@agent-native/dispatch 0.8.5 → 0.8.7

package/src/server/lib/app-creation-store.spec.ts

@@ -3,17 +3,104 @@ import { runWithRequestContext } from "@agent-native/core/server";
 import {
   generateWorkspaceAppDescription,
   listWorkspaceApps,
+  updateWorkspaceAppMetadata,
 } from "./app-creation-store.js";
 
 const originalFetch = globalThis.fetch;
+const settingsKey = "dispatch-app-creation-settings:user:dev@example.test";
+
+const mocks = vi.hoisted(() => {
+  const settings = new Map<string, unknown>();
+  const state = {
+    orgRole: "admin" as string | null,
+  };
+  return {
+    settings,
+    state,
+    getSetting: vi.fn(async (key: string) => settings.get(key) ?? null),
+    putSetting: vi.fn(async (key: string, value: unknown) => {
+      settings.set(key, value);
+    }),
+    getDbExec: vi.fn(() => ({
+      execute: vi.fn(async () => ({
+        rows: state.orgRole ? [{ role: state.orgRole }] : [],
+      })),
+    })),
+  };
+});
+
+vi.mock("@agent-native/core/db", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@agent-native/core/db")>();
+  return {
+    ...actual,
+    getDbExec: () => mocks.getDbExec(),
+  };
+});
+
+vi.mock("@agent-native/core/settings", () => ({
+  getSetting: (...args: any[]) => mocks.getSetting(...args),
+  putSetting: (...args: any[]) => mocks.putSetting(...args),
+}));
+
+vi.mock("./dispatch-store.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./dispatch-store.js")>();
+  return {
+    ...actual,
+    recordAudit: vi.fn(async () => {}),
+  };
+});
 
 afterEach(() => {
   vi.unstubAllEnvs();
   vi.unstubAllGlobals();
+  vi.clearAllMocks();
+  mocks.settings.clear();
+  mocks.state.orgRole = "admin";
   globalThis.fetch = originalFetch;
 });
 
 describe("listWorkspaceApps", () => {
+  function stubNoPendingContext() {
+    for (const key of [
+      "BRANCH",
+      "HEAD",
+      "VERCEL_GIT_COMMIT_REF",
+      "CF_PAGES_BRANCH",
+      "RENDER_GIT_BRANCH",
+      "FLY_BRANCH",
+      "WORKSPACE_GATEWAY_URL",
+      "DEPLOY_PRIME_URL",
+      "DEPLOY_URL",
+      "URL",
+      "APP_URL",
+      "BETTER_AUTH_URL",
+    ]) {
+      vi.stubEnv(key, "");
+    }
+  }
+
+  function stubManifest(
+    apps = [{ id: "dispatch", name: "Dispatch", path: "/dispatch" }],
+  ) {
+    vi.stubEnv("AGENT_NATIVE_WORKSPACE_APPS_JSON", JSON.stringify(apps));
+  }
+
+  function pendingApp(id: string, overrides: Record<string, unknown> = {}) {
+    return {
+      id,
+      name: id.charAt(0).toUpperCase() + id.slice(1),
+      description: `${id} is being created`,
+      path: `/${id}`,
+      builderUrl: `https://builder.io/app/projects/project-123/branch/${id}`,
+      branchName: id,
+      projectId: "project-123",
+      createdAt: "2026-05-20T18:00:00.000Z",
+      updatedAt: "2026-05-20T18:00:00.000Z",
+      expiresAt: "2999-01-01T00:00:00.000Z",
+      ...overrides,
+    };
+  }
+
   it("prefers the live workspace gateway manifest when available", async () => {
     const fetchMock = vi.fn(async () => {
       return new Response(
@@ -69,6 +156,7 @@ describe("listWorkspaceApps", () => {
   });
 
   it("filters workspace apps by audience", async () => {
+    stubNoPendingContext();
     vi.stubEnv(
       "AGENT_NATIVE_WORKSPACE_APPS_JSON",
       JSON.stringify([
@@ -99,6 +187,158 @@ describe("listWorkspaceApps", () => {
     expect(apps.map((app) => app.id)).toEqual(["portal"]);
   });
 
+  it("shows current branch and legacy pending Builder app rows", async () => {
+    stubManifest();
+    vi.stubEnv("BRANCH", "feature-a");
+    mocks.settings.set(settingsKey, {
+      pendingApps: [
+        pendingApp("mail", {
+          builderUrl: "https://builder.io/app/projects/project-123/branch/old",
+        }),
+        pendingApp("mail", {
+          contextId: "branch:feature-a",
+          contextLabel: "Branch: feature-a",
+          builderUrl:
+            "https://builder.io/app/projects/project-123/branch/feature-a",
+        }),
+        pendingApp("calendar", {
+          contextId: "branch:feature-b",
+          contextLabel: "Branch: feature-b",
+        }),
+        pendingApp("legacy"),
+      ],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "legacy", "mail"]);
+    expect(apps.find((app) => app.id === "mail")?.statusLabel).toBe(
+      "Pending Builder branch",
+    );
+    expect(apps.filter((app) => app.id === "mail")).toHaveLength(1);
+    expect(apps.find((app) => app.id === "mail")?.builderUrl).toContain(
+      "feature-a",
+    );
+  });
+
+  it("keeps unscoped legacy pending rows visible when there is no deploy context", async () => {
+    stubNoPendingContext();
+    stubManifest();
+    mocks.settings.set(settingsKey, {
+      pendingApps: [pendingApp("legacy")],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "legacy"]);
+  });
+
+  it("hides expired pending Builder app rows", async () => {
+    stubManifest();
+    vi.stubEnv("BRANCH", "feature-a");
+    mocks.settings.set(settingsKey, {
+      pendingApps: [
+        pendingApp("old-app", {
+          contextId: "branch:feature-a",
+          expiresAt: "2000-01-01T00:00:00.000Z",
+        }),
+        pendingApp("fresh-app", {
+          contextId: "branch:feature-a",
+        }),
+      ],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "fresh-app"]);
+  });
+
+  it("does not show a pending row after the app is present in the manifest", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      { id: "mail", name: "Mail", path: "/mail" },
+    ]);
+    mocks.settings.set(settingsKey, {
+      pendingApps: [pendingApp("mail")],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "mail"]);
+    expect(apps.find((app) => app.id === "mail")?.status).toBe("ready");
+  });
+
+  it("lets workspace admins update app display metadata", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      {
+        id: "todo",
+        name: "Todo",
+        description: "Original description",
+        path: "/todo",
+      },
+    ]);
+
+    const updated = await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () =>
+        updateWorkspaceAppMetadata({
+          appId: "todo",
+          name: "Todo Board",
+          description: "Tracks team work.",
+        }),
+    );
+
+    expect(updated.name).toBe("Todo Board");
+    expect(updated.description).toBe("Tracks team work.");
+    expect(mocks.settings.get("workspace-app-metadata:org:org-123")).toEqual({
+      apps: {
+        todo: expect.objectContaining({
+          name: "Todo Board",
+          description: "Tracks team work.",
+          updatedBy: "dev@example.test",
+        }),
+      },
+    });
+    expect(mocks.getDbExec).toHaveBeenCalled();
+  });
+
+  it("blocks non-admin workspace members from updating app display metadata", async () => {
+    mocks.state.orgRole = "member";
+    stubNoPendingContext();
+    stubManifest([{ id: "todo", name: "Todo", path: "/todo" }]);
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () =>
+          updateWorkspaceAppMetadata({
+            appId: "todo",
+            name: "Todo Board",
+          }),
+      ),
+    ).rejects.toThrow(
+      "Only organization owners and admins can update app creation settings.",
+    );
+    expect(
+      mocks.settings.get("workspace-app-metadata:org:org-123"),
+    ).toBeUndefined();
+  });
+
   it("generates a concise seed description from an app prompt", () => {
     expect(
       generateWorkspaceAppDescription(

package/src/server/lib/app-creation-store.ts

@@ -34,6 +34,7 @@ const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
 const WORKSPACE_APPS_GATEWAY_PATH = "/_workspace/apps";
 const WORKSPACE_APPS_GATEWAY_TIMEOUT_MS = 1_000;
 const MAX_PENDING_APPS = 50;
+const PENDING_WORKSPACE_APP_TTL_MS = 7 * 24 * 60 * 60 * 1_000;
 const AGENT_CARD_PATH = "/.well-known/agent-card.json";
 const AGENT_CARD_FETCH_TIMEOUT_MS = 1_500;
 const DEFAULT_WORKSPACE_APP_AUDIENCE = "internal";
@@ -111,9 +112,12 @@ interface PendingWorkspaceApp {
   builderUrl: string | null;
   branchName: string | null;
   projectId: string | null;
+  contextId: string | null;
+  contextLabel: string | null;
   audience?: WorkspaceAppAudience;
   createdAt: string;
   updatedAt: string;
+  expiresAt: string | null;
 }
 
 interface WorkspaceAppMetadataOverride {
@@ -209,6 +213,48 @@ function workspaceAppMetadataSettingsKey(): string {
   return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:user:${currentOwnerEmail()}`;
 }
 
+function cleanOptionalString(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function normalizeContextPart(value: string): string {
+  return value.trim().replace(/\s+/g, " ");
+}
+
+function pendingWorkspaceAppContext(): { id: string; label: string } | null {
+  const branch =
+    cleanOptionalString(process.env.BRANCH) ??
+    cleanOptionalString(process.env.HEAD) ??
+    cleanOptionalString(process.env.VERCEL_GIT_COMMIT_REF) ??
+    cleanOptionalString(process.env.CF_PAGES_BRANCH) ??
+    cleanOptionalString(process.env.RENDER_GIT_BRANCH) ??
+    cleanOptionalString(process.env.FLY_BRANCH);
+  if (branch) {
+    const normalized = normalizeContextPart(branch);
+    return { id: `branch:${normalized}`, label: `Branch: ${normalized}` };
+  }
+
+  const origin =
+    cleanOptionalString(process.env.DEPLOY_PRIME_URL) ??
+    cleanOptionalString(process.env.DEPLOY_URL) ??
+    cleanOptionalString(process.env.URL) ??
+    cleanOptionalString(process.env.APP_URL) ??
+    cleanOptionalString(process.env.BETTER_AUTH_URL) ??
+    cleanOptionalString(process.env.WORKSPACE_GATEWAY_URL);
+  if (!origin) return null;
+
+  try {
+    const parsed = new URL(origin);
+    return {
+      id: `origin:${parsed.origin}`,
+      label: parsed.hostname,
+    };
+  } catch {
+    const normalized = normalizeContextPart(origin);
+    return { id: `origin:${normalized}`, label: normalized };
+  }
+}
+
 async function readSettingsRecord(): Promise<Record<string, any>> {
   const raw = await getSetting(scopedSettingsKey()).catch(() => null);
   return raw && typeof raw === "object" && !Array.isArray(raw)
@@ -476,6 +522,61 @@ function parseWorkspaceAppsManifest(parsed: any): WorkspaceAppSummary[] | null {
   return apps.length ? apps : null;
 }
 
+function parseDateMs(value: string | null | undefined): number | null {
+  if (!value) return null;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function pendingWorkspaceAppExpiresAt(createdAt: string): string {
+  const createdMs = parseDateMs(createdAt) ?? Date.now();
+  return new Date(createdMs + PENDING_WORKSPACE_APP_TTL_MS).toISOString();
+}
+
+function isPendingWorkspaceAppExpired(
+  app: Pick<PendingWorkspaceApp, "createdAt" | "expiresAt">,
+): boolean {
+  const expiresMs =
+    parseDateMs(app.expiresAt) ??
+    (parseDateMs(app.createdAt) ?? Date.now()) + PENDING_WORKSPACE_APP_TTL_MS;
+  return expiresMs <= Date.now();
+}
+
+function pendingWorkspaceAppMatchesCurrentContext(
+  app: Pick<PendingWorkspaceApp, "contextId" | "createdAt" | "expiresAt">,
+): boolean {
+  if (isPendingWorkspaceAppExpired(app)) return false;
+  const currentContext = pendingWorkspaceAppContext();
+  if (!app.contextId) return true;
+  return app.contextId === currentContext?.id;
+}
+
+function pendingWorkspaceAppContextRank(
+  app: Pick<PendingWorkspaceApp, "contextId">,
+): number {
+  const currentContext = pendingWorkspaceAppContext();
+  if (app.contextId && app.contextId === currentContext?.id) return 2;
+  if (!app.contextId) return 1;
+  return 0;
+}
+
+function dedupePendingWorkspaceAppsForCurrentContext(
+  apps: PendingWorkspaceApp[],
+): PendingWorkspaceApp[] {
+  const byId = new Map<string, PendingWorkspaceApp>();
+  for (const app of apps) {
+    const existing = byId.get(app.id);
+    if (
+      !existing ||
+      pendingWorkspaceAppContextRank(app) >
+        pendingWorkspaceAppContextRank(existing)
+    ) {
+      byId.set(app.id, app);
+    }
+  }
+  return Array.from(byId.values());
+}
+
 function sortWorkspaceApps(a: WorkspaceAppSummary, b: WorkspaceAppSummary) {
   if (a.id === "dispatch") return -1;
   if (b.id === "dispatch") return 1;
@@ -495,6 +596,7 @@ function parsePendingWorkspaceApps(value: unknown): PendingWorkspaceApp[] {
         typeof record.path === "string" ? record.path.trim() : "";
       if (!id || !pathValue.startsWith("/")) return null;
       const now = new Date().toISOString();
+      const createdAt = cleanOptionalString(record.createdAt) ?? now;
       return {
         id,
         name:
@@ -518,17 +620,19 @@ function parsePendingWorkspaceApps(value: unknown): PendingWorkspaceApp[] {
           typeof record.projectId === "string" && record.projectId.trim()
             ? record.projectId.trim()
             : null,
+        contextId: cleanOptionalString(record.contextId),
+        contextLabel: cleanOptionalString(record.contextLabel),
         ...(record.audience === undefined
           ? {}
           : { audience: normalizeWorkspaceAppAudience(record.audience) }),
-        createdAt:
-          typeof record.createdAt === "string" && record.createdAt.trim()
-            ? record.createdAt.trim()
-            : now,
+        createdAt,
         updatedAt:
           typeof record.updatedAt === "string" && record.updatedAt.trim()
             ? record.updatedAt.trim()
             : now,
+        expiresAt:
+          cleanOptionalString(record.expiresAt) ??
+          pendingWorkspaceAppExpiresAt(createdAt),
       } satisfies PendingWorkspaceApp;
     })
     .filter((app): app is PendingWorkspaceApp => !!app)
@@ -597,7 +701,9 @@ export async function removePendingWorkspaceApp(input: {
   if (!appId) throw new Error("appId is required");
   const raw = await readSettingsRecord();
   const pending = parsePendingWorkspaceApps(raw.pendingApps);
-  const next = pending.filter((app) => app.id !== appId);
+  const next = pending.filter(
+    (app) => app.id !== appId || !pendingWorkspaceAppMatchesCurrentContext(app),
+  );
   const removed = next.length !== pending.length;
   if (!removed) return { removed: false };
   await putSetting(scopedSettingsKey(), { ...raw, pendingApps: next });
@@ -622,7 +728,7 @@ function pendingAppToSummary(app: PendingWorkspaceApp): WorkspaceAppSummary {
     publicPaths: [],
     protectedPaths: [],
     status: "pending",
-    statusLabel: "Building in Builder",
+    statusLabel: "Pending Builder branch",
     builderUrl: app.builderUrl,
     branchName: app.branchName,
     createdAt: app.createdAt,
@@ -633,9 +739,11 @@ async function appendPendingWorkspaceApps(
   apps: WorkspaceAppSummary[],
 ): Promise<WorkspaceAppSummary[]> {
   const readyIds = new Set(apps.map((app) => app.id));
-  const pendingApps = (await listPendingWorkspaceApps())
-    .filter((app) => !readyIds.has(app.id))
-    .map(pendingAppToSummary);
+  const pendingApps = dedupePendingWorkspaceAppsForCurrentContext(
+    (await listPendingWorkspaceApps())
+      .filter(pendingWorkspaceAppMatchesCurrentContext)
+      .filter((app) => !readyIds.has(app.id)),
+  ).map(pendingAppToSummary);
   return [...apps, ...pendingApps].sort(sortWorkspaceApps);
 }
 
@@ -765,9 +873,16 @@ async function recordPendingWorkspaceApp(input: {
   builderUrl?: string | null;
 }) {
   const now = new Date().toISOString();
+  const context = pendingWorkspaceAppContext();
   const raw = await readSettingsRecord();
   const pendingApps = parsePendingWorkspaceApps(raw.pendingApps);
-  const existing = pendingApps.find((app) => app.id === input.appId);
+  const contextId = context?.id ?? null;
+  const samePendingEntry = (app: PendingWorkspaceApp) =>
+    app.id === input.appId &&
+    (app.contextId === contextId || (!!contextId && !app.contextId));
+  const existing = pendingApps
+    .filter((app) => !isPendingWorkspaceAppExpired(app))
+    .find(samePendingEntry);
   const next: PendingWorkspaceApp = {
     id: input.appId,
     name: titleCase(input.appId),
@@ -778,15 +893,18 @@ async function recordPendingWorkspaceApp(input: {
     builderUrl: input.builderUrl?.trim() || null,
     branchName: input.branchName?.trim() || null,
     projectId: input.projectId,
+    contextId: context?.id ?? null,
+    contextLabel: context?.label ?? null,
     createdAt: existing?.createdAt || now,
     updatedAt: now,
+    expiresAt: pendingWorkspaceAppExpiresAt(existing?.createdAt || now),
   };
 
   await putSetting(scopedSettingsKey(), {
     ...raw,
     pendingApps: [
       next,
-      ...pendingApps.filter((app) => app.id !== input.appId),
+      ...pendingApps.filter((app) => !samePendingEntry(app)),
     ].slice(0, MAX_PENDING_APPS),
   });
 
@@ -807,6 +925,7 @@ async function recordPendingWorkspaceApp(input: {
       builderBranchUrlConfigured: !!next.builderUrl,
       branchName: next.branchName,
       projectIdConfigured: !!next.projectId,
+      contextLabel: next.contextLabel,
     },
   });
 }

package/src/server/lib/mcp-access-store.spec.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import {
+  isAppAllowedByMcpAccess,
+  normalizeMcpAppAccessSettings,
+} from "./mcp-access-store.js";
+
+describe("normalizeMcpAppAccessSettings", () => {
+  it("defaults to all apps", () => {
+    expect(normalizeMcpAppAccessSettings(null)).toEqual({
+      mode: "all-apps",
+      selectedAppIds: [],
+      updatedAt: undefined,
+      updatedBy: undefined,
+    });
+  });
+
+  it("normalizes selected app ids", () => {
+    expect(
+      normalizeMcpAppAccessSettings({
+        mode: "selected-apps",
+        selectedAppIds: [" Mail ", "mail", "calendar"],
+        updatedAt: "2026-05-20T12:00:00.000Z",
+        updatedBy: "admin@example.test",
+      }),
+    ).toEqual({
+      mode: "selected-apps",
+      selectedAppIds: ["mail", "calendar"],
+      updatedAt: "2026-05-20T12:00:00.000Z",
+      updatedBy: "admin@example.test",
+    });
+  });
+});
+
+describe("isAppAllowedByMcpAccess", () => {
+  it("allows every app in all-apps mode", () => {
+    expect(
+      isAppAllowedByMcpAccess("mail", {
+        mode: "all-apps",
+        selectedAppIds: [],
+      }),
+    ).toBe(true);
+  });
+
+  it("checks selected grants in selected-apps mode", () => {
+    expect(
+      isAppAllowedByMcpAccess("mail", {
+        mode: "selected-apps",
+        selectedAppIds: ["calendar"],
+      }),
+    ).toBe(false);
+    expect(
+      isAppAllowedByMcpAccess("calendar", {
+        mode: "selected-apps",
+        selectedAppIds: ["calendar"],
+      }),
+    ).toBe(true);
+  });
+});

package/src/server/lib/mcp-access-store.ts

@@ -0,0 +1,104 @@
+import {
+  getOrgSetting,
+  getUserSetting,
+  putOrgSetting,
+  putUserSetting,
+} from "@agent-native/core/settings";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+
+export const MCP_APP_ACCESS_SETTINGS_KEY = "dispatch-mcp-app-access";
+
+export type DispatchMcpAppAccessMode = "all-apps" | "selected-apps";
+
+export interface DispatchMcpAppAccessSettings {
+  mode: DispatchMcpAppAccessMode;
+  selectedAppIds: string[];
+  updatedAt?: string;
+  updatedBy?: string;
+}
+
+interface AccessScope {
+  kind: "org" | "user";
+  id: string;
+  actor: string;
+}
+
+function uniqueAppIds(values: unknown): string[] {
+  const input = Array.isArray(values) ? values : [];
+  return Array.from(
+    new Set(
+      input
+        .filter((value): value is string => typeof value === "string")
+        .map((value) => value.trim().toLowerCase())
+        .filter(Boolean),
+    ),
+  );
+}
+
+export function normalizeMcpAppAccessSettings(
+  raw: unknown,
+): DispatchMcpAppAccessSettings {
+  const record =
+    raw && typeof raw === "object" && !Array.isArray(raw)
+      ? (raw as Record<string, unknown>)
+      : {};
+  const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+  return {
+    mode,
+    selectedAppIds: uniqueAppIds(record.selectedAppIds),
+    updatedAt:
+      typeof record.updatedAt === "string" ? record.updatedAt : undefined,
+    updatedBy:
+      typeof record.updatedBy === "string" ? record.updatedBy : undefined,
+  };
+}
+
+function currentAccessScope(): AccessScope {
+  const actor = getRequestUserEmail();
+  if (!actor) throw new Error("no authenticated user");
+  const orgId = getRequestOrgId();
+  if (orgId) return { kind: "org", id: orgId, actor };
+  return { kind: "user", id: actor, actor };
+}
+
+export async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {
+  const scope = currentAccessScope();
+  const raw =
+    scope.kind === "org"
+      ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)
+      : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);
+  return normalizeMcpAppAccessSettings(raw);
+}
+
+export async function setDispatchMcpAppAccessSettings(input: {
+  mode: DispatchMcpAppAccessMode;
+  selectedAppIds?: string[];
+}): Promise<DispatchMcpAppAccessSettings> {
+  const scope = currentAccessScope();
+  const next: DispatchMcpAppAccessSettings = {
+    mode: input.mode,
+    selectedAppIds: uniqueAppIds(input.selectedAppIds),
+    updatedAt: new Date().toISOString(),
+    updatedBy: scope.actor,
+  };
+  const value = next as unknown as Record<string, unknown>;
+  if (scope.kind === "org") {
+    await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);
+  } else {
+    await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);
+  }
+  return next;
+}
+
+export function isAppAllowedByMcpAccess(
+  appId: string,
+  settings: DispatchMcpAppAccessSettings,
+): boolean {
+  const normalized = appId.trim().toLowerCase();
+  if (!normalized) return false;
+  if (settings.mode === "all-apps") return true;
+  return settings.selectedAppIds.includes(normalized);
+}