@agent-native/core 0.20.9 → 0.21.0

package/dist/cli/connect.js

@@ -31,12 +31,14 @@ import os from "node:os";
 import { spawn } from "node:child_process";
 import path from "node:path";
 import { findWorkspaceRoot } from "../mcp/workspace-resolve.js";
-import { CLIENTS, writeHttpEntryForClient, } from "./mcp-config-writers.js";
-import { visibleTemplates } from "./templates-meta.js";
+import { CLIENTS, configPathFor, writeCodexBlock, writeHttpEntryForClient, writeJsonMcpEntry, } from "./mcp-config-writers.js";
+import { TEMPLATES, visibleTemplates } from "./templates-meta.js";
 const DEVICE_START_PATH = "/_agent-native/mcp/connect/device/start";
 const DEVICE_POLL_PATH = "/_agent-native/mcp/connect/device/poll";
 const SERVER_NAME_PREFIX = "agent-native";
 const CONNECT_PREFERENCES_VERSION = 1;
+const CONNECT_PROFILES_VERSION = 1;
+const DEFAULT_DEV_GATEWAY = "http://127.0.0.1:8080";
 const CLIENT_LABELS = {
     "claude-code": "Claude Code",
     "claude-code-cli": "Claude Code CLI",
@@ -74,6 +76,16 @@ export function parseConnectArgs(argv) {
         let v;
         if (a === "--all")
             out.all = true;
+        else if ((v = eat("--apps")) !== undefined)
+            out.apps = v;
+        else if ((v = eat("--gateway")) !== undefined)
+            out.gateway = v;
+        else if ((v = eat("--gateway-url")) !== undefined)
+            out.gateway = v;
+        else if ((v = eat("--port")) !== undefined)
+            out.port = Number(v);
+        else if ((v = eat("--owner-email")) !== undefined)
+            out.ownerEmail = v;
         else if ((v = eat("--client")) !== undefined) {
             out.client = v;
             out.clientExplicit = true;
@@ -84,8 +96,12 @@ export function parseConnectArgs(argv) {
             out.name = v;
         else if ((v = eat("--token")) !== undefined)
             out.token = v;
-        else if (!a.startsWith("-") && !out.url)
-            out.url = a;
+        else if (!a.startsWith("-") && !out.url) {
+            if (!out.mode && (a === "dev" || a === "prod"))
+                out.mode = a;
+            else
+                out.url = a;
+        }
     }
     return out;
 }
@@ -483,6 +499,459 @@ export function writeConfigs(clients, serverName, mcpUrl, token, scope, baseDir
     }
     return written;
 }
+export function connectProfilesPath() {
+    return path.join(os.homedir(), ".agent-native", "connect-profiles.json");
+}
+function readConnectProfiles(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        if (parsed && typeof parsed === "object") {
+            return {
+                version: Number(parsed.version) || CONNECT_PROFILES_VERSION,
+                updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : undefined,
+                prodEntries: parsed.prodEntries && typeof parsed.prodEntries === "object"
+                    ? parsed.prodEntries
+                    : {},
+            };
+        }
+    }
+    catch {
+        // no saved profiles yet
+    }
+    return { version: CONNECT_PROFILES_VERSION, prodEntries: {} };
+}
+function writeConnectProfiles(file, profiles) {
+    profiles.version = CONNECT_PROFILES_VERSION;
+    profiles.updatedAt = new Date().toISOString();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(profiles, null, 2) + "\n", "utf-8");
+}
+function savedProfileEntry(profiles, serverName, client, file) {
+    return profiles.prodEntries?.[serverName]?.[client]?.[file];
+}
+function setSavedProfileEntry(profiles, serverName, client, file, entry) {
+    profiles.prodEntries ??= {};
+    profiles.prodEntries[serverName] ??= {};
+    profiles.prodEntries[serverName][client] ??= {};
+    profiles.prodEntries[serverName][client][file] = entry;
+}
+function readJsonMcpServerEntry(file, serverName) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        const entry = parsed?.mcpServers?.[serverName];
+        return entry && typeof entry === "object" ? entry : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function tomlQuoteForRead(s) {
+    return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function codexHeadersForRead(name) {
+    const headers = [`[mcp_servers.${tomlQuoteForRead(name)}]`];
+    if (/^[A-Za-z0-9_-]+$/.test(name))
+        headers.push(`[mcp_servers.${name}]`);
+    return headers;
+}
+function readCodexMcpBlock(file, serverName) {
+    let content = "";
+    try {
+        content = fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    const headers = new Set(codexHeadersForRead(serverName));
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        if (!headers.has(lines[i].trim()))
+            continue;
+        const block = [lines[i]];
+        i++;
+        while (i < lines.length && !/^\s*\[/.test(lines[i])) {
+            block.push(lines[i]);
+            i++;
+        }
+        return block.join("\n").replace(/\n*$/, "") + "\n";
+    }
+    return undefined;
+}
+function readCurrentMcpEntry(client, serverName, baseDir, scope) {
+    const file = configPathFor(client, baseDir, scope);
+    if (client === "codex") {
+        const block = readCodexMcpBlock(file, serverName);
+        return {
+            file,
+            saved: block
+                ? { kind: "codex", block, savedAt: new Date().toISOString() }
+                : undefined,
+        };
+    }
+    const entry = readJsonMcpServerEntry(file, serverName);
+    return {
+        file,
+        saved: entry
+            ? { kind: "json", entry, savedAt: new Date().toISOString() }
+            : undefined,
+    };
+}
+function writeSavedMcpEntry(client, file, serverName, saved) {
+    if (client === "codex") {
+        if (saved.kind !== "codex")
+            return;
+        writeCodexBlock(file, serverName, saved.block);
+        return;
+    }
+    if (saved.kind !== "json")
+        return;
+    writeJsonMcpEntry(file, serverName, saved.entry);
+}
+function unescapeTomlString(value) {
+    return value.replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function parseCodexHeaders(block) {
+    const line = block
+        .split(/\r?\n/)
+        .find((candidate) => /^\s*http_headers\s*=/.test(candidate));
+    if (!line)
+        return {};
+    const match = line.match(/\{(.*)\}/);
+    if (!match)
+        return {};
+    const headers = {};
+    const pairRe = /"((?:\\.|[^"])*)"\s*=\s*"((?:\\.|[^"])*)"/g;
+    let pair;
+    while ((pair = pairRe.exec(match[1]))) {
+        headers[unescapeTomlString(pair[1])] = unescapeTomlString(pair[2]);
+    }
+    return headers;
+}
+function savedEntryUrl(saved) {
+    if (!saved)
+        return undefined;
+    if (saved.kind === "json") {
+        return typeof saved.entry.url === "string" ? saved.entry.url : undefined;
+    }
+    const match = saved.block.match(/^\s*url\s*=\s*"((?:\\.|[^"])*)"/m);
+    return match ? unescapeTomlString(match[1]) : undefined;
+}
+function savedEntryHeaders(saved) {
+    if (!saved)
+        return {};
+    if (saved.kind === "json") {
+        const headers = saved.entry.headers;
+        return headers && typeof headers === "object"
+            ? Object.fromEntries(Object.entries(headers)
+                .filter((entry) => {
+                return typeof entry[1] === "string";
+            })
+                .map(([key, value]) => [key, value]))
+            : {};
+    }
+    return parseCodexHeaders(saved.block);
+}
+function isLoopbackMcpUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return (url.hostname === "localhost" ||
+            url.hostname === "127.0.0.1" ||
+            url.hostname === "::1" ||
+            url.hostname.startsWith("127."));
+    }
+    catch {
+        return false;
+    }
+}
+function decodeJwtSub(authHeader) {
+    if (!authHeader?.startsWith("Bearer "))
+        return undefined;
+    const token = authHeader.slice("Bearer ".length);
+    const [, payload] = token.split(".");
+    if (!payload)
+        return undefined;
+    try {
+        const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
+        const parsed = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+        return typeof parsed.sub === "string" && parsed.sub.includes("@")
+            ? parsed.sub
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownerEmailFromEntry(saved) {
+    const headers = savedEntryHeaders(saved);
+    return (headers["X-Agent-Native-Owner-Email"] || decodeJwtSub(headers.Authorization));
+}
+function readEnvFile(file) {
+    try {
+        return fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        return "";
+    }
+}
+function readEnvValue(content, key) {
+    let found;
+    for (const line of content.split(/\r?\n/)) {
+        const match = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/i);
+        if (match?.[1] === key) {
+            found = match[2].replace(/^["']|["']$/g, "");
+        }
+    }
+    return found;
+}
+function workspaceEnvContent(baseDir) {
+    return (readEnvFile(path.join(baseDir, ".env.local")) +
+        "\n" +
+        readEnvFile(path.join(baseDir, ".env")));
+}
+function localAccessToken(baseDir) {
+    const content = workspaceEnvContent(baseDir);
+    const single = readEnvValue(content, "ACCESS_TOKEN");
+    if (single)
+        return single;
+    const multi = readEnvValue(content, "ACCESS_TOKENS");
+    return multi
+        ?.split(",")
+        .map((token) => token.trim())
+        .find(Boolean);
+}
+function localA2ASecret(baseDir) {
+    return (process.env.A2A_SECRET ||
+        readEnvValue(workspaceEnvContent(baseDir), "A2A_SECRET"));
+}
+async function mintLocalA2AToken(ownerEmail, baseDir) {
+    const secret = ownerEmail ? localA2ASecret(baseDir) : undefined;
+    if (!secret)
+        return undefined;
+    const jose = await import("jose");
+    return new jose.SignJWT({ sub: ownerEmail })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuer("agent-native-connect-dev")
+        .setIssuedAt()
+        .setExpirationTime("30d")
+        .sign(new TextEncoder().encode(secret));
+}
+async function devHeadersForApp(params) {
+    const ownerEmail = params.ownerEmail ||
+        process.env.AGENT_NATIVE_OWNER_EMAIL ||
+        ownerEmailFromEntry(params.sourceEntry);
+    const headers = {};
+    const accessToken = localAccessToken(params.baseDir);
+    const a2aToken = accessToken
+        ? undefined
+        : await mintLocalA2AToken(ownerEmail, params.baseDir);
+    if (accessToken || a2aToken) {
+        headers.Authorization = `Bearer ${accessToken || a2aToken}`;
+    }
+    if (ownerEmail) {
+        headers["X-Agent-Native-Owner-Email"] = ownerEmail;
+    }
+    return Object.keys(headers).length ? headers : undefined;
+}
+function connectableApps(includeHidden = false) {
+    const source = includeHidden ? TEMPLATES : visibleTemplates();
+    return source
+        .filter((template) => typeof template.prodUrl === "string")
+        .map((template) => ({
+        name: template.name,
+        label: template.label,
+        url: template.prodUrl,
+        core: !!template.core,
+    }));
+}
+function profileDefaultApps() {
+    const core = connectableApps(false).filter((app) => app.core);
+    return core.length ? core : connectableApps(false);
+}
+function parseAppsList(value) {
+    return (value ?? "")
+        .split(",")
+        .map((app) => app.trim())
+        .filter(Boolean);
+}
+async function resolveProfileApps(parsed, deps) {
+    const allVisible = connectableApps(false);
+    const allIncludingHidden = connectableApps(true);
+    if (parsed.apps) {
+        const requested = parseAppsList(parsed.apps);
+        if (requested.includes("all"))
+            return allVisible;
+        const byName = new Map(allIncludingHidden.map((app) => [app.name, app]));
+        const unknown = requested.filter((name) => !byName.has(name));
+        if (unknown.length) {
+            throw new Error(`Unknown app(s): ${unknown.join(", ")}. Known apps: ${allIncludingHidden
+                .map((app) => app.name)
+                .join(", ")}`);
+        }
+        return requested.map((name) => byName.get(name));
+    }
+    if (parsed.all)
+        return allVisible;
+    if (shouldPrompt(deps)) {
+        const prompt = deps.promptHostedApps ?? promptForHostedApps;
+        const initialApps = profileDefaultApps().map((app) => app.name);
+        const selectedNames = normalizeHostedAppNames(await prompt({ apps: allVisible, initialApps }), allVisible);
+        if (selectedNames.length === 0)
+            return [];
+        const selected = new Set(selectedNames);
+        return allVisible.filter((app) => selected.has(app.name));
+    }
+    return profileDefaultApps();
+}
+function defaultDevGateway() {
+    if (process.env.WORKSPACE_GATEWAY_URL)
+        return process.env.WORKSPACE_GATEWAY_URL;
+    const port = process.env.WORKSPACE_PORT || process.env.PORT;
+    return port ? `http://127.0.0.1:${port}` : DEFAULT_DEV_GATEWAY;
+}
+function normalizeDevGateway(parsed) {
+    const raw = parsed.gateway ||
+        (Number.isFinite(parsed.port) && parsed.port
+            ? `http://127.0.0.1:${parsed.port}`
+            : defaultDevGateway());
+    const normalized = normalizeUrl(raw);
+    return normalized.replace(/\/+$/, "");
+}
+async function gatewayAppUrls(gatewayUrl, deps) {
+    const out = new Map();
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+        const response = await fetchImpl(`${gatewayUrl}/_workspace/apps`, {
+            signal: AbortSignal.timeout(1200),
+        });
+        if (!response.ok)
+            return out;
+        const apps = (await response.json());
+        if (!Array.isArray(apps))
+            return out;
+        for (const app of apps) {
+            if (!app || typeof app !== "object")
+                continue;
+            const id = app.id;
+            const url = app.url;
+            if (typeof id === "string" && typeof url === "string") {
+                out.set(id, normalizeUrl(url));
+            }
+        }
+    }
+    catch {
+        // The gateway may not be running yet; still write deterministic dev URLs.
+    }
+    return out;
+}
+function devMcpUrl(app, gatewayUrl, gatewayUrls) {
+    const base = gatewayUrls.get(app.name) ?? `${gatewayUrl}/${app.name}`;
+    return `${base.replace(/\/+$/, "")}/_agent-native/mcp`;
+}
+function serverNameForApp(app) {
+    return `${SERVER_NAME_PREFIX}-${app.name}`;
+}
+async function connectDevProfile(parsed, clients, deps) {
+    const apps = await resolveProfileApps(parsed, deps);
+    if (!apps || apps.length === 0)
+        return true;
+    const baseDir = projectBaseDir();
+    const scope = parsed.scope === "project" ? "project" : "user";
+    const gatewayUrl = normalizeDevGateway(parsed);
+    const gatewayUrls = await gatewayAppUrls(gatewayUrl, deps);
+    const profilesFile = deps.profilesFile ?? connectProfilesPath();
+    const profiles = readConnectProfiles(profilesFile);
+    const rows = [];
+    const ownerWarnings = new Set();
+    for (const app of apps) {
+        const serverName = serverNameForApp(app);
+        const mcpUrl = devMcpUrl(app, gatewayUrl, gatewayUrls);
+        for (const client of clients) {
+            const current = readCurrentMcpEntry(client, serverName, baseDir, scope);
+            const backup = savedProfileEntry(profiles, serverName, client, current.file);
+            if (current.saved && !isLoopbackMcpUrl(savedEntryUrl(current.saved))) {
+                setSavedProfileEntry(profiles, serverName, client, current.file, current.saved);
+            }
+            const sourceEntry = current.saved && !isLoopbackMcpUrl(savedEntryUrl(current.saved))
+                ? current.saved
+                : backup;
+            const headers = await devHeadersForApp({
+                ownerEmail: parsed.ownerEmail,
+                sourceEntry,
+                baseDir,
+            });
+            if (!headers?.["X-Agent-Native-Owner-Email"]) {
+                ownerWarnings.add(app.name);
+            }
+            const file = writeHttpEntryForClient(client, serverName, mcpUrl, undefined, baseDir, scope, headers);
+            rows.push({
+                app: app.name,
+                client,
+                status: "dev",
+                file,
+            });
+        }
+    }
+    writeConnectProfiles(profilesFile, profiles);
+    logOut("");
+    logOut(`  Switched ${apps.length} app(s) to dev via ${gatewayUrl}`);
+    for (const row of rows) {
+        logOut(`    ${row.app.padEnd(12)} ${row.client.padEnd(18)} ${row.file}`);
+    }
+    if (ownerWarnings.size) {
+        logOut("");
+        logOut(`  Tip: pass --owner-email <you@example.com> if local tools look sparse ` +
+            `for ${Array.from(ownerWarnings).join(", ")}.`);
+    }
+    logOut("");
+    logOut("  Restart your coding agent to pick up the dev MCP servers.");
+    return true;
+}
+async function connectProdProfile(parsed, clients, deps) {
+    const apps = await resolveProfileApps(parsed, deps);
+    if (!apps || apps.length === 0)
+        return true;
+    const baseDir = projectBaseDir();
+    const scope = parsed.scope === "project" ? "project" : "user";
+    const profilesFile = deps.profilesFile ?? connectProfilesPath();
+    const profiles = readConnectProfiles(profilesFile);
+    const restored = [];
+    const missing = [];
+    for (const app of apps) {
+        const serverName = serverNameForApp(app);
+        for (const client of clients) {
+            const file = configPathFor(client, baseDir, scope);
+            const saved = savedProfileEntry(profiles, serverName, client, file);
+            if (!saved) {
+                missing.push({ app: app.name, client });
+                continue;
+            }
+            writeSavedMcpEntry(client, file, serverName, saved);
+            restored.push({ app: app.name, client, file });
+        }
+    }
+    logOut("");
+    if (restored.length) {
+        logOut(`  Restored ${restored.length} production MCP entr${restored.length === 1 ? "y" : "ies"}.`);
+        for (const row of restored) {
+            logOut(`    ${row.app.padEnd(12)} ${row.client.padEnd(18)} ${row.file}`);
+        }
+    }
+    if (missing.length) {
+        logOut("");
+        logOut("  No saved production entry for:");
+        for (const row of missing) {
+            const app = apps.find((candidate) => candidate.name === row.app);
+            logOut(`    ${row.app.padEnd(12)} ${row.client.padEnd(18)} ` +
+                `run: agent-native connect ${app?.url ?? "<url>"} --client ${row.client}`);
+        }
+    }
+    logOut("");
+    logOut("  Restart your coding agent to pick up the production MCP servers.");
+    return missing.length === 0;
+}
 // ---------------------------------------------------------------------------
 // Single-app connect
 // ---------------------------------------------------------------------------
@@ -593,6 +1062,14 @@ Usage:
   agent-native connect --all [--client <c>] [--scope user|project]
       Connect every first-party hosted app at once.
 
+Developer:
+  agent-native connect dev [--apps mail,calendar] [--client <c>]
+      Switch selected first-party MCP entries to a local dev-lazy gateway.
+      Defaults to ${DEFAULT_DEV_GATEWAY}; override with --gateway or --port.
+
+  agent-native connect prod [--apps mail,calendar] [--client <c>]
+      Restore production MCP entries saved before the dev switch.
+
 Clients:  all (default), claude-code, claude-code-cli, codex, cowork
 Scope:    user (default, ~/.claude.json) or project (.mcp.json)`;
 /**
@@ -610,6 +1087,17 @@ export async function runConnect(args, deps = {}) {
     }
     const parsed = parseConnectArgs(args);
     try {
+        if (parsed.mode) {
+            const clients = await resolveConnectClients(parsed, deps);
+            if (!clients)
+                return;
+            const ok = parsed.mode === "dev"
+                ? await connectDevProfile(parsed, clients, deps)
+                : await connectProdProfile(parsed, clients, deps);
+            if (!ok)
+                process.exitCode = 1;
+            return;
+        }
         if (parsed.all) {
             const clients = await resolveConnectClients(parsed, deps);
             if (!clients)