@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/tool-manuals/pending-tools.service.ts

@@ -0,0 +1,179 @@
+import {
+  PLUGINS_DIR,
+  PLUGIN_MANIFEST_FILE,
+  PLUGIN_MCP_FILE,
+  DEFAULT_BRANCH,
+  pluginOfPath,
+  type ChangeRequest,
+  type IWorkflowService,
+} from '@bevel-software/platform-shared';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { readAt, visibleProposedFiles } from '../../shared/pending-proposals.js';
+import { utcpNamespacePrefix } from '../../shared/utcp-namespace.js';
+import { baseName, normalizeToolManual } from './tool-manuals.service.js';
+import { descriptorsFromMcpJson } from './mcp-json-discovery.js';
+import type {
+  IPendingToolService,
+  IToolManualService,
+  PendingTool,
+  ToolManualDescriptor,
+} from './tool-manuals.contract.js';
+
+/**
+ * Tools that exist only on an open change request — proposed, not released.
+ *
+ * The exact counterpart of `PendingSkillsService`, and for the same bug: the
+ * catalog is built from the DEFAULT branch, so a tool an agent proposes is
+ * nowhere in the product until somebody merges it — not for the author, who
+ * asked for it, and not for the person who has to approve it. A card here is a
+ * REVIEW surface and nothing more: nothing registers it, nothing calls it, and
+ * the library refuses to open it as a tool page.
+ *
+ * Two declaration surfaces produce a tool, so both produce a proposal:
+ *  - a `.tool` UTCP manual anywhere under the plugins root;
+ *  - a server added to a plugin's `mcp.json` (the authoritative location for
+ *    MCP servers).
+ *
+ * ADDITIONS ONLY. "Added" is judged by the catalog's own identity, the UTCP
+ * NAMESPACE the manual name resolves to: a declaration whose namespace the
+ * default branch already serves is an EDIT of a live tool, and that already has
+ * a home — the tool's own page, which lists the change requests against its
+ * file. Showing it here too would put a second, ghost card beside every tool
+ * under review. The namespace rather than the raw name because that is the
+ * identity `scanDisk` dedups by, and the two are not the same function: an
+ * `mcp.json` server key may carry a `-`, which namespaces to the same `__` as a
+ * `.tool` id's `_`, so `a-b` and `a_b` are one tool as far as the catalog (and
+ * its secret vault) is concerned.
+ *
+ * Who may see a proposal, and how it is read at its own branch, is
+ * `shared/pending-proposals.ts` — one answer for skills and tools alike.
+ */
+export class PendingToolsService implements IPendingToolService {
+  constructor(
+    private readonly workspaceService: WorkspaceService,
+    private readonly accessControl: IAccessControl,
+    private readonly toolManuals: Pick<IToolManualService, 'listAllSummaries'>,
+    private readonly workflow: IWorkflowService,
+  ) {}
+
+  async listPendingTools(userEmail: string): Promise<PendingTool[]> {
+    // The released set, UNFILTERED by the caller's read access — the same
+    // reasoning as the skill surface: a tool someone else can read and this
+    // caller cannot is still released, and counting it as pending would invent
+    // a review that is not happening.
+    let released: Set<string>;
+    try {
+      released = new Set(
+        (await this.toolManuals.listAllSummaries()).map((s) => utcpNamespacePrefix(s.name)),
+      );
+    } catch {
+      return [];
+    }
+
+    const proposed = await visibleProposedFiles(
+      {
+        workspaceService: this.workspaceService,
+        accessControl: this.accessControl,
+        workflow: this.workflow,
+      },
+      userEmail,
+      isToolDeclaration,
+    );
+
+    const out: PendingTool[] = [];
+    for (const { cr, path, content, isAuthor } of proposed) {
+      for (const descriptor of await this.declarationsIn(cr, path, content)) {
+        if (released.has(utcpNamespacePrefix(descriptor.name))) continue;
+        out.push({
+          slug: descriptor.slug,
+          name: descriptor.name,
+          path: descriptor.path,
+          type: descriptor.type,
+          ...(descriptor.description ? { description: descriptor.description } : {}),
+          plugin: pluginOfPath(descriptor.path),
+          changeRequestNumber: cr.number,
+          branch: cr.branch,
+          authorName: cr.appAuthor?.name ?? cr.author.name ?? 'Someone',
+          createdAt: cr.createdAt,
+          isAuthor,
+        });
+      }
+    }
+    // Oldest first, and by name within one request — the request that has been
+    // waiting longest is the one that needs answering, and a list that reorders
+    // as requests arrive moves under the pointer.
+    return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.name.localeCompare(b.name));
+  }
+
+  /**
+   * The tools one proposed file declares, parsed exactly as the catalog scanner
+   * would parse it — a `.tool` is one manual, an `mcp.json` is a manual per
+   * server. A file that does not parse declares nothing: a malformed `.tool` is
+   * skipped by the catalog too, and a card for something that will never load
+   * is worse than no card.
+   */
+  private async declarationsIn(
+    cr: ChangeRequest,
+    path: string,
+    content: string,
+  ): Promise<ToolManualDescriptor[]> {
+    if (!isMcpJson(path)) {
+      let descriptor: ToolManualDescriptor;
+      try {
+        descriptor = normalizeToolManual(baseName(path), path, content);
+      } catch {
+        return [];
+      }
+      // The filename is only the PROVISIONAL slug the parser needs when the
+      // frontmatter names nothing; the catalog overwrites it with the resolved
+      // manual name and serves that as the route (`scanDisk`). Do the same here
+      // or the two disagree the moment a `.tool` declares its own `id`, or the
+      // moment a filename is not route-safe to begin with (`My Weather.tool`).
+      descriptor.slug = descriptor.name;
+      return [descriptor];
+    }
+    // The plugin's own manifest carries what the portable `mcp.json` may not:
+    // the descriptions and the `local: true` that exempts a localhost server
+    // from the reachability gate. Read at the same branch, best-effort — a
+    // missing manifest costs a sentence, not the card. No separate access
+    // check: this caller already passed the write gate on the `mcp.json`
+    // beside it, which is the plugin folder's own verdict.
+    const pluginFolder = path.slice(`${PLUGINS_DIR}/`.length, -(PLUGIN_MCP_FILE.length + 1));
+    const manifest = await readAt(
+      this.workspaceService,
+      workspaceIdForBranch(DEFAULT_BRANCH),
+      cr.branch,
+      `${PLUGINS_DIR}/${pluginFolder}/${PLUGIN_MANIFEST_FILE}`,
+    );
+    return descriptorsFromMcpJson(pluginFolder, content, manifest);
+  }
+}
+
+/** `Plugins/<…>/mcp.json` — a plugin's MCP server declarations. */
+function isMcpJson(repoRelPath: string): boolean {
+  const segments = repoRelPath.split('/');
+  return (
+    segments[0] === PLUGINS_DIR &&
+    segments.length >= 3 &&
+    segments[segments.length - 1] === PLUGIN_MCP_FILE
+  );
+}
+
+/**
+ * Is this touched path something the tool catalog would read?
+ *
+ * A `.tool` anywhere under the plugins root — including one loose at the root,
+ * which the catalog scanner picks up and which therefore has to be reviewable —
+ * or a plugin's `mcp.json`. `Plugins/mcp.json` is not one: there is no plugin
+ * there for its servers to belong to.
+ */
+function isToolDeclaration(repoRelPath: string): boolean {
+  const segments = repoRelPath.split('/');
+  if (segments[0] !== PLUGINS_DIR || segments.length < 2) return false;
+  const last = segments[segments.length - 1] ?? '';
+  // Case-insensitive, matching the catalog's own walk.
+  if (last.toLowerCase().endsWith('.tool')) return true;
+  return isMcpJson(repoRelPath);
+}

package/src/modules/tool-manuals/tool-delete.service.ts

@@ -0,0 +1,401 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import {
+  DEFAULT_BRANCH,
+  HEXIS_EXTENSION_NS,
+  PLUGIN_MANIFEST_FILE,
+  PLUGIN_MCP_FILE,
+  type AuthUser,
+} from '@bevel-software/platform-shared';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { utcpNamespacePrefix } from '../../shared/utcp-namespace.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { IFsProbe } from '../../shared/fs.contract.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { IPluginIndexService, PluginCatalogEntry } from '../plugins/plugins.contract.js';
+import type { PluginSource } from '../plugins/discovery/plugin-source.js';
+import type { ISecretsVaultService } from '../secrets-vault/secrets-vault.contract.js';
+import type { IToolManualService, ToolManualSummary } from './tool-manuals.contract.js';
+
+/**
+ * Deleting ONE tool — a `.tool` manual or one `mcp.json` server entry — from
+ * its tool page, by an owner of the plugin that holds it.
+ *
+ * The OWNER verb, and the same verdict the plugin delete uses: `canOwner` on
+ * the plugin's folder (owner lists only, no admin rescue). A tool inherits its
+ * folder's rules, so the people who may delete the whole plugin are exactly
+ * the people who may delete one thing in it; a writer who merely edits the
+ * server does not get to make it vanish.
+ *
+ * What depends on the tool is said BEFORE it goes ({@link dependents}): the
+ * skills whose `allowed-tools` name it, the other plugins that carry it, and
+ * how many stored secrets sit under its name. Deletion then removes the
+ * definition in one commit and wipes those secrets — every user's, because a
+ * vault row under a namespace nothing declares is a credential nobody can see
+ * or remove, and a later tool reusing the name would inherit it. The skills'
+ * files are NOT touched: their `allowed-tools` entry becomes a dangling name,
+ * which the skill page already surfaces.
+ *
+ * One kind of row is deliberately left behind: a key whose remainder starts
+ * with `_`, which the UTCP encoding makes indistinguishable from a longer
+ * tool's (see `isKeyInNamespace`). It is neither counted nor wiped, so the
+ * dialog's number stays true to what goes.
+ */
+
+export interface ToolDependents {
+  slug: string;
+  name: string;
+  /** `manual` — a `.tool` file; `server` — an entry in a plugin's mcp.json. */
+  source: 'manual' | 'server';
+  /** The plugin holding the tool — where the page returns after a delete. */
+  plugin: { name: string; displayName: string };
+  /** Skills (the caller can read) whose `allowed-tools` name this tool. */
+  skills: { name: string; path: string }[];
+  /** OTHER plugins that carry the tool — linking its folder, or declaring the same server. */
+  plugins: { name: string; displayName: string }[];
+  /** Stored values and shared client secrets under the tool's name, every user's. */
+  storedKeys: number;
+  /** Per-user sign-ins under the tool's name. */
+  signIns: number;
+}
+
+export class ToolDeleteError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+  ) {
+    super(message);
+    this.name = 'ToolDeleteError';
+  }
+}
+
+interface CommitDriver {
+  runPendingCommit(
+    workspaceId: string,
+    branch: string,
+    targetPath: string,
+    user: AuthUser,
+    opts?: { systemAuthorized?: boolean },
+  ): Promise<void>;
+  /** Whether a commit is sitting on the local branch unpushed — see {@link ToolDeleteService.deleteManual}. */
+  hasUnpushedCommits(workspaceId: string): Promise<boolean>;
+}
+
+interface Located {
+  tool: ToolManualSummary;
+  source: 'manual' | 'server';
+  plugin: PluginCatalogEntry;
+  /** The plugin folder (repo-relative) the tool sits in. */
+  folder: string;
+}
+
+/**
+ * Whether a skill's `allowed-tools` entry names the tool — the same rule the
+ * library applies (`neededToolsFor`): the manual name itself, or one of its
+ * tools spelled `<manual>_<tool>` / `<manual>.<tool>`, case-insensitively.
+ */
+export function allowedToolNames(entry: string, toolName: string): boolean {
+  const e = entry.toLowerCase();
+  const n = toolName.toLowerCase();
+  return e === n || e.startsWith(`${n}_`) || e.startsWith(`${n}.`);
+}
+
+/**
+ * Own-property membership. `name in obj` answers for the PROTOTYPE too, so a
+ * tool called `toString` or `constructor` would look declared by every
+ * `mcpServers` map on the tree — a dependent list naming unrelated plugins,
+ * and a delete that proceeds against a file the server is no longer in.
+ */
+function hasOwn(obj: object, name: string): boolean {
+  return Object.prototype.hasOwnProperty.call(obj, name);
+}
+
+export class ToolDeleteService {
+  constructor(
+    private readonly workspaceService: WorkspaceService,
+    private readonly commits: CommitDriver,
+    private readonly accessControl: IAccessControl,
+    private readonly toolManuals: IToolManualService,
+    private readonly skills: ISkillService,
+    private readonly pluginIndex: IPluginIndexService,
+    private readonly source: PluginSource,
+    private readonly vault: Pick<ISecretsVaultService, 'countNamespace' | 'removeNamespace'>,
+    private readonly kbDirName: string,
+    private readonly disk: IFsProbe,
+  ) {}
+
+  /** What deleting `slug` would affect. Owner-gated like the delete itself. */
+  async dependents(userEmail: string, slug: string): Promise<ToolDependents> {
+    const { tool, source, plugin, folder } = await this.authorize(userEmail, slug);
+    const [skills, plugins, secrets] = await Promise.all([
+      this.dependentSkills(userEmail, tool.name),
+      this.carryingPlugins(userEmail, tool, folder, plugin),
+      this.vault.countNamespace(utcpNamespacePrefix(tool.name)),
+    ]);
+    return {
+      slug: tool.slug,
+      name: tool.name,
+      source,
+      plugin: { name: plugin.name, displayName: plugin.displayName },
+      skills,
+      plugins,
+      storedKeys: secrets.keys,
+      signIns: secrets.signIns,
+    };
+  }
+
+  /** Delete the definition in one commit, then wipe its secrets. Returns the plugin it lived in. */
+  async deleteTool(user: AuthUser, slug: string): Promise<{ plugin: string }> {
+    const { tool, source, plugin, folder } = await this.authorize(user.email, slug);
+    if (!plugin.linksAreManaged) {
+      // A plugin read from an external format is edited in its own repository;
+      // removing its file here would be undone by the next sync, or worse.
+      throw new ToolDeleteError("This tool's plugin is managed in another format — delete it there.", 422);
+    }
+    const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+    await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH);
+    const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+
+    if (source === 'manual') await this.deleteManual(user, wsId, kbRoot, tool);
+    else await this.deleteServer(user, wsId, kbRoot, tool, folder);
+
+    // The definition is gone at HEAD; the catalogs learn now rather than at
+    // their TTL, so the cards, the sidebar and the agent's tool list agree on
+    // the very next request.
+    this.toolManuals.invalidate();
+    this.pluginIndex.invalidate();
+    // Only after the commit landed: a refused delete must leave the tool
+    // exactly as it was, credentials included.
+    await this.wipeSecrets(tool);
+    return { plugin: plugin.name };
+  }
+
+  /**
+   * Readable tool → the plugin holding it → the owner verdict on that plugin.
+   * An unreadable tool is a 404 identical to an unknown one; a readable tool
+   * the caller does not own is a 403 — they can already see it exists.
+   */
+  private async authorize(userEmail: string, slug: string): Promise<Located> {
+    const tool = (await this.toolManuals.listAccessible(userEmail)).find((t) => t.slug === slug);
+    if (!tool) throw new ToolDeleteError('No such tool.', 404);
+    const source = tool.path.endsWith(`/${PLUGIN_MCP_FILE}`)
+      ? 'server'
+      : tool.path.toLowerCase().endsWith('.tool')
+        ? 'manual'
+        : null;
+    const owned = await this.owningPlugin(userEmail, tool.path);
+    if (!source || !owned) {
+      throw new ToolDeleteError("Only the owners of this tool's plugin can delete it.", 403);
+    }
+    return { tool, source, ...owned };
+  }
+
+  /** The plugin whose folder holds `toolPath` — the deepest one — if the caller owns it. */
+  private async owningPlugin(
+    userEmail: string,
+    toolPath: string,
+  ): Promise<{ plugin: PluginCatalogEntry; folder: string } | null> {
+    let best: { plugin: PluginCatalogEntry; folder: string } | null = null;
+    for (const plugin of await this.pluginIndex.catalog()) {
+      for (const folder of plugin.folders) {
+        if (!toolPath.startsWith(`${folder}/`)) continue;
+        if (!best || folder.length > best.folder.length) best = { plugin, folder };
+      }
+    }
+    if (!best) return null;
+    const owner = await this.accessControl.canOwner(workspaceIdForBranch(DEFAULT_BRANCH), userEmail, best.folder);
+    return owner ? best : null;
+  }
+
+  /**
+   * Wipe the tool's namespace, RETRIED — the definition is already gone at
+   * HEAD and cannot come back, so a vault that blinks once must not be what
+   * leaves rows under a name nothing declares (a credential nobody can see or
+   * remove, and one a later tool reusing the name would inherit).
+   *
+   * If it still will not go, the caller hears so in those words: the delete
+   * itself happened, and the one action left is a manual one.
+   */
+  private async wipeSecrets(tool: ToolManualSummary): Promise<void> {
+    let last: unknown;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        await this.vault.removeNamespace(utcpNamespacePrefix(tool.name));
+        return;
+      } catch (err) {
+        last = err;
+        if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      }
+    }
+    const why = last instanceof Error ? last.message : String(last);
+    throw new ToolDeleteError(
+      `The ${tool.name} tool was deleted, but its stored credentials could not be wiped (${why}). ` +
+        'Remove them from Secrets before anything reuses the name.',
+      500,
+    );
+  }
+
+  private async dependentSkills(userEmail: string, toolName: string): Promise<ToolDependents['skills']> {
+    // The caller's readable skills only: naming a skill somebody cannot read
+    // would confirm it exists. `allowed-tools` has no bulk read, so one load
+    // per skill; a skill that fails to load is not a dependent we can vouch for.
+    const readable = await this.skills.listSkills(userEmail);
+    const loaded = await Promise.all(
+      readable.map(async (s) => {
+        const got = await this.skills.getSkill(userEmail, s.name).catch(() => null);
+        const allowed = got?.ok && got.kind === 'skill' ? (got.skill.allowedTools ?? []) : [];
+        return allowed.some((e) => allowedToolNames(e, toolName)) ? { name: s.name, path: s.path } : null;
+      }),
+    );
+    return loaded.filter((s): s is { name: string; path: string } => s !== null);
+  }
+
+  /**
+   * Other plugins that carry this tool: one linking a root the tool sits under,
+   * or one whose servers declare the same name (a registry profile shared
+   * across bundles). The tool's own plugin is not a dependent — it is the home.
+   */
+  private async carryingPlugins(
+    userEmail: string,
+    tool: ToolManualSummary,
+    folder: string,
+    home: PluginCatalogEntry,
+  ): Promise<ToolDependents['plugins']> {
+    const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+    let discovered;
+    try {
+      await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH);
+      const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+      discovered = await this.source.discover(kbRoot);
+    } catch (err) {
+      // A partial answer is the one thing this list must never be: "no other
+      // plugin carries it" is what the owner deletes ON, so a scan that did
+      // not finish refuses rather than reassures.
+      throw new ToolDeleteError(
+        `Couldn't read which plugins carry this tool (${err instanceof Error ? err.message : String(err)}) — nothing was deleted.`,
+        503,
+      );
+    }
+    if (discovered.unreadable.length > 0) {
+      // A HOLE is a plugin that exists and could not be read. Listing the
+      // rest as if it were the whole answer would let the dialog vouch for a
+      // tree it never saw.
+      throw new ToolDeleteError(
+        `${discovered.unreadable.length === 1 ? 'A plugin' : `${discovered.unreadable.length} plugins`} could not be read, so what carries this tool cannot be listed in full — nothing was deleted.`,
+        503,
+      );
+    }
+    const catalog = await this.pluginIndex.catalog();
+    const candidates = discovered.plugins.filter((p) => {
+      if (p.folder === folder || p.name === home.name) return false;
+      const links = p.linkedRoots.some((r) => tool.path === r || tool.path.startsWith(`${r.replace(/\/+$/, '')}/`));
+      const declares = p.mcpServers !== null && hasOwn(p.mcpServers, tool.name);
+      return links || declares;
+    });
+    // Named only to a caller who can read the plugin's folder: a dependent
+    // list is not a side door onto which plugins exist.
+    const readable = await Promise.all(
+      candidates.map((p) => this.accessControl.canRead(wsId, userEmail, p.folder)),
+    );
+    const out = new Map<string, { name: string; displayName: string }>();
+    candidates.forEach((p, i) => {
+      if (!readable[i]) return;
+      const entry = catalog.find((c) => c.name === p.name);
+      out.set(p.name, { name: p.name, displayName: entry?.displayName ?? p.displayName });
+    });
+    return [...out.values()];
+  }
+
+  /**
+   * Park-then-commit, as the plugin delete does: the file is renamed to a
+   * dot-prefixed sibling the scanner ignores, the deletion committed, and only
+   * a landed commit lets the parked bytes go. A refused commit renames it
+   * back, so a failed delete is a no-op.
+   */
+  private async deleteManual(user: AuthUser, wsId: string, kbRoot: string, tool: ToolManualSummary): Promise<void> {
+    const abs = path.join(kbRoot, ...tool.path.split('/'));
+    if ((await this.disk.lstatOrNull(abs))?.isFile() !== true) throw new ToolDeleteError('No such tool.', 404);
+    const parked = path.join(path.dirname(abs), `.deleting-${randomUUID()}`);
+    await fs.rename(abs, parked);
+    try {
+      await this.commits.runPendingCommit(wsId, DEFAULT_BRANCH, `${this.kbDirName}/${tool.path}`, user, {
+        // The route authorized the delete with the owner verb; see class note.
+        systemAuthorized: true,
+      });
+    } catch (err) {
+      // Restore ONLY when nothing landed. The pipeline commits locally and
+      // THEN pushes, so a refused push leaves a commit that already removed
+      // the file: renaming it back there would leave the working tree dirty
+      // against HEAD — re-adding, on the next commit, the very tool this one
+      // deleted, which is the state the workflow layer's own recovery
+      // misreads (McpServerEditService refuses to touch the tree for the same
+      // reason). A probe that itself fails counts as "a commit may exist": the
+      // park survives, dot-prefixed and invisible to the scanner, for a person
+      // to clear — a delete must never destroy more than it names.
+      const committed = await this.commits.hasUnpushedCommits(wsId).catch(() => true);
+      if (!committed) await fs.rename(parked, abs).catch(() => {});
+      throw err;
+    }
+    await fs.rm(parked, { force: true }).catch(() => {});
+  }
+
+  /**
+   * Remove one server from BOTH files that describe it — the entry in
+   * `mcp.json` and its half in `plugin.json`'s extensions block — and commit
+   * them together, the way a server edit does. Leaving the extensions half
+   * behind would re-declare auth for a server that no longer exists.
+   */
+  private async deleteServer(
+    user: AuthUser,
+    wsId: string,
+    kbRoot: string,
+    tool: ToolManualSummary,
+    folder: string,
+  ): Promise<void> {
+    const pluginDir = path.join(kbRoot, ...path.posix.dirname(tool.path).split('/'));
+    const mcpAbs = path.join(pluginDir, PLUGIN_MCP_FILE);
+    const manifestAbs = path.join(pluginDir, PLUGIN_MANIFEST_FILE);
+    const mcp = await this.disk.readJsonObject(mcpAbs);
+    const servers = mcp?.mcpServers;
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers) || !hasOwn(servers, tool.name)) {
+      throw new ToolDeleteError('No such server.', 404);
+    }
+    delete (servers as Record<string, unknown>)[tool.name];
+
+    const manifest = await this.disk.readJsonObject(manifestAbs);
+    const extServers = (
+      (manifest?.extensions as Record<string, unknown> | undefined)?.[HEXIS_EXTENSION_NS] as
+        | Record<string, unknown>
+        | undefined
+    )?.mcpServers;
+    const touchManifest =
+      manifest !== null &&
+      extServers !== null &&
+      typeof extServers === 'object' &&
+      !Array.isArray(extServers) &&
+      hasOwn(extServers, tool.name);
+    if (touchManifest) delete (extServers as Record<string, unknown>)[tool.name];
+
+    const [mcpBefore, manifestBefore] = await Promise.all([
+      fs.readFile(mcpAbs, 'utf8'),
+      touchManifest ? fs.readFile(manifestAbs, 'utf8') : Promise.resolve(null),
+    ]);
+    try {
+      await fs.writeFile(mcpAbs, `${JSON.stringify(mcp, null, 2)}\n`, 'utf8');
+      if (touchManifest) await fs.writeFile(manifestAbs, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    } catch (err) {
+      await fs.writeFile(mcpAbs, mcpBefore, 'utf8').catch(() => {});
+      if (manifestBefore !== null) await fs.writeFile(manifestAbs, manifestBefore, 'utf8').catch(() => {});
+      throw err;
+    }
+    // Commit-stage failures propagate as-is: the pipeline may already hold a
+    // local commit, and rewriting the tree under it is the state its own
+    // recovery misreads (same contract as McpServerEditService).
+    await this.commits.runPendingCommit(wsId, DEFAULT_BRANCH, `${this.kbDirName}/${folder}`, user, {
+      systemAuthorized: true,
+    });
+  }
+}
+