@agenticmail/enterprise 0.5.250 → 0.5.252

package/dist/cli.js

@@ -56,7 +56,7 @@ Skill Development:
     import("./cli-serve-GBITKZXM.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
     break;
   case "agent":
-    import("./cli-agent-BB4GKQAM.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
+    import("./cli-agent-4I4UUABZ.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
     break;
   case "setup":
   default:

package/dist/dashboard/pages/skill-connections.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, adminCall } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 import { HelpButton } from '../components/help-button.js';
@@ -60,7 +60,7 @@ function McpServersSection() {
 
   useEffect(function() { load(); }, [load]);
   useEffect(function() {
-    adminCall('/agents').then(function(d) { setAgents((d.agents || d || []).filter(function(a) { return a.status !== 'archived'; })); }).catch(function() {});
+    apiCall('/agents').then(function(d) { setAgents((d.agents || d || []).filter(function(a) { return a.status !== 'archived'; })); }).catch(function() {});
   }, []);
 
   var resetForm = function() {
@@ -416,8 +416,8 @@ function McpServersSection() {
           // Agent assignment
           agents.length > 0 && h('div', { className: 'form-group', style: { marginTop: 16 } },
             h('label', { className: 'form-label', style: { display: 'flex', alignItems: 'center' } }, 'Agent Access', h(HelpButton, { label: 'Agent Access' },
-              h('p', null, 'Choose which agents can use this MCP server\'s tools. If none are selected, ALL agents can use it.'),
-              h('p', { style: { marginTop: 8 } }, 'Use this to restrict sensitive tools (like database access) to specific agents only.')
+              h('p', null, 'Choose which agents can use this MCP server\'s tools. You must select at least one agent — no agent has access until explicitly granted.'),
+              h('p', { style: { marginTop: 8 } }, 'This ensures sensitive tools (like database access) are never accidentally exposed to the wrong agent.')
             )),
             h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 6 } },
               agents.map(function(a) {
@@ -441,8 +441,8 @@ function McpServersSection() {
             ),
             h('div', { style: { fontSize: 11, color: 'var(--text-muted)', marginTop: 4 } },
               form.assignedAgents && form.assignedAgents.length > 0
-                ? form.assignedAgents.length + ' agent(s) selected — only they can use this server'
-                : 'No agents selected — all agents can use this server'
+                ? form.assignedAgents.length + ' agent(s) selected'
+                : 'No agents selected — no agent can use this server yet'
             )
           )
         ),

package/dist/mcp-process-manager-PPCP4RPZ.js

@@ -0,0 +1,424 @@
+import "./chunk-KFQGP6VL.js";
+
+// src/engine/mcp-process-manager.ts
+import { spawn } from "child_process";
+import { EventEmitter } from "events";
+var McpProcessManager = class extends EventEmitter {
+  db;
+  orgId;
+  servers = /* @__PURE__ */ new Map();
+  maxRestarts;
+  restartDelayMs;
+  discoveryTimeoutMs;
+  started = false;
+  healthTimer = null;
+  constructor(config) {
+    super();
+    this.db = config.engineDb;
+    this.orgId = config.orgId || "default";
+    this.maxRestarts = config.maxRestarts ?? 5;
+    this.restartDelayMs = config.restartDelayMs ?? 3e3;
+    this.discoveryTimeoutMs = config.discoveryTimeoutMs ?? 3e4;
+  }
+  /** Start the manager — load all enabled MCP servers from DB and connect */
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    try {
+      const rows = await this.db.query(
+        `SELECT * FROM mcp_servers WHERE org_id = $1`,
+        [this.orgId]
+      );
+      const servers = (rows || []).map((r) => {
+        const config = typeof r.config === "string" ? JSON.parse(r.config) : r.config || {};
+        return { ...config, id: r.id };
+      });
+      const enabled = servers.filter((s) => s.enabled !== false);
+      if (enabled.length === 0) {
+        console.log("[mcp-manager] No enabled MCP servers found");
+        return;
+      }
+      console.log(`[mcp-manager] Starting ${enabled.length} MCP server(s)...`);
+      await Promise.allSettled(enabled.map((s) => this.connectServer(s)));
+      this.healthTimer = setInterval(() => this.healthCheck(), 6e4);
+    } catch (e) {
+      if (e.message?.includes("does not exist") || e.message?.includes("no such table")) {
+        console.log("[mcp-manager] mcp_servers table does not exist yet \u2014 skipping");
+        return;
+      }
+      console.error(`[mcp-manager] Start failed: ${e.message}`);
+    }
+  }
+  /** Stop all servers and clean up */
+  async stop() {
+    this.started = false;
+    if (this.healthTimer) {
+      clearInterval(this.healthTimer);
+      this.healthTimer = null;
+    }
+    for (const [id, state] of Array.from(this.servers)) {
+      this.killProcess(state);
+      console.log(`[mcp-manager] Stopped server: ${state.config.name} (${id})`);
+    }
+    this.servers.clear();
+  }
+  /** Connect a single MCP server (stdio spawn or HTTP/SSE connect) */
+  async connectServer(config) {
+    const existing = this.servers.get(config.id);
+    if (existing) this.killProcess(existing);
+    const state = {
+      config,
+      status: "starting",
+      tools: [],
+      restartCount: 0,
+      rpcId: 0,
+      pendingRpc: /* @__PURE__ */ new Map(),
+      stdoutBuffer: ""
+    };
+    this.servers.set(config.id, state);
+    try {
+      if (config.type === "stdio") {
+        await this.connectStdio(state);
+      } else {
+        await this.connectHttp(state);
+      }
+    } catch (e) {
+      state.status = "error";
+      state.error = e.message;
+      console.error(`[mcp-manager] Failed to connect ${config.name}: ${e.message}`);
+      this.updateDbStatus(config.id, "error", 0, []);
+    }
+  }
+  /** Disconnect and remove a server */
+  async disconnectServer(serverId) {
+    const state = this.servers.get(serverId);
+    if (state) {
+      this.killProcess(state);
+      this.servers.delete(serverId);
+    }
+  }
+  /** Hot-reload: add or update a server config without restarting the whole manager */
+  async reloadServer(serverId) {
+    try {
+      const rows = await this.db.query(`SELECT * FROM mcp_servers WHERE id = $1`, [serverId]);
+      if (!rows?.length) {
+        await this.disconnectServer(serverId);
+        return;
+      }
+      const config = typeof rows[0].config === "string" ? JSON.parse(rows[0].config) : rows[0].config || {};
+      const serverConfig = { ...config, id: rows[0].id };
+      if (serverConfig.enabled === false) {
+        await this.disconnectServer(serverId);
+        return;
+      }
+      await this.connectServer(serverConfig);
+    } catch (e) {
+      console.error(`[mcp-manager] Reload failed for ${serverId}: ${e.message}`);
+    }
+  }
+  // ─── Tool Access ───────────────────────────────────────
+  /** Get all discovered tools across all connected servers, optionally filtered by agent */
+  getToolsForAgent(agentId) {
+    const tools = [];
+    for (const [id, state] of Array.from(this.servers)) {
+      if (state.status !== "connected") continue;
+      if (!state.config.assignedAgents?.length) continue;
+      if (agentId && !state.config.assignedAgents.includes(agentId)) continue;
+      if (!agentId) continue;
+      for (const tool of state.tools) {
+        tools.push({ ...tool, serverId: id, serverName: state.config.name });
+      }
+    }
+    return tools;
+  }
+  /** Get all connected server statuses */
+  getServerStatuses() {
+    return Array.from(this.servers.values()).map((s) => ({
+      id: s.config.id,
+      name: s.config.name,
+      status: s.status,
+      toolCount: s.tools.length,
+      error: s.error
+    }));
+  }
+  /** Call a tool on its MCP server */
+  async callTool(toolName, args, agentId) {
+    for (const [_id, state] of Array.from(this.servers)) {
+      if (state.status !== "connected") continue;
+      if (!state.config.assignedAgents?.length) continue;
+      if (!agentId || !state.config.assignedAgents.includes(agentId)) continue;
+      const tool = state.tools.find((t) => t.name === toolName);
+      if (!tool) continue;
+      if (state.config.type === "stdio") {
+        return this.callToolStdio(state, toolName, args);
+      } else {
+        return this.callToolHttp(state, toolName, args);
+      }
+    }
+    return { content: `Tool "${toolName}" not found on any connected MCP server`, isError: true };
+  }
+  // ─── Stdio Transport ──────────────────────────────────
+  async connectStdio(state) {
+    const { config } = state;
+    if (!config.command) throw new Error("No command specified for stdio MCP server");
+    const env = { ...process.env, ...config.env || {} };
+    const child = spawn(config.command, config.args || [], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env
+    });
+    state.process = child;
+    state.lastStarted = /* @__PURE__ */ new Date();
+    state.stdoutBuffer = "";
+    child.stdout.on("data", (chunk) => {
+      state.stdoutBuffer += chunk.toString();
+      this.processStdoutBuffer(state);
+    });
+    child.stderr.on("data", (chunk) => {
+      const msg = chunk.toString().trim();
+      if (msg) console.log(`[mcp:${config.name}:stderr] ${msg.slice(0, 200)}`);
+    });
+    child.on("exit", (code) => {
+      if (state.status === "connected" && config.autoRestart !== false && this.started) {
+        console.warn(`[mcp-manager] ${config.name} exited with code ${code} \u2014 restarting...`);
+        this.scheduleRestart(state);
+      }
+    });
+    child.on("error", (err) => {
+      state.status = "error";
+      state.error = err.message;
+      console.error(`[mcp-manager] ${config.name} process error: ${err.message}`);
+    });
+    const initResult = await this.sendRpc(state, "initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: "AgenticMail-Enterprise", version: "1.0" }
+    });
+    if (!initResult?.result) {
+      throw new Error(`Initialize failed: ${JSON.stringify(initResult?.error || "no response")}`);
+    }
+    this.sendNotification(state, "notifications/initialized", {});
+    const toolsResult = await this.sendRpc(state, "tools/list", {});
+    state.tools = (toolsResult?.result?.tools || []).map((t) => ({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema || { type: "object", properties: {} }
+    }));
+    state.status = "connected";
+    state.error = void 0;
+    console.log(`[mcp-manager] ${config.name} connected (stdio) \u2014 ${state.tools.length} tools discovered`);
+    this.updateDbStatus(config.id, "connected", state.tools.length, state.tools);
+    this.emit("server:connected", { serverId: config.id, tools: state.tools });
+  }
+  async callToolStdio(state, toolName, args) {
+    try {
+      const result = await this.sendRpc(state, "tools/call", { name: toolName, arguments: args });
+      if (result?.error) {
+        return { content: result.error.message || JSON.stringify(result.error), isError: true };
+      }
+      const contents = result?.result?.content || [];
+      const textParts = contents.map((c) => c.type === "text" ? c.text : JSON.stringify(c)).join("\n");
+      return { content: textParts || "OK", isError: result?.result?.isError };
+    } catch (e) {
+      return { content: `MCP call failed: ${e.message}`, isError: true };
+    }
+  }
+  // ─── HTTP/SSE Transport ────────────────────────────────
+  async connectHttp(state) {
+    const { config } = state;
+    if (!config.url) throw new Error("No URL specified for HTTP/SSE MCP server");
+    const headers = {
+      "Content-Type": "application/json",
+      ...config.headers || {}
+    };
+    if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
+    const timeout = (config.timeout || 30) * 1e3;
+    const initResp = await fetch(config.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "AgenticMail-Enterprise", version: "1.0" } }
+      }),
+      signal: AbortSignal.timeout(timeout)
+    });
+    if (!initResp.ok) throw new Error(`HTTP ${initResp.status}: ${await initResp.text().catch(() => "")}`);
+    const initData = await initResp.json();
+    if (initData.error) throw new Error(initData.error.message || "Initialize error");
+    const toolResp = await fetch(config.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    let tools = [];
+    if (toolResp.ok) {
+      const td = await toolResp.json();
+      tools = (td.result?.tools || []).map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema || { type: "object", properties: {} }
+      }));
+    }
+    state.tools = tools;
+    state.status = "connected";
+    state.error = void 0;
+    state.lastStarted = /* @__PURE__ */ new Date();
+    console.log(`[mcp-manager] ${config.name} connected (${config.type}) \u2014 ${tools.length} tools discovered`);
+    this.updateDbStatus(config.id, "connected", tools.length, tools);
+    this.emit("server:connected", { serverId: config.id, tools });
+  }
+  async callToolHttp(state, toolName, args) {
+    const { config } = state;
+    const headers = {
+      "Content-Type": "application/json",
+      ...config.headers || {}
+    };
+    if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
+    try {
+      const resp = await fetch(config.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: Date.now(),
+          method: "tools/call",
+          params: { name: toolName, arguments: args }
+        }),
+        signal: AbortSignal.timeout((config.timeout || 30) * 1e3)
+      });
+      if (!resp.ok) return { content: `HTTP ${resp.status}`, isError: true };
+      const data = await resp.json();
+      if (data.error) return { content: data.error.message || JSON.stringify(data.error), isError: true };
+      const contents = data.result?.content || [];
+      const textParts = contents.map((c) => c.type === "text" ? c.text : JSON.stringify(c)).join("\n");
+      return { content: textParts || "OK", isError: data.result?.isError };
+    } catch (e) {
+      return { content: `MCP HTTP call failed: ${e.message}`, isError: true };
+    }
+  }
+  // ─── JSON-RPC Helpers (stdio) ──────────────────────────
+  sendRpc(state, method, params) {
+    return new Promise((resolve, reject) => {
+      if (!state.process?.stdin?.writable) {
+        return reject(new Error("Process stdin not writable"));
+      }
+      const id = ++state.rpcId;
+      const msg = JSON.stringify({ jsonrpc: "2.0", id, method, params });
+      const timer = setTimeout(() => {
+        state.pendingRpc.delete(id);
+        reject(new Error(`RPC timeout for ${method} after ${this.discoveryTimeoutMs}ms`));
+      }, this.discoveryTimeoutMs);
+      state.pendingRpc.set(id, { resolve, reject, timer });
+      try {
+        state.process.stdin.write(msg + "\n");
+      } catch (e) {
+        state.pendingRpc.delete(id);
+        clearTimeout(timer);
+        reject(e);
+      }
+    });
+  }
+  sendNotification(state, method, params) {
+    if (!state.process?.stdin?.writable) return;
+    try {
+      const msg = JSON.stringify({ jsonrpc: "2.0", method, params });
+      state.process.stdin.write(msg + "\n");
+    } catch {
+    }
+  }
+  processStdoutBuffer(state) {
+    const lines = state.stdoutBuffer.split("\n");
+    state.stdoutBuffer = lines.pop() || "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed.id !== void 0 && state.pendingRpc.has(parsed.id)) {
+          const pending = state.pendingRpc.get(parsed.id);
+          state.pendingRpc.delete(parsed.id);
+          clearTimeout(pending.timer);
+          pending.resolve(parsed);
+        } else if (!parsed.id && parsed.method) {
+          this.emit("server:notification", {
+            serverId: state.config.id,
+            method: parsed.method,
+            params: parsed.params
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  // ─── Restart / Health ──────────────────────────────────
+  scheduleRestart(state) {
+    if (state.restartCount >= this.maxRestarts) {
+      state.status = "error";
+      state.error = `Max restarts (${this.maxRestarts}) exceeded`;
+      console.error(`[mcp-manager] ${state.config.name} exceeded max restarts`);
+      this.updateDbStatus(state.config.id, "error", 0, []);
+      return;
+    }
+    state.restartCount++;
+    const delay = this.restartDelayMs * state.restartCount;
+    setTimeout(async () => {
+      if (!this.started) return;
+      console.log(`[mcp-manager] Restarting ${state.config.name} (attempt ${state.restartCount})...`);
+      try {
+        await this.connectServer(state.config);
+      } catch (e) {
+        console.error(`[mcp-manager] Restart failed: ${e.message}`);
+      }
+    }, delay);
+  }
+  healthCheck() {
+    for (const [_id, state] of Array.from(this.servers)) {
+      if (state.status === "connected" && state.config.type === "stdio") {
+        if (state.process && state.process.exitCode !== null) {
+          console.warn(`[mcp-manager] ${state.config.name} process died (exit ${state.process.exitCode})`);
+          if (state.config.autoRestart !== false) {
+            this.scheduleRestart(state);
+          } else {
+            state.status = "error";
+            state.error = "Process exited";
+          }
+        }
+      }
+    }
+  }
+  killProcess(state) {
+    state.status = "stopped";
+    for (const [_id, pending] of Array.from(state.pendingRpc)) {
+      clearTimeout(pending.timer);
+      pending.reject(new Error("Server stopped"));
+    }
+    state.pendingRpc.clear();
+    if (state.process) {
+      try {
+        state.process.kill("SIGTERM");
+      } catch {
+      }
+      setTimeout(() => {
+        try {
+          state.process?.kill("SIGKILL");
+        } catch {
+        }
+      }, 3e3);
+      state.process = void 0;
+    }
+  }
+  async updateDbStatus(serverId, status, toolCount, tools) {
+    try {
+      await this.db.exec(
+        `UPDATE mcp_servers SET status = $1, tool_count = $2, tools = $3, updated_at = NOW() WHERE id = $4`,
+        [status, toolCount, JSON.stringify(tools.map((t) => ({ name: t.name, description: t.description }))), serverId]
+      );
+    } catch {
+    }
+  }
+};
+export {
+  McpProcessManager
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/enterprise",
-  "version": "0.5.250",
+  "version": "0.5.252",
   "description": "AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations",
   "type": "module",
   "bin": {

package/src/dashboard/pages/skill-connections.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, adminCall } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 import { HelpButton } from '../components/help-button.js';
@@ -60,7 +60,7 @@ function McpServersSection() {
 
   useEffect(function() { load(); }, [load]);
   useEffect(function() {
-    adminCall('/agents').then(function(d) { setAgents((d.agents || d || []).filter(function(a) { return a.status !== 'archived'; })); }).catch(function() {});
+    apiCall('/agents').then(function(d) { setAgents((d.agents || d || []).filter(function(a) { return a.status !== 'archived'; })); }).catch(function() {});
   }, []);
 
   var resetForm = function() {
@@ -416,8 +416,8 @@ function McpServersSection() {
           // Agent assignment
           agents.length > 0 && h('div', { className: 'form-group', style: { marginTop: 16 } },
             h('label', { className: 'form-label', style: { display: 'flex', alignItems: 'center' } }, 'Agent Access', h(HelpButton, { label: 'Agent Access' },
-              h('p', null, 'Choose which agents can use this MCP server\'s tools. If none are selected, ALL agents can use it.'),
-              h('p', { style: { marginTop: 8 } }, 'Use this to restrict sensitive tools (like database access) to specific agents only.')
+              h('p', null, 'Choose which agents can use this MCP server\'s tools. You must select at least one agent — no agent has access until explicitly granted.'),
+              h('p', { style: { marginTop: 8 } }, 'This ensures sensitive tools (like database access) are never accidentally exposed to the wrong agent.')
             )),
             h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 6 } },
               agents.map(function(a) {
@@ -441,8 +441,8 @@ function McpServersSection() {
             ),
             h('div', { style: { fontSize: 11, color: 'var(--text-muted)', marginTop: 4 } },
               form.assignedAgents && form.assignedAgents.length > 0
-                ? form.assignedAgents.length + ' agent(s) selected — only they can use this server'
-                : 'No agents selected — all agents can use this server'
+                ? form.assignedAgents.length + ' agent(s) selected'
+                : 'No agents selected — no agent can use this server yet'
             )
           )
         ),

package/src/engine/mcp-process-manager.ts

@@ -213,10 +213,10 @@ export class McpProcessManager extends EventEmitter {
     for (const [id, state] of Array.from(this.servers)) {
       if (state.status !== 'connected') continue;
 
-      // Check agent assignment
-      if (agentId && state.config.assignedAgents?.length) {
-        if (!state.config.assignedAgents.includes(agentId)) continue;
-      }
+      // Check agent assignment — empty/missing means NO agents have access
+      if (!state.config.assignedAgents?.length) continue;
+      if (agentId && !state.config.assignedAgents.includes(agentId)) continue;
+      if (!agentId) continue; // anonymous callers get nothing
 
       for (const tool of state.tools) {
         tools.push({ ...tool, serverId: id, serverName: state.config.name });
@@ -241,9 +241,8 @@ export class McpProcessManager extends EventEmitter {
     // Find which server owns this tool
     for (const [_id, state] of Array.from(this.servers)) {
       if (state.status !== 'connected') continue;
-      if (agentId && state.config.assignedAgents?.length) {
-        if (!state.config.assignedAgents.includes(agentId)) continue;
-      }
+      if (!state.config.assignedAgents?.length) continue;
+      if (!agentId || !state.config.assignedAgents.includes(agentId)) continue;
 
       const tool = state.tools.find(t => t.name === toolName);
       if (!tool) continue;