@ai-support-agent/cli 0.3.0-beta.1 → 0.3.1-beta.0

package/dist/mcp/config-writer.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TASK_ID_ENV = exports.CONVERSATION_ID_ENV = exports.BROWSER_LOCAL_PORT_ENV = void 0;
+exports.KNOWLEDGE_AGENT_ID_ENV = exports.KNOWLEDGE_COMMAND_ID_ENV = exports.TASK_ID_ENV = exports.CONVERSATION_ID_ENV = exports.BROWSER_LOCAL_PORT_ENV = void 0;
 exports.getMcpConfigPath = getMcpConfigPath;
 exports.buildMcpConfig = buildMcpConfig;
 exports.writeMcpConfig = writeMcpConfig;
@@ -72,6 +72,29 @@ exports.CONVERSATION_ID_ENV = 'AI_SUPPORT_CONVERSATION_ID';
  * 必要がある。
  */
 exports.TASK_ID_ENV = 'AI_SUPPORT_TASK_ID';
+/**
+ * このナレッジ登録依頼の元になったチャットコマンドのID の環境変数名。
+ *
+ * `update_system_knowledge` MCPツールが子プロセス側で
+ * `process.env[KNOWLEDGE_COMMAND_ID_ENV]` として読み取り、ナレッジ登録/改訂API
+ * （`POST /api/:tenantCode/agent/knowledge`）へ `commandId` として渡す。api側はこの
+ * `commandId` を使って `AgentCommandQueueService.getCommand(commandId, agentId, tenantCode)`
+ * によりコマンド生成時に刻印された本物の `knowledgeCanPublish`/`knowledgeRequesterUserId`
+ * を引き当てる（クライアント自己申告の値は信用しない）。LLM/モデルがツール呼び出し引数として
+ * 自由に指定できる値ではないため、ツールのスキーマには含めず、`CONVERSATION_ID_ENV`/
+ * `TASK_ID_ENV` と同じ理由（`StdioClientTransport` が呼び出し元プロセスの任意の環境変数を
+ * MCPサーバー子プロセスへ自動継承しない）により、per-command ファイルの `env` に明示的に
+ * 埋め込む必要がある。値は `writeCommandMcpConfig` の `commandId` 引数（呼び出し元が既に
+ * 持っている値）をそのまま使うため、常に埋め込まれる。
+ */
+exports.KNOWLEDGE_COMMAND_ID_ENV = 'AI_SUPPORT_AGENT_KNOWLEDGE_COMMAND_ID';
+/**
+ * エージェント自身の agentId の環境変数名。`KNOWLEDGE_COMMAND_ID_ENV` と組み合わせて
+ * api側が `AgentCommandQueueService.getCommand(commandId, agentId, tenantCode)` で
+ * コマンドレコードを引き当てるために使う。`KNOWLEDGE_COMMAND_ID_ENV` と同じ理由・同じ経路で
+ * per-command ファイルの `env` に埋め込む必要がある。
+ */
+exports.KNOWLEDGE_AGENT_ID_ENV = 'AI_SUPPORT_AGENT_KNOWLEDGE_AGENT_ID';
 /**
  * MCP 設定ファイルを書き出す
  *
@@ -159,7 +182,7 @@ function sanitizeCommandIdForFilename(commandId) {
  * （claude/codex CLI）の任意の環境変数は自動継承されないため（`CONVERSATION_ID_ENV`
  * の定義コメント参照）。
  */
-function writeCommandMcpConfig(baseConfigPath, commandId, conversationId, taskId) {
+function writeCommandMcpConfig(baseConfigPath, commandId, conversationId, taskId, agentId) {
     const raw = (0, fs_1.readFileSync)(baseConfigPath, 'utf-8');
     const config = JSON.parse(raw);
     const server = config.mcpServers?.['ai-support-agent'];
@@ -168,6 +191,8 @@ function writeCommandMcpConfig(baseConfigPath, commandId, conversationId, taskId
             ...(server.env ?? {}),
             [exports.CONVERSATION_ID_ENV]: conversationId,
             ...(taskId && { [exports.TASK_ID_ENV]: taskId }),
+            [exports.KNOWLEDGE_COMMAND_ID_ENV]: commandId,
+            ...(agentId && { [exports.KNOWLEDGE_AGENT_ID_ENV]: agentId }),
         };
     }
     const dir = (0, path_1.dirname)(baseConfigPath);

package/dist/mcp/config-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/mcp/config-writer.ts"],"names":[],"mappings":";;;AAeA,4CAEC;AAOD,wCAoBC;AA4CD,wCA2DC;AAiDD,sDAiCC;AAgBD,sEA6BC;AAlRD,mCAAmC;AACnC,2BAA0F;AAC1F,+BAAoC;AAEpC,sCAAkC;AAClC,oCAA0C;AAO1C;;GAEG;AACH,SAAgB,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAA,WAAI,EAAC,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,MAAc,EACd,WAAmB,EACnB,aAAqB,EACrB,UAAkB;IAElB,OAAO;QACL,UAAU,EAAE;YACV,kBAAkB,EAAE;gBAClB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,GAAG,EAAE;oBACH,wBAAwB,EAAE,MAAM;oBAChC,sBAAsB,EAAE,2BAA2B;oBACnD,6BAA6B,EAAE,WAAW;oBAC1C,4BAA4B,EAAE,UAAU;iBACzC;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,+BAA+B,CAAA;AAErE;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D;;;;;;;;;GASG;AACU,QAAA,WAAW,GAAG,oBAAoB,CAAA;AAE/C;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,MAAc,EACd,KAAa,EACb,WAAmB,EACnB,aAAqB,EACrB,cAAmC,EACnC,UAAmB,EACnB,gBAAyB;IAEzB,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAA;IAE/B,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhD,iFAAiF;IACjF,MAAM,kBAAkB,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1C,CAAC,CAAC,EAAE,CAAA;IAEJ,wCAAwC;IACxC,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE;YACV,kBAAkB,EAAE;gBAClB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,GAAG,EAAE;oBACH,wBAAwB,EAAE,MAAM;oBAChC,sBAAsB,EAAE,KAAK;oBAC7B,6BAA6B,EAAE,WAAW;oBAC1C,4BAA4B,EAAE,kBAAkB;oBAChD,GAAG,CAAC,gBAAgB,IAAI;wBACtB,CAAC,8BAAsB,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnD,CAAC;iBACH;aACF;YACD,6BAA6B;YAC7B,GAAG,CAAC,cAAc,EAAE,MAAM;gBACxB,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,CAAC,oBAAoB,CAAC;wBAC5B,GAAG,EAAE;4BACH,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM;4BACxC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM;yBAC1C;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAA;IAED,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC;AAYD;;;GAGG;AACH,SAAS,4BAA4B,CAAC,SAAiB;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,qBAAqB,CACnC,cAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,MAAe;IAEf,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,cAAc,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;IAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAA;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,GAAG;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACrB,CAAC,2BAAmB,CAAC,EAAE,cAAc;YACrC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,mBAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACzC,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,cAAc,CAAC,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAA,WAAI,EAC5B,GAAG,EACH,UAAU,4BAA4B,CAAC,SAAS,CAAC,IAAI,IAAA,mBAAU,GAAE,OAAO,CACzE,CAAA;IAED,IAAA,kBAAa,EAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,OAAO;QACjB,2CAA2C;QAC3C,8BAA8B;QAC9B,IAAI,EAAE,IAAI;KACX,CAAC,CAAA;IAEF,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,6BAA6B,CAC3C,cAAsB,EACtB,WAAmB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAEtC,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,cAAc,CAAC,CAAA;IACnC,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QACpE,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAA;YAC/B,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ;gBAAE,SAAQ;YAC3D,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACjC,OAAO,EAAE,CAAA;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sCAAsC;YACtC,mCAAmC;YACnC,eAAM,CAAC,IAAI,CAAC,gEAAgE,IAAI,KAAK,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/mcp/config-writer.ts"],"names":[],"mappings":";;;AAeA,4CAEC;AAOD,wCAoBC;AAqED,wCA2DC;AAiDD,sDAoCC;AAgBD,sEA6BC;AA9SD,mCAAmC;AACnC,2BAA0F;AAC1F,+BAAoC;AAEpC,sCAAkC;AAClC,oCAA0C;AAO1C;;GAEG;AACH,SAAgB,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAA,WAAI,EAAC,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,MAAc,EACd,WAAmB,EACnB,aAAqB,EACrB,UAAkB;IAElB,OAAO;QACL,UAAU,EAAE;YACV,kBAAkB,EAAE;gBAClB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,GAAG,EAAE;oBACH,wBAAwB,EAAE,MAAM;oBAChC,sBAAsB,EAAE,2BAA2B;oBACnD,6BAA6B,EAAE,WAAW;oBAC1C,4BAA4B,EAAE,UAAU;iBACzC;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,+BAA+B,CAAA;AAErE;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D;;;;;;;;;GASG;AACU,QAAA,WAAW,GAAG,oBAAoB,CAAA;AAE/C;;;;;;;;;;;;;;GAcG;AACU,QAAA,wBAAwB,GAAG,uCAAuC,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,qCAAqC,CAAA;AAE3E;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,MAAc,EACd,KAAa,EACb,WAAmB,EACnB,aAAqB,EACrB,cAAmC,EACnC,UAAmB,EACnB,gBAAyB;IAEzB,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAA;IAE/B,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhD,iFAAiF;IACjF,MAAM,kBAAkB,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1C,CAAC,CAAC,EAAE,CAAA;IAEJ,wCAAwC;IACxC,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE;YACV,kBAAkB,EAAE;gBAClB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,GAAG,EAAE;oBACH,wBAAwB,EAAE,MAAM;oBAChC,sBAAsB,EAAE,KAAK;oBAC7B,6BAA6B,EAAE,WAAW;oBAC1C,4BAA4B,EAAE,kBAAkB;oBAChD,GAAG,CAAC,gBAAgB,IAAI;wBACtB,CAAC,8BAAsB,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;qBACnD,CAAC;iBACH;aACF;YACD,6BAA6B;YAC7B,GAAG,CAAC,cAAc,EAAE,MAAM;gBACxB,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,CAAC,oBAAoB,CAAC;wBAC5B,GAAG,EAAE;4BACH,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM;4BACxC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM;yBAC1C;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAA;IAED,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC;AAYD;;;GAGG;AACH,SAAS,4BAA4B,CAAC,SAAiB;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,qBAAqB,CACnC,cAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,MAAe,EACf,OAAgB;IAEhB,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,cAAc,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;IAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAA;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,GAAG;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACrB,CAAC,2BAAmB,CAAC,EAAE,cAAc;YACrC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,mBAAW,CAAC,EAAE,MAAM,EAAE,CAAC;YACxC,CAAC,gCAAwB,CAAC,EAAE,SAAS;YACrC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,8BAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;SACtD,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,cAAc,CAAC,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAA,WAAI,EAC5B,GAAG,EACH,UAAU,4BAA4B,CAAC,SAAS,CAAC,IAAI,IAAA,mBAAU,GAAE,OAAO,CACzE,CAAA;IAED,IAAA,kBAAa,EAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,OAAO;QACjB,2CAA2C;QAC3C,8BAA8B;QAC9B,IAAI,EAAE,IAAI;KACX,CAAC,CAAA;IAEF,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,6BAA6B,CAC3C,cAAsB,EACtB,WAAmB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAEtC,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,cAAc,CAAC,CAAA;IACnC,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QACpE,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAA;YAC/B,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ;gBAAE,SAAQ;YAC3D,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACjC,OAAO,EAAE,CAAA;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sCAAsC;YACtC,mCAAmC;YACnC,eAAM,CAAC,IAAI,CAAC,gEAAgE,IAAI,KAAK,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAIzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAa/E;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAyBnI;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBpD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAIzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAc/E;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CA0BnI;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBpD"}

package/dist/mcp/server.js

@@ -20,6 +20,7 @@ const send_slack_file_1 = require("./tools/send-slack-file");
 const send_slack_message_1 = require("./tools/send-slack-message");
 const trigger_alarm_1 = require("./tools/trigger-alarm");
 const trigger_e2e_test_1 = require("./tools/trigger-e2e-test");
+const update_system_knowledge_1 = require("./tools/update-system-knowledge");
 /**
  * MCP サーバーを作成する
  */
@@ -39,6 +40,7 @@ function createMcpServer(apiClient, projectCode, browserSessionManager) {
     (0, trigger_alarm_1.registerTriggerAlarmTool)(server, apiClient);
     (0, read_slack_thread_1.registerReadSlackThreadTool)(server, apiClient);
     (0, trigger_e2e_test_1.registerTriggerE2eTestTool)(server, apiClient);
+    (0, update_system_knowledge_1.registerUpdateSystemKnowledgeTool)(server, apiClient);
     // browser_navigate/browser_click等とreport_test_stepが同じBrowserSessionManagerを
     // 参照するように、ここで一つだけ生成して両方に渡す（渡さないと、report_test_step が
     // アクティブなセッションを解決できず、常に白紙のスクリーンショットを撮ってしまう）。

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;AAuBA,0CAyBC;AAKD,wCAsBC;AA3ED,oEAAmE;AACnE,wEAAgF;AAEhF,8CAAyC;AACzC,4CAAuC;AACvC,6CAAsD;AACtD,yDAA+D;AAC/D,qFAA+E;AAC/E,qDAA6D;AAC7D,+CAAsD;AACtD,mDAA0D;AAC1D,qDAA4D;AAC5D,uDAA8D;AAC9D,2EAAiF;AACjF,iEAAuE;AACvE,6DAAmE;AACnE,mEAAyE;AACzE,yDAAgE;AAChE,+DAAqE;AAErE;;GAEG;AACH,SAAgB,eAAe,CAAC,SAAoB,EAAE,WAAmB,EAAE,qBAA6C;IACtH,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC;QAC3B,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IAEF,IAAA,8BAAmB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,IAAA,kCAAqB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACxC,IAAA,qCAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1C,IAAA,oCAAsB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,sCAAuB,EAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;IACvD,IAAA,yDAAgC,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACnD,IAAA,iDAA4B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAA,2CAAyB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5C,IAAA,wCAAwB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC3C,IAAA,+CAA2B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9C,IAAA,6CAA0B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC7C,4EAA4E;IAC5E,oDAAoD;IACpD,4CAA4C;IAC5C,MAAM,OAAO,GAAG,qBAAqB,IAAI,IAAI,+CAAqB,EAAE,CAAA;IACpE,MAAM,cAAc,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACvE,IAAA,uCAAuB,EAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAEnE,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,WAAW,CAAC,CAAA;IAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,CAAA;QAClB,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAA;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;AAwBA,0CA0BC;AAKD,wCAsBC;AA7ED,oEAAmE;AACnE,wEAAgF;AAEhF,8CAAyC;AACzC,4CAAuC;AACvC,6CAAsD;AACtD,yDAA+D;AAC/D,qFAA+E;AAC/E,qDAA6D;AAC7D,+CAAsD;AACtD,mDAA0D;AAC1D,qDAA4D;AAC5D,uDAA8D;AAC9D,2EAAiF;AACjF,iEAAuE;AACvE,6DAAmE;AACnE,mEAAyE;AACzE,yDAAgE;AAChE,+DAAqE;AACrE,6EAAmF;AAEnF;;GAEG;AACH,SAAgB,eAAe,CAAC,SAAoB,EAAE,WAAmB,EAAE,qBAA6C;IACtH,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC;QAC3B,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IAEF,IAAA,8BAAmB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,IAAA,kCAAqB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACxC,IAAA,qCAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1C,IAAA,oCAAsB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,sCAAuB,EAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;IACvD,IAAA,yDAAgC,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACnD,IAAA,iDAA4B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAA,2CAAyB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5C,IAAA,wCAAwB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC3C,IAAA,+CAA2B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9C,IAAA,6CAA0B,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAA,2DAAiC,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACpD,4EAA4E;IAC5E,oDAAoD;IACpD,4CAA4C;IAC5C,MAAM,OAAO,GAAG,qBAAqB,IAAI,IAAI,+CAAqB,EAAE,CAAA;IACpE,MAAM,cAAc,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACvE,IAAA,uCAAuB,EAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAEnE,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAQ,CAAC,WAAW,CAAC,CAAA;IAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,CAAA;QAClB,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAA;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/mcp/tools/update-system-knowledge.d.ts

@@ -0,0 +1,29 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ApiClient } from '../../api-client';
+/**
+ * update_system_knowledge ツールを MCP サーバーに登録する
+ *
+ * システムのナレッジベース（api側DB）へ実際に登録・改訂する唯一の手段。ローカルファイルへの
+ * 書き込みはナレッジ登録にはならないため、モデルが「ナレッジに反映して」という依頼をローカル
+ * ファイル書き込みだけで済ませてしまわないよう、description で明示的に誘導する。
+ *
+ * 依頼者の実際の権限（`knowledgeCanPublish`/`knowledgeRequesterUserId`）は、このツールの
+ * 呼び出し元では判定しない。旧設計ではリクエストボディの `canPublishHint` フィールドを
+ * クライアント自己申告のまま信用しており、有効なagentサービストークンさえあればこれを
+ * `true` に指定して承認ワークフローを完全にバイパスできてしまうCRITICALな脆弱性があった。
+ * 現在は `commandId`（このナレッジ登録依頼の元になったチャットコマンドのID）と
+ * `agentId`（エージェント自身のID）だけを渡し、api側で
+ * `AgentCommandQueueService.getCommand(commandId, agentId, tenantCode)` により、コマンド
+ * 生成時に刻印された本物の権限判定結果をサーバー側で引き当てる。省略時・レコード未検出時は
+ * 安全側のdraftになる。`commandId`/`agentId` は
+ * `AI_SUPPORT_AGENT_KNOWLEDGE_COMMAND_ID`/`AI_SUPPORT_AGENT_KNOWLEDGE_AGENT_ID` 環境変数
+ * （config-writer.ts の per-command MCP 設定経由でこの MCP サーバー子プロセスへ明示的に
+ * 渡される）から読み取る。LLM/モデルが自分で決めてよい値ではないため、ツールのスキーマ
+ * （引数）には一切含めない。
+ *
+ * `callId` は呼び出しごとに生成する冪等性キー（`newIdempotencyKey()`。send_slack_message や
+ * trigger_alarm と同じパターン）で、リトライ全体で同じ値を使うことで新規作成時の重複登録を
+ * api側で防ぐ。
+ */
+export declare function registerUpdateSystemKnowledgeTool(server: McpServer, apiClient: ApiClient): void;
+//# sourceMappingURL=update-system-knowledge.d.ts.map

package/dist/mcp/tools/update-system-knowledge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-system-knowledge.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/update-system-knowledge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAI5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAqC/F"}

package/dist/mcp/tools/update-system-knowledge.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerUpdateSystemKnowledgeTool = registerUpdateSystemKnowledgeTool;
+const zod_1 = require("zod");
+const config_writer_1 = require("../config-writer");
+const mcp_response_1 = require("./mcp-response");
+/**
+ * update_system_knowledge ツールを MCP サーバーに登録する
+ *
+ * システムのナレッジベース（api側DB）へ実際に登録・改訂する唯一の手段。ローカルファイルへの
+ * 書き込みはナレッジ登録にはならないため、モデルが「ナレッジに反映して」という依頼をローカル
+ * ファイル書き込みだけで済ませてしまわないよう、description で明示的に誘導する。
+ *
+ * 依頼者の実際の権限（`knowledgeCanPublish`/`knowledgeRequesterUserId`）は、このツールの
+ * 呼び出し元では判定しない。旧設計ではリクエストボディの `canPublishHint` フィールドを
+ * クライアント自己申告のまま信用しており、有効なagentサービストークンさえあればこれを
+ * `true` に指定して承認ワークフローを完全にバイパスできてしまうCRITICALな脆弱性があった。
+ * 現在は `commandId`（このナレッジ登録依頼の元になったチャットコマンドのID）と
+ * `agentId`（エージェント自身のID）だけを渡し、api側で
+ * `AgentCommandQueueService.getCommand(commandId, agentId, tenantCode)` により、コマンド
+ * 生成時に刻印された本物の権限判定結果をサーバー側で引き当てる。省略時・レコード未検出時は
+ * 安全側のdraftになる。`commandId`/`agentId` は
+ * `AI_SUPPORT_AGENT_KNOWLEDGE_COMMAND_ID`/`AI_SUPPORT_AGENT_KNOWLEDGE_AGENT_ID` 環境変数
+ * （config-writer.ts の per-command MCP 設定経由でこの MCP サーバー子プロセスへ明示的に
+ * 渡される）から読み取る。LLM/モデルが自分で決めてよい値ではないため、ツールのスキーマ
+ * （引数）には一切含めない。
+ *
+ * `callId` は呼び出しごとに生成する冪等性キー（`newIdempotencyKey()`。send_slack_message や
+ * trigger_alarm と同じパターン）で、リトライ全体で同じ値を使うことで新規作成時の重複登録を
+ * api側で防ぐ。
+ */
+function registerUpdateSystemKnowledgeTool(server, apiClient) {
+    server.tool('update_system_knowledge', 'Register or revise an entry in the system knowledge base (persisted in the backend database). '
+        + 'You MUST use this tool whenever a user asks you to add or update the knowledge base — '
+        + 'writing to a local file is NOT knowledge base registration and does not satisfy that request. '
+        + 'Pass `id` to revise an existing entry, or omit it to create a new one. '
+        + 'Whether the entry is published immediately or saved as a draft pending approval is determined '
+        + 'server-side based on the requester\'s actual permissions — this tool does not accept a publish flag.', {
+        id: zod_1.z.string().optional().describe('Existing knowledge entry ID to revise. Omit to create a new entry.'),
+        title: zod_1.z.string().describe('Title (1-200 characters)'),
+        content: zod_1.z.string().describe('Content in Markdown'),
+        category: zod_1.z.string().describe('Category (max 50 characters)'),
+        tags: zod_1.z.array(zod_1.z.string()).optional().describe('Tags'),
+        sourceIssue: zod_1.z.string().optional().describe('Related issue reference (max 50 characters)'),
+    }, async (args) => (0, mcp_response_1.withMcpErrorHandling)(async () => {
+        const commandId = process.env[config_writer_1.KNOWLEDGE_COMMAND_ID_ENV] || undefined;
+        const agentId = process.env[config_writer_1.KNOWLEDGE_AGENT_ID_ENV] || undefined;
+        const callId = (0, mcp_response_1.newIdempotencyKey)();
+        const result = await apiClient.updateSystemKnowledge({
+            id: args.id,
+            title: args.title,
+            content: args.content,
+            category: args.category,
+            tags: args.tags,
+            sourceIssue: args.sourceIssue,
+            commandId,
+            agentId,
+            callId,
+        });
+        return (0, mcp_response_1.mcpJsonResponse)(result);
+    }));
+}
+//# sourceMappingURL=update-system-knowledge.js.map

package/dist/mcp/tools/update-system-knowledge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-system-knowledge.js","sourceRoot":"","sources":["../../../src/mcp/tools/update-system-knowledge.ts"],"names":[],"mappings":";;AAgCA,8EAqCC;AApED,6BAAuB;AAGvB,oDAAmF;AACnF,iDAAyF;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,iCAAiC,CAAC,MAAiB,EAAE,SAAoB;IACvF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,gGAAgG;UAC5F,wFAAwF;UACxF,gGAAgG;UAChG,yEAAyE;UACzE,gGAAgG;UAChG,sGAAsG,EAC1G;QACE,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QACxG,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QACtD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC7D,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;KAC3F,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAA,mCAAoB,EAAC,KAAK,IAAI,EAAE;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAwB,CAAC,IAAI,SAAS,CAAA;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsB,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,MAAM,GAAG,IAAA,gCAAiB,GAAE,CAAA;QAElC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC;YACnD,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;YACT,OAAO;YACP,MAAM;SACP,CAAC,CAAA;QAEF,OAAO,IAAA,8BAAe,EAAC,MAAM,CAAC,CAAA;IAChC,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/oneshot-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oneshot-runner.d.ts","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqCH,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAa/E;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFtF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,MAAM,OAAO,CAAC,MAAM,CAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASjG"}
+{"version":3,"file":"oneshot-runner.d.ts","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwCH,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAa/E;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFtF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,MAAM,OAAO,CAAC,MAAM,CAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASjG"}

package/dist/oneshot-runner.js

@@ -21,8 +21,10 @@ const logger_1 = require("./logger");
 const types_1 = require("./types");
 const utils_1 = require("./utils");
 /**
- * Command types the ECS oneshot runner is allowed to execute (Phase 1).
- * The API only dispatches `execute_command` to ECS execution agents, but the
+ * Command types the ECS oneshot runner is allowed to execute (Phase 1:
+ * `execute_command`; Phase 3: `server_setup_exec` for the ECS dispatch mode
+ * of the server setup feature — see admin-docs `docs/features/server-setup.md`).
+ * The API only dispatches these types to ECS execution agents, but the
  * runner enforces the same allowlist defensively: a mis-dispatched `chat` /
  * `e2e_test` / `file_*` would otherwise run with a near-empty execution
  * context (no projectDir/mcpConfigPath/serverConfig/browser callbacks) and
@@ -30,6 +32,7 @@ const utils_1 = require("./utils");
  */
 const ONESHOT_SUPPORTED_COMMAND_TYPES = new Set([
     'execute_command',
+    'server_setup_exec',
 ]);
 /**
  * Working directory for `execute_command` in the container. The ECS image

package/dist/oneshot-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"oneshot-runner.js","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAkDH,wCAaC;AAMD,gCAkFC;AAQD,8CASC;AAtKD,6CAAwC;AACxC,yCAA2C;AAC3C,2CAA8C;AAC9C,qCAAiC;AACjC,mCAAmG;AACnG,mCAAyC;AAEzC;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAkC,IAAI,GAAG,CAAmB;IAC/F,iBAAiB;CAClB,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAExC,MAAM,iBAAiB,GAAG;IACxB,4BAAgB,CAAC,UAAU;IAC3B,4BAAgB,CAAC,QAAQ;IACzB,4BAAgB,CAAC,WAAW;IAC5B,4BAAgB,CAAC,YAAY;IAC7B,4BAAgB,CAAC,YAAY;IAC7B,4BAAgB,CAAC,mBAAmB;CAC5B,CAAA;AAWV;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,4BAAgB,CAAC,UAAU,CAAW;QACrD,OAAO,EAAE,GAAG,CAAC,4BAAgB,CAAC,QAAQ,CAAW;QACjD,UAAU,EAAE,GAAG,CAAC,4BAAgB,CAAC,WAAW,CAAW;QACvD,WAAW,EAAE,GAAG,CAAC,4BAAgB,CAAC,YAAY,CAAW;QACzD,UAAU,EAAE,GAAG,CAAC,4BAAgB,CAAC,YAAY,CAAW;QACxD,KAAK,EAAE,GAAG,CAAC,4BAAgB,CAAC,mBAAmB,CAAW;KAC3D,CAAA;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,UAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,aAAa,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IAC9E,eAAM,CAAC,IAAI,CAAC,mDAAmD,SAAS,YAAY,OAAO,EAAE,CAAC,CAAA;IAE9F,IAAI,MAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,sBAAS,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,8CAA8C,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpF,OAAO,CAAC,CAAA;IACV,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IAElC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAqB,EAAoB,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACrD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,sCAAsC,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC5E,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,OAAqB,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,2BAA2B,SAAS,KAAK,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAA;QACjF,eAAM,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAA;QACpC,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,MAAM,CAAC,IAAA,mBAAW,EAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,CAAC,GAAG,+BAA+B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjE,MAAM,OAAO,GAAG,iBAAiB,OAAO,CAAC,IAAI,sDAAsD,SAAS,GAAG,CAAA;QAC/G,eAAM,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAA;QACpC,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,MAAM,CAAC,IAAA,mBAAW,EAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IACtC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QAC5E,OAAO,CAAC,GAAG,GAAG,mBAAmB,CAAA;IACnC,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE;QACzD,SAAS;QACT,MAAM;QACN,OAAO;QACP,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAA;IAExB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,eAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACpE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,eAAM,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAA;IACjE,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CAAC,SAAgC,UAAU;IAChF,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,0BAA0B,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChE,QAAQ,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACxB,CAAC"}
+{"version":3,"file":"oneshot-runner.js","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAqDH,wCAaC;AAMD,gCAkFC;AAQD,8CASC;AAzKD,6CAAwC;AACxC,yCAA2C;AAC3C,2CAA8C;AAC9C,qCAAiC;AACjC,mCAAmG;AACnG,mCAAyC;AAEzC;;;;;;;;;GASG;AACH,MAAM,+BAA+B,GAAkC,IAAI,GAAG,CAAmB;IAC/F,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAExC,MAAM,iBAAiB,GAAG;IACxB,4BAAgB,CAAC,UAAU;IAC3B,4BAAgB,CAAC,QAAQ;IACzB,4BAAgB,CAAC,WAAW;IAC5B,4BAAgB,CAAC,YAAY;IAC7B,4BAAgB,CAAC,YAAY;IAC7B,4BAAgB,CAAC,mBAAmB;CAC5B,CAAA;AAWV;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,4BAAgB,CAAC,UAAU,CAAW;QACrD,OAAO,EAAE,GAAG,CAAC,4BAAgB,CAAC,QAAQ,CAAW;QACjD,UAAU,EAAE,GAAG,CAAC,4BAAgB,CAAC,WAAW,CAAW;QACvD,WAAW,EAAE,GAAG,CAAC,4BAAgB,CAAC,YAAY,CAAW;QACzD,UAAU,EAAE,GAAG,CAAC,4BAAgB,CAAC,YAAY,CAAW;QACxD,KAAK,EAAE,GAAG,CAAC,4BAAgB,CAAC,mBAAmB,CAAW;KAC3D,CAAA;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,UAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,aAAa,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IAC9E,eAAM,CAAC,IAAI,CAAC,mDAAmD,SAAS,YAAY,OAAO,EAAE,CAAC,CAAA;IAE9F,IAAI,MAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,sBAAS,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,8CAA8C,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpF,OAAO,CAAC,CAAA;IACV,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IAElC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAqB,EAAoB,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACrD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,sCAAsC,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC5E,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,OAAqB,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,2BAA2B,SAAS,KAAK,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAA;QACjF,eAAM,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAA;QACpC,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,MAAM,CAAC,IAAA,mBAAW,EAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,CAAC,GAAG,+BAA+B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjE,MAAM,OAAO,GAAG,iBAAiB,OAAO,CAAC,IAAI,sDAAsD,SAAS,GAAG,CAAA;QAC/G,eAAM,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAA;QACpC,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,MAAM,CAAC,IAAA,mBAAW,EAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IACtC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QAC5E,OAAO,CAAC,GAAG,GAAG,mBAAmB,CAAA;IACnC,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE;QACzD,SAAS;QACT,MAAM;QACN,OAAO;QACP,UAAU;KACX,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAA;IAExB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,eAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACpE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,eAAM,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAA;IACjE,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CAAC,SAAgC,UAAU;IAChF,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,0BAA0B,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChE,QAAQ,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACxB,CAAC"}

package/dist/server-setup/known-hosts-store.d.ts

@@ -0,0 +1,16 @@
+/** Directory (under the persistent config dir) holding one known_hosts file per (tenantCode, sshHostId) pair. */
+export declare function knownHostsDir(): string;
+/**
+ * Resolve (and ensure exists) the persistent known_hosts file path for a
+ * given tenant/host pair.
+ *
+ * Creates an empty file (mode 0600 — not secret, but kept restrictive like
+ * the rest of this directory's contents) the first time a given tenant/host
+ * pair is seen; that first run is TOFU's legitimate "trust on first use".
+ * Every subsequent run against the same host reuses (and lets `ssh` append
+ * to) the same file, so a later host-key change is detected — via ssh's own
+ * `StrictHostKeyChecking=accept-new` behavior — rather than silently
+ * accepted.
+ */
+export declare function resolveKnownHostsPath(tenantCode: string, sshHostId: string): string;
+//# sourceMappingURL=known-hosts-store.d.ts.map

package/dist/server-setup/known-hosts-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-hosts-store.d.ts","sourceRoot":"","sources":["../../src/server-setup/known-hosts-store.ts"],"names":[],"mappings":"AA2BA,iHAAiH;AACjH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAUnF"}

package/dist/server-setup/known-hosts-store.js

@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.knownHostsDir = knownHostsDir;
+exports.resolveKnownHostsPath = resolveKnownHostsPath;
+/**
+ * Persistent, per-SSH-host known_hosts file for `server_setup_exec`'s TOFU
+ * (Trust On First Use) host key checking.
+ *
+ * Unlike the SSH private key (fetched Just-In-Time and always removed with
+ * the rest of the per-run temp directory — see `server-setup-runner.ts`), a
+ * known_hosts entry is NOT secret: it only records the target host's public
+ * key fingerprint. Volatilizing it alongside the private key on every run
+ * defeats TOFU's entire purpose: `StrictHostKeyChecking=accept-new` only
+ * rejects a *changed* host key on a *later* connection if there is a
+ * *previously recorded* one to compare against. Starting from an empty file
+ * on every run means every run looks like a "first use", so a later
+ * DNS/route hijack presenting a different host key is silently accepted
+ * instead of rejected.
+ *
+ * This file is stored under the agent CLI's persistent config directory
+ * (`getConfigDir()`, e.g. `~/.ai-support-agent`), namespaced by tenantCode
+ * and sshHostId so distinct tenants/hosts never share (or clobber) each
+ * other's recorded host keys, and reused across every run against the same
+ * host.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_manager_1 = require("../config-manager");
+const utils_1 = require("../utils");
+/** Directory (under the persistent config dir) holding one known_hosts file per (tenantCode, sshHostId) pair. */
+function knownHostsDir() {
+    return path.join((0, config_manager_1.getConfigDir)(), 'server-setup', 'known-hosts');
+}
+/**
+ * Resolve (and ensure exists) the persistent known_hosts file path for a
+ * given tenant/host pair.
+ *
+ * Creates an empty file (mode 0600 — not secret, but kept restrictive like
+ * the rest of this directory's contents) the first time a given tenant/host
+ * pair is seen; that first run is TOFU's legitimate "trust on first use".
+ * Every subsequent run against the same host reuses (and lets `ssh` append
+ * to) the same file, so a later host-key change is detected — via ssh's own
+ * `StrictHostKeyChecking=accept-new` behavior — rather than silently
+ * accepted.
+ */
+function resolveKnownHostsPath(tenantCode, sshHostId) {
+    const dir = knownHostsDir();
+    (0, utils_1.ensureDir)(dir, 0o700);
+    const fileName = `${(0, utils_1.sanitizeNameSegment)(tenantCode)}__${(0, utils_1.sanitizeNameSegment)(sshHostId)}`;
+    const filePath = path.join(dir, fileName);
+    if (!fs.existsSync(filePath)) {
+        fs.writeFileSync(filePath, '', { mode: 0o600 });
+    }
+    return filePath;
+}
+//# sourceMappingURL=known-hosts-store.js.map

package/dist/server-setup/known-hosts-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-hosts-store.js","sourceRoot":"","sources":["../../src/server-setup/known-hosts-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,sCAEC;AAcD,sDAUC;AAtDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uCAAwB;AACxB,2CAA4B;AAE5B,sDAAgD;AAChD,oCAAyD;AAEzD,iHAAiH;AACjH,SAAgB,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,6BAAY,GAAE,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,qBAAqB,CAAC,UAAkB,EAAE,SAAiB;IACzE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAA,iBAAS,EAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAErB,MAAM,QAAQ,GAAG,GAAG,IAAA,2BAAmB,EAAC,UAAU,CAAC,KAAK,IAAA,2BAAmB,EAAC,SAAS,CAAC,EAAE,CAAA;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/server-setup/server-setup-runner.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Runner for the `server_setup_exec` command.
+ *
+ * Fetches the target host's SSH private key Just-In-Time from the API,
+ * writes it to a process-local temp directory, runs the bundled Ansible
+ * playbook (`ansible/playbook.yml`) against it, and — critically — always
+ * removes the temp directory (private key included) afterwards, whether the
+ * run succeeded or failed. See admin-docs `docs/features/server-setup.md`
+ * ("秘密鍵の受け渡し設計") for the full design and its security rationale.
+ *
+ * SECURITY: the SSH private key must never be logged, and the temp
+ * directory holding it must never survive past this function's execution.
+ */
+import { type CommandResult, type ServerSetupExecPayload } from '../types';
+import type { ApiClient } from '../api-client';
+export interface RunServerSetupContext {
+    commandId: string;
+    client: ApiClient;
+    agentId?: string;
+}
+/**
+ * Execute a `server_setup_exec` command: fetch the SSH credential, run the
+ * bundled playbook, and report per-step results. The temp directory holding
+ * the private key is always removed, on every exit path.
+ */
+export declare function runServerSetup(payload: ServerSetupExecPayload, ctx: RunServerSetupContext): Promise<CommandResult>;
+//# sourceMappingURL=server-setup-runner.d.ts.map

package/dist/server-setup/server-setup-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-setup-runner.d.ts","sourceRoot":"","sources":["../../src/server-setup/server-setup-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,EAAE,KAAK,aAAa,EAAe,KAAK,sBAAsB,EAAwF,MAAM,UAAU,CAAA;AAK7K,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAoH9C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AA8VD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,sBAAsB,EAC/B,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CAkKxB"}