zidane 7.2.5 → 8.0.4

package/dist/{mcp-CgNd-f3F.js → mcp-_wecH9Qe.js}

@@ -1,11 +1,11 @@
-import { l as toolOutputByteLength, u as toolResultToText } from "./types-CWgENVLY.js";
-import { n as shellQuote } from "./shell-quote-BmnhZmdM.js";
 import { u as errorMessage } from "./errors-DKiMrOKq.js";
-import { n as originPinnedFetch } from "./origin-pinned-fetch-CqG8VZIq.js";
+import { d as toolResultToText, u as toolOutputByteLength } from "./types-Cu0ZGDu9.js";
 import { a as sniffImageMediaTypeFromBase64, n as reconcileImageMediaType, o as sniffMediaTypeFromBase64, r as reconcileMediaType } from "./media-sniff-UKijEaiQ.js";
-import { sep } from "node:path";
+import { n as shellQuote } from "./shell-quote-BmnhZmdM.js";
+import { n as originPinnedFetch } from "./origin-pinned-fetch-CqG8VZIq.js";
 import { Buffer } from "node:buffer";
 import { mkdirSync } from "node:fs";
+import { sep } from "node:path";
 //#region src/mcp/oauth-provider.ts
 /**
 * In-memory store — primarily for tests, but valid as a no-persistence option
@@ -39,6 +39,7 @@ var McpOAuthProvider = class {
 	onAuthorizationUrl;
 	clientName;
 	_scope;
+	_state;
 	codeVerifierValue;
 	constructor(opts) {
 		this.name = opts.name;
@@ -47,6 +48,11 @@ var McpOAuthProvider = class {
 		this.onAuthorizationUrl = opts.onAuthorizationUrl;
 		this.clientName = opts.clientName ?? DEFAULT_CLIENT_NAME;
 		this._scope = opts.scope;
+		this._state = opts.state;
+	}
+	/** The configured `state` (the SDK sends nothing when it is empty). */
+	state() {
+		return this._state ?? "";
 	}
 	/**
 	* ALWAYS returns a URL — the placeholder in non-interactive mode — and
@@ -98,7 +104,7 @@ var McpOAuthProvider = class {
 		this.codeVerifierValue = verifier;
 	}
 	codeVerifier() {
-		if (!this.codeVerifierValue) throw new Error(`MCP OAuth: code verifier missing for "${this.name}" — the flow must call saveCodeVerifier() before the redirect`);
+		if (!this.codeVerifierValue) throw new Error(`MCP OAuth: code verifier missing for "${this.name}". the flow must call saveCodeVerifier() before the redirect`);
 		return this.codeVerifierValue;
 	}
 	async redirectToAuthorization(url) {
@@ -190,157 +196,6 @@ function hasAuthorizationHeader(headers) {
 	return false;
 }
 //#endregion
-//#region src/mcp/sse-to-json-fetch.ts
-/**
-* `fetch` shim that converts streamable-http POST responses with
-* `Content-Type: text/event-stream` into synthetic `application/json`
-* responses, preserving every original header (notably `mcp-session-id`).
-*
-* Why this exists
-* ----------------
-* The MCP SDK's streamable-http transport handles POST responses two ways
-* depending on `content-type`:
-*
-*   - `application/json` → `await response.json()` (works on every runtime).
-*   - `text/event-stream` → `body.pipeThrough(TextDecoderStream)
-*                              .pipeThrough(EventSourceParserStream)`
-*                          and forward each parsed event to `onmessage`.
-*
-* On Bun + MCP SDK 1.29.x the second pipeline silently drops the parsed
-* event: the full `event: message\ndata: {...}\n\n` arrives intact, the
-* stream closes, but `onmessage` is never called. Bootstrap then waits the
-* full `bootstrapTimeout` (10s default) and the agent loses every tool the
-* server would have exposed.
-*
-* The MCP spec lets clients accept either content type
-* (`Accept: application/json, text/event-stream`), so flipping the stream
-* to JSON at the boundary is a transparent, server-agnostic workaround.
-*
-* Scope of the shim
-* -----------------
-*   - POST + `text/event-stream` → drain, parse SSE message events, return
-*     a synthetic `application/json` response. Single event becomes a JSON
-*     object (matching the shape the SDK expects from non-streaming
-*     servers); multiple events become a JSON array (the SDK already
-*     iterates `Array.isArray(data)` from a JSON response).
-*   - GET (long-lived `_startOrAuthSse` listener) → untouched. Per-event
-*     latency matters there and the SSE pipeline isn't always broken on
-*     GET in the same way (different code path inside Bun's stream impl).
-*   - 202 / non-SSE / malformed SSE / no body → passthrough.
-*
-* Runtime gating
-* --------------
-* `sseToJsonFetchIfNeeded()` only returns a wrapper on Bun. Node + browser
-* runtimes get `undefined` and the SDK uses global `fetch` directly — no
-* extra buffer-and-redrain on the happy path, and no risk of collapsing a
-* future progress-streaming response into a single batched array. If you
-* need to apply the shim unconditionally (testing, custom hosts), call
-* `sseToJsonFetch()` directly.
-*
-* Cleanup
-* -------
-* Remove this file and its `fetch:` injection in `createTransport` once
-* either Bun fixes the `pipeThrough` chain or the SDK switches off the
-* streaming pipeline by default.
-*/
-/**
-* Detect whether we're running on Bun. The `Bun` global is set by the
-* runtime itself and isn't faked by Bun's Node-compat layer.
-*/
-function isBunRuntime() {
-	return typeof globalThis.Bun !== "undefined";
-}
-/**
-* Returns the `sseToJsonFetch` wrapper only on runtimes that need it
-* (currently Bun). Returns `undefined` everywhere else, which makes the
-* SDK fall back to the global `fetch` and keeps the streaming pipeline
-* intact on Node where it works correctly.
-*
-* Designed as the value to pass directly to `StreamableHTTPClientTransport`'s
-* `fetch` option:
-*
-*     new StreamableHTTPClientTransport(url, {
-*       fetch: sseToJsonFetchIfNeeded(),
-*     })
-*/
-function sseToJsonFetchIfNeeded() {
-	return isBunRuntime() ? sseToJsonFetch() : void 0;
-}
-/**
-* Wrap a `fetch` implementation so streamable-http POST responses that come
-* back as `text/event-stream` are converted to JSON. Pass the result as
-* `opts.fetch` to `StreamableHTTPClientTransport`.
-*
-* Always-on (i.e. unconditional) — for the runtime-gated entry point,
-* use {@link sseToJsonFetchIfNeeded} instead.
-*/
-function sseToJsonFetch(baseFetch = fetch) {
-	return async function sseToJsonWrappedFetch(input, init) {
-		const response = await baseFetch(input, init);
-		if ((init?.method ?? "GET").toString().toUpperCase() !== "POST") return response;
-		const contentType = response.headers.get("content-type");
-		if (!contentType || !contentType.includes("text/event-stream")) return response;
-		if (!response.body) return response;
-		let raw;
-		try {
-			raw = await response.text();
-		} catch {
-			return response;
-		}
-		const events = parseSseDataEvents(raw);
-		return synthesizeJsonResponse(response, events.length === 1 ? events[0] : events);
-	};
-}
-/**
-* Parse a buffered SSE body into the JSON payloads of its `message` events.
-*
-* Skips:
-* - SSE comments (lines starting with `:`).
-* - Non-default event types (`event: foo` ≠ `message`). The MCP server
-*   only ever emits `message` events for JSON-RPC; anything else is out of
-*   band and the SDK wouldn't have surfaced it to `onmessage` either.
-* - Malformed `data:` payloads (anything that fails `JSON.parse`).
-*/
-function parseSseDataEvents(raw) {
-	const events = [];
-	for (const block of raw.split(/\r?\n\r?\n/)) {
-		if (!block.trim()) continue;
-		const dataLines = [];
-		let isMessageEvent = true;
-		for (const line of block.split(/\r?\n/)) {
-			if (line.startsWith(":")) continue;
-			if (line.startsWith("event:")) {
-				const eventType = line.slice(6).trim();
-				if (eventType && eventType !== "message") isMessageEvent = false;
-			} else if (line.startsWith("data:")) {
-				const value = line.slice(5);
-				dataLines.push(value.startsWith(" ") ? value.slice(1) : value);
-			}
-		}
-		if (!isMessageEvent || dataLines.length === 0) continue;
-		try {
-			events.push(JSON.parse(dataLines.join("\n")));
-		} catch {}
-	}
-	return events;
-}
-/**
-* Build a `Response` mirroring the original's status / statusText / headers
-* but with a JSON body and `content-type: application/json`. Header
-* preservation is the whole point — `mcp-session-id` is set by the server
-* on the initialize POST and must round-trip into the SDK's
-* `_sessionId` capture (`response.headers.get('mcp-session-id')`).
-*/
-function synthesizeJsonResponse(original, payload) {
-	const headers = new Headers(original.headers);
-	headers.set("content-type", "application/json");
-	return new Response(JSON.stringify(payload), {
-		status: original.status,
-		statusText: original.statusText,
-		headers
-	});
-}
-//#endregion
 //#region src/mcp/tolerant-client.ts
 /**
 * Async factory — builds an instance of the tolerant MCP client. The
@@ -395,155 +250,235 @@ async function createTolerantClient(info, options) {
 	return new TolerantMcpClient(info, options);
 }
 //#endregion
-//#region src/mcp/index.ts
-/**
-* Non-owning view of a live MCP connection: the SAME tools and
-* instructions, but a no-op `close`. Handed to consumers that must never
-* tear down transports they don't own — the loop's per-call
-* `ToolContext.mcpConnection` and child agents spawned off the parent's
-* connection — because only the owning agent's destroy path may close the
-* real thing, and a doc comment alone is too weak a guard. Single shared
-* builder so the call sites can't drift when this shape grows a field.
-*/
-function nonOwningMcpView(connection) {
-	return {
-		tools: connection.tools,
-		...connection.instructions !== void 0 ? { instructions: connection.instructions } : {},
-		close: async () => {}
-	};
-}
-/**
-* Recover a discovered tool's `{ server, toolName }` from its namespaced name
-* (`mcp_<server>_<tool>`). Both server and tool names can contain underscores,
-* so this matches against the known server list by longest server-name prefix
-* rather than splitting blindly. Tools that match no configured server (custom
-* connectors with a different naming scheme) fall back to
-* `{ server: '', toolName: <namespacedName> }`.
-*/
-function deriveMcpToolMeta(namespacedName, servers) {
-	let best;
-	for (const server of servers) {
-		const prefix = `mcp_${server.name}_`;
-		if (namespacedName.startsWith(prefix) && (!best || server.name.length > best.name.length)) best = server;
-	}
-	if (best) return {
-		server: best.name,
-		toolName: namespacedName.slice(`mcp_${best.name}_`.length)
-	};
-	return {
-		server: "",
-		toolName: namespacedName
-	};
-}
+//#region src/mcp/tool-result.ts
 /**
-* Apply an {@link McpToolWrap} to every entry of a discovered-tool map,
-* resolving each tool's {@link McpToolMeta} from `servers`. Returns a fresh
-* map; the input is untouched. Used by the agent to apply the
-* `AgentOptions.mcpToolWrap` hook to discovered tools.
+* Lossy flattener — converts MCP `CallToolResult.content` blocks to a single
+* string. Text blocks are extracted; non-text blocks are JSON-stringified.
+*
+* Use this only at UI / log boundaries that require a string. The agent
+* loop itself routes through {@link normalizeMcpBlocks} so image blocks
+* survive into provider-native tool_result content (Anthropic blocks,
+* OpenAI companion-user-message).
 */
-function wrapDiscoveredMcpTools(tools, wrap, servers) {
-	const wrapped = {};
-	for (const [name, def] of Object.entries(tools)) wrapped[name] = wrap(def, deriveMcpToolMeta(name, servers));
-	return wrapped;
+function resultToString(content) {
+	if (!content || !Array.isArray(content)) return "";
+	return content.map((block) => {
+		if (block && typeof block === "object" && block.type === "text") {
+			const text = block.text;
+			if (typeof text === "string") return text;
+		}
+		return JSON.stringify(block);
+	}).join("\n");
 }
-const DEFAULT_MCP_BOOTSTRAP_TIMEOUT_MS = 1e4;
-const DEFAULT_MCP_CLOSE_TIMEOUT_MS = 5e3;
 /**
-* Fire a hook without letting a listener's rejection escape. A throwing
-* listener used to bring down the whole `Promise.all` in
-* `connectMcpServers`, defeating the batch's partial-failure tolerance.
-*
-* Failures are swallowed; under `ZIDANE_DEBUG` they're traced to stderr
-* so the misbehaving listener is still discoverable when a host opts in.
+* Resolve the media type for an audio/video content block whose `data` we have.
 *
-* `args` is variadic to match `Hookable.callHook`'s spread shape; in
-* practice every `AgentHooks` event takes a single context object.
+* MCP declares `mimeType` on these blocks, but it's frequently missing or
+* imprecise. Strategy: when the declared type is a recognized member of the
+* kind's family, reconcile it against the bytes (override only on a positive
+* different match); otherwise sniff from scratch; otherwise fall back to a
+* sensible default for the kind.
 */
-async function safeCallHook(hooks, event, ...args) {
-	if (!hooks) return;
-	try {
-		await hooks.callHook(event, ...args);
-	} catch (err) {
-		if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/mcp] hook "${event}" listener rejected: ${errorMessage(err)}\n`);
-	}
+function resolveMediaType(kind, declared, b64) {
+	const prefix = `${kind}/`;
+	const fallback = kind === "audio" ? "audio/wav" : "video/mp4";
+	if (typeof declared === "string" && declared.startsWith(prefix)) return reconcileMediaType(kind, declared, b64);
+	return sniffMediaTypeFromBase64(kind, b64) ?? fallback;
 }
 /**
-* Close a transport best-effort. The catch swallows everything — by the
-* time we're closing, the bootstrap has already failed and the only thing
-* worse than a leaked transport is a leaked transport AND a new error
-* masking the original cause.
-*/
-async function closeTransportQuietly(transport) {
-	if (!transport) return;
-	try {
-		await transport.close();
-	} catch {}
-}
-/**
-* Read the child PID off a stdio transport. Structural — only
-* `StdioClientTransport` exposes `pid`; HTTP/SSE transports return `null`.
-* Returns `null` once the child has exited (the SDK clears its process
-* reference on the child's `close` event), so a kill based on this value
-* never targets a recycled PID.
-*/
-function stdioPidOf(transport) {
-	if (transport?.__contextScoped === true) return null;
-	const pid = transport?.pid;
-	return typeof pid === "number" ? pid : null;
-}
-/**
-* Last-resort reaper for a stdio child whose transport close wedged. By the
-* time this runs, the graceful path (stdin EOF → SIGTERM escalation inside
-* the SDK, where the installed version implements it) has been abandoned —
-* SIGKILL is the only signal a hung child can't ignore. ESRCH (already
-* exited) is swallowed.
+* Turn an embedded-resource blob into the matching media block, choosing the
+* kind from the declared `mimeType` prefix when recognized, else by sniffing
+* the bytes (image → audio → video). Returns `null` when nothing identifies it
+* as media, so the caller can fall back to the JSON-stringify path.
 */
-function killStdioChild(pid) {
-	if (pid == null) return;
-	try {
-		process.kill(pid, "SIGKILL");
-	} catch {}
+function mediaBlockFromBlob(mimeType, b64) {
+	const image = sniffImageMediaTypeFromBase64(b64);
+	const audio = sniffMediaTypeFromBase64("audio", b64);
+	const video = sniffMediaTypeFromBase64("video", b64);
+	if (mimeType?.startsWith("image/")) {
+		if (image) return {
+			type: "image",
+			mediaType: image,
+			data: b64
+		};
+		if (audio) return {
+			type: "audio",
+			mediaType: audio,
+			data: b64
+		};
+		if (video) return {
+			type: "video",
+			mediaType: video,
+			data: b64
+		};
+		return {
+			type: "image",
+			mediaType: mimeType,
+			data: b64
+		};
+	}
+	if (mimeType?.startsWith("audio/")) {
+		if (audio) return {
+			type: "audio",
+			mediaType: reconcileMediaType("audio", mimeType, b64),
+			data: b64
+		};
+		if (image) return {
+			type: "image",
+			mediaType: image,
+			data: b64
+		};
+		if (video) return {
+			type: "video",
+			mediaType: video,
+			data: b64
+		};
+		return {
+			type: "audio",
+			mediaType: mimeType,
+			data: b64
+		};
+	}
+	if (mimeType?.startsWith("video/")) {
+		if (video) return {
+			type: "video",
+			mediaType: reconcileMediaType("video", mimeType, b64),
+			data: b64
+		};
+		if (image) return {
+			type: "image",
+			mediaType: image,
+			data: b64
+		};
+		if (audio) return {
+			type: "audio",
+			mediaType: audio,
+			data: b64
+		};
+		return {
+			type: "video",
+			mediaType: mimeType,
+			data: b64
+		};
+	}
+	if (image) return {
+		type: "image",
+		mediaType: image,
+		data: b64
+	};
+	if (audio) return {
+		type: "audio",
+		mediaType: audio,
+		data: b64
+	};
+	if (video) return {
+		type: "video",
+		mediaType: video,
+		data: b64
+	};
+	return null;
 }
 /**
-* Detect failure signatures that point at a transport mismatch and return
-* an actionable hint string. Conservative — only matches the signals we've
-* actually observed in the wild against MCP servers, so a real outage on
-* the right transport doesn't get misdiagnosed.
+* Normalize MCP `CallToolResult.content` to zidane's {@link ToolResultContent[]} shape.
 *
-* Streamable-HTTP against an SSE-only endpoint:
-*   - The transport opens an `initialize` POST. SSE-only servers respond
-*     with `405 Method Not Allowed` or `404 Not Found` (their `/sse` GET
-*     endpoint is the only handler). The SDK wraps these as
-*     `Error POSTing to endpoint (HTTP 40X): ...`.
-*   - Some proxies return `400` with a `text/event-stream` mismatch on
-*     POST; same root cause, same fix.
+* Handles the MCP content block types:
+* - `text` → preserved as `{type:'text', text}`
+* - `image` → preserved as `{type:'image', mediaType, data}` (MCP uses `mimeType`)
+* - `audio` → `{type:'audio', mediaType, data}`; mediaType reconciled/sniffed when
+*   the declared `mimeType` is missing or not an `audio/*` type
+* - `video` → `{type:'video', mediaType, data}` (non-standard, by analogy)
+* - `resource` with embedded text → flattened to a text block
+* - `resource` with embedded blob → routed to image/audio/video by sniffing bytes
+*   first, with declared `mimeType` as a fallback when bytes are unidentifiable
+*   (it's OPTIONAL on EmbeddedResource per the MCP spec, and often imprecise)
+* - Any unrecognized block → JSON-stringified fallback text block (lossy but safe)
+*
+* Returns `null` when the input is not an array — callers should fall back to an empty
+* result in that case.
 */
-function buildTransportMismatchHint(config, err) {
-	const msg = err.message;
-	if (config.transport === "streamable-http") {
-		if (/\bHTTP\s*40[45]\b/i.test(msg) || /\(40[45]\)/.test(msg)) return "This server may not implement the streamable-HTTP transport. Try `transport: 'sse'` (or `sseUrl` instead of `url`) on this server's config.";
-	}
-	if (config.transport === "stdio" && config.scope === "context") {
-		if (/connection closed/i.test(msg) || /before initialization|closed during connect/i.test(msg)) return `The server exited during startup. With \`scope: 'context'\` it runs INSIDE the execution context, so \`${config.command}\` must exist in that image (check \`mcp:warn\` for the child's stderr, e.g. "command not found"). Install the runtime in the context image, or use \`scope: 'host'\` if this server does not need the workspace filesystem.`;
+function normalizeMcpBlocks(content) {
+	if (!Array.isArray(content)) return null;
+	const out = [];
+	for (const raw of content) {
+		if (!raw || typeof raw !== "object") continue;
+		const block = raw;
+		if (block.type === "text" && typeof block.text === "string") {
+			out.push({
+				type: "text",
+				text: block.text
+			});
+			continue;
+		}
+		if (block.type === "image" && typeof block.data === "string") {
+			const declared = typeof block.mimeType === "string" ? block.mimeType : typeof block.mediaType === "string" ? block.mediaType : "image/png";
+			const mediaType = reconcileImageMediaType(declared, block.data);
+			out.push({
+				type: "image",
+				mediaType,
+				data: block.data
+			});
+			continue;
+		}
+		if (block.type === "audio" && typeof block.data === "string") {
+			out.push({
+				type: "audio",
+				mediaType: resolveMediaType("audio", block.mimeType ?? block.mediaType, block.data),
+				data: block.data
+			});
+			continue;
+		}
+		if (block.type === "video" && typeof block.data === "string") {
+			out.push({
+				type: "video",
+				mediaType: resolveMediaType("video", block.mimeType ?? block.mediaType, block.data),
+				data: block.data
+			});
+			continue;
+		}
+		if (block.type === "resource" && block.resource && typeof block.resource === "object") {
+			const res = block.resource;
+			if (typeof res.text === "string") {
+				out.push({
+					type: "text",
+					text: res.text
+				});
+				continue;
+			}
+			if (typeof res.blob === "string") {
+				const mediaBlock = mediaBlockFromBlob(typeof res.mimeType === "string" ? res.mimeType : void 0, res.blob);
+				if (mediaBlock) {
+					out.push(mediaBlock);
+					continue;
+				}
+			}
+		}
+		out.push({
+			type: "text",
+			text: JSON.stringify(block)
+		});
 	}
-	return null;
+	return out;
 }
 /**
-* Wrap a bootstrap failure so the surfaced `Error` carries an actionable
-* hint while preserving the original message + stack + cause. Returns the
-* input error verbatim when no hint applies.
+* Route the MCP result content through the narrowest appropriate zidane shape:
 *
-* `cause` (ES2022) gives hosts that introspect a way back to the raw SDK
-* error; the human-readable hint is the new message body that lands in
-* logs / hook payloads.
+* - All blocks are `text` → return a joined string (smaller wire payload,
+*   string-friendly for hook consumers that don't need structured access).
+* - Any block is non-text → return a structured `ToolResultContent[]`.
+* - Empty / non-array input → return `''`.
 */
-function withTransportMismatchHint(config, err) {
-	const hint = buildTransportMismatchHint(config, err);
-	if (!hint) return err;
-	const augmented = new Error(`${err.message}\nHint: ${hint}`, { cause: err });
-	if (err.stack) augmented.stack = err.stack;
-	return augmented;
+function packMcpResult(content) {
+	const normalized = normalizeMcpBlocks(content);
+	if (!normalized || normalized.length === 0) return "";
+	const parts = [];
+	for (const block of normalized) {
+		if (block.type !== "text") return normalized;
+		parts.push(block.text);
+	}
+	return parts.join("\n");
 }
+//#endregion
+//#region src/mcp/server-config.ts
 /**
 * The config a transport is actually built from.
 *
@@ -560,69 +495,15 @@ function withTransportMismatchHint(config, err) {
 */
 function resolveTransportConfig(config) {
 	return config.preExpanded ? config : expandMcpConfigEnv(config);
-}
-/**
-* Create an Agent Plugin server's `${PLUGIN_DATA}` directory, immediately
-* before the process that needs it is spawned.
-*
-* Creation lives here rather than in the plugin loader because loading is not
-* consent. A host must load every plugin it finds on disk just to learn its
-* name — identity lives in the manifest — and the user's `enabledPlugins` gate
-* only applies afterwards. Creating at load time therefore left a directory
-* behind for every plugin the user had switched OFF, on every discovery pass.
-* Spawn time is the first moment the answer is unambiguous.
-*
-* Gated on `preExpanded` AND `env.PLUGIN_DATA`. `preExpanded` is the explicit
-* loader-set marker; `env.PLUGIN_DATA` supplies the path. Requiring both keeps
-* a hand-written `mcps.json` that happens to set `PLUGIN_DATA` in its own env
-* from triggering directory creation off a value we never validated — a
-* filesystem side effect should not key off a user-settable name when an
-* unambiguous marker is already on the config.
-*
-* `cwd` is created too when it sits inside the data directory. A plugin may
-* legitimately declare `cwd: "${PLUGIN_DATA}/work"`, and spawning with a
-* non-existent `cwd` fails with a bare ENOENT. A `cwd` under `PLUGIN_ROOT` is
-* NOT created — that path is package content the author was supposed to ship,
-* and silently conjuring it would hide the mistake.
-*
-* Failures are swallowed deliberately: the spawn immediately after produces a
-* far better diagnostic than a thrown mkdir, and this must not be the thing
-* that takes a server down.
-*/
-function ensurePluginDataDir(config) {
-	if (!config.preExpanded) return;
-	const dataDir = config.env?.PLUGIN_DATA;
-	if (!dataDir) return;
-	try {
-		mkdirSync(dataDir, { recursive: true });
-		if (config.cwd && config.cwd !== dataDir && config.cwd.startsWith(dataDir + sep)) mkdirSync(config.cwd, { recursive: true });
-	} catch {}
-}
-/**
-* Origin-pinned `fetch` for a remote server that opted into header pinning,
-* or `undefined` when the server didn't (the overwhelmingly common case, and
-* the one where we leave redirect handling to the platform).
-*
-* Deliberately does NOT require `config.headers`: the credential most worth
-* pinning is often the one the config never mentions. `bootstrapServer`
-* attaches an OAuth provider to a FLAGLESS server whenever the host can build
-* one and stored tokens exist, and an Agent Plugins `mcp.json` cannot declare
-* `auth` at all — so a plugin's remote server routinely ends up with an
-* SDK-injected `Authorization` header and an empty `config.headers`.
-* `originPinnedFetch` always protects `authorization` for the same reason.
-*/
-function pinnedFetchFor(config, baseFetch) {
-	if (!config.pinHeaderOrigin || !config.url) return void 0;
-	return originPinnedFetch(config.url, Object.keys(config.headers ?? {}), baseFetch ?? fetch);
-}
-function inferTransport(raw) {
-	if (raw.transport === "stdio" || raw.transport === "sse" || raw.transport === "streamable-http") return raw.transport;
-	if (raw.type === "stdio" || raw.type === "sse" || raw.type === "streamable-http" || raw.type === "http") return raw.type === "http" ? "streamable-http" : raw.type;
-	if (raw.command) return "stdio";
-	if (raw.httpUrl) return "streamable-http";
-	if (raw.sseUrl) return "sse";
-	if (raw.url) return "streamable-http";
-	throw new Error(`Cannot infer MCP transport from config: ${JSON.stringify(raw)}`);
+}
+function inferTransport(raw) {
+	if (raw.transport === "stdio" || raw.transport === "sse" || raw.transport === "streamable-http") return raw.transport;
+	if (raw.type === "stdio" || raw.type === "sse" || raw.type === "streamable-http" || raw.type === "http") return raw.type === "http" ? "streamable-http" : raw.type;
+	if (raw.command) return "stdio";
+	if (raw.httpUrl) return "streamable-http";
+	if (raw.sseUrl) return "sse";
+	if (raw.url) return "streamable-http";
+	throw new Error(`Cannot infer MCP transport from config: ${JSON.stringify(raw)}`);
 }
 /**
 * Placeholder grammar for {@link expandEnvPlaceholders}: `${VAR}` and
@@ -652,7 +533,7 @@ function expandEnvPlaceholders(value, env = process.env) {
 		if (resolved !== void 0 && resolved !== "") return resolved;
 		if (fallback !== void 0) return fallback;
 		if (resolved !== void 0) return resolved;
-		if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/mcp] env placeholder "${match}" is not set — passed through literally\n`);
+		if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/mcp] env placeholder "${match}" is not set, passed through as written\n`);
 		return match;
 	});
 }
@@ -684,6 +565,34 @@ function expandMcpConfigEnv(config, env = process.env) {
 		...config.headers ? { headers: expandEnvRecord(config.headers, env) } : {}
 	};
 }
+/**
+* A config from a source that must never read this process's environment
+* (a machine's project file, `docs/MACHINES.md`): every `${VAR}` placeholder
+* resolved NOW to its `:-default`, else to the empty string, so the
+* transport's own expansion has nothing of this process's secrets to put
+* into a command, an env value, a URL or a header.
+*/
+function withoutEnvPlaceholders(config) {
+	const strip = (value) => {
+		let out = value;
+		for (let pass = 0; pass < 4 && ENV_PLACEHOLDER_RE.test(out); pass++) {
+			ENV_PLACEHOLDER_RE.lastIndex = 0;
+			out = out.replace(ENV_PLACEHOLDER_RE, (_match, _name, fallback) => fallback ?? "");
+		}
+		ENV_PLACEHOLDER_RE.lastIndex = 0;
+		return out.replace(ENV_PLACEHOLDER_RE, "");
+	};
+	const record = (r) => Object.fromEntries(Object.entries(r).map(([k, v]) => [k, strip(v)]));
+	return {
+		...config,
+		...config.command !== void 0 ? { command: strip(config.command) } : {},
+		...config.args ? { args: config.args.map((arg) => typeof arg === "string" ? strip(arg) : arg) } : {},
+		...config.env ? { env: record(config.env) } : {},
+		...config.cwd !== void 0 ? { cwd: strip(config.cwd) } : {},
+		...config.url !== void 0 ? { url: strip(config.url) } : {},
+		...config.headers ? { headers: record(config.headers) } : {}
+	};
+}
 function normalizeOne(name, raw) {
 	const transport = inferTransport(raw);
 	const url = raw.url ?? raw.httpUrl ?? raw.sseUrl;
@@ -755,230 +664,212 @@ function normalizeMcpServers(input) {
 	}
 	throw new Error(`Unsupported MCP server config shape: ${typeof input}`);
 }
+//#endregion
+//#region src/mcp/sse-to-json-fetch.ts
 /**
-* Lossy flattener — converts MCP `CallToolResult.content` blocks to a single
-* string. Text blocks are extracted; non-text blocks are JSON-stringified.
+* `fetch` shim that converts streamable-http POST responses with
+* `Content-Type: text/event-stream` into synthetic `application/json`
+* responses, preserving every original header (notably `mcp-session-id`).
 *
-* Use this only at UI / log boundaries that require a string. The agent
-* loop itself routes through {@link normalizeMcpBlocks} so image blocks
-* survive into provider-native tool_result content (Anthropic blocks,
-* OpenAI companion-user-message).
+* Why this exists
+* ----------------
+* The MCP SDK's streamable-http transport handles POST responses two ways
+* depending on `content-type`:
+*
+*   - `application/json` → `await response.json()` (works on every runtime).
+*   - `text/event-stream` → `body.pipeThrough(TextDecoderStream)
+*                              .pipeThrough(EventSourceParserStream)`
+*                          and forward each parsed event to `onmessage`.
+*
+* On Bun + MCP SDK 1.29.x the second pipeline silently drops the parsed
+* event: the full `event: message\ndata: {...}\n\n` arrives intact, the
+* stream closes, but `onmessage` is never called. Bootstrap then waits the
+* full `bootstrapTimeout` (10s default) and the agent loses every tool the
+* server would have exposed.
+*
+* The MCP spec lets clients accept either content type
+* (`Accept: application/json, text/event-stream`), so flipping the stream
+* to JSON at the boundary is a transparent, server-agnostic workaround.
+*
+* Scope of the shim
+* -----------------
+*   - POST + `text/event-stream` → drain, parse SSE message events, return
+*     a synthetic `application/json` response. Single event becomes a JSON
+*     object (matching the shape the SDK expects from non-streaming
+*     servers); multiple events become a JSON array (the SDK already
+*     iterates `Array.isArray(data)` from a JSON response).
+*   - GET (long-lived `_startOrAuthSse` listener) → untouched. Per-event
+*     latency matters there and the SSE pipeline isn't always broken on
+*     GET in the same way (different code path inside Bun's stream impl).
+*   - 202 / non-SSE / malformed SSE / no body → passthrough.
+*
+* Runtime gating
+* --------------
+* `sseToJsonFetchIfNeeded()` only returns a wrapper on Bun. Node + browser
+* runtimes get `undefined` and the SDK uses global `fetch` directly — no
+* extra buffer-and-redrain on the happy path, and no risk of collapsing a
+* future progress-streaming response into a single batched array. If you
+* need to apply the shim unconditionally (testing, custom hosts), call
+* `sseToJsonFetch()` directly.
+*
+* Cleanup
+* -------
+* Remove this file and its `fetch:` injection in `createTransport` once
+* either Bun fixes the `pipeThrough` chain or the SDK switches off the
+* streaming pipeline by default.
 */
-function resultToString(content) {
-	if (!content || !Array.isArray(content)) return "";
-	return content.map((block) => {
-		if (block && typeof block === "object" && block.type === "text") {
-			const text = block.text;
-			if (typeof text === "string") return text;
-		}
-		return JSON.stringify(block);
-	}).join("\n");
+/**
+* Detect whether we're running on Bun. The `Bun` global is set by the
+* runtime itself and isn't faked by Bun's Node-compat layer.
+*/
+function isBunRuntime() {
+	return typeof globalThis.Bun !== "undefined";
 }
 /**
-* Resolve the media type for an audio/video content block whose `data` we have.
+* Returns the `sseToJsonFetch` wrapper only on runtimes that need it
+* (currently Bun). Returns `undefined` everywhere else, which makes the
+* SDK fall back to the global `fetch` and keeps the streaming pipeline
+* intact on Node where it works correctly.
 *
-* MCP declares `mimeType` on these blocks, but it's frequently missing or
-* imprecise. Strategy: when the declared type is a recognized member of the
-* kind's family, reconcile it against the bytes (override only on a positive
-* different match); otherwise sniff from scratch; otherwise fall back to a
-* sensible default for the kind.
+* Designed as the value to pass directly to `StreamableHTTPClientTransport`'s
+* `fetch` option:
+*
+*     new StreamableHTTPClientTransport(url, {
+*       fetch: sseToJsonFetchIfNeeded(),
+*     })
 */
-function resolveMediaType(kind, declared, b64) {
-	const prefix = `${kind}/`;
-	const fallback = kind === "audio" ? "audio/wav" : "video/mp4";
-	if (typeof declared === "string" && declared.startsWith(prefix)) return reconcileMediaType(kind, declared, b64);
-	return sniffMediaTypeFromBase64(kind, b64) ?? fallback;
+function sseToJsonFetchIfNeeded() {
+	return isBunRuntime() ? sseToJsonFetch() : void 0;
 }
 /**
-* Turn an embedded-resource blob into the matching media block, choosing the
-* kind from the declared `mimeType` prefix when recognized, else by sniffing
-* the bytes (image → audio → video). Returns `null` when nothing identifies it
-* as media, so the caller can fall back to the JSON-stringify path.
+* Wrap a `fetch` implementation so streamable-http POST responses that come
+* back as `text/event-stream` are converted to JSON. Pass the result as
+* `opts.fetch` to `StreamableHTTPClientTransport`.
+*
+* Always-on (i.e. unconditional) — for the runtime-gated entry point,
+* use {@link sseToJsonFetchIfNeeded} instead.
 */
-function mediaBlockFromBlob(mimeType, b64) {
-	const image = sniffImageMediaTypeFromBase64(b64);
-	const audio = sniffMediaTypeFromBase64("audio", b64);
-	const video = sniffMediaTypeFromBase64("video", b64);
-	if (mimeType?.startsWith("image/")) {
-		if (image) return {
-			type: "image",
-			mediaType: image,
-			data: b64
-		};
-		if (audio) return {
-			type: "audio",
-			mediaType: audio,
-			data: b64
-		};
-		if (video) return {
-			type: "video",
-			mediaType: video,
-			data: b64
-		};
-		return {
-			type: "image",
-			mediaType: mimeType,
-			data: b64
-		};
-	}
-	if (mimeType?.startsWith("audio/")) {
-		if (audio) return {
-			type: "audio",
-			mediaType: reconcileMediaType("audio", mimeType, b64),
-			data: b64
-		};
-		if (image) return {
-			type: "image",
-			mediaType: image,
-			data: b64
-		};
-		if (video) return {
-			type: "video",
-			mediaType: video,
-			data: b64
-		};
-		return {
-			type: "audio",
-			mediaType: mimeType,
-			data: b64
-		};
-	}
-	if (mimeType?.startsWith("video/")) {
-		if (video) return {
-			type: "video",
-			mediaType: reconcileMediaType("video", mimeType, b64),
-			data: b64
-		};
-		if (image) return {
-			type: "image",
-			mediaType: image,
-			data: b64
-		};
-		if (audio) return {
-			type: "audio",
-			mediaType: audio,
-			data: b64
-		};
-		return {
-			type: "video",
-			mediaType: mimeType,
-			data: b64
-		};
-	}
-	if (image) return {
-		type: "image",
-		mediaType: image,
-		data: b64
-	};
-	if (audio) return {
-		type: "audio",
-		mediaType: audio,
-		data: b64
-	};
-	if (video) return {
-		type: "video",
-		mediaType: video,
-		data: b64
+function sseToJsonFetch(baseFetch = fetch) {
+	return async function sseToJsonWrappedFetch(input, init) {
+		const response = await baseFetch(input, init);
+		if ((init?.method ?? "GET").toString().toUpperCase() !== "POST") return response;
+		const contentType = response.headers.get("content-type");
+		if (!contentType || !contentType.includes("text/event-stream")) return response;
+		if (!response.body) return response;
+		let raw;
+		try {
+			raw = await response.text();
+		} catch {
+			return response;
+		}
+		const events = parseSseDataEvents(raw);
+		return synthesizeJsonResponse(response, events.length === 1 ? events[0] : events);
 	};
-	return null;
 }
 /**
-* Normalize MCP `CallToolResult.content` to zidane's {@link ToolResultContent[]} shape.
-*
-* Handles the MCP content block types:
-* - `text` → preserved as `{type:'text', text}`
-* - `image` → preserved as `{type:'image', mediaType, data}` (MCP uses `mimeType`)
-* - `audio` → `{type:'audio', mediaType, data}`; mediaType reconciled/sniffed when
-*   the declared `mimeType` is missing or not an `audio/*` type
-* - `video` → `{type:'video', mediaType, data}` (non-standard, by analogy)
-* - `resource` with embedded text → flattened to a text block
-* - `resource` with embedded blob → routed to image/audio/video by sniffing bytes
-*   first, with declared `mimeType` as a fallback when bytes are unidentifiable
-*   (it's OPTIONAL on EmbeddedResource per the MCP spec, and often imprecise)
-* - Any unrecognized block → JSON-stringified fallback text block (lossy but safe)
+* Parse a buffered SSE body into the JSON payloads of its `message` events.
 *
-* Returns `null` when the input is not an array — callers should fall back to an empty
-* result in that case.
+* Skips:
+* - SSE comments (lines starting with `:`).
+* - Non-default event types (`event: foo` ≠ `message`). The MCP server
+*   only ever emits `message` events for JSON-RPC; anything else is out of
+*   band and the SDK wouldn't have surfaced it to `onmessage` either.
+* - Malformed `data:` payloads (anything that fails `JSON.parse`).
 */
-function normalizeMcpBlocks(content) {
-	if (!Array.isArray(content)) return null;
-	const out = [];
-	for (const raw of content) {
-		if (!raw || typeof raw !== "object") continue;
-		const block = raw;
-		if (block.type === "text" && typeof block.text === "string") {
-			out.push({
-				type: "text",
-				text: block.text
-			});
-			continue;
-		}
-		if (block.type === "image" && typeof block.data === "string") {
-			const mediaType = reconcileImageMediaType(typeof block.mimeType === "string" ? block.mimeType : typeof block.mediaType === "string" ? block.mediaType : "image/png", block.data);
-			out.push({
-				type: "image",
-				mediaType,
-				data: block.data
-			});
-			continue;
-		}
-		if (block.type === "audio" && typeof block.data === "string") {
-			out.push({
-				type: "audio",
-				mediaType: resolveMediaType("audio", block.mimeType ?? block.mediaType, block.data),
-				data: block.data
-			});
-			continue;
-		}
-		if (block.type === "video" && typeof block.data === "string") {
-			out.push({
-				type: "video",
-				mediaType: resolveMediaType("video", block.mimeType ?? block.mediaType, block.data),
-				data: block.data
-			});
-			continue;
-		}
-		if (block.type === "resource" && block.resource && typeof block.resource === "object") {
-			const res = block.resource;
-			if (typeof res.text === "string") {
-				out.push({
-					type: "text",
-					text: res.text
-				});
-				continue;
-			}
-			if (typeof res.blob === "string") {
-				const mediaBlock = mediaBlockFromBlob(typeof res.mimeType === "string" ? res.mimeType : void 0, res.blob);
-				if (mediaBlock) {
-					out.push(mediaBlock);
-					continue;
-				}
+function parseSseDataEvents(raw) {
+	const events = [];
+	for (const block of raw.split(/\r?\n\r?\n/)) {
+		if (!block.trim()) continue;
+		const dataLines = [];
+		let isMessageEvent = true;
+		for (const line of block.split(/\r?\n/)) {
+			if (line.startsWith(":")) continue;
+			if (line.startsWith("event:")) {
+				const eventType = line.slice(6).trim();
+				if (eventType && eventType !== "message") isMessageEvent = false;
+			} else if (line.startsWith("data:")) {
+				const value = line.slice(5);
+				dataLines.push(value.startsWith(" ") ? value.slice(1) : value);
 			}
 		}
-		out.push({
-			type: "text",
-			text: JSON.stringify(block)
-		});
+		if (!isMessageEvent || dataLines.length === 0) continue;
+		try {
+			events.push(JSON.parse(dataLines.join("\n")));
+		} catch {}
 	}
-	return out;
+	return events;
 }
 /**
-* Route the MCP result content through the narrowest appropriate zidane shape:
+* Build a `Response` mirroring the original's status / statusText / headers
+* but with a JSON body and `content-type: application/json`. Header
+* preservation is the whole point — `mcp-session-id` is set by the server
+* on the initialize POST and must round-trip into the SDK's
+* `_sessionId` capture (`response.headers.get('mcp-session-id')`).
+*/
+function synthesizeJsonResponse(original, payload) {
+	const headers = new Headers(original.headers);
+	headers.set("content-type", "application/json");
+	return new Response(JSON.stringify(payload), {
+		status: original.status,
+		statusText: original.statusText,
+		headers
+	});
+}
+//#endregion
+//#region src/mcp/transport.ts
+/**
+* Create an Agent Plugin server's `${PLUGIN_DATA}` directory, immediately
+* before the process that needs it is spawned.
 *
-* - All blocks are `text` → return a joined string (smaller wire payload,
-*   string-friendly for hook consumers that don't need structured access).
-* - Any block is non-text → return a structured `ToolResultContent[]`.
-* - Empty / non-array input → return `''`.
+* Creation lives here rather than in the plugin loader because loading is not
+* consent. A host must load every plugin it finds on disk just to learn its
+* name — identity lives in the manifest — and the user's `enabledPlugins` gate
+* only applies afterwards. Creating at load time therefore left a directory
+* behind for every plugin the user had switched OFF, on every discovery pass.
+* Spawn time is the first moment the answer is unambiguous.
+*
+* Gated on `preExpanded` AND `env.PLUGIN_DATA`. `preExpanded` is the explicit
+* loader-set marker; `env.PLUGIN_DATA` supplies the path. Requiring both keeps
+* a hand-written `mcps.json` that happens to set `PLUGIN_DATA` in its own env
+* from triggering directory creation off a value we never validated — a
+* filesystem side effect should not key off a user-settable name when an
+* unambiguous marker is already on the config.
+*
+* `cwd` is created too when it sits inside the data directory. A plugin may
+* legitimately declare `cwd: "${PLUGIN_DATA}/work"`, and spawning with a
+* non-existent `cwd` fails with a bare ENOENT. A `cwd` under `PLUGIN_ROOT` is
+* NOT created — that path is package content the author was supposed to ship,
+* and silently conjuring it would hide the mistake.
+*
+* Failures are swallowed deliberately: the spawn immediately after produces a
+* far better diagnostic than a thrown mkdir, and this must not be the thing
+* that takes a server down.
 */
-function packMcpResult(content) {
-	const normalized = normalizeMcpBlocks(content);
-	if (!normalized || normalized.length === 0) return "";
-	const parts = [];
-	for (const block of normalized) {
-		if (block.type !== "text") return normalized;
-		parts.push(block.text);
-	}
-	return parts.join("\n");
+function ensurePluginDataDir(config) {
+	if (!config.preExpanded) return;
+	const dataDir = config.env?.PLUGIN_DATA;
+	if (!dataDir) return;
+	try {
+		mkdirSync(dataDir, { recursive: true });
+		if (config.cwd && config.cwd !== dataDir && config.cwd.startsWith(dataDir + sep)) mkdirSync(config.cwd, { recursive: true });
+	} catch {}
+}
+/**
+* Origin-pinned `fetch` for a remote server that opted into header pinning,
+* or `undefined` when the server didn't (the overwhelmingly common case, and
+* the one where we leave redirect handling to the platform).
+*
+* Deliberately does NOT require `config.headers`: the credential most worth
+* pinning is often the one the config never mentions. `bootstrapServer`
+* attaches an OAuth provider to a FLAGLESS server whenever the host can build
+* one and stored tokens exist, and an Agent Plugins `mcp.json` cannot declare
+* `auth` at all — so a plugin's remote server routinely ends up with an
+* SDK-injected `Authorization` header and an empty `config.headers`.
+* `originPinnedFetch` always protects `authorization` for the same reason.
+*/
+function pinnedFetchFor(config, baseFetch) {
+	if (!config.pinHeaderOrigin || !config.url) return void 0;
+	return originPinnedFetch(config.url, Object.keys(config.headers ?? {}), baseFetch ?? fetch);
 }
 /**
 * Create the appropriate MCP transport for a server config.
@@ -1001,7 +892,7 @@ async function createTransport(rawConfig, authProvider, hooks, execution) {
 		case "stdio": {
 			if (config.scope === "context") {
 				if (!execution) throw new Error(`MCP server "${config.name}" requests \`scope: 'context'\`, but no execution context was supplied to the connector. Pass \`execution\` to connectMcpServers(), or use \`scope: 'host'\`.`);
-				const { createContextStdioTransport } = await import("./context-transport-T_6AYIvy.js");
+				const { createContextStdioTransport } = await import("./context-transport-DSMTUsK1.js");
 				const executionHandle = await execution.getHandle();
 				let commandLine = [config.command, ...config.args ?? []].map(shellQuote).join(" ");
 				let env = config.env;
@@ -1020,7 +911,7 @@ async function createTransport(rawConfig, authProvider, hooks, execution) {
 					...hooks ? { hooks } : {}
 				});
 			}
-			const { StdioClientTransport, getDefaultEnvironment } = await import("./stdio-loader-Bbx19dMZ.js");
+			const { StdioClientTransport, getDefaultEnvironment } = await import("./stdio-loader-C830Vg-Z.js");
 			const mergedEnv = config.env && !config.strictEnv ? {
 				...getDefaultEnvironment(),
 				...config.env
@@ -1060,7 +951,7 @@ async function createTransport(rawConfig, authProvider, hooks, execution) {
 /**
 * Split a stdio-transport child's stderr into lines and surface them via `mcp:warn`.
 */
-const MAX_MCP_STDERR_LINE_CHARS = 64 * 1024;
+const MAX_MCP_STDERR_LINE_CHARS = 65536;
 /**
 * Line-splitting core shared by the two stderr pumps: the Node-stream one
 * below (host stdio children) and the async-iterable one in
@@ -1113,6 +1004,156 @@ function attachStderrWarnPump(transport, serverName, hooks) {
 	stream.on("close", flush);
 	stream.on("error", flush);
 }
+//#endregion
+//#region src/mcp/index.ts
+/**
+* Non-owning view of a live MCP connection: the SAME tools and
+* instructions, but a no-op `close`. Handed to consumers that must never
+* tear down transports they don't own — the loop's per-call
+* `ToolContext.mcpConnection` and child agents spawned off the parent's
+* connection — because only the owning agent's destroy path may close the
+* real thing, and a doc comment alone is too weak a guard. Single shared
+* builder so the call sites can't drift when this shape grows a field.
+*/
+function nonOwningMcpView(connection) {
+	return {
+		tools: connection.tools,
+		...connection.instructions !== void 0 ? { instructions: connection.instructions } : {},
+		close: async () => {}
+	};
+}
+/**
+* Recover a discovered tool's `{ server, toolName }` from its namespaced name
+* (`mcp_<server>_<tool>`). Both server and tool names can contain underscores,
+* so this matches against the known server list by longest server-name prefix
+* rather than splitting blindly. Tools that match no configured server (custom
+* connectors with a different naming scheme) fall back to
+* `{ server: '', toolName: <namespacedName> }`.
+*/
+function deriveMcpToolMeta(namespacedName, servers) {
+	let best;
+	for (const server of servers) {
+		const prefix = `mcp_${server.name}_`;
+		if (namespacedName.startsWith(prefix) && (!best || server.name.length > best.name.length)) best = server;
+	}
+	if (best) return {
+		server: best.name,
+		toolName: namespacedName.slice(`mcp_${best.name}_`.length)
+	};
+	return {
+		server: "",
+		toolName: namespacedName
+	};
+}
+/**
+* Apply an {@link McpToolWrap} to every entry of a discovered-tool map,
+* resolving each tool's {@link McpToolMeta} from `servers`. Returns a fresh
+* map; the input is untouched. Used by the agent to apply the
+* `AgentOptions.mcpToolWrap` hook to discovered tools.
+*/
+function wrapDiscoveredMcpTools(tools, wrap, servers) {
+	const wrapped = {};
+	for (const [name, def] of Object.entries(tools)) wrapped[name] = wrap(def, deriveMcpToolMeta(name, servers));
+	return wrapped;
+}
+const DEFAULT_MCP_BOOTSTRAP_TIMEOUT_MS = 1e4;
+const DEFAULT_MCP_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* Fire a hook without letting a listener's rejection escape. A throwing
+* listener used to bring down the whole `Promise.all` in
+* `connectMcpServers`, defeating the batch's partial-failure tolerance.
+*
+* Failures are swallowed; under `ZIDANE_DEBUG` they're traced to stderr
+* so the misbehaving listener is still discoverable when a host opts in.
+*
+* `args` is variadic to match `Hookable.callHook`'s spread shape; in
+* practice every `AgentHooks` event takes a single context object.
+*/
+async function safeCallHook(hooks, event, ...args) {
+	if (!hooks) return;
+	try {
+		await hooks.callHook(event, ...args);
+	} catch (err) {
+		if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/mcp] hook "${event}" listener rejected: ${errorMessage(err)}\n`);
+	}
+}
+/**
+* Close a transport best-effort. The catch swallows everything — by the
+* time we're closing, the bootstrap has already failed and the only thing
+* worse than a leaked transport is a leaked transport AND a new error
+* masking the original cause.
+*/
+async function closeTransportQuietly(transport) {
+	if (!transport) return;
+	try {
+		await transport.close();
+	} catch {}
+}
+/**
+* Read the child PID off a stdio transport. Structural — only
+* `StdioClientTransport` exposes `pid`; HTTP/SSE transports return `null`.
+* Returns `null` once the child has exited (the SDK clears its process
+* reference on the child's `close` event), so a kill based on this value
+* never targets a recycled PID.
+*/
+function stdioPidOf(transport) {
+	if (transport?.__contextScoped === true) return null;
+	const pid = transport?.pid;
+	return typeof pid === "number" ? pid : null;
+}
+/**
+* Last-resort reaper for a stdio child whose transport close wedged. By the
+* time this runs, the graceful path (stdin EOF → SIGTERM escalation inside
+* the SDK, where the installed version implements it) has been abandoned —
+* SIGKILL is the only signal a hung child can't ignore. ESRCH (already
+* exited) is swallowed.
+*/
+function killStdioChild(pid) {
+	if (pid == null) return;
+	try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
+/**
+* Detect failure signatures that point at a transport mismatch and return
+* an actionable hint string. Conservative — only matches the signals we've
+* actually observed in the wild against MCP servers, so a real outage on
+* the right transport doesn't get misdiagnosed.
+*
+* Streamable-HTTP against an SSE-only endpoint:
+*   - The transport opens an `initialize` POST. SSE-only servers respond
+*     with `405 Method Not Allowed` or `404 Not Found` (their `/sse` GET
+*     endpoint is the only handler). The SDK wraps these as
+*     `Error POSTing to endpoint (HTTP 40X): ...`.
+*   - Some proxies return `400` with a `text/event-stream` mismatch on
+*     POST; same root cause, same fix.
+*/
+function buildTransportMismatchHint(config, err) {
+	const msg = err.message;
+	if (config.transport === "streamable-http") {
+		if (/\bHTTP\s*40[45]\b/i.test(msg) || /\(40[45]\)/.test(msg)) return "This server may not implement the streamable-HTTP transport. Try `transport: 'sse'` (or `sseUrl` instead of `url`) on this server's config.";
+	}
+	if (config.transport === "stdio" && config.scope === "context") {
+		if (/connection closed/i.test(msg) || /before initialization|closed during connect/i.test(msg)) return `The server exited during startup. With \`scope: 'context'\` it runs INSIDE the execution context, so \`${config.command}\` must exist in that image (check \`mcp:warn\` for the child's stderr, e.g. "command not found"). Install the runtime in the context image, or use \`scope: 'host'\` if this server does not need the workspace filesystem.`;
+	}
+	return null;
+}
+/**
+* Wrap a bootstrap failure so the surfaced `Error` carries an actionable
+* hint while preserving the original message + stack + cause. Returns the
+* input error verbatim when no hint applies.
+*
+* `cause` (ES2022) gives hosts that introspect a way back to the raw SDK
+* error; the human-readable hint is the new message body that lands in
+* logs / hook payloads.
+*/
+function withTransportMismatchHint(config, err) {
+	const hint = buildTransportMismatchHint(config, err);
+	if (!hint) return err;
+	const augmented = new Error(`${err.message}\nHint: ${hint}`, { cause: err });
+	if (err.stack) augmented.stack = err.stack;
+	return augmented;
+}
 /**
 * True when an error from `client.connect()` indicates the user needs to
 * (re-)authenticate against the MCP server. Two signal families:
@@ -1314,9 +1355,9 @@ function wrapConnectWithHookFire(connect, fire) {
 */
 async function bootstrapServer(config, _clientFactory, hooks, options) {
 	const start = Date.now();
-	if (config.enabledTools && config.disabledTools) return emitConfigFailure(config, hooks, `MCP server "${config.name}": enabledTools and disabledTools are mutually exclusive — set one or the other, not both.`);
+	if (config.enabledTools && config.disabledTools) return emitConfigFailure(config, hooks, `MCP server "${config.name}": set enabledTools or disabledTools, not both.`);
 	if (config.lazyConnect && (!config.cachedTools || config.cachedTools.length === 0)) return emitConfigFailure(config, hooks, `MCP server "${config.name}": lazyConnect requires cachedTools (the host must pre-populate the tool schemas so they can be advertised without a connection).`);
-	if (config.lazyConnect && config.auth === "oauth") return emitConfigFailure(config, hooks, `MCP server "${config.name}": lazyConnect is not compatible with auth: 'oauth' — OAuth servers must complete the handshake at bootstrap so a login affordance can surface before the model commits to a tool call.`);
+	if (config.lazyConnect && config.auth === "oauth") return emitConfigFailure(config, hooks, `MCP server "${config.name}": lazyConnect doesn't work with auth: 'oauth'. OAuth servers must complete the handshake at bootstrap so a login affordance can surface before the model commits to a tool call.`);
 	await safeCallHook(hooks, "mcp:bootstrap:start", {
 		name: config.name,
 		transport: config.transport
@@ -1520,7 +1561,7 @@ function makeLazyConnector(config, _clientFactory, authProvider, hooks, executio
 				liveTransport = null;
 				(hooks?.callHook("mcp:warn", {
 					name: config.name,
-					message: "connection closed unexpectedly — will reconnect on next tool call"
+					message: "connection closed, reconnecting on the next tool call"
 				}))?.catch(() => {});
 			}
 		};
@@ -1655,6 +1696,9 @@ async function applyMcpToolFilters(config, tools, hooks) {
 * a fresh empty object schema instead of failing the run. (Fresh per call so a
 * downstream in-place mutation can't bleed across degraded tools.)
 */
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function toObjectSchema(schema) {
 	if (typeof schema === "object" && schema !== null && !Array.isArray(schema)) return schema;
 	return {
@@ -1712,7 +1756,8 @@ function buildMcpToolDef(config, getClient, tool, namespacedName, hooks, invalid
 		spec: {
 			name: namespacedName,
 			description: tool.description || "",
-			inputSchema: toObjectSchema(tool.inputSchema)
+			inputSchema: toObjectSchema(tool.inputSchema),
+			...isPlainObject(tool.outputSchema) ? { outputSchema: tool.outputSchema } : {}
 		},
 		execute: async (input, ctx) => {
 			const { turnId, callId, signal } = ctx;
@@ -1784,7 +1829,7 @@ function buildMcpToolDef(config, getClient, tool, namespacedName, hooks, invalid
 					}, void 0, {
 						timeout,
 						signal: rpcSignal
-					}), timeout, `MCP tool "${tool.name}" on server "${config.name}" timed out after ${timeout}ms. The server may still be processing the request — verify its effect before retrying, and do not immediately retry the identical call.`, signal);
+					}), timeout, `MCP tool "${tool.name}" on server "${config.name}" timed out after ${timeout}ms. The server may still be processing the request, so check its effect before retrying, and do not immediately retry the identical call.`, signal);
 				};
 				let result;
 				try {
@@ -1803,6 +1848,7 @@ function buildMcpToolDef(config, getClient, tool, namespacedName, hooks, invalid
 					const detail = (typeof output === "string" ? output : toolResultToText(output)).trim();
 					throw new Error(detail || `MCP tool "${tool.name}" on server "${config.name}" reported an error with no diagnostic content`);
 				}
+				if (result.structuredContent !== void 0) ctx.reportStructured?.(result.structuredContent);
 				const transformCtx = {
 					turnId,
 					callId,
@@ -1910,6 +1956,6 @@ async function raceWithTimeoutAndSignal(task, timeoutMs, timeoutMessage, signal)
 	}
 }
 //#endregion
-export { hasAuthorizationHeader as _, expandEnvPlaceholders as a, normalizeMcpBlocks as c, resultToString as d, wrapDiscoveredMcpTools as f, createMemoryMcpCredentialStore as g, McpOAuthProvider as h, deriveMcpToolMeta as i, normalizeMcpServers as l, sseToJsonFetchIfNeeded as m, connectMcpServers as n, expandMcpConfigEnv as o, createTolerantClient as p, createStderrLineEmitter as r, nonOwningMcpView as s, attachStderrWarnPump as t, resolveTransportConfig as u, isOAuthTokenRejectionError as v };
+export { createMemoryMcpCredentialStore as _, attachStderrWarnPump as a, expandEnvPlaceholders as c, resolveTransportConfig as d, withoutEnvPlaceholders as f, McpOAuthProvider as g, createTolerantClient as h, wrapDiscoveredMcpTools as i, expandMcpConfigEnv as l, resultToString as m, deriveMcpToolMeta as n, createStderrLineEmitter as o, normalizeMcpBlocks as p, nonOwningMcpView as r, sseToJsonFetchIfNeeded as s, connectMcpServers as t, normalizeMcpServers as u, hasAuthorizationHeader as v, isOAuthTokenRejectionError as y };
 
-//# sourceMappingURL=mcp-CgNd-f3F.js.map
+//# sourceMappingURL=mcp-_wecH9Qe.js.map