@aitne/daemon 0.1.0

package/dist/services/mcp/generators/claude.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { buildEnvFromServers, scopedEnvVarName, serversForBackend, } from "./types.js";
+/**
+ * B-003 Phase 2 — Claude MCP config generator (.mcp.json).
+ *
+ * Claude Code / Agent SDK discovers MCP servers from `<workdir>/.mcp.json`.
+ * The SDK also accepts the same shape as the `mcpServers` option to `query()`.
+ *
+ * Spec reference: https://docs.claude.com/en/docs/claude-code/mcp.json
+ * — last reviewed 2026-04-18.
+ *
+ * Secrets are NOT inlined in the file. We emit `${MCP_<ID>_<KEY>}`
+ * placeholders and carry the value in the spawned-process env; Claude's
+ * config-file loader expands `${VAR}` references from that env at read time.
+ */
+export const SPEC_VERSION = "claude-2026-04-18";
+const StdioServerSchema = z.object({
+    type: z.literal("stdio"),
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
+});
+const HttpServerSchema = z.object({
+    type: z.literal("http"),
+    url: z.string().url(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+const SseServerSchema = z.object({
+    type: z.literal("sse"),
+    url: z.string().url(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+const McpJsonSchema = z.object({
+    mcpServers: z.record(z.string(), z.union([StdioServerSchema, HttpServerSchema, SseServerSchema])),
+});
+function envRefs(server) {
+    const out = {};
+    for (const key of server.envKeys) {
+        out[key] = `\${${scopedEnvVarName(server.id, key)}}`;
+    }
+    return out;
+}
+function headerRefs(server) {
+    const out = {};
+    for (const key of server.headerKeys) {
+        out[key] = `\${${scopedEnvVarName(server.id, key)}}`;
+    }
+    return out;
+}
+function allKeys(server) {
+    return [...server.envKeys, ...server.headerKeys];
+}
+export function generateClaudeConfig(allServers, options) {
+    const servers = serversForBackend(allServers, "claude");
+    const mcpServers = {};
+    for (const server of servers) {
+        if (server.transport === "stdio") {
+            if (!server.command)
+                continue;
+            const env = envRefs(server);
+            mcpServers[server.id] = {
+                type: "stdio",
+                command: server.command,
+                ...(server.args && server.args.length > 0 ? { args: server.args } : {}),
+                ...(Object.keys(env).length > 0 ? { env } : {}),
+                ...(server.cwd ? { cwd: server.cwd } : {}),
+            };
+            continue;
+        }
+        if (server.transport === "http" || server.transport === "sse") {
+            if (!server.url)
+                continue;
+            const headers = headerRefs(server);
+            mcpServers[server.id] = {
+                type: server.transport,
+                url: server.url,
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+        }
+    }
+    const body = { mcpServers };
+    McpJsonSchema.parse(body);
+    return {
+        path: ".mcp.json",
+        contents: `${JSON.stringify(body, null, 2)}\n`,
+        env: buildEnvFromServers(servers, options, allKeys),
+    };
+}
+//# sourceMappingURL=claude.js.map

package/dist/services/mcp/generators/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../../src/services/mcp/generators/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEhD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,CAClB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAChE;CACF,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,MAAiB;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,MAAiB;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,UAAgC,EAChC,OAAyB;IAEzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACtB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACtB,IAAI,EAAE,MAAM,CAAC,SAAS;gBACtB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;IAC5B,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE1B,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC9C,GAAG,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/services/mcp/generators/codex.d.ts

@@ -0,0 +1,22 @@
+import type { McpServer } from "../types.js";
+import { type GeneratedMcpConfig, type GeneratorOptions } from "./types.js";
+/**
+ * B-003 Phase 2 — Codex MCP config generator (.codex/config.toml).
+ *
+ * Codex uses TOML and has no explicit `type` field — the transport is
+ * inferred from which keys are present (`command` = stdio, `url` = http).
+ * HTTP transport currently requires `features.experimental_use_rmcp_client`
+ * to be set globally.
+ *
+ * For bearer-auth over HTTP, Codex expects the token to come from an
+ * environment variable referenced by `bearer_token_env_var`. For stdio env
+ * passthrough, Codex reads `env = { KEY = "value" }` directly — there is
+ * no `${VAR}` expansion like Claude has, so we inline the concrete value
+ * we receive from the blob store.
+ *
+ * Spec reference: Codex CLI docs, `mcp_servers` + `features.experimental_use_rmcp_client`
+ * — last reviewed 2026-04-18.
+ */
+export declare const SPEC_VERSION = "codex-2026-04-18";
+export declare function generateCodexConfig(allServers: readonly McpServer[], options: GeneratorOptions): GeneratedMcpConfig;
+//# sourceMappingURL=codex.d.ts.map

package/dist/services/mcp/generators/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/generators/codex.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAkB/C,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,EAAE,gBAAgB,GACxB,kBAAkB,CAyEpB"}

package/dist/services/mcp/generators/codex.js

@@ -0,0 +1,102 @@
+import { z } from "zod";
+import { stringify as stringifyToml } from "@iarna/toml";
+import { buildEnvFromServers, scopedEnvVarName, serversForBackend, } from "./types.js";
+/**
+ * B-003 Phase 2 — Codex MCP config generator (.codex/config.toml).
+ *
+ * Codex uses TOML and has no explicit `type` field — the transport is
+ * inferred from which keys are present (`command` = stdio, `url` = http).
+ * HTTP transport currently requires `features.experimental_use_rmcp_client`
+ * to be set globally.
+ *
+ * For bearer-auth over HTTP, Codex expects the token to come from an
+ * environment variable referenced by `bearer_token_env_var`. For stdio env
+ * passthrough, Codex reads `env = { KEY = "value" }` directly — there is
+ * no `${VAR}` expansion like Claude has, so we inline the concrete value
+ * we receive from the blob store.
+ *
+ * Spec reference: Codex CLI docs, `mcp_servers` + `features.experimental_use_rmcp_client`
+ * — last reviewed 2026-04-18.
+ */
+export const SPEC_VERSION = "codex-2026-04-18";
+const StdioServerSchema = z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
+});
+const HttpServerSchema = z.object({
+    url: z.string().url(),
+    bearer_token_env_var: z.string().min(1).optional(),
+});
+// Codex's schema is "one-of stdio | http" but TOML can't express unions;
+// we validate each entry individually.
+const CodexEntrySchema = z.union([StdioServerSchema, HttpServerSchema]);
+export function generateCodexConfig(allServers, options) {
+    const servers = serversForBackend(allServers, "codex");
+    const body = {};
+    const mcpServers = {};
+    let needsRmcp = false;
+    for (const server of servers) {
+        if (server.transport === "stdio") {
+            if (!server.command)
+                continue;
+            const env = {};
+            // Codex has no placeholder expansion — inline concrete values. We
+            // pull them from `options.secrets` (already namespaced as
+            // `<serverId>:<keyName>`) and surface them to Codex under the
+            // caller-visible key name.
+            for (const key of server.envKeys) {
+                const raw = options.secrets[`${server.id}:${key}`];
+                if (raw !== undefined)
+                    env[key] = raw;
+            }
+            const entry = {
+                command: server.command,
+                ...(server.args && server.args.length > 0 ? { args: [...server.args] } : {}),
+                ...(Object.keys(env).length > 0 ? { env } : {}),
+                ...(server.cwd ? { cwd: server.cwd } : {}),
+            };
+            CodexEntrySchema.parse(entry);
+            mcpServers[server.id] = entry;
+            continue;
+        }
+        if (server.transport === "http" || server.transport === "sse") {
+            // Codex only supports streamable HTTP for remote MCPs; SSE falls into
+            // the same config shape since the rmcp client negotiates transport.
+            if (!server.url)
+                continue;
+            needsRmcp = true;
+            // Pick a single header to drive `bearer_token_env_var` — by convention,
+            // we key off a header literally named "Authorization". Multi-header
+            // support isn't in Codex's schema yet; if the user declares more than
+            // one, we emit only the bearer env ref and let the probe flag it.
+            const bearerKey = server.headerKeys.find((k) => k.toLowerCase() === "authorization");
+            const entry = {
+                url: server.url,
+                ...(bearerKey
+                    ? { bearer_token_env_var: scopedEnvVarName(server.id, bearerKey) }
+                    : {}),
+            };
+            CodexEntrySchema.parse(entry);
+            mcpServers[server.id] = entry;
+        }
+    }
+    if (needsRmcp) {
+        body.features = { experimental_use_rmcp_client: true };
+    }
+    if (Object.keys(mcpServers).length > 0) {
+        body.mcp_servers = mcpServers;
+    }
+    // For http/sse, the bearer token still flows via child-process env —
+    // bearer_token_env_var points Codex at the scoped env name. For stdio,
+    // Codex uses the inlined env block so this env record stays empty for
+    // stdio-only mixes.
+    const env = buildEnvFromServers(servers, options, (server) => server.transport === "stdio" ? [] : server.headerKeys);
+    return {
+        path: ".codex/config.toml",
+        contents: stringifyToml(body),
+        env,
+    };
+}
+//# sourceMappingURL=codex.js.map

package/dist/services/mcp/generators/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../../src/services/mcp/generators/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,yEAAyE;AACzE,uCAAuC;AACvC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAExE,MAAM,UAAU,mBAAmB,CACjC,UAAgC,EAChC,OAAyB;IAEzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEvD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,kEAAkE;YAClE,0DAA0D;YAC1D,8DAA8D;YAC9D,2BAA2B;YAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACnD,IAAI,GAAG,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACxC,CAAC;YACD,MAAM,KAAK,GAA4B;gBACrC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC;YACF,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC9D,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAC3C,CAAC;YACF,MAAM,KAAK,GAA4B;gBACrC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,GAAG,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3D,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACtD,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,aAAa,CAAC,IAA2C,CAAC;QACpE,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/services/mcp/generators/gemini.d.ts

@@ -0,0 +1,20 @@
+import type { McpServer } from "../types.js";
+import { type GeneratedMcpConfig, type GeneratorOptions } from "./types.js";
+/**
+ * B-003 Phase 2 — Gemini MCP config generator (.gemini/settings.json).
+ *
+ * Gemini CLI discovers MCP servers from `<workdir>/.gemini/settings.json`
+ * under the top-level `mcpServers` key. Transport is keyed off which of
+ * `httpUrl` / `url` / `command` is set (precedence: `httpUrl` > `url` >
+ * `command`).
+ *
+ * Env expansion uses **`$VAR`** (no braces). Gemini also does NOT read
+ * project `.env`, so we must carry every referenced var through the
+ * spawned-process env ourselves.
+ *
+ * Spec reference: Gemini CLI docs, `settings.json#mcpServers`
+ * — last reviewed 2026-04-18.
+ */
+export declare const SPEC_VERSION = "gemini-2026-04-18";
+export declare function generateGeminiConfig(allServers: readonly McpServer[], options: GeneratorOptions): GeneratedMcpConfig;
+//# sourceMappingURL=gemini.d.ts.map

package/dist/services/mcp/generators/gemini.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/generators/gemini.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AA8ChD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,EAAE,gBAAgB,GACxB,kBAAkB,CA2CpB"}

package/dist/services/mcp/generators/gemini.js

@@ -0,0 +1,97 @@
+import { z } from "zod";
+import { buildEnvFromServers, scopedEnvVarName, serversForBackend, } from "./types.js";
+/**
+ * B-003 Phase 2 — Gemini MCP config generator (.gemini/settings.json).
+ *
+ * Gemini CLI discovers MCP servers from `<workdir>/.gemini/settings.json`
+ * under the top-level `mcpServers` key. Transport is keyed off which of
+ * `httpUrl` / `url` / `command` is set (precedence: `httpUrl` > `url` >
+ * `command`).
+ *
+ * Env expansion uses **`$VAR`** (no braces). Gemini also does NOT read
+ * project `.env`, so we must carry every referenced var through the
+ * spawned-process env ourselves.
+ *
+ * Spec reference: Gemini CLI docs, `settings.json#mcpServers`
+ * — last reviewed 2026-04-18.
+ */
+export const SPEC_VERSION = "gemini-2026-04-18";
+const HttpServerSchema = z.object({
+    httpUrl: z.string().url(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+const SseServerSchema = z.object({
+    url: z.string().url(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+const StdioServerSchema = z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
+});
+const GeminiSettingsSchema = z.object({
+    mcpServers: z.record(z.string(), z.union([HttpServerSchema, SseServerSchema, StdioServerSchema])),
+});
+function envRefs(server) {
+    const out = {};
+    for (const key of server.envKeys) {
+        out[key] = `$${scopedEnvVarName(server.id, key)}`;
+    }
+    return out;
+}
+function headerRefs(server) {
+    const out = {};
+    for (const key of server.headerKeys) {
+        out[key] = `$${scopedEnvVarName(server.id, key)}`;
+    }
+    return out;
+}
+function allKeys(server) {
+    return [...server.envKeys, ...server.headerKeys];
+}
+export function generateGeminiConfig(allServers, options) {
+    const servers = serversForBackend(allServers, "gemini");
+    const mcpServers = {};
+    for (const server of servers) {
+        if (server.transport === "http") {
+            if (!server.url)
+                continue;
+            const headers = headerRefs(server);
+            mcpServers[server.id] = {
+                httpUrl: server.url,
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            continue;
+        }
+        if (server.transport === "sse") {
+            if (!server.url)
+                continue;
+            const headers = headerRefs(server);
+            mcpServers[server.id] = {
+                url: server.url,
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            continue;
+        }
+        if (server.transport === "stdio") {
+            if (!server.command)
+                continue;
+            const env = envRefs(server);
+            mcpServers[server.id] = {
+                command: server.command,
+                ...(server.args && server.args.length > 0 ? { args: server.args } : {}),
+                ...(Object.keys(env).length > 0 ? { env } : {}),
+                ...(server.cwd ? { cwd: server.cwd } : {}),
+            };
+        }
+    }
+    const body = { mcpServers };
+    GeminiSettingsSchema.parse(body);
+    return {
+        path: ".gemini/settings.json",
+        contents: `${JSON.stringify(body, null, 2)}\n`,
+        env: buildEnvFromServers(servers, options, allKeys),
+    };
+}
+//# sourceMappingURL=gemini.js.map

package/dist/services/mcp/generators/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../../src/services/mcp/generators/gemini.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEhD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAClB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAChE;CACF,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,MAAiB;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,MAAiB;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,UAAgC,EAChC,OAAyB;IAEzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACtB,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACtB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;IAC5B,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC9C,GAAG,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/services/mcp/generators/index.d.ts

@@ -0,0 +1,20 @@
+import type { BackendId } from "@aitne/shared";
+import type { McpServer } from "../types.js";
+import { generateClaudeConfig } from "./claude.js";
+import { generateCodexConfig } from "./codex.js";
+import { generateGeminiConfig } from "./gemini.js";
+import type { GeneratedMcpConfig, GeneratorOptions } from "./types.js";
+export { generateClaudeConfig, generateCodexConfig, generateGeminiConfig };
+export type { GeneratedMcpConfig, GeneratorOptions };
+/** Spec versions for each backend generator — bumped when the upstream
+ *  config shape changes. Surface in `/api/mcp/servers` responses so the
+ *  dashboard can warn about incompatibility.
+ */
+export declare const GENERATOR_SPEC_VERSIONS: {
+    readonly claude: "claude-2026-04-18";
+    readonly codex: "codex-2026-04-18";
+    readonly gemini: "gemini-2026-04-18";
+};
+/** Dispatch to the generator for the given backend. */
+export declare function generateMcpConfig(backend: BackendId, servers: readonly McpServer[], options: GeneratorOptions): GeneratedMcpConfig;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/mcp/generators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/generators/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,oBAAoB,EAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EAEpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EAErB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,EAClB,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,EAAE,gBAAgB,GACxB,kBAAkB,CAapB"}

package/dist/services/mcp/generators/index.js

@@ -0,0 +1,29 @@
+import { generateClaudeConfig, SPEC_VERSION as CLAUDE_SPEC_VERSION, } from "./claude.js";
+import { generateCodexConfig, SPEC_VERSION as CODEX_SPEC_VERSION, } from "./codex.js";
+import { generateGeminiConfig, SPEC_VERSION as GEMINI_SPEC_VERSION, } from "./gemini.js";
+export { generateClaudeConfig, generateCodexConfig, generateGeminiConfig };
+/** Spec versions for each backend generator — bumped when the upstream
+ *  config shape changes. Surface in `/api/mcp/servers` responses so the
+ *  dashboard can warn about incompatibility.
+ */
+export const GENERATOR_SPEC_VERSIONS = {
+    claude: CLAUDE_SPEC_VERSION,
+    codex: CODEX_SPEC_VERSION,
+    gemini: GEMINI_SPEC_VERSION,
+};
+/** Dispatch to the generator for the given backend. */
+export function generateMcpConfig(backend, servers, options) {
+    switch (backend) {
+        case "claude":
+            return generateClaudeConfig(servers, options);
+        case "codex":
+            return generateCodexConfig(servers, options);
+        case "gemini":
+            return generateGeminiConfig(servers, options);
+        default: {
+            const never = backend;
+            throw new Error(`Unsupported backend for MCP generation: ${String(never)}`);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/services/mcp/generators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/services/mcp/generators/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EACpB,YAAY,IAAI,mBAAmB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,YAAY,IAAI,kBAAkB,GACnC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,YAAY,IAAI,mBAAmB,GACpC,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;AAG3E;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,kBAAkB;IACzB,MAAM,EAAE,mBAAmB;CACnB,CAAC;AAEX,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAC/B,OAAkB,EAClB,OAA6B,EAC7B,OAAyB;IAEzB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,OAAO;YACV,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAU,OAAO,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/services/mcp/generators/types.d.ts

@@ -0,0 +1,47 @@
+import type { BackendId } from "@aitne/shared";
+import type { McpServer } from "../types.js";
+/**
+ * B-003 Phase 2 — MCP config generators.
+ *
+ * Each backend has its own config file format. A generator takes the list of
+ * *enabled* servers targeting that backend and returns:
+ *   - `path`: the relative path (inside the session workdir) to write.
+ *   - `contents`: the serialized file.
+ *   - `env`: the env vars the spawned backend process must export. Per open
+ *     question #1 in the design doc, secrets are NOT written into the config
+ *     file — they are exported into the child process env and the config
+ *     file references them as placeholders (`${VAR}`, `$VAR`, or Codex's
+ *     `bearer_token_env_var`).
+ *
+ * Generators are pure functions: `(servers, options) → GeneratedMcpConfig`.
+ */
+export interface GeneratedMcpConfig {
+    path: string;
+    contents: string;
+    env: Record<string, string>;
+}
+export interface GeneratorOptions {
+    /**
+     * Secret values already resolved by the caller (via `resolveMcpSecrets`),
+     * keyed by `<serverId>:<keyName>` so multiple servers can coexist without
+     * env-var name collisions. The generator picks the subset it needs.
+     */
+    secrets: Record<string, string>;
+}
+/**
+ * Scope every secret variable with the server id so two servers that both
+ * declare `TOKEN` can't clobber each other in the spawned process env.
+ * Claude's generator sends `${TOKEN_FOR_<server>}` to the SDK, Codex's
+ * generator points `bearer_token_env_var` at the same scoped name, etc.
+ */
+export declare function scopedEnvVarName(serverId: string, keyName: string): string;
+/**
+ * Collect the `env` record for `servers`, routing each declared env/header
+ * key through `scopedEnvVarName`. Missing secrets are skipped silently —
+ * the generator still emits the placeholder so the user can see what is
+ * expected, and the run fails at the backend level if the var is truly
+ * required.
+ */
+export declare function buildEnvFromServers(servers: readonly McpServer[], options: GeneratorOptions, keySelector: (server: McpServer) => readonly string[]): Record<string, string>;
+export declare function serversForBackend(servers: readonly McpServer[], backend: BackendId): McpServer[];
+//# sourceMappingURL=types.d.ts.map

package/dist/services/mcp/generators/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/generators/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU1E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,MAAM,EAAE,GACpD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUxB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,EAAE,SAAS,GACjB,SAAS,EAAE,CAIb"}

package/dist/services/mcp/generators/types.js

@@ -0,0 +1,40 @@
+/**
+ * Scope every secret variable with the server id so two servers that both
+ * declare `TOKEN` can't clobber each other in the spawned process env.
+ * Claude's generator sends `${TOKEN_FOR_<server>}` to the SDK, Codex's
+ * generator points `bearer_token_env_var` at the same scoped name, etc.
+ */
+export function scopedEnvVarName(serverId, keyName) {
+    const clean = keyName
+        .toUpperCase()
+        .replace(/[^A-Z0-9_]/g, "_")
+        .replace(/^_+|_+$/g, "");
+    const idPart = serverId
+        .toUpperCase()
+        .replace(/[^A-Z0-9_]/g, "_")
+        .replace(/^_+|_+$/g, "");
+    return `MCP_${idPart}_${clean}`;
+}
+/**
+ * Collect the `env` record for `servers`, routing each declared env/header
+ * key through `scopedEnvVarName`. Missing secrets are skipped silently —
+ * the generator still emits the placeholder so the user can see what is
+ * expected, and the run fails at the backend level if the var is truly
+ * required.
+ */
+export function buildEnvFromServers(servers, options, keySelector) {
+    const env = {};
+    for (const server of servers) {
+        for (const keyName of keySelector(server)) {
+            const raw = options.secrets[`${server.id}:${keyName}`];
+            if (raw === undefined)
+                continue;
+            env[scopedEnvVarName(server.id, keyName)] = raw;
+        }
+    }
+    return env;
+}
+export function serversForBackend(servers, backend) {
+    return servers.filter((s) => s.enabled && s.backends.includes(backend));
+}
+//# sourceMappingURL=types.js.map

package/dist/services/mcp/generators/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/services/mcp/generators/types.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAe;IAChE,MAAM,KAAK,GAAG,OAAO;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,OAAO,MAAM,IAAI,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,OAAyB,EACzB,WAAqD;IAErD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAA6B,EAC7B,OAAkB;IAElB,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/services/mcp/probe.d.ts

@@ -0,0 +1,31 @@
+import type { McpProbeResult, McpServer } from "./types.js";
+/**
+ * B-003 Phase 2 — MCP probe sandbox.
+ *
+ * Runs MCP `initialize` + `tools/list` against a server definition without
+ * committing it to the session flow. Three transport shapes are supported:
+ *
+ * - **stdio**: spawn the command under a strict env allowlist in a
+ *   per-probe cwd, 10 s timeout, kill the whole process tree on timeout.
+ * - **http**: POST JSON-RPC with `Accept: application/json, text/event-stream`
+ *   (Streamable HTTP). Redirects only accepted if same origin.
+ * - **sse**: same as http for this probe — we never open the event stream
+ *   here, we only issue the JSON-RPC exchange against the MCP endpoint.
+ *
+ * The probe intentionally hand-rolls the minimal JSON-RPC 2.0 exchange
+ * rather than pulling in `@modelcontextprotocol/sdk` for Phase 2. This
+ * keeps the dep surface stable; Phase 3 can adopt the SDK when we wire
+ * actual tool calls and need the full client lifecycle.
+ */
+export interface McpProbeOptions {
+    /** `PA_DATA_DIR` — the per-probe sandbox cwd lives under `<dataDir>/mcp`. */
+    dataDir: string;
+    /** Resolved secrets keyed by variable / header name. */
+    secrets: Record<string, string>;
+    /** Override for tests — default `PROBE_TIMEOUT_MS`. */
+    timeoutMs?: number;
+    /** Clock injection for deterministic durationMs in tests. */
+    now?: () => number;
+}
+export declare function probeMcpServer(server: Pick<McpServer, "id" | "transport" | "command" | "args" | "cwd" | "url" | "envKeys" | "headerKeys">, options: McpProbeOptions): Promise<McpProbeResult>;
+//# sourceMappingURL=probe.d.ts.map

package/dist/services/mcp/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/probe.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAY5D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,IAAI,CACV,SAAS,EACT,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CACnF,EACD,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAsBzB"}