@codeam/shared 2.61.44 → 2.61.46

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'github_issues' | 'github' | 'gitlab';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'github_issues' | 'github' | 'gitlab';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -388,8 +388,9 @@ type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' |
  * field the delivery `envMapping` references.
  */
 interface IntegrationApiKeyField {
-    /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`, …). */
-    key: 'accessToken' | 'orgUrl';
+    /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`,
+     *  `appKey`, `host`, …). */
+    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host';
     /** Form label. */
     label: string;
     /** Example / placeholder. */
@@ -400,15 +401,35 @@ interface IntegrationApiKeyField {
     help?: string;
 }
 type IntegrationHealth = 'ok' | 'expired' | 'revoked';
-/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`). */
+/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`).
+ *
+ * Two transports:
+ *  - **stdio (default):** the shim spawns `command args` (with `envMapping`
+ *    credentials in the env) and byte-pipes it to the agent.
+ *  - **HTTP (`httpUrl` set):** the shim connects to a REMOTE MCP over
+ *    Streamable HTTP and relays it to the agent's stdio — for vendors that only
+ *    ship a hosted MCP (e.g. PostHog `mcp.posthog.com`). `command`/`args` are
+ *    unused (empty); credentials go in `httpHeaders` (never `envMapping`).
+ */
 interface IntegrationMcpDelivery {
     command: string;
     args: string[];
-    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. */
+    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. STDIO transport. */
     envMapping: Record<string, string>;
     /** Static, non-credential env the server needs to boot (e.g. mode flags).
-     *  Merged into the child env BENEATH the credential envMapping. Never secrets. */
+     *  Merged into the child env BENEATH the credential envMapping. Never secrets. STDIO transport. */
     staticEnv?: Record<string, string>;
+    /** HTTP transport — a REMOTE MCP URL (Streamable HTTP). When set, the shim
+     *  relays to it instead of spawning `command`. May carry `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken (e.g. a per-user regional host:
+     *  `https://mcp.{host}/…`). */
+    httpUrl?: string;
+    /** HTTP transport — header name → value TEMPLATE with `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken at spawn (e.g.
+     *  `{ Authorization: 'Bearer {accessToken}' }` or Datadog's
+     *  `{ 'DD-API-KEY': '{accessToken}', 'DD-APPLICATION-KEY': '{appKey}' }`). The
+     *  token stays server-side of the shim — never on argv. */
+    httpHeaders?: Record<string, string>;
 }
 interface IntegrationDelivery {
     mcp?: IntegrationMcpDelivery;
@@ -484,6 +505,10 @@ interface BrokeredIntegrationToken {
      *  single BOT token, injected by the broker from config — the per-user
      *  credential IS the guildId. Absent for non-Discord integrations. */
     guildId?: string;
+    /** Datadog Application key (user-scoped) — sent alongside the API key
+     *  (`accessToken`) as the `DD-APPLICATION-KEY` header; `host` carries the
+     *  regional site. Absent for non-Datadog integrations. */
+    appKey?: string;
 }
 
 /**
@@ -531,7 +556,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'github_issues' | 'github' | 'gitlab';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'github_issues' | 'github' | 'gitlab';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -388,8 +388,9 @@ type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' |
  * field the delivery `envMapping` references.
  */
 interface IntegrationApiKeyField {
-    /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`, …). */
-    key: 'accessToken' | 'orgUrl';
+    /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`,
+     *  `appKey`, `host`, …). */
+    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host';
     /** Form label. */
     label: string;
     /** Example / placeholder. */
@@ -400,15 +401,35 @@ interface IntegrationApiKeyField {
     help?: string;
 }
 type IntegrationHealth = 'ok' | 'expired' | 'revoked';
-/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`). */
+/** stdio MCP server spec, executed as DATA by the CLI shim (`codeam mcp-run <id>`).
+ *
+ * Two transports:
+ *  - **stdio (default):** the shim spawns `command args` (with `envMapping`
+ *    credentials in the env) and byte-pipes it to the agent.
+ *  - **HTTP (`httpUrl` set):** the shim connects to a REMOTE MCP over
+ *    Streamable HTTP and relays it to the agent's stdio — for vendors that only
+ *    ship a hosted MCP (e.g. PostHog `mcp.posthog.com`). `command`/`args` are
+ *    unused (empty); credentials go in `httpHeaders` (never `envMapping`).
+ */
 interface IntegrationMcpDelivery {
     command: string;
     args: string[];
-    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. */
+    /** env var name → credential field (`accessToken` | `cloudId` | …). Env only, never argv. STDIO transport. */
     envMapping: Record<string, string>;
     /** Static, non-credential env the server needs to boot (e.g. mode flags).
-     *  Merged into the child env BENEATH the credential envMapping. Never secrets. */
+     *  Merged into the child env BENEATH the credential envMapping. Never secrets. STDIO transport. */
     staticEnv?: Record<string, string>;
+    /** HTTP transport — a REMOTE MCP URL (Streamable HTTP). When set, the shim
+     *  relays to it instead of spawning `command`. May carry `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken (e.g. a per-user regional host:
+     *  `https://mcp.{host}/…`). */
+    httpUrl?: string;
+    /** HTTP transport — header name → value TEMPLATE with `{field}` placeholders
+     *  filled from the BrokeredIntegrationToken at spawn (e.g.
+     *  `{ Authorization: 'Bearer {accessToken}' }` or Datadog's
+     *  `{ 'DD-API-KEY': '{accessToken}', 'DD-APPLICATION-KEY': '{appKey}' }`). The
+     *  token stays server-side of the shim — never on argv. */
+    httpHeaders?: Record<string, string>;
 }
 interface IntegrationDelivery {
     mcp?: IntegrationMcpDelivery;
@@ -484,6 +505,10 @@ interface BrokeredIntegrationToken {
      *  single BOT token, injected by the broker from config — the per-user
      *  credential IS the guildId. Absent for non-Discord integrations. */
     guildId?: string;
+    /** Datadog Application key (user-scoped) — sent alongside the API key
+     *  (`accessToken`) as the `DD-APPLICATION-KEY` header; `host` carries the
+     *  regional site. Absent for non-Datadog integrations. */
+    appKey?: string;
 }
 
 /**
@@ -531,7 +556,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "clickup", "figma", "trello", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -909,6 +909,98 @@ var INTEGRATION_REGISTRY = {
       }
     }
   },
+  posthog: {
+    id: "posthog",
+    name: "PostHog",
+    icon: "posthog",
+    category: "observability",
+    // LIVE — api_key: the user pastes a PostHog Personal API Key (phx_…, created
+    // with the "MCP Server" preset). PostHog's MCP is HOSTED-ONLY
+    // (mcp.posthog.com) over HTTP, and its stdio bridge (mcp-remote) forces its
+    // own browser OAuth — incompatible with our headless broker. So delivery
+    // uses the shim's HTTP transport: it relays to the hosted MCP with the key
+    // as a Bearer header (exactly Cursor's {url, headers} config). No OAuth, no
+    // GSM secret; a backend VALIDATOR proves the key + vaults it.
+    enabled: true,
+    auth: {
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "Personal API Key",
+          placeholder: "phx_xxxxxxxxxxxxxxxx",
+          secret: true,
+          help: 'PostHog \u2192 Settings \u2192 Personal API keys \u2192 create with the "MCP Server" preset (scopes it to a project).'
+        }
+      ]
+    },
+    delivery: {
+      mcp: {
+        // HTTP transport (not a spawned stdio server) — the shim relays to
+        // PostHog's hosted MCP with the key as a Bearer header. The key stays
+        // server-side of the shim, never on argv.
+        command: "",
+        args: [],
+        envMapping: {},
+        httpUrl: "https://mcp.posthog.com/mcp",
+        httpHeaders: { Authorization: "Bearer {accessToken}" }
+      }
+    }
+  },
+  datadog: {
+    id: "datadog",
+    name: "Datadog",
+    icon: "datadog",
+    category: "observability",
+    // LIVE — api_key: the user pastes a Datadog API key (org-scoped) + an
+    // Application key (user-scoped, grants the read scopes) + their regional
+    // site. Datadog's OFFICIAL hosted MCP (mcp.<site>) accepts these as headers
+    // headless (verified) — no OAuth, no GSM secret. Delivery uses the shim's
+    // HTTP transport with the site templated into the URL and both keys sent as
+    // DD-API-KEY / DD-APPLICATION-KEY headers.
+    enabled: true,
+    auth: {
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "API Key",
+          placeholder: "Datadog API key",
+          secret: true,
+          help: "Organization API key \u2014 Datadog \u2192 Organization Settings \u2192 API Keys."
+        },
+        {
+          key: "appKey",
+          label: "Application Key",
+          placeholder: "Datadog application key",
+          secret: true,
+          help: "User Application key (grants the read scopes) \u2014 Datadog \u2192 Organization Settings \u2192 Application Keys."
+        },
+        {
+          key: "host",
+          label: "Site",
+          placeholder: "datadoghq.com",
+          secret: false,
+          help: "Your Datadog site \u2014 US1: datadoghq.com \xB7 EU: datadoghq.eu \xB7 US3: us3.datadoghq.com \xB7 US5: us5.datadoghq.com \xB7 AP1: ap1.datadoghq.com."
+        }
+      ]
+    },
+    delivery: {
+      mcp: {
+        // HTTP transport — the shim relays to Datadog's hosted MCP for the
+        // user's site, with both keys as headers. Keys stay server-side of the
+        // shim, never on argv.
+        command: "",
+        args: [],
+        envMapping: {},
+        httpUrl: "https://mcp.{host}/api/unstable/mcp-server/mcp",
+        httpHeaders: {
+          "DD-API-KEY": "{accessToken}",
+          "DD-APPLICATION-KEY": "{appKey}"
+        }
+      }
+    }
+  },
   notion: {
     id: "notion",
     name: "Notion",
@@ -1313,7 +1405,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "posthog",
   "clickup",
   "figma",
   "trello",
@@ -1326,8 +1417,7 @@ var UPCOMING_INTEGRATION_IDS = [
   "mixpanel",
   "pendo",
   "pagerduty",
-  "amplitude",
-  "datadog"
+  "amplitude"
 ];
 function getIntegrationBranding(id) {
   return INTEGRATION_BRANDING[id] ?? null;