@assistkick/create 1.19.0 → 1.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistkick/create",
-  "version": "1.19.0",
+  "version": "1.22.0",
   "description": "Scaffold assistkick-product-system into any project",
   "type": "module",
   "bin": {

package/templates/assistkick-product-system/packages/backend/src/routes/mcp_config.ts

@@ -0,0 +1,87 @@
+/**
+ * MCP config routes — per-user MCP server configuration management.
+ * All endpoints accept an optional ?projectId query param to scope configs to a project.
+ * Without projectId, configs are global (user-level).
+ *
+ * GET    /api/mcp-config?projectId=...         — get configs for the authenticated user
+ * PUT    /api/mcp-config/:type?projectId=...   — upsert a config (type = localhost | remote)
+ * DELETE /api/mcp-config/:type?projectId=...   — delete a config
+ */
+
+import { Router } from 'express';
+import type { McpConfigService } from '../services/mcp_config_service.js';
+
+interface McpConfigRoutesDeps {
+  mcpConfigService: McpConfigService;
+  log: (tag: string, ...args: any[]) => void;
+}
+
+export const createMcpConfigRoutes = ({ mcpConfigService, log }: McpConfigRoutesDeps): Router => {
+  const router: Router = Router();
+
+  // GET /api/mcp-config?projectId=...
+  router.get('/', async (req, res) => {
+    const userId = (req as any).user?.id;
+    if (!userId) { res.status(401).json({ error: 'Unauthorized' }); return; }
+
+    const projectId = (req.query.projectId as string) || null;
+
+    try {
+      const configs = await mcpConfigService.getAllConfigs(userId, projectId);
+      res.json({ configs });
+    } catch (err: any) {
+      log('MCP_CONFIG', `List configs failed: ${err.message}`);
+      res.status(500).json({ error: 'Failed to list MCP configs' });
+    }
+  });
+
+  // PUT /api/mcp-config/:type?projectId=...
+  router.put('/:type', async (req, res) => {
+    const userId = (req as any).user?.id;
+    if (!userId) { res.status(401).json({ error: 'Unauthorized' }); return; }
+
+    const configType = req.params.type;
+    const projectId = (req.query.projectId as string) || (req.body.projectId as string) || null;
+    const { mcpServersJson } = req.body;
+
+    if (!mcpServersJson || typeof mcpServersJson !== 'string') {
+      res.status(400).json({ error: 'mcpServersJson is required and must be a string' });
+      return;
+    }
+
+    try {
+      const config = await mcpConfigService.upsertConfig(userId, configType, mcpServersJson, projectId);
+      res.json({ config });
+    } catch (err: any) {
+      log('MCP_CONFIG', `Upsert config failed: ${err.message}`);
+      if (err.message.includes('Invalid JSON') || err.message.includes('configType must be')) {
+        res.status(400).json({ error: err.message });
+        return;
+      }
+      res.status(500).json({ error: 'Failed to save MCP config' });
+    }
+  });
+
+  // DELETE /api/mcp-config/:type?projectId=...
+  router.delete('/:type', async (req, res) => {
+    const userId = (req as any).user?.id;
+    if (!userId) { res.status(401).json({ error: 'Unauthorized' }); return; }
+
+    const configType = req.params.type;
+    const projectId = (req.query.projectId as string) || null;
+
+    try {
+      const deleted = await mcpConfigService.deleteConfig(userId, configType, projectId);
+      if (!deleted) {
+        res.status(404).json({ error: 'Config not found' });
+        return;
+      }
+      res.json({ success: true });
+    } catch (err: any) {
+      log('MCP_CONFIG', `Delete config failed: ${err.message}`);
+      res.status(500).json({ error: 'Failed to delete MCP config' });
+    }
+  });
+
+  return router;
+};

package/templates/assistkick-product-system/packages/backend/src/server.ts

@@ -54,6 +54,8 @@ import { createChatSessionRoutes } from './routes/chat_sessions.js';
 import { createChatUploadRoutes } from './routes/chat_upload.js';
 import { createChatFilesRoutes } from './routes/chat_files.js';
 import { createSkillRoutes } from './routes/skills.js';
+import { McpConfigService } from './services/mcp_config_service.js';
+import { createMcpConfigRoutes } from './routes/mcp_config.js';
 import { DevCommandDetector } from './services/dev_command_detector.js';
 import { PreviewServerManager } from './services/preview_server_manager.js';
 import { createPreviewApiRoutes, createPreviewProxyMiddleware } from './routes/preview.js';
@@ -186,6 +188,11 @@ waitForDb().then(async () => {
   logError('STARTUP', 'Startup tasks failed', err);
 });
 
+// MCP config routes (per-user MCP server configuration)
+const mcpConfigService = new McpConfigService({ getDb, log });
+const mcpConfigRoutes = createMcpConfigRoutes({ mcpConfigService, log });
+app.use('/api/mcp-config', authMiddleware.requireAuth, mcpConfigRoutes);
+
 // Chat v2 session management routes (authenticated)
 const chatSessionService = new ChatSessionService({ getDb, log });
 const chatMessageRepository = new ChatMessageRepository({ getDb, log });
@@ -262,7 +269,7 @@ const chatWss = new WebSocketServer({ noServer: true });
 const chatCliBridge = new ChatCliBridge({ projectRoot: paths.projectRoot, workspacesDir: paths.workspacesDir, log });
 const permissionService = new PermissionService({ getDb, log });
 const titleGeneratorService = new TitleGeneratorService({ log });
-const chatHandler = new ChatWsHandler({ wss: chatWss, authService, chatCliBridge, permissionService, chatMessageRepository, chatSessionService, titleGeneratorService, log });
+const chatHandler = new ChatWsHandler({ wss: chatWss, authService, chatCliBridge, permissionService, chatMessageRepository, chatSessionService, titleGeneratorService, mcpConfigService, log });
 
 // Chat permission routes — used by MCP permission server (no auth — internal only)
 const chatPermissionRoutes = createChatPermissionRoutes({ permissionService, log });

package/templates/assistkick-product-system/packages/backend/src/services/chat_cli_bridge.ts

@@ -33,6 +33,8 @@ export interface SpawnOptions {
   allowedTools?: string[];
   /** Compacted conversation context to prepend to the system prompt */
   continuationContext?: string;
+  /** Inline MCP config JSON string to pass via --mcp-config */
+  mcpConfigJson?: string;
   onEvent: (event: Record<string, unknown>) => void;
 }
 
@@ -90,6 +92,11 @@ export class ChatCliBridge {
       }
     }
 
+    // MCP server configuration (inline JSON string)
+    if (options.mcpConfigJson) {
+      args.push('--mcp-config', options.mcpConfigJson);
+    }
+
     // Prompt via stdin
     args.push('-p', '-');
 

package/templates/assistkick-product-system/packages/backend/src/services/chat_ws_handler.ts

@@ -29,6 +29,7 @@ import type { PermissionService, PermissionDecision, PermissionRequest } from '.
 import type { ChatMessageRepository } from './chat_message_repository.js';
 import type { ChatSessionService } from './chat_session_service.js';
 import type { TitleGeneratorService } from './title_generator_service.js';
+import type { McpConfigService } from './mcp_config_service.js';
 
 export interface ChatWsHandlerDeps {
   wss: WebSocketServer;
@@ -38,6 +39,7 @@ export interface ChatWsHandlerDeps {
   chatMessageRepository?: ChatMessageRepository;
   chatSessionService?: ChatSessionService;
   titleGeneratorService?: TitleGeneratorService;
+  mcpConfigService?: McpConfigService;
   log: (tag: string, ...args: unknown[]) => void;
 }
 
@@ -237,6 +239,7 @@ export class ChatWsHandler {
   private readonly chatMessageRepository: ChatMessageRepository | null;
   private readonly chatSessionService: ChatSessionService | null;
   private readonly titleGeneratorService: TitleGeneratorService | null;
+  private readonly mcpConfigService: McpConfigService | null;
   private readonly log: ChatWsHandlerDeps['log'];
   private readonly activeStreams = new Map<WebSocket, Set<string>>();
 
@@ -249,7 +252,10 @@ export class ChatWsHandler {
   /** Track stream context per Claude session ID for message persistence. */
   private readonly streamContexts = new Map<string, StreamContext>();
 
-  constructor({ wss, authService, chatCliBridge, permissionService, chatMessageRepository, chatSessionService, titleGeneratorService, log }: ChatWsHandlerDeps) {
+  /** Map WebSocket connections to their authenticated user ID. */
+  private readonly wsUserIds = new Map<WebSocket, string>();
+
+  constructor({ wss, authService, chatCliBridge, permissionService, chatMessageRepository, chatSessionService, titleGeneratorService, mcpConfigService, log }: ChatWsHandlerDeps) {
     this.wss = wss;
     this.authService = authService;
     this.chatCliBridge = chatCliBridge;
@@ -257,6 +263,7 @@ export class ChatWsHandler {
     this.chatMessageRepository = chatMessageRepository || null;
     this.chatSessionService = chatSessionService || null;
     this.titleGeneratorService = titleGeneratorService || null;
+    this.mcpConfigService = mcpConfigService || null;
     this.log = log;
 
     // Register the permission request handler to route requests to the right WebSocket
@@ -317,6 +324,7 @@ export class ChatWsHandler {
     }
 
     this.log('CHAT_WS', `Admin ${payload.email} connected`);
+    this.wsUserIds.set(ws, payload.sub);
 
     ws.on('message', (raw: Buffer | string) => {
       let msg: ChatClientMessage;
@@ -340,6 +348,7 @@ export class ChatWsHandler {
 
     ws.on('close', () => {
       this.log('CHAT_WS', `Admin ${payload.email} disconnected`);
+      this.wsUserIds.delete(ws);
       this.cancelActiveStream(ws);
     });
 
@@ -416,6 +425,21 @@ export class ChatWsHandler {
       }
     }
 
+    // Build inline MCP config JSON for this spawn (if user has MCP servers configured)
+    let mcpConfigJson: string | undefined;
+    const userId = this.wsUserIds.get(ws);
+    if (userId && this.mcpConfigService) {
+      try {
+        const mergedServers = await this.mcpConfigService.buildMergedConfig(userId, projectId);
+        if (mergedServers) {
+          mcpConfigJson = JSON.stringify({ mcpServers: mergedServers });
+          this.log('CHAT_WS', `MCP config: ${Object.keys(mergedServers).length} server(s) for user ${userId}`);
+        }
+      } catch (err: any) {
+        this.log('CHAT_WS', `Failed to build MCP config: ${err.message}`);
+      }
+    }
+
     try {
       const { completion, systemPrompt } = this.chatCliBridge.spawn({
         projectId,
@@ -425,6 +449,7 @@ export class ChatWsHandler {
         permissionMode,
         allowedTools: msg.allowedTools,
         continuationContext,
+        mcpConfigJson,
         onEvent: (event) => {
           // Forward to current WS (may have been re-attached after disconnect)
           const currentWs = this.sessionToWs.get(claudeSessionId);

package/templates/assistkick-product-system/packages/backend/src/services/mcp_config_service.ts

@@ -0,0 +1,157 @@
+/**
+ * McpConfigService — CRUD operations for per-user MCP server configurations.
+ * Each user has two config slots per scope: 'localhost' (local dev) and 'remote' (Docker/cloud).
+ * Configs can be global (projectId=null) or project-scoped (projectId set).
+ * Uses deterministic IDs to enforce uniqueness at the PK level.
+ */
+
+import {eq, and, isNull, or} from 'drizzle-orm';
+import {userMcpConfigs} from '@assistkick/shared/db/schema.js';
+import {existsSync} from 'node:fs';
+
+interface McpConfigServiceDeps {
+  getDb: () => any;
+  log: (tag: string, ...args: unknown[]) => void;
+}
+
+export interface McpConfigRecord {
+  id: string;
+  userId: string;
+  projectId: string | null;
+  configType: string;
+  mcpServersJson: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export class McpConfigService {
+  private readonly getDb: () => any;
+  private readonly log: McpConfigServiceDeps['log'];
+
+  constructor({getDb, log}: McpConfigServiceDeps) {
+    this.getDb = getDb;
+    this.log = log;
+  }
+
+  /** Generate a deterministic ID to enforce (userId, projectId, configType) uniqueness. */
+  private makeId = (userId: string, configType: string, projectId?: string | null): string => {
+    const scope = projectId || 'global';
+    return `mcpcfg_${userId}_${scope}_${configType}`;
+  };
+
+  /** Get all MCP configs for a user at a given scope. */
+  getAllConfigs = async (userId: string, projectId?: string | null): Promise<McpConfigRecord[]> => {
+    const db = this.getDb();
+    const scopeCondition = projectId
+      ? eq(userMcpConfigs.projectId, projectId)
+      : isNull(userMcpConfigs.projectId);
+    return db.select().from(userMcpConfigs).where(
+      and(eq(userMcpConfigs.userId, userId), scopeCondition),
+    );
+  };
+
+  /** Get a single config by user, scope, and type. */
+  getConfig = async (userId: string, configType: string, projectId?: string | null): Promise<McpConfigRecord | null> => {
+    const db = this.getDb();
+    const id = this.makeId(userId, configType, projectId);
+    const [row] = await db.select().from(userMcpConfigs).where(eq(userMcpConfigs.id, id));
+    return row || null;
+  };
+
+  /** Create or update a config. Validates JSON before storing. */
+  upsertConfig = async (userId: string, configType: string, mcpServersJson: string, projectId?: string | null): Promise<McpConfigRecord> => {
+    try {
+      JSON.parse(mcpServersJson);
+    } catch {
+      throw new Error('Invalid JSON in mcpServersJson');
+    }
+
+    if (configType !== 'localhost' && configType !== 'remote') {
+      throw new Error('configType must be "localhost" or "remote"');
+    }
+
+    const db = this.getDb();
+    const id = this.makeId(userId, configType, projectId);
+    const now = new Date().toISOString();
+
+    const existing = await this.getConfig(userId, configType, projectId);
+
+    if (existing) {
+      await db.update(userMcpConfigs)
+        .set({mcpServersJson, updatedAt: now})
+        .where(eq(userMcpConfigs.id, id));
+      this.log('MCP_CONFIG', `Updated ${configType} config for user ${userId} (project: ${projectId || 'global'})`);
+      return {...existing, mcpServersJson, updatedAt: now};
+    }
+
+    const record: McpConfigRecord = {
+      id,
+      userId,
+      projectId: projectId || null,
+      configType,
+      mcpServersJson,
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    await db.insert(userMcpConfigs).values(record);
+    this.log('MCP_CONFIG', `Created ${configType} config for user ${userId} (project: ${projectId || 'global'})`);
+    return record;
+  };
+
+  /** Delete a config. */
+  deleteConfig = async (userId: string, configType: string, projectId?: string | null): Promise<boolean> => {
+    const db = this.getDb();
+    const id = this.makeId(userId, configType, projectId);
+    const existing = await this.getConfig(userId, configType, projectId);
+    if (!existing) return false;
+
+    await db.delete(userMcpConfigs).where(eq(userMcpConfigs.id, id));
+    this.log('MCP_CONFIG', `Deleted ${configType} config for user ${userId} (project: ${projectId || 'global'})`);
+    return true;
+  };
+
+  /**
+   * Build a merged mcpServers object for a user + project based on the current environment.
+   * Merges global configs first, then project-specific configs on top (project overrides global).
+   * In Docker: only remote configs are included.
+   * Locally: both localhost and remote configs are merged.
+   */
+  buildMergedConfig = async (userId: string, projectId?: string | null): Promise<Record<string, unknown> | null> => {
+    const db = this.getDb();
+
+    // Load global + project-scoped configs in one query
+    const condition = projectId
+      ? and(
+          eq(userMcpConfigs.userId, userId),
+          or(isNull(userMcpConfigs.projectId), eq(userMcpConfigs.projectId, projectId)),
+        )
+      : and(eq(userMcpConfigs.userId, userId), isNull(userMcpConfigs.projectId));
+
+    const configs: McpConfigRecord[] = await db.select().from(userMcpConfigs).where(condition);
+    if (configs.length === 0) return null;
+
+    const isDocker = process.env.DOCKER === '1' || existsSync('/.dockerenv');
+
+    const merged: Record<string, unknown> = {};
+
+    // Apply global configs first, then project-specific (so project overrides global)
+    const globalConfigs = configs.filter(c => !c.projectId);
+    const projectConfigs = configs.filter(c => !!c.projectId);
+
+    for (const cfg of [...globalConfigs, ...projectConfigs]) {
+      if (isDocker && cfg.configType === 'localhost') continue;
+
+      try {
+        const servers = JSON.parse(cfg.mcpServersJson);
+        if (servers && typeof servers === 'object') {
+          Object.assign(merged, servers);
+        }
+      } catch {
+        // Skip invalid JSON entries
+      }
+    }
+
+    return Object.keys(merged).length > 0 ? merged : null;
+  };
+}

package/templates/assistkick-product-system/packages/frontend/src/api/client.ts

@@ -941,6 +941,43 @@ export class ApiClient {
     return resp.json();
   };
 
+  // --- MCP Config ---
+
+  /** Fetch MCP configs for the authenticated user. Pass projectId for project-scoped, omit for global. */
+  getMcpConfigs = async (projectId?: string | null): Promise<{ configs: Array<{ id: string; userId: string; projectId: string | null; configType: string; mcpServersJson: string; createdAt: string; updatedAt: string }> }> => {
+    const qs = projectId ? `?projectId=${encodeURIComponent(projectId)}` : '';
+    const resp = await this.fetchWithRefresh(`${this.baseUrl}/api/mcp-config${qs}`);
+    if (!resp.ok) throw new Error(`Failed to fetch MCP configs: ${resp.status}`);
+    return resp.json();
+  };
+
+  /** Save (create or update) an MCP config. Pass projectId for project-scoped, omit for global. */
+  saveMcpConfig = async (configType: 'localhost' | 'remote', mcpServersJson: string, projectId?: string | null): Promise<{ config: any }> => {
+    const qs = projectId ? `?projectId=${encodeURIComponent(projectId)}` : '';
+    const resp = await this.fetchWithRefresh(`${this.baseUrl}/api/mcp-config/${configType}${qs}`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mcpServersJson }),
+    });
+    if (!resp.ok) {
+      const err = await resp.json().catch(() => ({}));
+      throw new Error(err.error || `Failed to save MCP config: ${resp.status}`);
+    }
+    return resp.json();
+  };
+
+  /** Delete an MCP config. Pass projectId for project-scoped, omit for global. */
+  deleteMcpConfig = async (configType: 'localhost' | 'remote', projectId?: string | null): Promise<void> => {
+    const qs = projectId ? `?projectId=${encodeURIComponent(projectId)}` : '';
+    const resp = await this.fetchWithRefresh(`${this.baseUrl}/api/mcp-config/${configType}${qs}`, {
+      method: 'DELETE',
+    });
+    if (!resp.ok) {
+      const err = await resp.json().catch(() => ({}));
+      throw new Error(err.error || `Failed to delete MCP config: ${resp.status}`);
+    }
+  };
+
   // --- File system ---
 
   fetchFileTree = async (projectId: string) => {

package/templates/assistkick-product-system/packages/frontend/src/components/ChatView.tsx

@@ -30,7 +30,8 @@ import {PermissionModeSelector} from './PermissionModeSelector';
 import {AttachmentManager} from '../lib/attachment_manager';
 import type {SkillInfo} from '../api/client';
 import {apiClient} from '../api/client';
-import {Check, ChevronDown, ChevronUp, Copy, Search, Settings2, X, Zap} from 'lucide-react';
+import {Check, ChevronDown, ChevronUp, Copy, Search, Server, Settings2, X, Zap} from 'lucide-react';
+import {McpConfigModal} from './McpConfigModal';
 import {IconButton} from './ds/IconButton';
 import {formatTokenCount} from '../lib/context_usage_helpers';
 import {useFileTreeCache} from '../hooks/use_file_tree_cache';
@@ -123,6 +124,7 @@ export function ChatView({ visible }: ChatViewProps) {
   useEffect(() => { localStorage.setItem('chat_allowed_tools', JSON.stringify(allowedTools)); }, [allowedTools]);
 
   const [showSettings, setShowSettings] = useState(false);
+  const [showMcpConfig, setShowMcpConfig] = useState(false);
   const [isNewSession, setIsNewSession] = useState(true);
   const [compacting, setCompacting] = useState(false);
   const [copiedSessionId, setCopiedSessionId] = useState(false);
@@ -757,6 +759,14 @@ export function ChatView({ visible }: ChatViewProps) {
                 Compact
               </button>
             )}
+            <IconButton
+              label="MCP server config"
+              variant="ghost"
+              size="sm"
+              onClick={() => setShowMcpConfig(true)}
+            >
+              <Server size={14} strokeWidth={2} />
+            </IconButton>
             <IconButton
               label="Chat settings"
               variant={showSettings ? 'accent' : 'ghost'}
@@ -826,6 +836,9 @@ export function ChatView({ visible }: ChatViewProps) {
         }
         onRespond={handlePermissionResponse}
       />
+
+      {/* MCP Config modal */}
+      {showMcpConfig && <McpConfigModal onClose={() => setShowMcpConfig(false)} />}
     </div>
   );
 }