@brainmcp/brainmcp 0.1.12 → 0.1.14

package/dist/lib/credentials.js

@@ -0,0 +1,304 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { withSessionLock } from '../runtime/lock.js';
+import { closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { assertNotSymlink, ensureDirectory0700, getBrainHome, getCurrentAccountId, resolveStateDir, writeAtomic0600 } from '../runtime/storage.js';
+import { createPlatformVault, UnavailableSecretVault, vaultAccountKey, LEGACY_VAULT_ACCOUNT } from './vault.js';
+export class MemoryCredentialStore {
+    creds = null;
+    locked = false;
+    async get() {
+        return this.creds ? JSON.parse(JSON.stringify(this.creds)) : null;
+    }
+    async set(credentials) {
+        this.creds = JSON.parse(JSON.stringify(credentials));
+    }
+    async clear() {
+        this.creds = null;
+    }
+    async adoptLegacySecret() { }
+    async withRefreshLock(action) {
+        while (this.locked) {
+            await new Promise((r) => setTimeout(r, 20));
+        }
+        this.locked = true;
+        try {
+            return await action(await this.get());
+        }
+        finally {
+            this.locked = false;
+        }
+    }
+}
+export class FileCredentialStore {
+    lockContext = new AsyncLocalStorage();
+    baseDir;
+    warn;
+    allowInsecure;
+    constructor(options = {}) {
+        this.baseDir = options.baseDir ?? getBrainHome();
+        this.warn = options.warn ?? ((msg) => console.warn(`[brainmcp credentials] ${msg}`));
+        this.allowInsecure = options.allowInsecureModesForTesting ?? false;
+    }
+    credentialPaths() {
+        const stateDir = this.lockContext.getStore() ?? resolveStateDir(this.baseDir);
+        return {
+            stateDir,
+            filePath: join(stateDir, 'credentials.json'),
+            lockPath: join(stateDir, 'credentials.lock'),
+        };
+    }
+    assertSafePath(targetPath, checkFileExists = true) {
+        if (this.allowInsecure)
+            return;
+        // Check directory
+        const dir = dirname(targetPath);
+        if (existsSync(dir)) {
+            const dirStat = lstatSync(dir);
+            if (dirStat.isSymbolicLink()) {
+                throw new Error(`Insecure configuration: directory ${dir} is a symbolic link.`);
+            }
+            if (process.platform !== 'win32') {
+                const mode = dirStat.mode & 0o777;
+                if (mode !== 0o700) {
+                    throw new Error(`Insecure permissions on ${dir}: permissions are ${mode.toString(8)}, must be 700.`);
+                }
+                if (process.getuid && dirStat.uid !== process.getuid()) {
+                    throw new Error(`Insecure ownership: directory ${dir} is not owned by current user.`);
+                }
+            }
+        }
+        // Check target file if it exists
+        if (existsSync(targetPath)) {
+            const fileStat = lstatSync(targetPath);
+            if (fileStat.isSymbolicLink()) {
+                throw new Error(`Insecure configuration: file ${targetPath} is a symbolic link.`);
+            }
+            if (!fileStat.isFile()) {
+                throw new Error(`Insecure configuration: ${targetPath} is not a regular file.`);
+            }
+            if (process.platform !== 'win32') {
+                const mode = fileStat.mode & 0o777;
+                if (mode !== 0o600) {
+                    throw new Error(`Insecure permissions on ${targetPath}: permissions are ${mode.toString(8)}, must be 600.`);
+                }
+                if (process.getuid && fileStat.uid !== process.getuid()) {
+                    throw new Error(`Insecure ownership: file ${targetPath} is not owned by current user.`);
+                }
+            }
+        }
+        else if (checkFileExists) {
+            // File doesn't exist yet, which is fine
+        }
+    }
+    ensureDirectory() {
+        if (!existsSync(this.baseDir)) {
+            mkdirSync(this.baseDir, { recursive: true, mode: 0o700 });
+        }
+        else if (!this.allowInsecure) {
+            const homeStat = lstatSync(this.baseDir);
+            if (homeStat.isSymbolicLink()) {
+                throw new Error(`Insecure configuration: directory ${this.baseDir} is a symbolic link.`);
+            }
+        }
+        const paths = this.credentialPaths();
+        ensureDirectory0700(paths.stateDir);
+        this.assertSafePath(paths.filePath, false);
+        return paths;
+    }
+    async get() {
+        const { filePath } = this.credentialPaths();
+        if (!existsSync(filePath)) {
+            return null;
+        }
+        this.assertSafePath(filePath);
+        try {
+            const raw = readFileSync(filePath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (parsed.version !== 1) {
+                this.warn(`Unsupported credentials schema version: ${parsed.version}`);
+                return null;
+            }
+            return parsed;
+        }
+        catch (error) {
+            this.warn(`Failed to read credentials: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    async set(credentials) {
+        const { filePath, stateDir } = this.ensureDirectory();
+        const tempFile = join(stateDir, `credentials.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`);
+        const data = JSON.stringify(credentials, null, 2);
+        // Write to temp file with mode 0600
+        try {
+            const fd = openSync(tempFile, constants.O_CREAT |
+                constants.O_EXCL |
+                constants.O_WRONLY |
+                (typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0), 0o600);
+            try {
+                writeFileSync(fd, data, 'utf-8');
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            this.assertSafePath(tempFile);
+            // Atomically rename
+            renameSync(tempFile, filePath);
+            this.assertSafePath(filePath);
+        }
+        catch (error) {
+            try {
+                if (existsSync(tempFile))
+                    unlinkSync(tempFile);
+            }
+            catch {
+                // Best-effort cleanup.
+            }
+            throw error;
+        }
+    }
+    async clear() {
+        const { filePath } = this.credentialPaths();
+        if (existsSync(filePath)) {
+            this.assertSafePath(filePath);
+            unlinkSync(filePath);
+        }
+    }
+    async adoptLegacySecret() { }
+    async withRefreshLock(action) {
+        const stateDir = this.credentialPaths().stateDir;
+        return withSessionLock('credentials', () => this.lockContext.run(stateDir, async () => action(await this.get())), { baseDir: stateDir });
+    }
+}
+export class VaultCredentialStore {
+    vault;
+    lockStore;
+    baseDir;
+    lockContext = new AsyncLocalStorage();
+    constructor(vault, lockStore, baseDir) {
+        this.vault = vault;
+        this.lockStore = lockStore;
+        this.baseDir = baseDir;
+    }
+    get backend() {
+        return 'os_vault';
+    }
+    backendMarkerPath() {
+        return join(this.lockContext.getStore()?.stateDir ?? resolveStateDir(this.baseDir ?? getBrainHome()), 'credentials.backend.json');
+    }
+    secretKey() {
+        if (this.lockContext.getStore())
+            return this.lockContext.getStore().key;
+        const accountId = getCurrentAccountId(this.baseDir ?? getBrainHome());
+        return accountId ? vaultAccountKey(accountId) : LEGACY_VAULT_ACCOUNT;
+    }
+    async get() {
+        // A fresh/isolated Brain home must not probe or adopt another home's
+        // machine-wide vault entry merely because it uses the same account key.
+        if (!existsSync(this.backendMarkerPath()))
+            return null;
+        assertNotSymlink(this.backendMarkerPath());
+        const raw = await this.vault.getSecret(this.secretKey());
+        if (!raw)
+            return null;
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed.version !== 1)
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(credentials) {
+        const marker = this.backendMarkerPath();
+        await this.vault.setSecret(JSON.stringify(credentials), this.secretKey());
+        ensureDirectory0700(dirname(marker));
+        writeAtomic0600(marker, JSON.stringify({ backend: 'os_vault', updatedAt: new Date().toISOString() }));
+    }
+    async clear() {
+        const marker = this.backendMarkerPath();
+        await this.vault.deleteSecret(this.secretKey());
+        if (existsSync(marker)) {
+            assertNotSymlink(marker);
+            unlinkSync(marker);
+        }
+    }
+    async adoptLegacySecret() {
+        const accountId = getCurrentAccountId(this.baseDir ?? getBrainHome());
+        if (!accountId)
+            return;
+        const namespaced = vaultAccountKey(accountId);
+        if (await this.vault.getSecret(namespaced))
+            return;
+        const legacy = await this.vault.getSecret(LEGACY_VAULT_ACCOUNT);
+        if (!legacy)
+            return;
+        await this.vault.setSecret(legacy, namespaced);
+        await this.vault.deleteSecret(LEGACY_VAULT_ACCOUNT);
+        writeAtomic0600(this.backendMarkerPath(), JSON.stringify({ backend: 'os_vault', updatedAt: new Date().toISOString() }));
+    }
+    async withRefreshLock(action) {
+        const context = { key: this.secretKey(), stateDir: resolveStateDir(this.baseDir ?? getBrainHome()) };
+        return this.lockStore.withRefreshLock(() => this.lockContext.run(context, async () => action(await this.get())));
+    }
+}
+export const FILE_CREDENTIALS_ACK_FILENAME = 'allow-file-credentials';
+export function fileCredentialsAcknowledged(baseDir) {
+    if (process.env.BRAINMCP_ALLOW_FILE_CREDENTIALS === '1')
+        return true;
+    const home = baseDir ?? getBrainHome();
+    const acknowledgement = join(home, FILE_CREDENTIALS_ACK_FILENAME);
+    if (!existsSync(acknowledgement))
+        return false;
+    const stat = lstatSync(acknowledgement);
+    if (stat.isSymbolicLink() || !stat.isFile())
+        return false;
+    if (process.platform !== 'win32') {
+        if ((stat.mode & 0o777) !== 0o600)
+            return false;
+        if (process.getuid && stat.uid !== process.getuid())
+            return false;
+    }
+    return true;
+}
+export function writeFileCredentialsAcknowledgement(baseDir) {
+    const home = baseDir ?? getBrainHome();
+    ensureDirectory0700(home);
+    writeAtomic0600(join(home, FILE_CREDENTIALS_ACK_FILENAME), JSON.stringify({ acknowledgedAt: new Date().toISOString() }));
+}
+export async function createDefaultCredentialStore(options = {}) {
+    const warn = options.warn ?? ((msg) => console.warn(`[brainmcp credentials] ${msg}`));
+    const fileStore = new FileCredentialStore({
+        baseDir: options.baseDir,
+        warn,
+    });
+    const vault = options.vault ??
+        (options.baseDir ? new UnavailableSecretVault() : createPlatformVault());
+    const home = options.baseDir ?? getBrainHome();
+    const existingFile = existsSync(join(resolveStateDir(home), 'credentials.json'));
+    // An acknowledged file login remains usable when the OS vault later becomes
+    // available. Only the active account's file determines that backend.
+    if (existingFile)
+        return { store: fileStore, backend: 'file' };
+    if (await vault.isAvailable()) {
+        return { store: new VaultCredentialStore(vault, fileStore, options.baseDir), backend: 'os_vault' };
+    }
+    const allowFile = options.allowFileCredentials === true ||
+        existingFile ||
+        fileCredentialsAcknowledged(options.baseDir);
+    if (!allowFile) {
+        throw new Error('OS credential vault is unavailable. Re-run `brainmcp login --allow-file-credentials` to store tokens in an owner-only ~/.brainmcp file (0700/0600, no symlinks).');
+    }
+    if (!existingFile) {
+        warn('OS credential vault is unavailable; using the owner-only ~/.brainmcp file store. This is an explicit fallback, not the default.');
+    }
+    if (options.persistFileAcknowledgement) {
+        writeFileCredentialsAcknowledgement(options.baseDir);
+    }
+    return { store: fileStore, backend: 'file' };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,EAAoB,MAAM,YAAY,CAAC;AAgClI,MAAM,OAAO,qBAAqB;IACxB,KAAK,GAA6B,IAAI,CAAC;IACvC,MAAM,GAAG,KAAK,CAAC;IAEvB,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAA8B;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,iBAAiB,KAAmB,CAAC;IAE3C,KAAK,CAAC,eAAe,CAAI,MAAyD;QAChF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAQD,MAAM,OAAO,mBAAmB;IACb,WAAW,GAAG,IAAI,iBAAiB,EAAU,CAAC;IACvD,OAAO,CAAS;IAChB,IAAI,CAA4B;IAChC,aAAa,CAAU;IAE/B,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,4BAA4B,IAAI,KAAK,CAAC;IACrE,CAAC;IAEO,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SAC7C,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,UAAkB,EAAE,eAAe,GAAG,IAAI;QAC/D,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAE/B,kBAAkB;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,sBAAsB,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CACpF,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,gCAAgC,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,sBAAsB,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,yBAAyB,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;gBACnC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,UAAU,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAC3F,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,gCAAgC,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAA8B;QACtC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAEtD,MAAM,QAAQ,GAAG,IAAI,CACnB,QAAQ,EACR,mBAAmB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAC3E,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAElD,oCAAoC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CACjB,QAAQ,EACR,SAAS,CAAC,OAAO;gBACf,SAAS,CAAC,MAAM;gBAChB,SAAS,CAAC,QAAQ;gBAClB,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EACvE,KAAK,CACN,CAAC;YACF,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACjC,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,oBAAoB;YACpB,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,QAAQ,CAAC;oBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC9B,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,KAAmB,CAAC;IAE3C,KAAK,CAAC,eAAe,CAAI,MAAyD;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;QACjD,OAAO,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3I,CAAC;CAEF;AAID,MAAM,OAAO,oBAAoB;IAGZ;IACA;IACA;IAJF,WAAW,GAAG,IAAI,iBAAiB,EAAqC,CAAC;IAC1F,YACmB,KAAkB,EAClB,SAA8B,EAC9B,OAAgB;QAFhB,UAAK,GAAL,KAAK,CAAa;QAClB,cAAS,GAAT,SAAS,CAAqB;QAC9B,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,iBAAiB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACpI,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAG,CAAC,GAAG,CAAC;QACzE,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,GAAG;QACP,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAA8B;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,eAAe,CACb,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAC7E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QACpD,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,MAAyD;QAChF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,EAAE,CAAC;QACrG,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAgB;IAClE,MAAM,IAAI,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC;IACvC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,eAAe,CACb,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAwC,EAAE;IAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,KAAK,GACT,OAAO,CAAC,KAAK;QACb,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACjF,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE/D,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,oBAAoB,KAAK,IAAI;QACrC,YAAY;QACZ,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kKAAkK,CACnK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CACF,iIAAiI,CAClI,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;QACvC,mCAAmC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/lib/endpoints.d.ts

@@ -0,0 +1,5 @@
+export declare const COMPANION_WORKSPACES_PATH = "/api/mcp/workspaces";
+export declare function resolveCompanionApiUrl(env?: NodeJS.Dict<string | undefined>): string;
+export declare function resolveCompanionOAuthIssuer(env?: NodeJS.Dict<string | undefined>): string;
+export declare function describeMisdirectedCompanionApi(apiUrl: string): string | null;
+export declare function companionWorkspacesUrl(apiUrl?: string): string;

package/dist/lib/endpoints.js

@@ -0,0 +1,31 @@
+import { BRAIN_API_ORIGIN, BRAIN_MCP_ORIGIN } from '../agent-config.js';
+import { validateHttpUrl } from './http.js';
+export const COMPANION_WORKSPACES_PATH = '/api/mcp/workspaces';
+const MCP_REST_HOSTS = new Set(['mcp.brainmcp.ai', 'dash.brainmcp.ai']);
+function absoluteHttpUrl(value) {
+    const url = validateHttpUrl(value.replace(/\/+$/, ''));
+    const path = url.pathname === '/' ? '' : url.pathname.replace(/\/+$/, '');
+    return `${url.origin}${path}`;
+}
+export function resolveCompanionApiUrl(env = process.env) {
+    return absoluteHttpUrl(env.BRAINMCP_API_URL?.trim() || BRAIN_API_ORIGIN);
+}
+export function resolveCompanionOAuthIssuer(env = process.env) {
+    return absoluteHttpUrl(env.BRAINMCP_OAUTH_ISSUER?.trim() || BRAIN_MCP_ORIGIN);
+}
+export function describeMisdirectedCompanionApi(apiUrl) {
+    let hostname;
+    try {
+        hostname = new URL(apiUrl).hostname;
+    }
+    catch {
+        return null;
+    }
+    if (!MCP_REST_HOSTS.has(hostname))
+        return null;
+    return `Companion REST must use ${BRAIN_API_ORIGIN}, not ${apiUrl}. Unset BRAINMCP_API_URL or point it at the API origin.`;
+}
+export function companionWorkspacesUrl(apiUrl = resolveCompanionApiUrl()) {
+    return new URL(COMPANION_WORKSPACES_PATH, `${absoluteHttpUrl(apiUrl)}/`).toString();
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/lib/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/lib/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAE/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAExE,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAuC,OAAO,CAAC,GAAG;IACvF,OAAO,eAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAuC,OAAO,CAAC,GAAG;IAC5F,OAAO,eAAe,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,2BAA2B,gBAAgB,SAAS,MAAM,yDAAyD,CAAC;AAC7H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB,sBAAsB,EAAE;IAC9E,OAAO,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC"}

package/dist/lib/http.d.ts

@@ -0,0 +1,3 @@
+/** Keep deadlines active through response-body consumption as well as headers. */
+export declare function withRequestDeadline<T>(timeoutMs: number, signal: AbortSignal | undefined, action: (signal: AbortSignal) => Promise<T>): Promise<T>;
+export declare function validateHttpUrl(value: string, trustedBase?: string): URL;

package/dist/lib/http.js

@@ -0,0 +1,51 @@
+import { BRAIN_API_ORIGIN, BRAIN_DASHBOARD_URL, BRAIN_MCP_ORIGIN } from '../agent-config.js';
+/** Keep deadlines active through response-body consumption as well as headers. */
+export async function withRequestDeadline(timeoutMs, signal, action) {
+    const controller = new AbortController();
+    const abort = () => controller.abort(signal?.reason);
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const timer = setTimeout(() => controller.abort(new Error('Request timed out')), timeoutMs);
+    let onAbort;
+    try {
+        controller.signal.throwIfAborted();
+        const cancelled = new Promise((_, reject) => {
+            onAbort = () => reject(new Error('Request cancelled or timed out'));
+            controller.signal.addEventListener('abort', onAbort, { once: true });
+        });
+        return await Promise.race([action(controller.signal), cancelled]);
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+        if (onAbort)
+            controller.signal.removeEventListener('abort', onAbort);
+    }
+}
+const BRAIN_ORIGINS = new Set([
+    BRAIN_MCP_ORIGIN,
+    BRAIN_API_ORIGIN,
+    new URL(BRAIN_DASHBOARD_URL).origin,
+]);
+export function validateHttpUrl(value, trustedBase) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('Invalid API or OAuth endpoint URL.');
+    }
+    const loopback = url.hostname === '127.0.0.1' || url.hostname === 'localhost' || url.hostname === '[::1]';
+    if ((url.protocol !== 'https:' && !(loopback && url.protocol === 'http:')) || url.username || url.password || url.hash) {
+        throw new Error('API and OAuth endpoints require HTTPS (HTTP is allowed only on loopback), without credentials or fragments.');
+    }
+    if (trustedBase) {
+        const origin = new URL(trustedBase).origin;
+        if (url.origin !== origin && !(BRAIN_ORIGINS.has(origin) && BRAIN_ORIGINS.has(url.origin))) {
+            throw new Error('OAuth endpoint origin does not match the trusted Brain issuer.');
+        }
+    }
+    return url;
+}
+//# sourceMappingURL=http.js.map

package/dist/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEhG,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,MAA+B,EAC/B,MAA2C;IAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,OAAO;QAAE,KAAK,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5F,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACjD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,gBAAgB;IAChB,gBAAgB;IAChB,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,WAAoB;IACjE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC1G,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/managed.d.ts

@@ -8,3 +8,11 @@ export declare function removeTomlBlock(existing: string | undefined): string |
 export declare function upsertJsonServer(existing: string | undefined, client: ClientId, rootKey?: 'mcpServers' | 'servers', scope?: Scope): string;
 export declare function removeJsonServer(existing: string | undefined, rootKey?: 'mcpServers' | 'servers'): string | undefined;
 export declare function parseJsonc(source: string): Record<string, unknown>;
+/**
+ * Update one JSONC property without reserializing the rest of the document.
+ * This is used for hook files so comments and unrelated host configuration
+ * survive BrainMCP install/remove operations.
+ */
+export declare function upsertJsoncPath(existing: string | undefined, path: readonly string[], value: unknown): string;
+/** Remove one JSONC property while preserving the rest of the source text. */
+export declare function removeJsoncPath(existing: string | undefined, path: readonly string[]): string | undefined;

package/dist/lib/managed.js

@@ -130,6 +130,58 @@ export function parseJsonc(source) {
         throw new Error(`Invalid JSON/JSONC configuration: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/**
+ * Update one JSONC property without reserializing the rest of the document.
+ * This is used for hook files so comments and unrelated host configuration
+ * survive BrainMCP install/remove operations.
+ */
+export function upsertJsoncPath(existing, path, value) {
+    if (path.length === 0)
+        throw new Error('A JSONC property path is required.');
+    let source = existing?.trim() ? existing : '{}\n';
+    parseJsonc(source);
+    let objectOpen = rootObjectOpen(source);
+    for (const segment of path.slice(0, -1)) {
+        const object = findObjectPropertyObject(source, objectOpen, segment);
+        if (!object) {
+            source = insertJsonObjectProperty(source, objectOpen, segment, {});
+            objectOpen = findObjectPropertyObject(source, objectOpen, segment).valueOpen;
+            continue;
+        }
+        objectOpen = object.valueOpen;
+    }
+    const propertyName = path.at(-1);
+    const property = findObjectProperty(source, objectOpen, propertyName);
+    if (property) {
+        const parsed = parseJsonc(source);
+        let current = parsed;
+        for (const segment of path) {
+            current = current && typeof current === 'object' && !Array.isArray(current)
+                ? current[segment]
+                : undefined;
+        }
+        if (sameJsonValue(current, value))
+            return existing ?? source;
+        return replaceJsonPropertyValue(source, property, value);
+    }
+    return insertJsonObjectProperty(source, objectOpen, propertyName, value);
+}
+/** Remove one JSONC property while preserving the rest of the source text. */
+export function removeJsoncPath(existing, path) {
+    if (existing === undefined)
+        return undefined;
+    if (path.length === 0)
+        throw new Error('A JSONC property path is required.');
+    parseJsonc(existing);
+    let objectOpen = rootObjectOpen(existing);
+    for (const segment of path.slice(0, -1)) {
+        const object = findObjectPropertyObject(existing, objectOpen, segment);
+        if (!object)
+            return existing;
+        objectOpen = object.valueOpen;
+    }
+    return removeObjectProperty(existing, objectOpen, path.at(-1));
+}
 function isBrainConfig(value) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         return false;
@@ -268,6 +320,20 @@ function replaceJsonPropertyValue(source, property, value) {
     const rendered = JSON.stringify(value, null, 2).replace(/\n/g, `\n${indent}`);
     return `${source.slice(0, property.valueStart)}${rendered}${source.slice(property.valueEnd + 1)}`;
 }
+function insertJsonObjectProperty(source, objectOpen, propertyName, value) {
+    const close = matchingBrace(source, objectOpen);
+    const inner = source.slice(objectOpen + 1, close);
+    const baseIndent = lineIndentAt(source, objectOpen);
+    const entryIndent = `${baseIndent}  `;
+    const renderedValue = JSON.stringify(value, null, 2).replace(/\n/g, `\n${entryIndent}`);
+    const rendered = `${JSON.stringify(propertyName)}: ${renderedValue}`;
+    if (!inner.trim()) {
+        return `${source.slice(0, objectOpen + 1)}\n${entryIndent}${rendered}\n${baseIndent}${source.slice(close)}`;
+    }
+    const end = objectOpen + 1 + inner.search(/\s*$/);
+    const comma = source.slice(objectOpen + 1, end).trimEnd().endsWith(',') ? '' : ',';
+    return `${source.slice(0, end)}${comma}\n${entryIndent}${rendered}${source.slice(end)}`;
+}
 /** Finds an object-valued property at the current object's top level, ignoring strings/comments. */
 function findObjectPropertyObject(source, objectOpen, propertyName) {
     const property = findObjectProperty(source, objectOpen, propertyName);
@@ -281,21 +347,21 @@ function findObjectPropertyObject(source, objectOpen, propertyName) {
         valueClose: property.valueEnd,
     };
 }
-/** Removes one top-level object property without reformatting its siblings or their comments. */
+/** Removes one top-level JSON property without reformatting its siblings or comments. */
 function removeObjectProperty(source, objectOpen, propertyName) {
-    const property = findObjectPropertyObject(source, objectOpen, propertyName);
+    const property = findObjectProperty(source, objectOpen, propertyName);
     if (!property)
-        throw new Error(`Could not locate the ${propertyName} object.`);
+        return source;
     const objectClose = matchingBrace(source, objectOpen);
-    const next = skipJsoncTrivia(source, property.valueClose + 1, objectClose);
+    const next = skipJsoncTrivia(source, property.valueEnd + 1, objectClose);
     if (source[next] === ',') {
         return `${source.slice(0, property.keyStart)}${source.slice(next + 1)}`;
     }
     const previousComma = previousTopLevelComma(source, objectOpen, property.keyStart);
     if (previousComma >= 0) {
-        return `${source.slice(0, previousComma)}${source.slice(property.valueClose + 1)}`;
+        return `${source.slice(0, previousComma)}${source.slice(property.valueEnd + 1)}`;
     }
-    return `${source.slice(0, property.keyStart)}${source.slice(property.valueClose + 1)}`;
+    return `${source.slice(0, property.keyStart)}${source.slice(property.valueEnd + 1)}`;
 }
 function rootObjectOpen(source) {
     const open = skipJsoncTrivia(source, 0, source.length);