@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/tool-manuals/__tests__/tool-manuals.tools.test.ts

@@ -45,11 +45,28 @@ const CATALOG = [
   },
 ];
 
+// Alice's plugin holds a `.tool` the scan refused; Bob can't read that file.
+const REFUSED = [
+  { path: 'Plugins/Sales/broken.tool', reason: 'Nested mappings are not allowed in compact mappings (line 4, column 3)' },
+];
+
 const toolManualService = {
   listAccessible: vi.fn(async (email: string) =>
     email === ALICE.email ? CATALOG : CATALOG.filter((m) => m.slug === 'weather'),
   ),
+  // Both halves out of one call — the listing has no way to ask for them
+  // separately, and so no way to describe two different snapshots.
+  listAccessibleCatalog: vi.fn(async (email: string) => ({
+    tools: email === ALICE.email ? CATALOG : CATALOG.filter((m) => m.slug === 'weather'),
+    invalid: email === ALICE.email ? REFUSED : [],
+  })),
   listLocalOnly: async () => [],
+  // Alice declared `crm` on her draft; nothing else is pending anywhere.
+  listDeclaredOnlyOnBranch: vi.fn(async (email: string, branch: string) =>
+    email === ALICE.email && branch === 'alice/add-crm'
+      ? [{ name: 'crm', path: 'Plugins/Sales/mcp.json', type: 'mcp' as const }]
+      : [],
+  ),
 } as unknown as IToolManualService;
 
 const accessControl = {
@@ -113,11 +130,11 @@ afterEach(async () => {
   vi.clearAllMocks();
 });
 
-const callSetup = (base: string, bearer: string) =>
+const callSetup = (base: string, bearer: string, body: Record<string, unknown> = {}) =>
   fetch(`${base}/api/agent/tools/list_tool_setup`, {
     method: 'POST',
     headers: { 'content-type': 'application/json', authorization: `Bearer ${bearer}` },
-    body: JSON.stringify({}),
+    body: JSON.stringify(body),
   });
 
 describe('list_tool_setup — access controls resolved for the caller', () => {
@@ -144,6 +161,25 @@ describe('list_tool_setup — access controls resolved for the caller', () => {
     expect(bob.tools[0].variables[0].userConfigured).toBe(false);
   });
 
+  it('names the `.tool` files the scan refused, resolved for the caller', async () => {
+    const base = await start();
+
+    const alice = (await (await callSetup(base, 'bevel_alice')).json()) as {
+      tools: { slug: string }[];
+      invalid: { path: string; reason: string }[];
+    };
+    // The refusal costs that file and nothing else: the catalog is whole...
+    expect(alice.tools.map((t) => t.slug).sort()).toEqual(['billing', 'weather']);
+    // ...and the one file that did not make it is named, with why and where.
+    expect(alice.invalid).toEqual(REFUSED);
+    expect(toolManualService.listAccessibleCatalog).toHaveBeenCalledWith(ALICE.email);
+
+    // Bob can't read that file, so he is not told it exists — the same
+    // default-deny the catalog itself applies.
+    const bob = (await (await callSetup(base, 'bevel_bob')).json()) as { invalid: unknown[] };
+    expect(bob.invalid).toEqual([]);
+  });
+
   it('rejects an unauthenticated call outright', async () => {
     const base = await start();
     const res = await fetch(`${base}/api/agent/tools/list_tool_setup`, {
@@ -154,3 +190,79 @@ describe('list_tool_setup — access controls resolved for the caller', () => {
     expect(res.status).toBe(401);
   });
 });
+
+describe('list_tool_setup — a declaration that lives on a draft says so', () => {
+  it('names the tools declared on the given branch that the default branch does not serve yet', async () => {
+    const base = await start();
+    const res = await callSetup(base, 'bevel_alice', { branch: 'alice/add-crm' });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      tools: { slug: string }[];
+      onBranchOnly: { name: string; path: string; branch: string }[];
+      note?: string;
+    };
+    // Resolved for the caller, on the branch they named.
+    expect(toolManualService.listDeclaredOnlyOnBranch).toHaveBeenCalledWith(ALICE.email, 'alice/add-crm');
+    // The released catalog is unchanged — the draft's server is not in it...
+    expect(body.tools.map((t) => t.slug)).not.toContain('crm');
+    // ...and the agent is told where it is and what makes it live.
+    expect(body.onBranchOnly).toEqual([
+      { name: 'crm', path: 'Plugins/Sales/mcp.json', type: 'mcp', branch: 'alice/add-crm' },
+    ]);
+    expect(body.note).toContain('`alice/add-crm` only');
+    expect(body.note).toContain('open_change_request');
+  });
+
+  it('defaults to the in-app agent’s focused branch when no branch is given', async () => {
+    const base = await start();
+    // The in-process agent's loopback token carries the branch its workspace is on.
+    const agentToken = new InternalTokenService({ secret: 'test-secret' }).mint({
+      userId: ALICE.id,
+      focusedBranch: 'alice/add-crm',
+    });
+    const res = await callSetup(base, agentToken);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { onBranchOnly: { name: string; branch: string }[]; note?: string };
+    expect(toolManualService.listDeclaredOnlyOnBranch).toHaveBeenCalledWith(ALICE.email, 'alice/add-crm');
+    expect(body.onBranchOnly).toEqual([
+      { name: 'crm', path: 'Plugins/Sales/mcp.json', type: 'mcp', branch: 'alice/add-crm' },
+    ]);
+    expect(body.note).toContain('`alice/add-crm` only');
+  });
+
+  it('prefers an explicit branch over the focused one', async () => {
+    const base = await start();
+    const agentToken = new InternalTokenService({ secret: 'test-secret' }).mint({
+      userId: ALICE.id,
+      focusedBranch: 'alice/other-draft',
+    });
+    const body = (await (await callSetup(base, agentToken, { branch: 'alice/add-crm' })).json()) as {
+      onBranchOnly: { name: string }[];
+    };
+    expect(toolManualService.listDeclaredOnlyOnBranch).toHaveBeenCalledTimes(1);
+    expect(toolManualService.listDeclaredOnlyOnBranch).toHaveBeenCalledWith(ALICE.email, 'alice/add-crm');
+    expect(body.onBranchOnly.map((p) => p.name)).toEqual(['crm']);
+  });
+
+  it('carries the refused files on the branch answer too', async () => {
+    const base = await start();
+    const body = (await (await callSetup(base, 'bevel_alice', { branch: 'alice/add-crm' })).json()) as {
+      invalid: { path: string }[];
+      onBranchOnly: unknown[];
+      note?: string;
+    };
+    // The two halves are independent: a pending draft declaration must not
+    // displace the report of a file the released catalog refused.
+    expect(body.invalid.map((i) => i.path)).toEqual(['Plugins/Sales/broken.tool']);
+    expect(body.onBranchOnly).toHaveLength(1);
+    expect(body.note).toBeTruthy();
+  });
+
+  it('reports nothing pending, and no note, without a branch', async () => {
+    const base = await start();
+    const body = (await (await callSetup(base, 'bevel_alice')).json()) as { onBranchOnly: unknown[]; note?: string };
+    expect(body.onBranchOnly).toEqual([]);
+    expect(body.note).toBeUndefined();
+    expect(toolManualService.listDeclaredOnlyOnBranch).not.toHaveBeenCalled();
+  });
+});

package/src/modules/tool-manuals/index.ts

@@ -1,4 +1,5 @@
 export { ToolManualService } from './tool-manuals.service.js';
+export { PendingToolsService } from './pending-tools.service.js';
 export { registerToolManualsTools } from './tool-manuals.tools.js';
 export {
   createToolManualsAgentRoutes,
@@ -6,7 +7,9 @@ export {
 } from './tool-manuals.routes.js';
 export {
   EXTERNAL_KB_MANUAL_NAME,
+  type IPendingToolService,
   type IToolManualService,
+  type PendingTool,
   type ToolManualSummary,
   type ToolManualDetail,
   type ToolCapability,

package/src/modules/tool-manuals/mcp-json-discovery.ts

@@ -5,6 +5,9 @@ import {
   PLUGINS_DIR,
 } from '@bevel-software/platform-shared';
 import type { ToolManualDescriptor, ToolVariable } from './tool-manuals.contract.js';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('tool-manuals');
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import { RESERVED_VARIABLE_NAMES, findReservedVariableRef } from '../../shared/variable-refs.js';
 
@@ -195,6 +198,121 @@ export function validatedVariables(raw: unknown): ToolVariable[] | null {
  * materialization is a later phase — so a stdio server relying on them will
  * fail to spawn until then; bare-command servers (`npx …`) work today.
  */
+/**
+ * The ONE judgement of an `mcp.json` server entry — its name and its
+ * transport — shared by the manual scanner (which layers the platform's
+ * extension data and its reachability gate on top), the bundle dialect's
+ * registry (whose configs become entries) and the marketplace compiler
+ * (which ships only what a client could run). An entry that fails here fails
+ * everywhere, for one reason; an entry that passes is returned NORMALISED to
+ * the portable shape every consumer emits.
+ */
+export type McpEntryVerdict =
+  | { ok: true; transport: 'stdio'; entry: PortableStdioEntry }
+  | { ok: true; transport: 'streamable-http'; entry: PortableHttpEntry }
+  | { ok: false; reason: string };
+
+/** A stdio server as a client launches it — every field already the type the launcher needs. */
+export interface PortableStdioEntry {
+  type: 'stdio';
+  command: string;
+  args: string[];
+  env?: Record<string, string>;
+  cwd?: string;
+}
+/** An http server as a client dials it — an endpoint, never a credential. */
+export interface PortableHttpEntry {
+  type: 'streamable-http';
+  url: string;
+  headers?: Record<string, string>;
+}
+
+/**
+ * A record whose every value is a string, or null — no coercion, no cast.
+ * Built without a prototype: the keys are HTTP header and environment
+ * variable names, and a plain object would silently swallow one spelled
+ * `__proto__` (a prototype assignment, not a property) — every accepted key
+ * must come out the other side.
+ */
+function stringMap(v: unknown): Record<string, string> | null {
+  if (!isRecord(v)) return null;
+  const out: Record<string, string> = Object.create(null) as Record<string, string>;
+  for (const [k, val] of Object.entries(v)) {
+    if (typeof val !== 'string') return null;
+    out[k] = val;
+  }
+  return out;
+}
+
+export function judgeMcpServerEntry(name: string, raw: unknown): McpEntryVerdict {
+  // The name rule (lowercase, alphanumeric first) also keeps every object
+  // prototype key — `__proto__`, `constructor` — out of the plain-object
+  // maps consumers build from these names.
+  if (!SERVER_NAME_RE.test(name)) {
+    return {
+      ok: false,
+      reason: 'the name is the secret namespace and route slug, so it must be lowercase alphanumeric with `_`/`-`',
+    };
+  }
+  if (!isRecord(raw) || typeof raw.type !== 'string') return { ok: false, reason: 'no transport type' };
+  if (raw.type === 'stdio') {
+    if (typeof raw.command !== 'string' || raw.command.length === 0) return { ok: false, reason: 'no command' };
+    const entry: PortableStdioEntry = { type: 'stdio', command: raw.command, args: [] };
+    if (raw.args !== undefined) {
+      // A launcher gets the strings it was given, never a stringified object.
+      if (!Array.isArray(raw.args) || !raw.args.every((a) => typeof a === 'string')) {
+        return { ok: false, reason: 'args must be a list of strings' };
+      }
+      entry.args = raw.args;
+    }
+    if (raw.env !== undefined) {
+      const env = stringMap(raw.env);
+      if (env === null) return { ok: false, reason: 'env must be a map of strings' };
+      entry.env = env;
+    }
+    if (raw.cwd !== undefined) {
+      if (typeof raw.cwd !== 'string') return { ok: false, reason: 'cwd must be a string' };
+      entry.cwd = raw.cwd;
+    }
+    return { ok: true, transport: 'stdio', entry };
+  }
+  if (raw.type === 'sse') {
+    // The pinned `@utcp/mcp` speaks `stdio` and streamable `http` — there
+    // is no sse transport in its schema, so a declaration claiming one either
+    // fails validation or, worse, dials a handshake the server does not
+    // speak. Refusing names the fix; silently rebuilding as http used to
+    // configure exactly that wrong handshake.
+    return {
+      ok: false,
+      reason: 'the MCP client has no `sse` transport — declare the server as `streamable-http` if it supports it',
+    };
+  }
+  if (raw.type === 'streamable-http') {
+    if (typeof raw.url !== 'string' || raw.url.length === 0) return { ok: false, reason: 'no url' };
+    let parsed: URL;
+    try {
+      parsed = new URL(raw.url);
+    } catch {
+      return { ok: false, reason: 'url must be http(s)' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return { ok: false, reason: 'url must be http(s)' };
+    // A portable entry is an endpoint. A credential belongs in the vault and
+    // reaches a client through the platform, never verbatim in a config that
+    // is compiled into a marketplace and cloned onto every member's machine.
+    if (parsed.username || parsed.password) return { ok: false, reason: 'url must not carry credentials' };
+    const entry: PortableHttpEntry = { type: 'streamable-http', url: raw.url };
+    if (raw.headers !== undefined) {
+      const headers = stringMap(raw.headers);
+      if (headers === null) return { ok: false, reason: 'headers must be a map of strings' };
+      entry.headers = headers;
+    }
+    return { ok: true, transport: 'streamable-http', entry };
+  }
+  // Unknown transport: the spec says an unknown `type` invalidates the
+  // ENTRY, not the file — the caller skips it and keeps its siblings.
+  return { ok: false, reason: `unknown type "${raw.type}"` };
+}
+
 export function descriptorsFromMcpJson(
   pluginFolder: string,
   mcpJsonText: string,
@@ -204,7 +322,7 @@ export function descriptorsFromMcpJson(
   try {
     mcp = JSON.parse(mcpJsonText);
   } catch {
-    console.warn(`[tool-manuals] ${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MCP_FILE} is not valid JSON — skipped.`);
+    log.warn(`${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MCP_FILE} is not valid JSON — skipped.`);
     return [];
   }
   if (!isRecord(mcp) || !isRecord(mcp.mcpServers)) return [];
@@ -217,8 +335,8 @@ export function descriptorsFromMcpJson(
       // A broken manifest costs the extension data (auth wiring), not the
       // servers themselves — they are still listed, as the spec's own
       // "invalid components are skipped, valid ones load" posture suggests.
-      console.warn(
-        `[tool-manuals] ${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MANIFEST_FILE} is not valid JSON — ` +
+      log.warn(
+        `${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MANIFEST_FILE} is not valid JSON — ` +
           'its mcp-server auth/variable declarations are ignored.',
       );
     }
@@ -227,18 +345,14 @@ export function descriptorsFromMcpJson(
   const mcpJsonPath = `${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MCP_FILE}`;
 
   const out: ToolManualDescriptor[] = [];
-  for (const [name, raw] of Object.entries(mcp.mcpServers)) {
-    if (!SERVER_NAME_RE.test(name)) {
-      console.warn(
-        `[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: the name is the secret ` +
-          'namespace and route slug, so it must be lowercase alphanumeric with `_`/`-`.',
-      );
-      continue;
-    }
-    if (!isRecord(raw) || typeof raw.type !== 'string') {
-      console.warn(`[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: no transport type.`);
+  for (const [name, rawEntry] of Object.entries(mcp.mcpServers)) {
+    const verdict = judgeMcpServerEntry(name, rawEntry);
+    if (!verdict.ok) {
+      log.warn(`skipping mcp server "${name}" in ${mcpJsonPath}: ${verdict.reason}.`);
       continue;
     }
+    // Narrowed by the verdict: an entry that passed is a record.
+    const raw = rawEntry as Record<string, unknown>;
     // The extension entry is knowledge-base content too — same zero-trust
     // parse as the rest: a non-object entry reads as "no extension data".
     const ext: HexisMcpServerExtension = isRecord(extensions[name])
@@ -249,8 +363,8 @@ export function descriptorsFromMcpJson(
     // into outbound requests exactly the same way.
     const reserved = referencesReservedVariable({ raw, ext });
     if (reserved !== null) {
-      console.warn(
-        `[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: its declaration (mcp.json ` +
+      log.warn(
+        `skipping mcp server "${name}" in ${mcpJsonPath}: its declaration (mcp.json ` +
           `entry or plugin.json extension) references the reserved variable "${reserved}" — API_URL and ` +
           'CONNECTION_KEY are platform-seeded and may not appear in server declarations.',
       );
@@ -258,8 +372,8 @@ export function descriptorsFromMcpJson(
     }
     const variables = validatedVariables(ext.variables);
     if (variables === null) {
-      console.warn(
-        `[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: its plugin.json \`variables\` ` +
+      log.warn(
+        `skipping mcp server "${name}" in ${mcpJsonPath}: its plugin.json \`variables\` ` +
           'declaration is malformed — a dropped declaration would silently re-scope a credential, so ' +
           'the server stays offline until the manifest is fixed.',
       );
@@ -274,91 +388,46 @@ export function descriptorsFromMcpJson(
       ...(variables.length > 0 ? { variables } : {}),
     };
 
-    if (raw.type === 'stdio') {
-      if (typeof raw.command !== 'string' || raw.command.length === 0) {
-        console.warn(`[tool-manuals] skipping stdio server "${name}" in ${mcpJsonPath}: no command.`);
-        continue;
-      }
-      out.push({
-        ...shared,
-        remote: false,
-        stdio: {
-          command: raw.command,
-          args: Array.isArray(raw.args) ? raw.args.map(String) : [],
-          env: isRecord(raw.env) ? (raw.env as Record<string, string>) : undefined,
-          cwd: typeof raw.cwd === 'string' ? raw.cwd : undefined,
-        },
-      });
-      continue;
-    }
-
-    if (raw.type === 'sse') {
-      // The pinned `@utcp/mcp` speaks `stdio` and streamable `http` — there
-      // is no sse transport in its schema, so a template claiming one either
-      // fails validation or, worse, dials a handshake the server does not
-      // speak. Refusing here names the fix; silently rebuilding as http used
-      // to configure exactly that wrong handshake.
-      console.warn(
-        `[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: the MCP client has no \`sse\` transport — declare the server as \`streamable-http\` if it supports it.`,
-      );
+    if (verdict.transport === 'stdio') {
+      const { command, args, env, cwd } = verdict.entry;
+      out.push({ ...shared, remote: false, stdio: { command, args, env, cwd } });
       continue;
     }
 
-    if (raw.type === 'streamable-http') {
-      if (typeof raw.url !== 'string' || raw.url.length === 0) {
-        console.warn(`[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: no url.`);
-        continue;
-      }
-      // Remote-capable servers get the same SSRF gate `.tool` urls pass —
-      // otherwise mcp.json becomes the way to point the backend at loopback,
-      // private ranges, or the cloud metadata endpoint. A `local: true` entry
-      // is exempt because loopback is exactly what local MEANS, and only the
-      // user's own machine ever dials it.
-      // Scheme first, for EVERYONE: `local: true` exempts a server from the
-      // private-network reachability policy, not from being http(s) at all.
-      let schemeOk = false;
+    const url = verdict.entry.url;
+    // Remote-capable servers get the same SSRF gate `.tool` urls pass —
+    // otherwise mcp.json becomes the way to point the backend at loopback,
+    // private ranges, or the cloud metadata endpoint. A `local: true` entry
+    // is exempt because loopback is exactly what local MEANS, and only the
+    // user's own machine ever dials it. (The scheme itself was judged for
+    // everyone above: `local: true` exempts a server from the reachability
+    // policy, not from being http(s) at all.)
+    if (ext.local !== true) {
       try {
-        const u = new URL(raw.url);
-        schemeOk = u.protocol === 'http:' || u.protocol === 'https:';
-      } catch {
-        schemeOk = false;
-      }
-      if (!schemeOk) {
-        console.warn(`[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: url must be http(s).`);
+        assertSafeFetchUrl(url, { label: `mcp server "${name}" url` });
+      } catch (err) {
+        log.warn(
+          `skipping mcp server "${name}" in ${mcpJsonPath}: ` +
+            `${err instanceof Error ? err.message : String(err)} (declare it \`local: true\` if it is deliberately private).`,
+        );
         continue;
       }
-      if (ext.local !== true) {
-        try {
-          assertSafeFetchUrl(raw.url, { label: `mcp server "${name}" url` });
-        } catch (err) {
-          console.warn(
-            `[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: ` +
-              `${err instanceof Error ? err.message : String(err)} (declare it \`local: true\` if it is deliberately private).`,
-          );
-          continue;
-        }
-      }
-      // Extension headers (auth, `${VAR}` refs) win over mcp.json's literal
-      // ones on a key collision: the portable file cannot carry a credential,
-      // so when both name the same header the extension is the operative one.
-      // Both sides pass the isRecord gate — spreading a malformed non-object
-      // value (a string, say) would scatter its indices into header keys.
-      const headers = {
-        ...(isRecord(raw.headers) ? (raw.headers as Record<string, string>) : {}),
-        ...(isRecord(ext.headers) ? (ext.headers as Record<string, string>) : {}),
-      };
-      out.push({
-        ...shared,
-        url: raw.url,
-        ...(Object.keys(headers).length > 0 ? { headers } : {}),
-        ...(ext.local === true ? { remote: false } : {}),
-      });
-      continue;
     }
-
-    // Unknown transport: the spec says an unknown `type` invalidates the
-    // ENTRY, not the file — skip it, keep its siblings.
-    console.warn(`[tool-manuals] skipping mcp server "${name}" in ${mcpJsonPath}: unknown type "${raw.type}".`);
+    // Extension headers (auth, `${VAR}` refs) win over mcp.json's literal
+    // ones on a key collision: the portable file cannot carry a credential,
+    // so when both name the same header the extension is the operative one.
+    // Both sides pass the isRecord gate — spreading a malformed non-object
+    // value (a string, say) would scatter its indices into header keys.
+    const headers = {
+      ...(verdict.entry.headers ?? {}),
+      ...(isRecord(ext.headers) ? (ext.headers as Record<string, string>) : {}),
+    };
+    out.push({
+      ...shared,
+      url,
+      ...(Object.keys(headers).length > 0 ? { headers } : {}),
+      ...(ext.local === true ? { remote: false } : {}),
+    });
   }
   return out;
 }

package/src/modules/tool-manuals/mcp-server-edit.service.ts

@@ -14,6 +14,7 @@ import { validatedVariables } from './mcp-json-discovery.js';
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import { containsVariableReference, findReservedVariableRef } from '../../shared/variable-refs.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
+import type { IFsProbe } from '../../shared/fs.contract.js';
 import type { IToolManualService, ToolVariable } from './tool-manuals.contract.js';
 
 /**
@@ -127,9 +128,16 @@ export class McpServerEditService {
     private readonly accessControl: IAccessControl,
     private readonly toolManuals: IToolManualService,
     private readonly kbDirName: string,
+    private readonly disk: IFsProbe,
   ) {}
 
-  /** The merged view of one server, or null when unknown/unreadable (indistinguishable, fail closed). */
+  /**
+   * The merged view of one server, or null when unknown — including when
+   * `mcp.json` is absent, is not a JSON object, or has no object entry for it
+   * (indistinguishable, fail closed). A missing or malformed manifest only
+   * leaves the extension fields empty. A filesystem failure reading either
+   * file is not "unknown" and propagates.
+   */
   async getServer(userEmail: string, slug: string): Promise<McpServerView | null> {
     const located = await this.locate(userEmail, slug);
     if (!located) return null;
@@ -418,8 +426,8 @@ export class McpServerEditService {
     const mcpAbs = path.join(pluginDir, PLUGIN_MCP_FILE);
     const manifestAbs = path.join(pluginDir, PLUGIN_MANIFEST_FILE);
     return {
-      mcp: await readJson(mcpAbs),
-      manifest: await readJson(manifestAbs),
+      mcp: await this.disk.readJsonObject(mcpAbs),
+      manifest: await this.disk.readJsonObject(manifestAbs),
       mcpAbs,
       manifestAbs,
     };
@@ -432,14 +440,3 @@ export class McpServerEditService {
     return entry && typeof entry === 'object' ? (entry as Record<string, unknown>) : {};
   }
 }
-
-async function readJson(p: string): Promise<Record<string, unknown> | null> {
-  try {
-    const parsed: unknown = JSON.parse(await fs.readFile(p, 'utf-8'));
-    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
-      ? (parsed as Record<string, unknown>)
-      : null;
-  } catch {
-    return null;
-  }
-}