privateer-agent 0.2.1 → 0.3.0

package/src/hooks/engine.ts

@@ -1,155 +0,0 @@
-import type { ToolSet } from "ai";
-import { exec } from "../tools/exec.ts";
-
-// A single hook: a shell command, optionally gated by a regex matched against the
-// tool name (tool events only). Loaded from settings under the `hooks` key.
-export interface HookDef {
-  matcher?: string;
-  command: string;
-}
-
-export type HookEvent = "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "Stop";
-export type HooksConfig = Partial<Record<HookEvent, HookDef[]>>;
-
-// Aggregated result of firing an event's hooks.
-export interface HookOutcome {
-  block?: boolean; // PreToolUse / UserPromptSubmit may veto
-  reason?: string;
-  additionalContext?: string; // UserPromptSubmit may inject extra context
-}
-
-const HOOK_TIMEOUT_MS = 30_000;
-const KNOWN_EVENTS: HookEvent[] = ["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop"];
-
-// Parse the loosely-typed `hooks` section of settings into a validated HooksConfig.
-export function loadHooks(raw: unknown): HooksConfig {
-  if (typeof raw !== "object" || raw === null) return {};
-  const out: HooksConfig = {};
-  for (const event of KNOWN_EVENTS) {
-    const entries = (raw as Record<string, unknown>)[event];
-    if (!Array.isArray(entries)) continue;
-    const defs: HookDef[] = [];
-    for (const e of entries) {
-      if (e && typeof e === "object" && typeof (e as any).command === "string") {
-        defs.push({ matcher: (e as any).matcher, command: (e as any).command });
-      }
-    }
-    if (defs.length) out[event] = defs;
-  }
-  return out;
-}
-
-function matches(def: HookDef, toolName?: string): boolean {
-  if (!def.matcher) return true;
-  if (toolName === undefined) return true;
-  try {
-    return new RegExp(def.matcher).test(toolName);
-  } catch {
-    return false; // invalid regex → don't match
-  }
-}
-
-// Fire one hook with a JSON payload on stdin; interpret its result. A hook blocks by
-// exiting with code 2 (reason from stderr) or printing JSON with decision "block"/"deny".
-// It may inject context via { "additionalContext": "..." }.
-async function fireHook(def: HookDef, payload: unknown, cwd: string): Promise<HookOutcome> {
-  const res = await exec(def.command, [], {
-    cwd,
-    timeoutMs: HOOK_TIMEOUT_MS,
-    shell: true,
-    input: JSON.stringify(payload),
-  });
-  if (res.code === 2) return { block: true, reason: res.stderr.trim() || "blocked by hook" };
-  const stdout = res.stdout.trim();
-  if (stdout.startsWith("{")) {
-    try {
-      const out = JSON.parse(stdout) as Record<string, unknown>;
-      const decision = (out.decision ?? out.permissionDecision) as string | undefined;
-      return {
-        block: decision === "block" || decision === "deny",
-        reason: (out.reason ?? out.permissionDecisionReason) as string | undefined,
-        additionalContext: out.additionalContext as string | undefined,
-      };
-    } catch {
-      /* not JSON → no control signal */
-    }
-  }
-  return {};
-}
-
-// Runs the configured hooks for each lifecycle event.
-export class HookRunner {
-  constructor(
-    private readonly hooks: HooksConfig,
-    private readonly cwd: string,
-  ) {}
-
-  has(event: HookEvent): boolean {
-    return (this.hooks[event]?.length ?? 0) > 0;
-  }
-
-  config(): HooksConfig {
-    return this.hooks;
-  }
-
-  // Fire tool-event hooks (Pre/PostToolUse). The first hook to block wins.
-  async tool(
-    event: "PreToolUse" | "PostToolUse",
-    toolName: string,
-    payload: { input: unknown; output?: unknown },
-  ): Promise<HookOutcome> {
-    const defs = (this.hooks[event] ?? []).filter((d) => matches(d, toolName));
-    let merged: HookOutcome = {};
-    for (const def of defs) {
-      const outcome = await fireHook(def, { event, tool: toolName, ...payload, cwd: this.cwd }, this.cwd);
-      if (outcome.block) return outcome;
-      merged = { ...merged, ...outcome };
-    }
-    return merged;
-  }
-
-  // Fire UserPromptSubmit hooks; a block vetoes the turn, additionalContext is merged.
-  async prompt(text: string): Promise<HookOutcome> {
-    const defs = this.hooks.UserPromptSubmit ?? [];
-    let context = "";
-    for (const def of defs) {
-      const outcome = await fireHook(def, { event: "UserPromptSubmit", prompt: text, cwd: this.cwd }, this.cwd);
-      if (outcome.block) return outcome;
-      if (outcome.additionalContext) context += (context ? "\n" : "") + outcome.additionalContext;
-    }
-    return context ? { additionalContext: context } : {};
-  }
-
-  // Fire Stop hooks (turn finished); fire-and-report, no control flow.
-  async stop(): Promise<void> {
-    for (const def of this.hooks.Stop ?? []) {
-      await fireHook(def, { event: "Stop", cwd: this.cwd }, this.cwd);
-    }
-  }
-}
-
-// Wrap each tool's execute with Pre/PostToolUse hooks. A blocking PreToolUse hook
-// short-circuits the call, returning the reason so the model can adapt. No-op when no
-// tool hooks are configured.
-export function wrapToolsWithHooks(tools: ToolSet, runner: HookRunner): ToolSet {
-  if (!runner.has("PreToolUse") && !runner.has("PostToolUse")) return tools;
-  const wrapped: ToolSet = {};
-  for (const [name, t] of Object.entries(tools)) {
-    const orig = (t as any).execute;
-    if (typeof orig !== "function") {
-      wrapped[name] = t;
-      continue;
-    }
-    wrapped[name] = {
-      ...(t as any),
-      execute: async (input: unknown, options: unknown) => {
-        const pre = await runner.tool("PreToolUse", name, { input });
-        if (pre.block) return `Blocked by PreToolUse hook: ${pre.reason ?? "no reason given"}`;
-        const output = await orig(input, options);
-        await runner.tool("PostToolUse", name, { input, output });
-        return output;
-      },
-    } as ToolSet[string];
-  }
-  return wrapped;
-}

package/src/main.tsx

@@ -1,209 +0,0 @@
-import React from "react";
-import { render } from "ink";
-import { Command } from "commander";
-import { spawn } from "node:child_process";
-import { openSync } from "node:fs";
-import { join } from "node:path";
-import { Root } from "./components/Root.tsx";
-import { NAME, VERSION, DESCRIPTION } from "./version.ts";
-import { loadConfig, globalDir } from "./config/load.ts";
-import { createSession } from "./session.ts";
-import { loadLatest, loadSession } from "./memory/store.ts";
-import { configuredProviders } from "./providers/resolve.ts";
-import { describeError } from "./engine/errors.ts";
-import { runDaemon } from "./daemon/index.ts";
-import { revokeChildSession } from "./auth/privateer.ts";
-
-// Set while Ink owns the screen. A stray unhandled rejection while the TUI is up
-// must NOT reach stdout/stderr — Node's default printer dumps the whole error
-// object (the request body included) unredacted and scrambles the render. The
-// underlying error has already surfaced cleanly via the engine's `error` event,
-// so here we just swallow the duplicate.
-let tuiActive = false;
-
-process.on("unhandledRejection", (reason) => {
-  if (tuiActive) return;
-  const d = describeError(reason);
-  process.stderr.write(`\nError: ${d.message}${d.hint ? `\n${d.hint}` : ""}\n`);
-  process.exitCode = 1;
-});
-
-interface CliOptions {
-  print?: boolean;
-  model?: string;
-  cwd?: string;
-  dangerouslySkipPermissions?: boolean;
-  // Commander treats `--no-quarter` as a negatable boolean: `quarter` is true by
-  // default and becomes false when the flag is passed.
-  quarter?: boolean;
-  continue?: boolean;
-  resume?: string;
-  onboard?: boolean;
-  // Commander negatable boolean: `confine` is true by default, false with --no-confine.
-  confine?: boolean;
-}
-
-const DEFAULT_MODEL = "anthropic:claude-opus-4-8";
-
-async function main() {
-  const program = new Command();
-
-  program
-    .name(NAME)
-    .description(DESCRIPTION)
-    .version(VERSION, "-v, --version")
-    .argument("[prompt...]", "prompt to send (with -p, runs headless)")
-    .option("-p, --print", "print mode: run headless and write the answer to stdout")
-    .option("-m, --model <provider:model>", "model to use, e.g. openrouter:anthropic/claude-opus-4.8")
-    .option("-C, --cwd <dir>", "working directory")
-    .option("--no-confine", "let the agent read/edit outside the working directory without prompting")
-    .option("--dangerously-skip-permissions", "auto-approve all tool actions (bypass mode)")
-    .option("--no-quarter", "auto-approve all tool actions, taking no prisoners (bypass mode)")
-    .option("-c, --continue", "resume the most recent session in this directory")
-    .option("-r, --resume <id>", "resume a specific session by id (printed on exit)")
-    .option("--onboard", "run the provider/key setup flow")
-    .action(async (promptParts: string[], options: CliOptions) => {
-      // Terminal-window close (SIGHUP) or a kill (SIGTERM) bypasses the normal
-      // exit path below — revoke this terminal's Privateer session first so it
-      // drops off the app's Linked Devices immediately instead of lingering
-      // until server-side expiry. Installing a handler replaces Node's default
-      // terminate-on-signal, so exit explicitly with the conventional code.
-      const revokeAndExit = (code: number) => () => {
-        void revokeChildSession().finally(() => process.exit(code));
-      };
-      process.on("SIGHUP", revokeAndExit(129));
-      process.on("SIGTERM", revokeAndExit(143));
-      try {
-        if (options.cwd) process.chdir(options.cwd);
-        const config = loadConfig();
-        if (options.dangerouslySkipPermissions || options.quarter === false)
-          config.permissionMode = "bypass";
-        // --no-confine turns off the working-directory boundary for this run.
-        if (options.confine === false) config.confineToCwd = false;
-        // --resume <id> loads a specific session (the id printed on a prior exit);
-        // --continue loads the most recent one.
-        const resume = options.resume
-          ? loadSession(process.cwd(), options.resume)
-          : options.continue
-            ? loadLatest(process.cwd())
-            : null;
-        if (options.resume && !resume) {
-          process.stderr.write(`No session "${options.resume}" found in this directory.\n`);
-        }
-        const modelSpec = options.model ?? resume?.modelSpec ?? config.defaultModel ?? DEFAULT_MODEL;
-
-        if (options.print) {
-          await runPrint(modelSpec, promptParts.join(" ").trim(), config.confineToCwd);
-          await revokeChildSession();
-          return;
-        }
-
-        // First-run onboarding: no provider has credentials yet (and we're not
-        // resuming). Also forceable with --onboard.
-        const noProviderReady = !configuredProviders(config).some((p) => p.ready);
-        const startInOnboarding = Boolean(options.onboard) || (!resume && noProviderReady);
-
-        // Interactive TUI.
-        tuiActive = true;
-        const { waitUntilExit } = render(
-          <Root
-            config={config}
-            modelSpec={modelSpec}
-            cwd={process.cwd()}
-            resume={resume}
-            startInOnboarding={startInOnboarding}
-          />,
-        );
-        await waitUntilExit();
-        tuiActive = false;
-
-        // This terminal is done — release its Privateer session so it leaves the
-        // app's Linked Devices right away. Started before the resume hint prints
-        // and awaited after, so it doesn't delay the output.
-        const revoked = revokeChildSession();
-
-        // On exit, print a hash that resumes this conversation later (à la Claude
-        // Code). The latest persisted session carries the id used this run; it only
-        // exists once at least one turn has been saved.
-        const last = loadLatest(process.cwd());
-        if (last && last.messages.length > 0) {
-          process.stdout.write(`\nResume this session:  ${NAME} --resume ${last.id}\n`);
-        }
-        await revoked;
-      } catch (err) {
-        // Configuration/resolution errors are expected and user-facing — print them
-        // cleanly without a stack trace.
-        process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
-        process.exitCode = 1;
-      }
-    });
-
-  // The scheduler daemon: a resident process that fires routines on their cron
-  // schedule. Runs in the foreground by default; --detach forks a background copy.
-  program
-    .command("daemon")
-    .description("run the scheduler that fires saved routines on their cron schedule")
-    .option("--detach", "start the daemon in the background and return")
-    .action((opts: { detach?: boolean }) => {
-      if (opts.detach) {
-        const logPath = join(globalDir(), "daemon.log");
-        const out = openSync(logPath, "a");
-        // Re-invoke this same runtime + script without --detach, fully detached.
-        const args = process.argv.slice(1).filter((a) => a !== "--detach");
-        const child = spawn(process.argv[0], args, { detached: true, stdio: ["ignore", out, out] });
-        child.unref();
-        process.stdout.write(`Daemon started in background (pid ${child.pid}).\nLogs: ${logPath}\n`);
-        return;
-      }
-      runDaemon();
-    });
-
-  await program.parseAsync(process.argv);
-}
-
-// Headless one-shot: stream the answer to stdout, surfacing tool activity on stderr.
-async function runPrint(modelSpec: string, prompt: string, confineToCwd: boolean) {
-  if (!prompt) {
-    process.stderr.write("No prompt provided.\n");
-    process.exitCode = 1;
-    return;
-  }
-  const session = createSession({ config: loadConfig(), modelSpec, cwd: process.cwd(), confineToCwd });
-  for await (const ev of session.engine.send(prompt)) {
-    switch (ev.type) {
-      case "text":
-        process.stdout.write(ev.text);
-        break;
-      case "tool-call":
-        process.stderr.write(`\n· ${ev.name} ${JSON.stringify(ev.input)}\n`);
-        break;
-      case "tool-error":
-        process.stderr.write(`\n! ${ev.name}: ${ev.error}\n`);
-        break;
-      case "routed":
-        process.stderr.write(
-          ev.missing && ev.missing.length > 0
-            ? `\n⚠ no model configured for ${ev.missing.join("/")} input\n`
-            : `\n↪ ${ev.label}${ev.reason ? ` · ${ev.reason}` : ""}\n`,
-        );
-        break;
-      case "error":
-        process.stderr.write(`\nError: ${ev.error}${ev.hint ? `\n${ev.hint}` : ""}\n`);
-        process.exitCode = 1;
-        break;
-      case "finish":
-        process.stdout.write(
-          `\n\n[${modelSpec} · ${ev.usage.totalTokens} tokens · ${ev.finishReason}]\n`,
-        );
-        break;
-    }
-  }
-}
-
-main().catch((err) => {
-  // Redact + summarize rather than dumping the raw error object, which may carry
-  // request bodies or key material in provider-error fields.
-  const d = describeError(err);
-  process.stderr.write(`Error: ${d.message}${d.hint ? `\n${d.hint}` : ""}\n`);
-  process.exit(1);
-});

package/src/mcp/client.ts

@@ -1,251 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { tool, jsonSchema, type ToolSet } from "ai";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { globalPaths, projectPaths } from "../config/paths.ts";
-import { type PermissionGate, PermissionDeniedError } from "../permissions/gate.ts";
-import { FileOAuthProvider, type AuthorizePrompt } from "./oauth.ts";
-
-// A local stdio server (launched as a child process) or a remote HTTP server.
-export type StdioServerConfig = { command: string; args?: string[]; env?: Record<string, string> };
-export type HttpServerConfig = { url: string; headers?: Record<string, string>; transport?: "http" | "sse" };
-export type McpServerConfig = StdioServerConfig | HttpServerConfig;
-export type McpServers = Record<string, McpServerConfig>;
-
-function isStdio(cfg: McpServerConfig): cfg is StdioServerConfig {
-  return typeof (cfg as StdioServerConfig).command === "string";
-}
-
-export interface McpToolDef {
-  name: string;
-  description?: string;
-  inputSchema?: Record<string, unknown>;
-  // Standard MCP behavioral hints. We use `destructiveHint`/`readOnlyHint` to
-  // decide whether a tool may auto-approve: a tool that performs an irreversible
-  // external action marks itself destructive so it ALWAYS reaches the human.
-  annotations?: { readOnlyHint?: boolean; destructiveHint?: boolean };
-}
-
-// Read mcp.json from project then user scope (project overrides). Accepts either a
-// top-level map or a { "mcpServers": {...} } wrapper. An entry is kept if it names a
-// stdio `command` or a remote `url`; anything else is dropped.
-export function loadMcpServers(cwd: string = process.cwd()): McpServers {
-  const merge = (path: string, into: McpServers) => {
-    if (!existsSync(path)) return;
-    try {
-      const raw = JSON.parse(readFileSync(path, "utf8"));
-      const map = (raw && typeof raw === "object" && raw.mcpServers) || raw;
-      if (map && typeof map === "object") {
-        for (const [name, cfg] of Object.entries(map as Record<string, unknown>)) {
-          if (cfg && typeof cfg === "object") {
-            const c = cfg as Partial<StdioServerConfig & HttpServerConfig>;
-            if (typeof c.command === "string" || typeof c.url === "string") {
-              into[name] = cfg as McpServerConfig;
-            }
-          }
-        }
-      }
-    } catch {
-      /* malformed mcp.json → skip */
-    }
-  };
-  const servers: McpServers = {};
-  merge(globalPaths().mcp, servers);
-  merge(projectPaths(cwd).mcp, servers);
-  return servers;
-}
-
-// process.env as a clean string map, so stdio servers inherit our environment
-// (StdioClientTransport otherwise launches with a minimal default env).
-function inheritedEnv(extra?: Record<string, string>): Record<string, string> {
-  const base: Record<string, string> = {};
-  for (const [k, v] of Object.entries(process.env)) if (v !== undefined) base[k] = v;
-  return { ...base, ...extra };
-}
-
-function withTimeout<T>(p: Promise<T>, ms: number, label: string): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(`${label} timed out`)), ms);
-    p.then((v) => (clearTimeout(timer), resolve(v)), (e) => (clearTimeout(timer), reject(e)));
-  });
-}
-
-// An MCP client over the official SDK, transport chosen from config: a local child
-// process (stdio) or a remote server (Streamable HTTP, falling back to legacy SSE).
-// Exposes only what the agent needs: connect, tools/list, tools/call, close.
-export class McpClient {
-  private client?: Client;
-
-  constructor(
-    private readonly name: string,
-    private readonly cfg: McpServerConfig,
-    private readonly cwd: string,
-    private readonly onAuthorize?: AuthorizePrompt,
-  ) {}
-
-  async connect(timeoutMs = 10_000): Promise<void> {
-    const client = new Client({ name: "privateer", version: "0.1.0" }, { capabilities: {} });
-    if (isStdio(this.cfg)) {
-      const transport = new StdioClientTransport({
-        command: this.cfg.command,
-        args: this.cfg.args ?? [],
-        env: inheritedEnv(this.cfg.env),
-        cwd: this.cwd,
-        stderr: "ignore", // keep server logs out of the TUI
-      });
-      await withTimeout(client.connect(transport), timeoutMs, `MCP server "${this.name}" connect`);
-      this.client = client;
-      return;
-    }
-
-    const url = new URL(this.cfg.url);
-    const requestInit = this.cfg.headers ? { headers: this.cfg.headers } : undefined;
-    // Static header auth wins. Otherwise attach an interactive OAuth provider — it
-    // stays dormant unless the server actually answers 401.
-    const authProvider = this.cfg.headers
-      ? undefined
-      : new FileOAuthProvider(this.name, this.cfg.url, this.onAuthorize);
-    const sse = () => new SSEClientTransport(url, { requestInit, authProvider });
-
-    if (this.cfg.transport === "sse") {
-      await this.tryConnect(client, sse, authProvider, timeoutMs);
-    } else {
-      const http = () => new StreamableHTTPClientTransport(url, { requestInit, authProvider });
-      try {
-        await this.tryConnect(client, http, authProvider, timeoutMs);
-      } catch (err) {
-        // A server that only speaks the legacy HTTP+SSE transport rejects the
-        // Streamable-HTTP handshake; retry once over SSE before giving up.
-        if (this.cfg.transport !== "http") await this.tryConnect(client, sse, authProvider, timeoutMs);
-        else throw err;
-      }
-    }
-    this.client = client;
-  }
-
-  // Connect with one transport kind. On a 401 with an OAuth provider configured,
-  // run the interactive consent dance (browser → loopback redirect → code →
-  // token exchange) and reconnect with a fresh transport that picks up the tokens.
-  private async tryConnect(
-    client: Client,
-    make: () => StreamableHTTPClientTransport | SSEClientTransport,
-    provider: FileOAuthProvider | undefined,
-    timeoutMs: number,
-  ): Promise<void> {
-    const transport = make();
-    try {
-      await withTimeout(client.connect(transport), timeoutMs, `MCP server "${this.name}" connect`);
-    } catch (err) {
-      if (err instanceof UnauthorizedError && provider) {
-        const code = await provider.waitForCode();
-        await transport.finishAuth(code);
-        await withTimeout(client.connect(make()), timeoutMs, `MCP server "${this.name}" reconnect`);
-      } else {
-        throw err;
-      }
-    }
-  }
-
-  async listTools(): Promise<McpToolDef[]> {
-    const res = await this.client!.listTools();
-    return Array.isArray(res?.tools)
-      ? res.tools.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema as Record<string, unknown>,
-          annotations: t.annotations as McpToolDef["annotations"],
-        }))
-      : [];
-  }
-
-  async callTool(name: string, args: unknown): Promise<string> {
-    const res = await this.client!.callTool({ name, arguments: (args ?? {}) as Record<string, unknown> });
-    return formatContent(res);
-  }
-
-  close(): void {
-    void this.client?.close();
-  }
-}
-
-function formatContent(result: any): string {
-  const content = result?.content;
-  if (Array.isArray(content)) {
-    const text = content
-      .map((c: any) => (c?.type === "text" ? c.text : `[${c?.type ?? "content"}]`))
-      .join("\n");
-    return result?.isError ? `Error: ${text}` : text || "(no output)";
-  }
-  return JSON.stringify(result ?? {});
-}
-
-// Adapt one server's MCP tools into AI-SDK tools, namespaced as "<server>__<tool>" and
-// routed through the permission gate (MCP calls are external, so they prompt by default).
-export function adaptMcpTools(
-  server: string,
-  client: McpClient,
-  defs: McpToolDef[],
-  gate: PermissionGate,
-): ToolSet {
-  const set: ToolSet = {};
-  for (const d of defs) {
-    const name = `${server}__${d.name}`;
-    // A mutating tool (e.g. send email, delete file) marks itself destructive. We
-    // map that to `alwaysAsk`, which the gate never auto-approves — so it always
-    // prompts the human (phone on remote turns, terminal otherwise) even under
-    // bypass mode or the allowlist. Read-only tools follow the normal policy.
-    const destructive = d.annotations?.destructiveHint === true && d.annotations?.readOnlyHint !== true;
-    set[name] = tool({
-      description: d.description ?? `${d.name} (MCP server: ${server})`,
-      inputSchema: jsonSchema((d.inputSchema as any) ?? { type: "object", properties: {} }),
-      execute: async (args: unknown) => {
-        const decision = await gate.request({
-          tool: name,
-          kind: "fetch",
-          title: `MCP ${server}: ${d.name}`,
-          detail: JSON.stringify(args ?? {}).slice(0, 120),
-          alwaysAsk: destructive,
-        });
-        if (decision === "deny") throw new PermissionDeniedError(name);
-        return client.callTool(d.name, args);
-      },
-    });
-  }
-  return set;
-}
-
-export interface McpConnection {
-  tools: ToolSet;
-  clients: McpClient[];
-  status: { server: string; tools: number; error?: string }[];
-}
-
-// Connect every configured server, returning the merged toolset, the live clients (to
-// close on teardown), and a per-server status. Failures are isolated per server.
-export async function connectMcpServers(
-  servers: McpServers,
-  cwd: string,
-  gate: PermissionGate,
-  onAuthorize?: AuthorizePrompt,
-): Promise<McpConnection> {
-  const tools: ToolSet = {};
-  const clients: McpClient[] = [];
-  const status: McpConnection["status"] = [];
-  for (const [name, cfg] of Object.entries(servers)) {
-    const client = new McpClient(name, cfg, cwd, onAuthorize);
-    try {
-      await client.connect();
-      const defs = await client.listTools();
-      Object.assign(tools, adaptMcpTools(name, client, defs, gate));
-      clients.push(client);
-      status.push({ server: name, tools: defs.length });
-    } catch (err) {
-      client.close();
-      status.push({ server: name, tools: 0, error: err instanceof Error ? err.message : String(err) });
-    }
-  }
-  return { tools, clients, status };
-}