/${run.id}`);
-            }
-            const done = String(current.status) === "succeeded";
-            return withFrontendUrl({
-                ...agentSessionPayload(dashPath),
-                generation_id: run.id,
-                status: current.status,
-                repo: integration.repo_url,
-                operations: preview.operation_count,
-                endpoints_published: preview.endpoint_count,
-                endpoints_excluded: preview.excluded_count,
-                spec_warnings: preview.warnings ?? [],
-                languages: current.languages,
-                files: current.files ?? [],
-                pr_url: current.pr_url ?? null,
-                error: current.error ?? null,
-                download_url: done
-                    ? `${BACKEND_URL}/sdk/generations/${run.id}/download`
-                    : null,
-                _agent_hints: done
-                    ? {
-                        next_actions: [
-                            `Download the archive: curl -H "Authorization: Bearer $PREMAN_API_KEY" -o sdk.zip ${BACKEND_URL}/sdk/generations/${run.id}/download`,
-                        ],
-                    }
-                    : {
-                        next_actions: [
-                            `Still ${current.status}. Poll with get_sdk_generation(generation_id="${run.id}").`,
-                        ],
-                    },
-            }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Confirm a repository is connected and has discovered endpoints (get_endpoints).",
-                    "If open_pr was true, the repository must have opted in to automatic pull requests.",
-                ],
-                related_tools: ["get_endpoints", "get_sdk_languages", "get_sdk_generation"],
-            });
-        }
-    });
-    // ── get_sdk_generation ────────────────────────────────────────────
-    server.tool("get_sdk_generation", "Poll one SDK generation run started by generate_sdk. Returns status and, once finished, the download URL.", {
-        generation_id: z.string().describe("The generation_id returned by generate_sdk"),
-    }, async (args) => {
-        try {
-            const run = await sdkFetch("GET", `/sdk/generations/${args.generation_id}`);
-            const done = String(run.status) === "succeeded";
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify({
-                            generation_id: run.id,
-                            status: run.status,
-                            attempts: run.attempts,
-                            error: run.error ?? null,
-                            pr_url: run.pr_url ?? null,
-                            files: run.files ?? [],
-                            download_url: done
-                                ? `${BACKEND_URL}/sdk/generations/${run.id}/download`
-                                : null,
-                        }, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["generate_sdk"],
-            });
-        }
-    });
-    // ── get_sdk_languages ─────────────────────────────────────────────
-    server.tool("get_sdk_languages", "Which languages this PreMan deployment can generate, and whether the generator toolchain is present at all.", {}, async () => {
-        try {
-            const roster = await sdkFetch("GET", "/sdk/languages");
-            return {
-                content: [
-                    { type: "text", text: JSON.stringify(roster, null, 2) },
-                ],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["generate_sdk"],
-            });
-        }
-    });
-    // ── import_collection ─────────────────────────────────────────────
-    server.tool("import_collection", "Import a Postman, OpenAPI, Bruno, or curl collection. Converts to .ot.yaml and saves. Returns slim summary (name, endpoint list, collection_id). Set include_yaml=true to get the full YAML string.", {
-        content: z.string().describe("Raw collection content (Postman JSON, OpenAPI YAML, Bruno .bru, curl command)"),
-        format_hint: z.enum(["postman", "openapi", "bruno", "curl"]).optional().describe("Format override (auto-detected if omitted)"),
-        include_yaml: z.boolean().optional().default(false).describe("Include the full .ot.yaml string in the response (default false to save tokens)"),
-        project_id: z.string().optional().describe("Scope imported collection to a project"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("import_collection", args);
-            const collectionId = result?.collection_id ?? "";
-            const dashPath = collectionId ? `/collections?id=${collectionId}` : "/collections";
-            emitActivity("navigate", { path: dashPath });
-            emitActivity("data_refresh", { scope: "collections" });
-            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Check that the content is valid Postman JSON, OpenAPI YAML, Bruno .bru, or curl. Try format_hint to force detection."],
-                related_tools: ["get_endpoints"],
-            });
-        }
-    });
-    // ── migrate_from_postman ──────────────────────────────────────────
-    server.tool("migrate_from_postman", "Move a Postman collection into PreMan, fully wired, in one call. Converts the collection keeping the assertions its pm.test blocks declared, splits the environment into shared variables and encrypted secrets, and creates one scheduled test suite per request seeded from those assertions. Suites are created switched OFF; pass activate=true to start them and attach alert rules so a failing check opens a fix task. Returns next_steps — the honest list of what still needs a human.", {
-        content: z.string().optional().describe("Raw Postman collection export (v2.x JSON)"),
-        collection_id: z.string().optional().describe("Pull from a connected Postman workspace instead of pasting content"),
-        environment: z.string().optional().describe("Raw Postman environment export (JSON)"),
-        name: z.string().optional().describe("Override the collection name"),
-        project_id: z.string().optional().describe("Scope the migration to a project"),
-        activate: z.boolean().optional().default(false).describe("Start the suites and create alert rules. Leave false to review first."),
-        channel_ids: z.array(z.string()).optional().describe("Alert channels to notify. Empty still records events and opens fix tasks."),
-        autofix_enabled: z.boolean().optional().default(false).describe("Let a failure dispatch to the coding agent automatically"),
-        include_yaml: z.boolean().optional().default(false).describe("Include the full .ot.yaml string (default false to save tokens)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("migrate_from_postman", args);
-            const collectionId = result?.collection_id ?? "";
-            const dashPath = collectionId ? `/collections?id=${collectionId}` : "/collections";
-            emitActivity("navigate", { path: dashPath });
-            emitActivity("data_refresh", { scope: "collections" });
-            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Provide either content (a Postman v2.x export) or collection_id from a connected Postman workspace.",
-                    "Connect a workspace at /integrations/postman/connect to use collection_id.",
-                ],
-                related_tools: ["import_collection", "get_endpoints"],
-            });
-        }
-    });
-    // ── recover_assertions ────────────────────────────────────────────
-    server.tool("recover_assertions", "Hand back assertions you translated from a Postman script PreMan could not read. An import's migration_report lists every dropped pm.test block with the script attached under entries[].source — read that JavaScript, convert what it checks, and call this. The assertion lands on the collection endpoint, its workbench request and the scheduled suite, so the next run grades it. Each assertion accepts: status (int or '2xx'), status_not (int), response_time_ms ('< 500'), json_paths ({'json.id': 7}, or 'exists' to require a field).", {
-        collection_id: z.string().describe("The collection the import created"),
-        endpoint_id: z.string().describe("entries[].endpoint_id from the migration report (or the endpoint name)"),
-        assertions: z.array(z.record(z.any())).describe("The converted assertions"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("recover_assertions", args);
-            emitActivity("data_refresh", { scope: "collections" });
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Check collection_id and endpoint_id against the migration_report entries.",
-                    "Each assertion must use the documented fields: status, status_not, response_time_ms, json_paths.",
-                ],
-                related_tools: ["get_collection", "migrate_from_postman"],
-            });
-        }
-    });
-    // ── detect_drift ──────────────────────────────────────────────────
-    server.tool("detect_drift", "Detect spec drift by comparing live API responses against a collection spec. Returns a list of drift alerts per endpoint with expected vs actual differences.", {
-        base_url: z.string().describe("Base URL to test against (e.g. https://api.example.com)"),
-        collection_yaml: z.string().optional().describe("Raw .ot.yaml content"),
-        collection_id: z.string().optional().describe("ID of a saved collection from the dashboard"),
-        headers: z.record(z.string()).optional().describe("Request headers applied to all drift-check requests (e.g. auth tokens)"),
-    }, async (args) => {
-        try {
-            emitActivity("navigate", { path: "/endpoints", query_params: { view: "drift" } });
-            const result = await callBackend("detect_drift", args);
-            return withFrontendUrl({ ...result, ...agentSessionPayload("/endpoints?view=drift") }, "/endpoints?view=drift");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Provide a base_url and either a collection_id or collection_yaml. Call list_collections to find saved collections."],
-                related_tools: ["import_collection", "test_api", "list_collections"],
-            });
-        }
-    });
-    // ── run_tests ─────────────────────────────────────────────────────
-    server.tool("run_tests", "Batch-run multiple API endpoints in one call. More efficient than calling test_api N times. Returns per-endpoint results with pass/fail, status codes, and response times.", {
-        endpoints: z.array(z.object({
-            method: z.string().describe("HTTP method"),
-            path: z.string().describe("URL path or full URL"),
-            base_url: z.string().optional().describe("Base URL override for this endpoint"),
-        })).describe("List of endpoints to test"),
-        base_url: z.string().optional().describe("Fallback base URL for endpoints without one"),
-        headers: z.record(z.string()).optional().describe("Request headers applied to all requests"),
-    }, async (args) => {
-        try {
-            emitActivity("test_started", { tool: "run_tests", endpoint_count: args.endpoints.length });
-            const result = await callBackend("run_api_tests", args);
-            emitActivity("test_complete", { tool: "run_tests", total: result?.total, passed: result?.passed, failed: result?.failed });
-            return withFrontendUrl({ ...result, ...agentSessionPayload("/endpoints") }, "/endpoints");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Verify the endpoints array has valid method and path fields. Use test_api for individual endpoint debugging."],
-                related_tools: ["test_api", "get_endpoints"],
-            });
-        }
-    });
-    // ── list_collections ──────────────────────────────────────────────
-    server.tool("list_collections", "List saved collections (Postman, OpenAPI, curl imports). Returns id, name, format, created_at for each. Use get_collection for full details.", {
-        project_id: z.string().optional().describe("Scope to a specific project"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("list_collections", args);
-            emitActivity("navigate", { path: "/collections" });
-            return {
-                content: [{ type: "text", text: JSON.stringify({ ...result, ...agentSessionPayload("/collections") }) }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["If no collections exist, import one with import_collection."],
-                related_tools: ["import_collection"],
-            });
-        }
-    });
-    // ── get_collection ───────────────────────────────────────────────
-    server.tool("get_collection", "Get details for a single collection by ID. Returns metadata and endpoint list. Set include_content=true to also get the raw YAML string.", {
-        collection_id: z.string().describe("UUID of the collection"),
-        include_content: z.boolean().optional().default(false).describe("Include the raw YAML content (default false to save tokens)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("get_collection", args);
-            const collectionId = result?.id ?? args.collection_id;
-            const dashPath = `/collections?id=${collectionId}`;
-            emitActivity("navigate", { path: dashPath });
-            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Verify the collection_id by calling list_collections first."],
-                related_tools: ["list_collections"],
-            });
-        }
-    });
-    // ── delete_collection ────────────────────────────────────────────
-    server.tool("delete_collection", "Soft-delete a collection by ID. The collection is archived (is_active=false) and no longer appears in list_collections.", {
-        collection_id: z.string().describe("UUID of the collection to delete"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("delete_collection", args);
-            emitActivity("data_refresh", { scope: "collections" });
-            return {
-                content: [{ type: "text", text: JSON.stringify({ ...result, ...agentSessionPayload("/collections") }) }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Verify the collection_id by calling list_collections first."],
-                related_tools: ["list_collections"],
-            });
-        }
-    });
-    // ── list_runs ────────────────────────────────────────────────────
-    server.tool("list_runs", "List recent test runs with summary metadata. Heavy fields (logs, video paths) are stripped to save tokens.", {
-        limit: z.number().optional().default(20).describe("Max runs to return (default 20)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("list_runs", args);
-            emitActivity("navigate", { path: "/runs" });
-            return withFrontendUrl({ ...result, ...agentSessionPayload("/runs") }, "/runs");
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["If no runs exist, create one with test_api or run_tests."],
-                related_tools: ["test_api", "run_tests"],
-            });
-        }
-    });
-    // ── endpoints_dashboard ───────────────────────────────────────────────
-    server.tool("endpoints_dashboard", "[DEPRECATED -- use get_endpoints with include_sessions=true, include_collections=true instead] Return ALL endpoints aggregated from registry, MCP sessions, and collections.", {
-        filter_method: z.string().optional().describe("Filter by HTTP method: GET, POST, PUT, PATCH, DELETE"),
-        filter_source: z.string().optional().describe("Filter by source: 'collection', 'mcp', or 'project'"),
-        project_id: z.string().optional().describe("Scope to a specific project"),
-        format: z.enum(["json", "text"]).optional().default("json").describe("'json' (default, structured) or 'text' (deprecated terminal UI)"),
-        open_ui: z.boolean().optional().default(false).describe("Also open the visual dashboard (default: false)"),
-    }, async (args) => {
-        try {
-            emitActivity("navigate", { path: "/endpoints" });
-            const result = await callBackend("endpoints_dashboard", args);
-            const asRecord = result;
-            if (args.open_ui) {
-                return withFrontendUrl(enrichEndpointsBrowserUrl(asRecord), "/endpoints");
-            }
-            if (args.format === "text" && typeof result === "string") {
-                return { content: [{ type: "text", text: result }] };
-            }
-            const enriched = typeof result === "object" && result !== null && !Array.isArray(result)
-                ? { ...enrichEndpointsBrowserUrl(asRecord), ...agentSessionPayload("/endpoints") }
-                : result;
-            return {
-                content: [{
-                        type: "text",
-                        text: typeof enriched === "string" ? enriched : JSON.stringify(enriched),
-                    }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["DEPRECATED: Use get_endpoints instead."],
-                related_tools: ["get_endpoints"],
-            });
-        }
-    });
-    // ── preman_create_api_key ──────────────────────────────────────────
-    // Lets agents complete signup/login entirely in the IDE:
-    // user_auth_* returns a JWT, then this tool mints and stores the pm_live_ key.
-    server.tool("preman_create_api_key", "Mint and save a PreMan pm_live_ API key using a JWT from user_auth_login, user_auth_verify_otp, or user_auth_set_password. Use this to finish account setup without opening the website.", {
-        access_token: z.string().describe("JWT returned by user_auth_login, user_auth_verify_otp, or user_auth_set_password"),
-        name: z.string().optional().describe("API key name. Defaults to this MCP device name."),
-    }, async (args) => {
-        try {
-            const name = args.name || `${os.hostname()} MCP`;
-            const keyResp = await fetch(`${BACKEND_URL}/api-keys`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    Authorization: `Bearer ${args.access_token}`,
-                },
-                body: JSON.stringify({ name }),
-            });
-            const keyText = await keyResp.text();
-            let keyData;
-            try {
-                keyData = keyText ? JSON.parse(keyText) : {};
-            }
-            catch {
-                keyData = { raw: keyText };
-            }
-            if (!keyResp.ok) {
-                throw new Error(`Create API key failed: ${keyResp.status} ${String(keyData.detail ?? keyData.raw ?? keyText)}`);
-            }
-            const apiKey = String(keyData.key || "");
-            if (!apiKey.startsWith("pm_live_")) {
-                throw new Error("Create API key response did not include a valid pm_live_ key.");
-            }
-            API_KEY = apiKey;
-            let email;
-            try {
-                const meResp = await fetch(`${BACKEND_URL}/auth/me`, {
-                    headers: { Authorization: `Bearer ${args.access_token}` },
-                });
-                if (meResp.ok) {
-                    const me = await meResp.json();
-                    email = typeof me.email === "string" ? me.email : undefined;
-                }
-            }
-            catch {
-                // Email is nice to have; the API key is the important credential.
-            }
-            await saveCredentials({
-                api_key: apiKey,
-                backend_url: BACKEND_URL,
-                user_email: email,
-                device_name: name,
-                created_at: new Date().toISOString(),
-            });
-            return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            status: "authenticated",
-                            email,
-                            api_key: apiKey,
-                            key_prefix: keyData.key_prefix,
-                            key_id: keyData.id,
-                            saved_to: CREDENTIALS_FILE,
-                            message: "PreMan account and MCP credentials are ready. You can now scan endpoints, preview, deploy, test, and list hosted MCPs from the agent.",
-                            _agent_hints: {
-                                next_actions: [
-                                    "Call discover_endpoints_from_codebase to scan this project.",
-                                    "Call verify_endpoints_live if you have a base URL to test against.",
-                                    "Call mcp_preview, then mcp_deploy to create a hosted MCP.",
-                                ],
-                                related_tools: ["discover_endpoints_from_codebase", "verify_endpoints_live", "mcp_preview", "mcp_deploy"],
-                            },
-                        }),
-                    }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Get a fresh JWT by calling user_auth_login, user_auth_verify_otp, or user_auth_set_password.",
-                    "Or run `npm exec -y premanmcp@latest -- login` in the terminal.",
-                ],
-                related_tools: ["user_auth_login", "user_auth_verify_otp", "user_auth_set_password"],
-            });
-        }
-    });
-    // ── preman_login ─────────────────────────────────────────────────
-    server.tool("preman_login", "Authenticate with PreMan. Starts a one-time device authorization flow and returns a verification_url. Use Cursor Agent Browser (browser_navigate to verification_url) or open it manually to approve. Then run preman_login_complete with device_code.", {
-        device_name: z.string().optional().describe("Friendly name for this device (e.g. 'My MacBook')"),
-    }, async (args) => {
-        if (API_KEY) {
-            const check = await verifyApiKey(API_KEY);
-            if (check.valid) {
-                return {
-                    content: [{
-                            type: "text",
-                            text: JSON.stringify({
-                                status: "already_authenticated",
-                                email: check.email,
-                                message: `Already logged in as ${check.email ?? "unknown"}. Use preman_logout first if you want to switch accounts.`,
-                            }),
-                        }],
-                };
-            }
-        }
-        const deviceName = args.device_name || `${os.hostname()} MCP`;
-        try {
-            const reqResp = await fetch(`${BACKEND_URL}/auth/device/request`, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ device_name: deviceName }),
-            });
-            if (!reqResp.ok) {
-                const text = await reqResp.text();
-                throw new Error(`Device auth request failed: ${reqResp.status} ${text}`);
-            }
-            const reqData = await reqResp.json();
-            const deviceCode = reqData.device_code;
-            const userCode = reqData.user_code;
-            const verificationUrl = reqData.verification_url;
-            const expiresIn = reqData.expires_in ?? 600;
-            const pollInterval = reqData.poll_interval ?? 5;
-            return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            status: "awaiting_approval",
-                            user_code: userCode,
-                            verification_url: verificationUrl,
-                            expires_in_seconds: expiresIn,
-                            poll_interval_seconds: pollInterval,
-                            _device_code: deviceCode,
-                            instructions: [
-                                `Open this URL to approve: ${verificationUrl}`,
-                                `Your code is: ${userCode}`,
-                                "Log in (if needed) and click Approve.",
-                                "Then run preman_login_complete to finish setup.",
-                            ],
-                            _cursor_agent_steps: [
-                                `Use Cursor Agent Browser: browser_navigate to: ${verificationUrl}`,
-                                `The user code is ${userCode}. The user must log in and approve.`,
-                                `After the user approves, call preman_login_complete with device_code="${deviceCode}" to finish.`,
-                            ],
-                        }),
-                    }],
-            };
-        }
-        catch (e) {
-            return toolError(e.message, "backend_error", { next_actions: ["Retry preman_login"], related_tools: ["preman_login"] });
-        }
-    });
-    // ── preman_login_complete ────────────────────────────────────────
-    // Polls the backend for the approved API key after the user approves
-    // the device request in the browser.
-    server.tool("preman_login_complete", "Complete the login flow after the user approved the device request in the browser. Polls for the API key and stores it locally.", {
-        device_code: z.string().describe("The device_code returned by preman_login"),
-    }, async (args) => {
-        const maxAttempts = 60;
-        const pollMs = 5000;
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            try {
-                const resp = await fetch(`${BACKEND_URL}/auth/device/poll`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({ device_code: args.device_code }),
-                });
-                if (!resp.ok) {
-                    const text = await resp.text();
-                    throw new Error(`Poll error: ${resp.status} ${text}`);
-                }
-                const data = await resp.json();
-                const status = data.status;
-                if (status === "approved" && data.api_key) {
-                    const apiKey = data.api_key;
-                    API_KEY = apiKey;
-                    const check = await verifyApiKey(apiKey);
-                    await saveCredentials({
-                        api_key: apiKey,
-                        backend_url: BACKEND_URL,
-                        user_email: check.email ?? data.user_email,
-                        created_at: new Date().toISOString(),
-                    });
-                    return {
-                        content: [{
-                                type: "text",
-                                text: JSON.stringify({
-                                    status: "authenticated",
-                                    email: check.email,
-                                    message: `Successfully authenticated as ${check.email ?? "unknown"}. Credentials saved — you won't need to log in again.`,
-                                    endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
-                                    _agent_hints: {
-                                        next_actions: [
-                                            `browser_navigate to the URL in endpoints_page_url to open PreMan on the Endpoints page (sign in to the web app if needed).`,
-                                            "Call get_endpoints to see your registered API endpoints.",
-                                            "Call test_api to test an endpoint.",
-                                            "Call import_collection to import a Postman/OpenAPI spec.",
-                                        ],
-                                        related_tools: ["get_endpoints", "test_api", "import_collection"],
-                                    },
-                                }),
-                            }],
-                    };
-                }
-                if (status === "expired") {
-                    return toolError("Device authorization request expired. Run preman_login again.", "auth_required", {
-                        next_actions: ["Re-run preman_login"],
-                        related_tools: ["preman_login"],
-                    });
-                }
-                // Still pending — wait and retry
-                await new Promise((r) => setTimeout(r, pollMs));
-            }
-            catch (e) {
-                return toolError(e.message, "backend_error", { next_actions: ["Re-run preman_login"], related_tools: ["preman_login"] });
-            }
-        }
-        return toolError("Timed out waiting for approval. Run preman_login again.", "auth_required", {
-            next_actions: ["Re-run preman_login"],
-            related_tools: ["preman_login"],
-        });
-    });
-    // ── preman_status ────────────────────────────────────────────────
-    server.tool("preman_status", "Check PreMan authentication status and connection info.", {}, async () => {
-        if (!API_KEY) {
-            return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            authenticated: false,
-                            backend_url: BACKEND_URL,
-                            frontend_base_url: FRONTEND_BASE,
-                            endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
-                            config: configSource(),
-                            message: "Not authenticated. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.",
-                        }),
-                    }],
-            };
-        }
-        const check = await verifyApiKey(API_KEY);
-        if (!check.valid) {
-            return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            authenticated: false,
-                            backend_url: BACKEND_URL,
-                            frontend_base_url: FRONTEND_BASE,
-                            endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
-                            config: configSource(),
-                            message: "Stored API key is no longer valid. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.",
-                        }),
-                    }],
-            };
-        }
-        const workbench = await heartbeatWorkbenchLink();
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        authenticated: true,
-                        email: check.email,
-                        key_name: check.key_name,
-                        backend_url: BACKEND_URL,
-                        frontend_base_url: FRONTEND_BASE,
-                        endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
-                        config: configSource(),
-                        coding_agent: workbench,
-                        _agent_hints: {
-                            next_actions: [
-                                workbench && workbench.connected
-                                    ? "Coding agent is linked to PreMan workbench — call discover_endpoints_from_codebase or get_endpoints."
-                                    : "If PreMan workbench shows pairing, set PREMAN_PAIR_CODE then call preman_status again.",
-                                "browser_navigate to `endpoints_page_url` (SPA shell + ot_agent_route) to open PreMan on the Endpoints page (sign in if prompted), then call get_endpoints.",
-                                "Call get_endpoints to see registered API endpoints.",
-                                "Call test_api to test an endpoint.",
-                            ],
-                            related_tools: ["get_endpoints", "test_api", "import_collection", "discover_endpoints_from_codebase"],
-                        },
-                    }),
-                }],
-        };
-    });
-    // ── preman_logout ────────────────────────────────────────────────
-    server.tool("preman_logout", "Log out of PreMan. Clears stored credentials so you can switch accounts or re-authenticate.", {}, async () => {
-        const wasAuthenticated = !!API_KEY;
-        API_KEY = "";
-        await clearCredentials();
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        status: "logged_out",
-                        was_authenticated: wasAuthenticated,
-                        message: wasAuthenticated
-                            ? "Logged out and credentials cleared. Run preman_login to sign in again."
-                            : "No credentials to clear. Already logged out.",
-                    }),
-                }],
-        };
-    });
-    // ── App user auth (JWT) — same server as preman-local / PREMAN_BACKEND
-    registerUserAuthFlowTools(server, BACKEND_URL);
-    server.tool("share_user_auth_flow_with_ui", "Stream signup, verify-otp, login, and resend-otp (send OTP) into the signed-in PreMan Playground with request/response JSON schemas. Requires preman_login or PREMAN_API_KEY so the session appears in the user's dashboard immediately. Pair with user_auth_* tools to execute flows.", {
-        upstream_base_url: z
-            .string()
-            .optional()
-            .describe("API under test, e.g. http://127.0.0.1:8000. Defaults to PREMAN_BACKEND."),
-        session_id: z
-            .string()
-            .optional()
-            .describe("Reuse an existing agent session id; omit to create a new session."),
-        intent: z.string().optional().describe("Label shown in the Playground session list."),
-    }, async (args) => {
-        try {
-            requireAuth();
-            const result = await shareAuthFlowToUi({
-                backendUrl: BACKEND_URL,
-                frontendUrl: FRONTEND_BASE,
-                upstreamBaseUrl: typeof args.upstream_base_url === "string"
-                    ? args.upstream_base_url
-                    : undefined,
-                sessionId: typeof args.session_id === "string" ? args.session_id : undefined,
-                intent: typeof args.intent === "string" ? args.intent : undefined,
-                apiKey: API_KEY || undefined,
-            });
-            return {
-                content: [{ type: "text", text: JSON.stringify(result) }],
-            };
-        }
-        catch (e) {
-            const m = e instanceof Error ? e.message : String(e);
-            return toolError(m, inferErrorCode(m), {
-                next_actions: [
-                    "Ensure the API is running (e.g. uv run api.py on port 8000).",
-                    "Set PREMAN_BACKEND to that URL in preman-mcp config.",
-                ],
-                related_tools: [
-                    "user_auth_signup",
-                    "share_endpoints_with_ui",
-                    "preman_status",
-                ],
-            });
-        }
-    });
-    // ── Hosted MCP platform tools ──────────────────────────────────────
-    // Thin stdio proxies; all real logic lives in flowtest/mcp/hosted_mcp_tools.py
-    // and is reached via the /mcp/call-tool HTTP bridge.
-    server.tool("connect_logs", "Front door for connecting a customer's production logs to PreMan. Call with NO arguments first: it returns the projects you can use, the supported sources, and the questions to ask. Then call again with action='connect' (CloudWatch/S3/PostHog), action='push' (logs that live anywhere else — Kubernetes, a PaaS drain, a self-hosted collector), and finally action='verify'. NEVER ask the user for AWS access keys: AWS access is a read-only role the customer creates from the CloudFormation template this tool returns, and your job is to run the deploy command it gives you. For action='push', reference $PREMAN_API_KEY by name in any config you write — never print the key itself.", {
-        action: z
-            .enum(["brief", "connect", "push", "verify"])
-            .optional()
-            .describe("Omit for the guided brief; then connect | push | verify"),
-        project_id: z.string().optional().describe("PreMan project the logs belong to"),
-        source: z
-            .enum(["cloudwatch", "s3", "posthog"])
-            .optional()
-            .describe("Where the logs already land; required for action='connect'"),
-        config: z
-            .record(z.any())
-            .optional()
-            .describe("Source config: cloudwatch {region, log_group}, s3 {region, bucket, prefix?}, posthog {project_id, host?, event_names?}"),
-        aws_account_id: z
-            .string()
-            .optional()
-            .describe("Customer's 12-digit AWS account id; used to predict the role ARN the template creates"),
-        posthog_api_key: z.string().optional().describe("PostHog personal API key, read scope (posthog only)"),
-        name: z.string().optional().describe("Display name for the connector"),
-        env_name: z.string().optional().describe("Environment the logs belong to, e.g. production"),
-        stream: z.enum(["frontend", "backend", "unknown"]).optional().describe("Which log rail these lines land on"),
-        interval_seconds: z.number().optional().describe("Poll interval; defaults per source type"),
-        connector_id: z.string().optional().describe("Connector to check; required for action='verify'"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("connect_logs", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Call connect_logs with no arguments to see the supported actions."],
-                related_tools: ["connect_logs"],
-            });
-        }
-    });
-    server.tool("discover_endpoints_from_codebase", "Return a brief the coding agent follows to extract HTTP endpoints from the user's codebase. Call this first when the user asks to turn their API into an MCP — the returned instructions tell your agent how to walk the repo and what shape to produce. Then pass the findings to verify_endpoints_live.", {
-        base_path: z.string().optional().describe("Directory to scan (defaults to CWD)"),
-        framework_hint: z.string().optional().describe("fastapi | express | nestjs | rails | django | nextjs"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("discover_endpoints_from_codebase", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["verify_endpoints_live"],
-            });
-        }
-    });
-    server.tool("verify_endpoints_live", "Probe each proposed endpoint against the user's running local backend and classify the responses (confirmed / unconfirmed / unreachable / review). Collapses agent-extraction ambiguity into deterministic signal. Pass only the endpoints the agent proposed, with method + path_template at minimum.", {
-        endpoints: z.array(z.any()).describe("Endpoints proposed by discover_endpoints_from_codebase"),
-        local_base_url: z.string().describe("Where the backend is running, e.g. http://localhost:8000"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("verify_endpoints_live", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Start the local backend, then retry."],
-                related_tools: ["discover_endpoints_from_codebase", "mcp_preview"],
-            });
-        }
-    });
-    // ── Collections test generation ────────────────────────────────────
-    // The dashboard's Generate Tests / Review flagged / Setup fixtures /
-    // Enrich with agent buttons, so an agent can run them without clicking.
-    server.tool("generate_saved_tests", "Generate scheduled test suites for every endpoint already saved in a PreMan workspace. This is the dashboard's Collections 'Generate Tests' button: it clones the workspace's connected GitHub repository, matches the discovered routes onto the saved endpoints by method and path, and writes heuristic cases onto the ones it matches. No model is involved, so nothing invents a body for a DELETE. Write, destructive, low-confidence, and path-parameter routes come back flagged and disabled — clear them with review_generated_tests. This is not generate_tests, which writes cases for a single endpoint you describe.", {
-        action: z
-            .enum(["generate", "status"])
-            .optional()
-            .describe("generate (default) runs the scan; status is read-only counts"),
-        integration_id: z
-            .string()
-            .optional()
-            .describe("Connected repo to scan. Omit to use the one with the most synced endpoints."),
-        workspace_id: z.string().optional().describe("Defaults to the caller's own workspace"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("generate_saved_tests", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Connect a GitHub repository to this workspace in Settings → Integrations, then retry.",
-                ],
-                related_tools: ["review_generated_tests", "setup_test_fixtures", "enrich_generated_tests"],
-            });
-        }
-    });
-    server.tool("review_generated_tests", "List and approve the generated test suites PreMan flagged for human review. This is the dashboard's 'Review flagged' button. generate_saved_tests deliberately leaves mutating and ambiguous routes disabled; this is how a reviewed suite gets turned on. Approving enables the suite's read-only schedule and does not raise the unattended write policy, so a DELETE stays gated at run time. List first and show the user each suite and its reason; only use approve_all when they asked to clear the whole queue.", {
-        action: z
-            .enum(["list", "approve", "approve_all"])
-            .optional()
-            .describe("list (default) | approve one request_id | approve_all (max 50)"),
-        request_id: z.string().optional().describe("Saved request to approve; required for approve"),
-        workspace_id: z.string().optional().describe("Defaults to the caller's own workspace"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("review_generated_tests", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Call review_generated_tests with action='list' to see the queue."],
-                related_tools: ["generate_saved_tests", "enrich_generated_tests"],
-            });
-        }
-    });
-    server.tool("setup_test_fixtures", "Fill the {id} path parameters in saved PreMan endpoints with real record ids. This is the dashboard's 'Setup fixtures' button: a happy-path test for GET /users/{id} needs an id that exists, so PreMan calls the sibling list route read-only, harvests ids from the response, and falls back to the endpoint's schema example. It never mints a fake UUID that would only 404 and never fires a write. Harvested values are stored in workspace settings and returned as a .env snippet. This does not approve anything.", {
-        action: z
-            .enum(["setup", "list"])
-            .optional()
-            .describe("setup (default) harvests ids; list reports what is still missing"),
-        workspace_id: z.string().optional().describe("Defaults to the caller's own workspace"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("setup_test_fixtures", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["Save at least one endpoint with a {id} path parameter, then retry."],
-                related_tools: ["generate_saved_tests", "review_generated_tests"],
-            });
-        }
-    });
-    server.tool("enrich_generated_tests", "Add model-written test cases on top of PreMan's heuristic suites. This is the dashboard's 'Enrich with agent' button. generate_saved_tests writes deterministic cases only; this pass asks a model for a few extra edge cases per suite. It touches review-cleared suites only, skips destructive and billing-sensitive requests unless workspace policy already allows that risk, skips suites already enriched, and stops after 40 suites per call so a large collection cannot fan out into hundreds of model calls. Leftovers come back as remaining.", {
-        action: z
-            .enum(["enrich", "list"])
-            .optional()
-            .describe("enrich (default) runs the pass; list returns the eligible suites"),
-        workspace_id: z.string().optional().describe("Defaults to the caller's own workspace"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("enrich_generated_tests", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Run generate_saved_tests first, then clear the review queue with review_generated_tests.",
-                ],
-                related_tools: ["generate_saved_tests", "review_generated_tests"],
-            });
-        }
-    });
-    server.tool("share_endpoints_with_ui", "Push discovered or verified endpoints into the PreMan Playground so the user can see them, test them, and convert selected endpoints into hosted MCP tools. Use this after verify_endpoints_live or when the user explicitly asks to stream endpoints to the UI.", {
-        endpoints: z.array(z.any()).describe("Endpoints to push. Each item should include method plus path/path_template/url; include schemas when available."),
-        upstream_base_url: z.string().optional().describe("Default upstream base URL for testing and MCP generation, e.g. http://127.0.0.1:8000 or https://api.example.com"),
-        intent: z.string().optional().describe("Short label for the session, e.g. 'Login endpoint' or 'Auth endpoints'"),
-        session_id: z.string().optional().describe("Optional existing session id to append/replace. Omit to create a new session."),
-    }, async (args) => {
-        try {
-            const result = await callBackend("share_endpoints_with_ui", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: [
-                    "Make sure PREMAN_API_KEY is set or run preman_login, then retry.",
-                    "If the PreMan Playground opens but is empty, confirm PREMAN_BACKEND points to the same backend that received this push.",
-                ],
-                related_tools: ["verify_endpoints_live", "mcp_preview", "preman_status"],
-            });
-        }
-    });
-    server.tool("mcp_preview", "Pick endpoints matching an intent, generate a tool-schema preview, and automatically share the selected endpoints into the PreMan Playground session so the user can see/test/deploy them in the UI. Also writes the same two-pane HTML to preman-mcp/mcp-preview-last.html and returns preview_file_url; use Cursor Simple Browser or `node preman-mcp/scripts/open-cursor-preview.mjs` if the inline MCP app panel does not appear. Endpoint selection uses deterministic keyword matching.", {
-        intent: z.string().describe("Free text like 'auth endpoints' or 'everything related to orders'"),
-        endpoints: z.array(z.any()).describe("Candidate endpoints (typically the confirmed bucket from verify_endpoints_live)"),
-        upstream_base_url: z.string().optional().describe("Target business API base URL. Usually inferred from verify_endpoints_live results. Do not use PREMAN_BACKEND / api.preman.live unless the user's API is actually the PreMan backend."),
-    }, async (args) => {
-        try {
-            const previewArgs = { ...args };
-            const inferredUpstream = inferUpstreamBaseUrlFromEndpoints(previewArgs.endpoints);
-            const requestedUpstream = typeof previewArgs.upstream_base_url === "string"
-                ? previewArgs.upstream_base_url.trim()
-                : "";
-            if (!requestedUpstream && inferredUpstream) {
-                previewArgs.upstream_base_url = inferredUpstream;
-            }
-            else if (requestedUpstream &&
-                isPreManControlPlaneUrl(requestedUpstream) &&
-                inferredUpstream &&
-                !isPreManControlPlaneUrl(inferredUpstream)) {
-                previewArgs.upstream_base_url = inferredUpstream;
-            }
-            const result = await callBackend("mcp_preview", {
-                ...previewArgs,
-                session_id: AGENT_SESSION_ID,
-            });
-            const previewData = (result && typeof result === "object" && !Array.isArray(result))
-                ? result
-                : {};
-            const panelHtml = buildConversionPanelHtml(previewData);
-            const { absolutePath, fileUrl } = await writeMcpPreviewFile(panelHtml);
-            const basePayload = result && typeof result === "object" && !Array.isArray(result)
-                ? result
-                : { raw: result };
-            const uiPayload = basePayload.ui && typeof basePayload.ui === "object" && !Array.isArray(basePayload.ui)
-                ? basePayload.ui
-                : {};
-            const withPreviewNav = {
-                ...basePayload,
-                preview_html_path: absolutePath,
-                preview_file_url: fileUrl,
-                _agent_session: {
-                    session_id: typeof basePayload.session_id === "string" ? basePayload.session_id : AGENT_SESSION_ID,
-                    dashboard_url: typeof uiPayload.url === "string"
-                        ? uiPayload.url
-                        : buildAgentDashboardUrl("/endpoints"),
-                },
-                _how_to_see_the_ui: [
-                    "The selected endpoints were automatically shared into the PreMan Playground session. Open ui.url or _agent_session.dashboard_url to see them.",
-                    "Cursor may not show the embedded MCP app (no new tab is opened by default).",
-                    "Run `node preman-mcp/scripts/open-cursor-preview.mjs` from the repo root; it copies the http:// URL to the clipboard (macOS) and tries cursor:// + vscode:// Simple Browser handlers.",
-                    "If no tab appears: Cmd+Shift+P → “Simple Browser: Show” → paste the http://127.0.0.1:… URL from the script output. In the integrated terminal, Cmd+Click that URL may open the in-editor browser.",
-                    "File → Open on preview_html_path shows source, not a rendered page.",
-                ],
-            };
-            return {
-                content: [
-                    { type: "text", text: JSON.stringify(withPreviewNav, null, 0) },
-                    {
-                        type: "resource",
-                        resource: {
-                            uri: MCP_PREVIEW_RESOURCE_URI,
-                            mimeType: "text/html;profile=mcp-app",
-                            text: panelHtml,
-                        },
-                    },
-                    {
-                        type: "resource_link",
-                        name: "preman-mcp-preview",
-                        title: "PreMan · MCP Preview",
-                        uri: MCP_PREVIEW_RESOURCE_URI,
-                        mimeType: "text/html;profile=mcp-app",
-                    },
-                ],
-                _meta: { [RESOURCE_URI_META_KEY]: MCP_PREVIEW_RESOURCE_URI },
-            };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["mcp_deploy"],
-            });
-        }
-    });
-    server.tool("mcp_deploy", "Create and host an MCP server from a preview spec plus an upstream credential. Returns an install snippet to give to a coding agent. By default the MCP is public and NO consumer token is minted: pass initial_consumer_label to mint one, or call mcp_mint_consumer_token afterwards. Do not tell the user they have a token unless raw_consumer_token came back non-null. The upstream secret is encrypted at rest with a Fernet key; it is never returned to clients after this call.", {
-        name: z.string().describe("Human-readable name, e.g. 'Acme Auth MCP'"),
-        upstream_base_url: z.string().describe("Base URL of the business's real backend. Do not use PREMAN_BACKEND / api.preman.live unless deploying an MCP for PreMan itself."),
-        spec: z.any().describe("The spec_preview object returned by mcp_preview"),
-        initial_upstream_secret: z.string().describe("API key / bearer / basic value the MCP will use to reach the upstream backend"),
-        upstream_auth_style: z.any().optional().describe("Override how the credential is injected. Default: { type:'header', name:'Authorization', prefix:'Bearer ' }"),
-        initial_upstream_secret_type: z.string().optional().describe("bearer | api_key | basic | custom"),
-        initial_consumer_label: z.string().optional().describe("Label for the first consumer token. Omit and no token is minted and the MCP is reachable by anyone holding the URL; pass a label to mint one and get a private, revocable install snippet."),
-    }, async (args) => {
-        try {
-            const deployArgs = { ...args };
-            const requestedUpstream = typeof deployArgs.upstream_base_url === "string"
-                ? deployArgs.upstream_base_url.trim()
-                : "";
-            const spec = deployArgs.spec && typeof deployArgs.spec === "object" && !Array.isArray(deployArgs.spec)
-                ? deployArgs.spec
-                : {};
-            const specUpstream = typeof spec.upstream_base_url === "string" ? spec.upstream_base_url.trim() : "";
-            if (requestedUpstream &&
-                isPreManControlPlaneUrl(requestedUpstream) &&
-                specUpstream &&
-                !isPreManControlPlaneUrl(specUpstream)) {
-                deployArgs.upstream_base_url = specUpstream;
-            }
-            const result = await callBackend("mcp_deploy", deployArgs);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["mcp_mint_consumer_token", "mcp_list_deployed"],
-            });
-        }
-    });
-    server.tool("mcp_list_deployed", "List the hosted MCPs the current user has deployed.", {}, async () => {
-        try {
-            const result = await callBackend("mcp_list_deployed", {});
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message));
-        }
-    });
-    server.tool("mcp_mint_consumer_token", "Mint a consumer token for a hosted MCP. The raw token is returned ONCE — only its hash is stored. Pass upstream_credential_id to map this consumer to a specific upstream credential; omit it to use the MCP's default credential.", {
-        hosted_mcp_id: z.string().describe("The hosted MCP's id"),
-        consumer_label: z.string().describe("Human-readable label for this consumer, e.g. 'acme-beta-bob'"),
-        upstream_credential_id: z.string().optional().describe("Optional credential mapping for this consumer token"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("mcp_mint_consumer_token", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["mcp_revoke_consumer_token", "mcp_list_deployed"],
-            });
-        }
-    });
-    server.tool("mcp_revoke_consumer_token", "Revoke a consumer token so future invocations by that consumer are rejected. Idempotent — revoking an already-revoked token returns ok:true with already_revoked:true.", {
-        hosted_mcp_id: z.string().describe("The hosted MCP's id"),
-        token_id: z.string().describe("The consumer token's id (from mcp_mint_consumer_token's token.id)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("mcp_revoke_consumer_token", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message));
-        }
-    });
-    // ── preman_get_fix_task ───────────────────────────────────────────
-    server.tool("preman_get_fix_task", "Pull pending coding-agent fix tasks built from fired PreMan alerts. Each task packages a failing endpoint: title, expected vs actual, failure stats, and a reproducible curl (package.repro.curl). Fix the endpoint using the curl, then call preman_complete_fix_task with the fix_task_id. Check package.auto_pr: when eligible is true, push your fix on the branch it names and call preman_open_fix_pr.", {
-        status: z.enum(["open", "delivered", "resolved"]).optional().default("open").describe("'open' (default) hands out new tasks and marks them delivered; 'delivered' re-fetches ones already pulled; 'resolved' for history"),
-        limit: z.number().optional().default(5).describe("Max tasks to return (capped at 20)"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("preman_get_fix_task", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                next_actions: ["No open fix tasks means no alerts have been handed off. Create a handoff from a fired alert in the dashboard."],
-            });
-        }
-    });
-    // ── preman_complete_fix_task ──────────────────────────────────────
-    server.tool("preman_complete_fix_task", "Mark a fix task resolved once its endpoint failure is fixed.", {
-        fix_task_id: z.string().describe("The id from a preman_get_fix_task result"),
-        resolution_note: z.string().optional().default("").describe("Optional note on what was fixed"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("preman_complete_fix_task", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["preman_get_fix_task"],
-            });
-        }
-    });
-    // ── preman_open_fix_pr ────────────────────────────────────────────
-    server.tool("preman_open_fix_pr", "Open a pull request for a fix branch you already pushed (Auto-PR, Tier 2). Only for fix tasks whose package.auto_pr.eligible is true. Patch and push the preman/fix-* branch with your own git credentials first — PreMan never pushes code. PreMan then verifies the branch exists, re-checks the endpoint in production, and opens a PR with that evidence. PreMan never merges automatically — it merges only its own preman/fix-* branches, only on repositories that turned merging on, and only after you approve.", {
-        fix_task_id: z.string().describe("The id from a preman_get_fix_task result"),
-        branch: z.string().describe("The branch you pushed — must match package.auto_pr.branch"),
-        summary: z.string().optional().default("").describe("Short description of the fix, included in the PR body"),
-        local_rerun: z.string().optional().default("").describe("Your local test/re-run output, included as agent-reported evidence"),
-    }, async (args) => {
-        try {
-            const result = await callBackend("preman_open_fix_pr", args);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return toolError(e.message, inferErrorCode(e.message), {
-                related_tools: ["preman_get_fix_task", "preman_complete_fix_task"],
-                next_actions: ["Auto-PR requires the repo to have opted in and the fix task to be an API_BUG failure mapped to that repo."],
-            });
-        }
-    });
-    return server;
-}
-// ── Start ─────────────────────────────────────────────────────────────
-/**
- * A pre-push hook PreMan wrote can stop working — the machine gained a `preman`
- * belonging to another package, or lost the one it pinned — and the only symptom
- * is one skipped line per push. This process starting is proof PreMan runs here,
- * so it is a good moment to check. Detached with stdio ignored: the check shells
- * out to npm, and this process's stdout is the MCP protocol.
- */
-function repairPushHookInBackground() {
+    if (!body.trim())
+        return;
+    const contentType = response.headers.get("content-type") || "";
+    const replies = contentType.includes("text/event-stream")
+        ? parseSse(body)
+        : [JSON.parse(body)];
+    for (const reply of replies)
+        write(reply);
+}
+const input = createInterface({ input: process.stdin, crlfDelay: Infinity });
+let queue = Promise.resolve();
+input.on("line", (line) => {
+    const raw = line.trim();
+    if (!raw)
+        return;
+    let message;
     try {
-        const cli = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "bin", "cli.js");
-        if (!existsSync(cli))
-            return;
-        const child = spawn(process.execPath, [cli, "hook", "repair", "--if-stale"], {
-            detached: true,
-            stdio: "ignore",
-        });
-        child.unref();
+        message = JSON.parse(raw);
     }
     catch {
-        // Never worth failing a server start over.
-    }
-}
-async function main() {
-    await initAuth();
-    const server = createServer();
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-    repairPushHookInBackground();
-    // Starting the configured MCP server is itself proof that the coding agent
-    // is live.  Previously the workbench remained in `connecting` until someone
-    // explicitly asked the agent to call `preman_status`, even when this process
-    // already had valid stored credentials and the pairing code in its env.
-    // Keep startup non-blocking so a slow control plane cannot delay MCP setup.
-    if (API_KEY) {
-        void heartbeatWorkbenchLink().then((link) => {
-            if (link?.ok) {
-                console.error("[PreMan] Coding-agent connection heartbeat sent");
-            }
-            else if (link) {
-                console.error(`[PreMan] Coding-agent heartbeat not accepted: ${String(link.detail || link.status || "unknown error")}`);
-            }
-        });
+        write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
+        return;
     }
-}
-main().catch(console.error);
-process.on("SIGINT", () => { process.exit(0); });
-process.on("SIGTERM", () => { process.exit(0); });
+    queue = queue.then(() => forward(message)).catch((error) => {
+        rpcError(message, -32603, error instanceof Error ? error.message : "Internal proxy error");
+    });
+});