@codeam/shared 2.61.44 → 2.61.45

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'github_issues' | 'github' | 'gitlab';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'github_issues' | 'github' | 'gitlab';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -400,15 +400,32 @@ interface IntegrationApiKeyField {
     help?: string;
 }
 type IntegrationHealth = 'ok' | 'expired' | 'revoked';
-/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`). */
+/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`).
+ *
+ * Two transports:
+ *  - **stdio (default):** the shim spawns `command args` (with `envMapping`
+ *    credentials in the env) and byte-pipes it to the agent.
+ *  - **HTTP (`httpUrl` set):** the shim connects to a REMOTE MCP over
+ *    Streamable HTTP and relays it to the agent's stdio — for vendors that only
+ *    ship a hosted MCP (e.g. PostHog `mcp.posthog.com`). `command`/`args` are
+ *    unused (empty); credentials go in `httpHeaders` (never `envMapping`).
+ */
 interface IntegrationMcpDelivery {
     command: string;
     args: string[];
-    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. */
+    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. STDIO transport. */
     envMapping: Record<string, string>;
     /** Static, non-credential env the server needs to boot (e.g. mode flags).
-     *  Merged into the child env BENEATH the credential envMapping. Never secrets. */
+     *  Merged into the child env BENEATH the credential envMapping. Never secrets. STDIO transport. */
     staticEnv?: Record<string, string>;
+    /** HTTP transport — a REMOTE MCP URL (Streamable HTTP). When set, the shim
+     *  relays to it instead of spawning `command`. */
+    httpUrl?: string;
+    /** HTTP transport — header name → value TEMPLATE with `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken at spawn (e.g.
+     *  `{ Authorization: 'Bearer {accessToken}' }`). The token stays server-side of
+     *  the shim — never on argv. */
+    httpHeaders?: Record<string, string>;
 }
 interface IntegrationDelivery {
     mcp?: IntegrationMcpDelivery;
@@ -531,7 +548,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'github_issues' | 'github' | 'gitlab';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'github_issues' | 'github' | 'gitlab';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -400,15 +400,32 @@ interface IntegrationApiKeyField {
     help?: string;
 }
 type IntegrationHealth = 'ok' | 'expired' | 'revoked';
-/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`). */
+/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`).
+ *
+ * Two transports:
+ *  - **stdio (default):** the shim spawns `command args` (with `envMapping`
+ *    credentials in the env) and byte-pipes it to the agent.
+ *  - **HTTP (`httpUrl` set):** the shim connects to a REMOTE MCP over
+ *    Streamable HTTP and relays it to the agent's stdio — for vendors that only
+ *    ship a hosted MCP (e.g. PostHog `mcp.posthog.com`). `command`/`args` are
+ *    unused (empty); credentials go in `httpHeaders` (never `envMapping`).
+ */
 interface IntegrationMcpDelivery {
     command: string;
     args: string[];
-    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. */
+    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. STDIO transport. */
     envMapping: Record<string, string>;
     /** Static, non-credential env the server needs to boot (e.g. mode flags).
-     *  Merged into the child env BENEATH the credential envMapping. Never secrets. */
+     *  Merged into the child env BENEATH the credential envMapping. Never secrets. STDIO transport. */
     staticEnv?: Record<string, string>;
+    /** HTTP transport — a REMOTE MCP URL (Streamable HTTP). When set, the shim
+     *  relays to it instead of spawning `command`. */
+    httpUrl?: string;
+    /** HTTP transport — header name → value TEMPLATE with `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken at spawn (e.g.
+     *  `{ Authorization: 'Bearer {accessToken}' }`). The token stays server-side of
+     *  the shim — never on argv. */
+    httpHeaders?: Record<string, string>;
 }
 interface IntegrationDelivery {
     mcp?: IntegrationMcpDelivery;
@@ -531,7 +548,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -909,6 +909,44 @@ var INTEGRATION_REGISTRY = {
       }
     }
   },
+  posthog: {
+    id: "posthog",
+    name: "PostHog",
+    icon: "posthog",
+    category: "observability",
+    // LIVE — api_key: the user pastes a PostHog Personal API Key (phx_…, created
+    // with the "MCP Server" preset). PostHog's MCP is HOSTED-ONLY
+    // (mcp.posthog.com) over HTTP, and its stdio bridge (mcp-remote) forces its
+    // own browser OAuth — incompatible with our headless broker. So delivery
+    // uses the shim's HTTP transport: it relays to the hosted MCP with the key
+    // as a Bearer header (exactly Cursor's {url, headers} config). No OAuth, no
+    // GSM secret; a backend VALIDATOR proves the key + vaults it.
+    enabled: true,
+    auth: {
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "Personal API Key",
+          placeholder: "phx_xxxxxxxxxxxxxxxx",
+          secret: true,
+          help: 'PostHog \u2192 Settings \u2192 Personal API keys \u2192 create with the "MCP Server" preset (scopes it to a project).'
+        }
+      ]
+    },
+    delivery: {
+      mcp: {
+        // HTTP transport (not a spawned stdio server) — the shim relays to
+        // PostHog's hosted MCP with the key as a Bearer header. The key stays
+        // server-side of the shim, never on argv.
+        command: "",
+        args: [],
+        envMapping: {},
+        httpUrl: "https://mcp.posthog.com/mcp",
+        httpHeaders: { Authorization: "Bearer {accessToken}" }
+      }
+    }
+  },
   notion: {
     id: "notion",
     name: "Notion",
@@ -1313,7 +1351,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "posthog",
   "clickup",
   "figma",
   "trello",