synabun 1.3.0 → 2.0.0

package/mcp-server/dist/config.d.ts

@@ -0,0 +1,22 @@
+export declare const config: {
+    readonly dataHome: string;
+    readonly dataDir: string;
+    readonly sqlite: {
+        readonly dbPath: string;
+    };
+    readonly embedding: {
+        readonly model: "Xenova/all-MiniLM-L6-v2";
+        readonly dimensions: 384;
+    };
+};
+export declare function getEnvPath(): string;
+export declare function detectProject(cwd?: string): string;
+/**
+ * The registered root directory of a project label (or one of its aliases),
+ * or null. Relative `related_files` are relative to this, not to whichever
+ * process happens to read them — over HTTP that is the Neural Interface.
+ */
+export declare function projectRoot(project: string | null | undefined): string | null;
+/** Resolve labels without changing the historic spelling on stored records. */
+export declare function projectAliases(project: string): string[];
+//# sourceMappingURL=config.d.ts.map

package/mcp-server/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,MAAM;;;;;;;;;;CAUT,CAAC;AAIX,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AA4BD,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAkClD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQ7E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CASxD"}

package/mcp-server/dist/config.js

@@ -0,0 +1,109 @@
+import path from 'path';
+import fs from 'fs';
+import { getDataHome } from '../../lib/paths.js';
+import { isHttpMode, callerMemoryContext } from './services/identity.js';
+const dataHome = getDataHome();
+// --- Static config ---
+export const config = {
+    dataHome,
+    dataDir: process.env.MEMORY_DATA_DIR || path.resolve(dataHome, 'mcp-data'),
+    sqlite: {
+        dbPath: process.env.SQLITE_DB_PATH || '', // resolved lazily from dataDir
+    },
+    embedding: {
+        model: 'Xenova/all-MiniLM-L6-v2',
+        dimensions: 384,
+    },
+};
+// --- .env path resolution (for file watching) ---
+export function getEnvPath() {
+    return process.env.DOTENV_PATH || path.resolve(dataHome, '.env');
+}
+// --- Project Detection (reads from claude-code-projects.json) ---
+// The project registry lives under <dataHome>/data/, NOT config.dataDir
+// (<dataHome>/mcp-data/). It is written there by neural-interface/server.js and
+// read from there by hooks/claude-code/shared.mjs. Pointing at dataDir meant the
+// file never existed, loadRegisteredProjects() always returned [], and
+// detectProject() silently fell through to a raw directory basename — ignoring
+// every registered project label.
+const PROJECTS_PATH = path.resolve(dataHome, 'data', 'claude-code-projects.json');
+function loadRegisteredProjects() {
+    try {
+        if (!fs.existsSync(PROJECTS_PATH))
+            return [];
+        return JSON.parse(fs.readFileSync(PROJECTS_PATH, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+}
+function normalizeLabel(label) {
+    return label.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+}
+export function detectProject(cwd) {
+    if (!cwd && callerMemoryContext().project)
+        return callerMemoryContext().project;
+    // Over HTTP every caller shares the Neural Interface process, so process.cwd()
+    // is the server's directory, not the caller's — it labeled every memory
+    // "neural-interface" regardless of where the client actually was. Return a
+    // neutral bucket instead of a confident wrong answer: "global" is a mislabel
+    // you can find and fix, "neural-interface" is indistinguishable from a real one.
+    if (!cwd && isHttpMode())
+        return 'global';
+    const dir = cwd || process.cwd();
+    const lower = dir.toLowerCase().replace(/\\/g, '/');
+    const projects = loadRegisteredProjects();
+    // Sort by path length descending — most specific match wins
+    const sorted = projects
+        .map((p) => ({
+        path: p.path.toLowerCase().replace(/\\/g, '/'),
+        label: normalizeLabel(p.label),
+    }))
+        .sort((a, b) => b.path.length - a.path.length);
+    // 1. Exact path prefix match (cwd is inside a registered project)
+    for (const p of sorted) {
+        if (lower.startsWith(p.path + '/') || lower === p.path)
+            return p.label;
+    }
+    // 2. Substring match — cwd folder name contains a registered project's folder name
+    for (const p of sorted) {
+        const projFolder = path.basename(p.path).toLowerCase();
+        if (lower.includes(projFolder))
+            return p.label;
+    }
+    // 3. Fallback to directory basename
+    const base = path.basename(dir).toLowerCase().replace(/[^a-z0-9-]/g, '-');
+    return base || 'global';
+}
+/**
+ * The registered root directory of a project label (or one of its aliases),
+ * or null. Relative `related_files` are relative to this, not to whichever
+ * process happens to read them — over HTTP that is the Neural Interface.
+ */
+export function projectRoot(project) {
+    if (!project)
+        return null;
+    const normalized = normalizeLabel(project);
+    for (const p of loadRegisteredProjects()) {
+        if (!p?.path)
+            continue;
+        if (p.label?.toLowerCase() === project.toLowerCase() || (normalized && (normalizeLabel(p.label ?? '') === normalized || normalizeLabel(path.basename(p.path)) === normalized)))
+            return p.path;
+    }
+    return null;
+}
+/** Resolve labels without changing the historic spelling on stored records. */
+export function projectAliases(project) {
+    const normalized = normalizeLabel(project);
+    const aliases = new Set([project, normalized].filter(Boolean));
+    for (const p of loadRegisteredProjects()) {
+        if (p.label.toLowerCase() === project.toLowerCase() || (normalized && (normalizeLabel(p.label) === normalized || normalizeLabel(path.basename(p.path)) === normalized))) {
+            aliases.add(p.label);
+            if (normalizeLabel(p.label))
+                aliases.add(normalizeLabel(p.label));
+            aliases.add(path.basename(p.path));
+        }
+    }
+    return [...aliases];
+}
+//# sourceMappingURL=config.js.map

package/mcp-server/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;AAE/B,wBAAwB;AAExB,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC1E,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAG,+BAA+B;KAC3E;IACD,SAAS,EAAE;QACT,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,GAAG;KAChB;CACO,CAAC;AAEX,mDAAmD;AAEnD,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,mEAAmE;AAEnE,wEAAwE;AACxE,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;AAOlF,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,mBAAmB,EAAE,CAAC,OAAO;QAAE,OAAO,mBAAmB,EAAE,CAAC,OAAQ,CAAC;IACjF,+EAA+E;IAC/E,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,iFAAiF;IACjF,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAE1C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,QAAQ;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAC9C,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;KAC/B,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEjD,kEAAkE;IAClE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACzE,CAAC;IAED,mFAAmF;IACnF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAkC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,SAAS;QACvB,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChM,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC;YACxK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC"}

package/mcp-server/dist/http.d.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/**
+ * HTTP transport for SynaBun MCP server.
+ *
+ * STATEFUL: each MCP client (a Claude Code process — CLI window, sidepanel
+ * chat, loop) performs an initialize handshake and receives a unique
+ * Mcp-Session-Id, which it echoes on every subsequent request. That id — or
+ * an explicit X-Synabun-Terminal header injected at launch (loops, sidepanel)
+ * — becomes the caller's identity for browser session/tab isolation. Every
+ * transport.handleRequest call runs inside an AsyncLocalStorage identity
+ * context so neural-interface.ts resolves per-caller state instead of
+ * process-global state (the old stateless mode collapsed every HTTP caller
+ * into one identity → cross-automation tab collisions).
+ *
+ * Mount on any Express app or run standalone.
+ */
+import { type Router } from 'express';
+/**
+ * Initialize DB, categories, and warm up the embedding model.
+ * Safe to call multiple times — only runs once.
+ * Exported so the Neural Interface can eagerly init at startup.
+ */
+export declare function ensureInit(): Promise<void>;
+/**
+ * Create Express routes for the MCP HTTP endpoint.
+ * Auth is handled externally (URL-embedded key in server.js).
+ * Can be mounted on an existing Express app: app.use('/mcp', createMcpRoutes());
+ */
+export declare function createMcpRoutes(): Router;
+//# sourceMappingURL=http.d.ts.map

package/mcp-server/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAGH,OAAgB,EAAgB,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAyH7D;;;;GAIG;AACH,wBAAsB,UAAU,kBAU/B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CA0GxC"}

package/mcp-server/dist/http.js

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+/**
+ * HTTP transport for SynaBun MCP server.
+ *
+ * STATEFUL: each MCP client (a Claude Code process — CLI window, sidepanel
+ * chat, loop) performs an initialize handshake and receives a unique
+ * Mcp-Session-Id, which it echoes on every subsequent request. That id — or
+ * an explicit X-Synabun-Terminal header injected at launch (loops, sidepanel)
+ * — becomes the caller's identity for browser session/tab isolation. Every
+ * transport.handleRequest call runs inside an AsyncLocalStorage identity
+ * context so neural-interface.ts resolves per-caller state instead of
+ * process-global state (the old stateless mode collapsed every HTTP caller
+ * into one identity → cross-automation tab collisions).
+ *
+ * Mount on any Express app or run standalone.
+ */
+import { randomUUID } from 'node:crypto';
+import express from 'express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { ensureDatabase } from './services/sqlite.js';
+import { initCategoryCache } from './services/categories.js';
+import { warmupEmbeddings } from './services/local-embeddings.js';
+import { createMcpServer, refreshServerSchemas, onSchemaRefresh, setServerRole, setServerCapabilities } from './index.js';
+import { markHttpMode, obtainIdentity, sanitizeDesktopGrant, sanitizePin, sanitizeRole, runWithIdentity, releaseIdentity, startIdentitySweeper, } from './services/identity.js';
+let initialized = false;
+let initPromise = null;
+// Warm-server pool: registering 100+ tools (with Zod schema construction)
+// is measurable overhead. Pre-build the next server off the request path;
+// drop it when category schemas change. With stateful sessions this is
+// consumed once per CLIENT SESSION (initialize), not per request.
+let warmServer = null;
+function takeServer() {
+    const server = warmServer ?? createMcpServer('full');
+    warmServer = null;
+    setImmediate(() => {
+        try {
+            if (!warmServer)
+                warmServer = createMcpServer('full');
+        }
+        catch { /* next request builds inline */ }
+    });
+    return server;
+}
+const mcpSessions = new Map();
+const MCP_SESSION_TTL_MS = parseInt(process.env.SYNABUN_MCP_SESSION_TTL_MS || '', 10) || 60 * 60 * 1000;
+let sessionSweeperStarted = false;
+function startSessionSweeper() {
+    if (sessionSweeperStarted)
+        return;
+    sessionSweeperStarted = true;
+    const interval = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, entry] of mcpSessions) {
+            if (now - entry.lastSeen > MCP_SESSION_TTL_MS) {
+                console.error(`[mcp-http] session ${sid} evicted after ${Math.round((now - entry.lastSeen) / 60000)}min idle (${mcpSessions.size - 1} remain)`);
+                // transport.close() fires onclose → map cleanup + releaseIdentity + server.close.
+                try {
+                    entry.transport.close();
+                }
+                catch { /* already closed */ }
+            }
+        }
+    }, 10 * 60 * 1000);
+    interval.unref();
+}
+// Category/schema changes: drop the warm server AND refresh every live
+// session's tool schemas (tool.update() pushes tools/list_changed to clients
+// that hold an open notification stream).
+onSchemaRefresh(() => {
+    warmServer = null;
+    for (const entry of mcpSessions.values()) {
+        try {
+            refreshServerSchemas(entry.server);
+        }
+        catch { /* per-session best-effort */ }
+    }
+});
+/**
+ * Per-request caller identity. Explicit X-Synabun-* headers (injected into the
+ * launch config of loops, scheduled loops, and sidepanel sessions) win; plain
+ * CLI windows fall back to their unique Mcp-Session-Id.
+ */
+function deriveIdentity(req, sid) {
+    const memoryContext = {
+        project: req.get('x-synabun-project')?.slice(0, 200),
+        session: req.get('x-synabun-memory-session')?.slice(0, 200),
+        generation: req.get('x-synabun-context-generation')?.slice(0, 200),
+    };
+    // Re-read on every request: the assistant brain sends X-Synabun-Role with
+    // each call, so the role never outlives the headers that granted it.
+    // Tunnel callers (a remote MCP-key holder) can claim neither the assistant
+    // role nor a computer-use grant.
+    const remote = !!req.get('cf-connecting-ip');
+    const role = remote ? null : sanitizeRole(req.get('x-synabun-role'));
+    const desktopGrant = remote ? null : sanitizeDesktopGrant(req.get('x-synabun-desktop-grant'));
+    const headerTerminal = sanitizePin(req.get('x-synabun-terminal'));
+    if (headerTerminal) {
+        const identity = obtainIdentity(headerTerminal, {
+            source: 'header',
+            pins: {
+                terminalSessionId: headerTerminal,
+                browserSessionId: sanitizePin(req.get('x-synabun-browser-session')),
+                browserTabId: sanitizePin(req.get('x-synabun-browser-tab')),
+            },
+            role,
+            desktopGrant,
+        });
+        identity.memoryContext = { ...identity.memoryContext, ...Object.fromEntries(Object.entries(memoryContext).filter(([, v]) => v !== undefined)) };
+        return identity;
+    }
+    // The initialize request has no session id yet — identity for it is
+    // irrelevant (no tool calls happen during initialize), so a throwaway key
+    // is fine; real requests carry the assigned Mcp-Session-Id.
+    const identity = obtainIdentity(sid || `init-${randomUUID()}`, { source: 'mcp-session', role, desktopGrant });
+    identity.memoryContext = { ...identity.memoryContext, ...Object.fromEntries(Object.entries(memoryContext).filter(([, v]) => v !== undefined)) };
+    return identity;
+}
+function jsonRpcError(res, status, code, message) {
+    res.status(status).json({ jsonrpc: '2.0', error: { code, message }, id: null });
+}
+/**
+ * Initialize DB, categories, and warm up the embedding model.
+ * Safe to call multiple times — only runs once.
+ * Exported so the Neural Interface can eagerly init at startup.
+ */
+export async function ensureInit() {
+    if (initialized)
+        return;
+    if (initPromise)
+        return initPromise;
+    initPromise = (async () => {
+        await ensureDatabase();
+        await initCategoryCache();
+        warmupEmbeddings().catch(error => console.error('[memory] Local model unavailable; keyword recall remains available:', error.message));
+        initialized = true;
+    })();
+    try {
+        await initPromise;
+    }
+    finally {
+        initPromise = null;
+    }
+}
+/**
+ * Create Express routes for the MCP HTTP endpoint.
+ * Auth is handled externally (URL-embedded key in server.js).
+ * Can be mounted on an existing Express app: app.use('/mcp', createMcpRoutes());
+ */
+export function createMcpRoutes() {
+    markHttpMode();
+    startIdentitySweeper();
+    startSessionSweeper();
+    const router = express.Router();
+    router.use(express.json());
+    router.post('/', async (req, res) => {
+        await ensureInit();
+        try {
+            const sid = req.get('mcp-session-id') || undefined;
+            // Existing client session — route to its transport.
+            if (sid) {
+                const entry = mcpSessions.get(sid);
+                if (!entry) {
+                    // Expired/unknown session: 404 per spec → the client re-initializes.
+                    return jsonRpcError(res, 404, -32001, 'Session not found');
+                }
+                entry.lastSeen = Date.now();
+                await runWithIdentity(deriveIdentity(req, sid), () => entry.transport.handleRequest(req, res, req.body));
+                return;
+            }
+            // New client — must be an initialize request.
+            if (!isInitializeRequest(req.body)) {
+                return jsonRpcError(res, 400, -32000, 'Bad Request: no valid session ID provided');
+            }
+            const server = takeServer();
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (newSid) => {
+                    mcpSessions.set(newSid, { transport, server, lastSeen: Date.now() });
+                    deriveIdentity(req, newSid);
+                    const terminal = sanitizePin(req.get('x-synabun-terminal'));
+                    // The warm server was built role-less. The SDK awaits this hook
+                    // BEFORE dispatching the initialize request, so binding the role
+                    // here makes the handshake instructions and the client's first
+                    // tools/list already advertise the role-gated `agents` group.
+                    const remote = !!req.get('cf-connecting-ip');
+                    const role = remote ? null : sanitizeRole(req.get('x-synabun-role'));
+                    if (role)
+                        setServerRole(server, role);
+                    // The capability-gated `computer` group is advertised only to a caller
+                    // presenting a desktop grant (re-checked server-side on every call).
+                    const grant = remote ? null : sanitizeDesktopGrant(req.get('x-synabun-desktop-grant'));
+                    if (grant)
+                        setServerCapabilities(server, { computer: true });
+                    console.error(`[mcp-http] session ${newSid} init (terminal=${terminal || 'none'}${role ? `, role=${role}` : ''}${grant ? ', computer' : ''}, sessions=${mcpSessions.size})`);
+                },
+            });
+            // Re-entry guard: server.close() closes its transport, which fires
+            // onclose again — without the guard that recurses until stack overflow.
+            let tornDown = false;
+            transport.onclose = () => {
+                if (tornDown)
+                    return;
+                tornDown = true;
+                const closedSid = transport.sessionId;
+                if (closedSid && mcpSessions.has(closedSid)) {
+                    mcpSessions.delete(closedSid);
+                    // Releases the identity's acquired browser tab (if any). Header-keyed
+                    // identities (loops) are keyed by terminal id, not sid — untouched.
+                    releaseIdentity(closedSid);
+                    console.error(`[mcp-http] session ${closedSid} closed (${mcpSessions.size} remain)`);
+                }
+                try {
+                    server.close();
+                }
+                catch { /* already closed */ }
+            };
+            await server.connect(transport);
+            await runWithIdentity(deriveIdentity(req, undefined), () => transport.handleRequest(req, res, req.body));
+        }
+        catch (error) {
+            console.error('MCP HTTP error:', error);
+            if (!res.headersSent) {
+                jsonRpcError(res, 500, -32603, 'Internal server error');
+            }
+        }
+    });
+    // GET opens the SSE notification stream (tools/list_changed reaches HTTP
+    // clients); DELETE terminates the session (fires transport.onclose → tab release).
+    const handleSessionRequest = async (req, res) => {
+        const sid = req.get('mcp-session-id') || undefined;
+        const entry = sid ? mcpSessions.get(sid) : undefined;
+        if (!sid || !entry) {
+            return jsonRpcError(res, sid ? 404 : 400, sid ? -32001 : -32000, sid ? 'Session not found' : 'Bad Request: no valid session ID provided');
+        }
+        entry.lastSeen = Date.now();
+        try {
+            await runWithIdentity(deriveIdentity(req, sid), () => entry.transport.handleRequest(req, res));
+        }
+        catch (error) {
+            console.error('MCP HTTP error:', error);
+            if (!res.headersSent) {
+                jsonRpcError(res, 500, -32603, 'Internal server error');
+            }
+        }
+    };
+    router.get('/', handleSessionRequest);
+    router.delete('/', handleSessionRequest);
+    return router;
+}
+// If run directly, start a standalone HTTP server
+const isMain = process.argv[1]?.replace(/\\/g, '/').endsWith('/http.js')
+    || process.argv[1]?.replace(/\\/g, '/').endsWith('/http.ts');
+if (isMain) {
+    const PORT = parseInt(process.env.MCP_HTTP_PORT || '3345', 10);
+    const app = express();
+    app.use('/mcp', createMcpRoutes());
+    app.get('/', (_req, res) => {
+        res.json({ name: 'SynaBun MCP (HTTP)', status: 'ok', endpoint: '/mcp' });
+    });
+    app.listen(PORT, () => {
+        console.log(`SynaBun MCP HTTP server listening on port ${PORT}`);
+        console.log(`Endpoint: http://localhost:${PORT}/mcp`);
+    });
+    // Standalone-only: SIGKILL ourselves on exit to skip C++ static destructors and
+    // dodge the onnxruntime-node at-exit abort (`libc++abi: ... mutex lock failed`).
+    // When imported in-process by the Neural Interface, that server's own `exit`
+    // handler covers this instead. See mcp-server/src/index.ts for the rationale.
+    process.on('exit', () => {
+        try {
+            process.kill(process.pid, 'SIGKILL');
+        }
+        catch { /* already gone */ }
+    });
+}
+//# sourceMappingURL=http.js.map

package/mcp-server/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,OAAsC,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC1H,OAAO,EAEL,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,kEAAkE;AAClE,IAAI,UAAU,GAA8C,IAAI,CAAC;AAEjE,SAAS,UAAU;IACjB,MAAM,MAAM,GAAG,UAAU,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACrD,UAAU,GAAG,IAAI,CAAC;IAClB,YAAY,CAAC,GAAG,EAAE;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEtD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExG,IAAI,qBAAqB,GAAG,KAAK,CAAC;AAClC,SAAS,mBAAmB;IAC1B,IAAI,qBAAqB;QAAE,OAAO;IAClC,qBAAqB,GAAG,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,kBAAkB,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,aAAa,WAAW,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChJ,kFAAkF;gBAClF,IAAI,CAAC;oBAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,0CAA0C;AAC1C,eAAe,CAAC,GAAG,EAAE;IACnB,UAAU,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IACrF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAuB;IAC3D,MAAM,aAAa,GAAG;QACpB,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC;QACnD,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC;QAC1D,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC;KAClE,CAAC;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,cAAc,CAAC,cAAc,EAAE;YAC9C,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE;gBACJ,iBAAiB,EAAE,cAAc;gBACjC,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBACnE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;aAC5D;YACD,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;QACH,QAAQ,CAAC,aAAa,GAAG,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QAC7I,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,IAAI,QAAQ,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9G,QAAQ,CAAC,aAAa,GAAG,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;IAC7I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,GAAqB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACxF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,WAAW;QAAE,OAAO;IACxB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,cAAc,EAAE,CAAC;QACvB,MAAM,iBAAiB,EAAE,CAAC;QAC1B,gBAAgB,EAAE,CAAC,KAAK,CAAC,KAAK,CAAA,EAAE,CAAA,OAAO,CAAC,KAAK,CAAC,qEAAqE,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACpI,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,WAAW,GAAG,IAAI,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,YAAY,EAAE,CAAC;IACf,oBAAoB,EAAE,CAAC;IACvB,mBAAmB,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,UAAU,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;YAEnD,oDAAoD;YACpD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,qEAAqE;oBACrE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CACnD,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAClD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;oBAC/B,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACrE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;oBAC5D,gEAAgE;oBAChE,iEAAiE;oBACjE,+DAA+D;oBAC/D,8DAA8D;oBAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACrE,IAAI,IAAI;wBAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACtC,uEAAuE;oBACvE,qEAAqE;oBACrE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;oBACvF,IAAI,KAAK;wBAAE,qBAAqB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7D,OAAO,CAAC,KAAK,CAAC,sBAAsB,MAAM,mBAAmB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC/K,CAAC;aACF,CAAC,CAAC;YACH,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;gBACtC,IAAI,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC9B,sEAAsE;oBACtE,oEAAoE;oBACpE,eAAe,CAAC,SAAS,CAAC,CAAC;oBAC3B,OAAO,CAAC,KAAK,CAAC,sBAAsB,SAAS,YAAY,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,CAAC;oBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxD,CAAC,CAAC;YAEF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,CACzD,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAC5C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,mFAAmF;IACnF,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACjF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QAC5I,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CACnD,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kDAAkD;AAClD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;OACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAE/D,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAEnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,MAAM,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/mcp-server/dist/index.d.ts

@@ -0,0 +1,48 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { PROFILE_PRESETS, VALID_GROUPS, ProfileRuntime, resolveProfileGroups, persistProfile } from './services/profiles.js';
+import type { CallerRole } from './services/identity.js';
+export { PROFILE_PRESETS, VALID_GROUPS, ProfileRuntime, resolveProfileGroups, persistProfile };
+export declare function registerTools(server: McpServer, runtime?: ProfileRuntime): {
+    rememberTool: import("@modelcontextprotocol/sdk/server/mcp.js").RegisteredTool;
+    recallTool: import("@modelcontextprotocol/sdk/server/mcp.js").RegisteredTool;
+    reflectTool: import("@modelcontextprotocol/sdk/server/mcp.js").RegisteredTool;
+    memoriesTool: import("@modelcontextprotocol/sdk/server/mcp.js").RegisteredTool;
+    runtime: ProfileRuntime;
+};
+export declare function trackToolUsage(toolName: string): void;
+export declare function getActiveProfile(): {
+    profile: string;
+    activeGroups: string[];
+};
+export declare function applyProfile(profileName: string): import("./services/profiles.js").ProfileApplyResult;
+export declare function getToolUsageSummary(runtime?: ProfileRuntime): {
+    counts: Record<string, number>;
+    profile: string;
+    activeGroups: string[];
+    recommendation: string;
+};
+export declare function createMcpServer(forceProfile?: string, options?: {
+    catalogMode?: 'profiled' | 'deferred';
+    role?: CallerRole | null;
+}): McpServer;
+export declare function getServerProfileRuntime(target: McpServer): ProfileRuntime | null;
+/**
+ * Bind a caller role to a live server built by createMcpServer. Role-gated
+ * groups (agents) are advertised only while the role matches, so the runtime
+ * re-applies its current profile, and the initialize instructions are
+ * refreshed in place: the SDK reads Server._instructions when it answers the
+ * initialize request, and the HTTP transport calls this from
+ * onsessioninitialized, which runs before that request is dispatched.
+ */
+export declare function setServerRole(target: McpServer, role: CallerRole | null): boolean;
+/**
+ * Bind proven capabilities (a desktop grant → `computer`) to a live server;
+ * same mechanics as setServerRole, called from the HTTP initialize hook.
+ */
+export declare function setServerCapabilities(target: McpServer, caps: {
+    computer?: boolean;
+}): boolean;
+export declare function refreshServerSchemas(target: McpServer): void;
+export declare function onSchemaRefresh(fn: () => void): void;
+export declare function refreshCategorySchemas(): void;
+//# sourceMappingURL=index.d.ts.map

package/mcp-server/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiCpE,OAAO,EACL,eAAe,EAAE,YAAY,EAAE,cAAc,EAC7C,oBAAoB,EAAsB,cAAc,EAEzD,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC;AAgC/F,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,cAAyD;;;;;;EAkElH;AA+BD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,QAK9C;AAOD,wBAAgB,gBAAgB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAE9E;AAED,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,uDAE/C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAkDrL;AAWD,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CAAO,aAUvI;AAOD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,IAAI,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAQjF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAU9F;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAO5D;AA2BD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAEpD;AAID,wBAAgB,sBAAsB,SASrC"}