@dotdrelle/wiki-manager 0.15.34 → 0.15.38

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.15.34",
-  "commit": "8b6b1aa"
+  "version": "0.15.38",
+  "commit": "abf8356"
 }

package/src/core/compose.js

@@ -19,11 +19,17 @@ const execFileAsync = promisify(execFile);
 export const COMPOSE_SERVICES = ['serve', 'mcp-http', 'production-mcp'];
 const SERVICE_DESCRIPTION_LABEL = 'wiki-manager.description';
 
+// Deux alias seulement, pour les deux services qu'un opérateur pilote vraiment
+// à part. `mcp-http` n'en a plus : il fait partie du socle démarré par `all` et
+// `services`, et son alias `mcp` ajoutait une ligne à lire pour un service que
+// personne ne démarre seul. Il reste adressable sous son nom Compose.
+//
+// Pas d'alias `wiki` non plus : c'est déjà le nom du service Compose one-shot
+// derrière `/wiki run`. En faire un alias de `mcp-http` le masquait, et
+// `/start wiki` démarrait silencieusement un autre service que celui nommé.
 const DEFAULT_SERVICE_ALIASES = {
   all: COMPOSE_SERVICES,
   ui: ['serve'],
-  wiki: ['mcp-http'],
-  mcp: ['mcp-http'],
   production: ['production-mcp'],
 };
 
@@ -92,6 +98,22 @@ export function serviceNames() {
   return [...new Set([...COMPOSE_SERVICES, ...Object.keys(serviceAliases())])].sort();
 }
 
+/**
+ * Noms proposés à la complétion de `/start`, `/stop` et `/logs`.
+ *
+ * La liste complète mélangeait les alias et les services Compose qu'ils
+ * désignent — `mcp` et `mcp-http`, `ui` et `serve`, `production` et
+ * `production-mcp` — et affichait `all` deux fois, une fois comme mot-clé du
+ * shell et une fois comme alias Compose. Dix entrées pour cinq actions
+ * réelles. On ne propose donc que le vocabulaire destiné à l'opérateur ; les
+ * noms Compose bruts restent acceptés si on les tape.
+ */
+export function serviceChoices() {
+  const aliases = Object.keys(serviceAliases());
+  // `all` est ajouté par l'appelant, en tête : c'est le choix par défaut.
+  return aliases.filter((name) => name !== 'all').sort();
+}
+
 export function serviceDescription(name) {
   return serviceDescriptions()[name] ?? null;
 }

package/src/core/dockerCompose.test.js

@@ -19,11 +19,29 @@ test('workspace compose does not start a per-workspace agent runtime', async ()
   );
 });
 
+test('shipped compose files never carry a build context', async () => {
+  // Ces deux fichiers partent dans le paquet npm, où les dépôts frères
+  // (`../agent-external/…`) n'existent pas : un `build:` y rend toute commande
+  // Compose irrésolvable chez l'utilisateur. Les images sont construites et
+  // publiées par build-and-push.sh, jamais par le manager.
+  for (const file of ['../../docker-compose.yml', '../../agents.docker-compose.yml']) {
+    const compose = YAML.parse(await readFile(new URL(file, import.meta.url), 'utf8'));
+    for (const [name, service] of Object.entries(compose.services ?? {})) {
+      assert.equal(service.build, undefined, `${file} ${name}: shipped files must reference an image, never build it`);
+      assert.ok(service.image, `${file} ${name}: must declare an image`);
+    }
+  }
+});
+
 test('no compose service relies on a bare environment passthrough', async () => {
   // `- VAR` makes Compose print `The "VAR" variable is not set. Defaulting to a
   // blank string.` for every key the operator left as a commented placeholder —
   // CONNECTORS_MCP_PORT once connectors were enabled. That warning reached the
   // ShellUI looking like a failure. Every entry must carry its own default.
+  //
+  // Une valeur vide est ici sans danger : l'application OAuth embarquée dans
+  // l'image du connecteur est lue depuis un fichier, plus depuis un ENV que la
+  // chaîne vide écraserait.
   for (const file of ['../../docker-compose.yml', '../../agents.docker-compose.yml']) {
     const compose = YAML.parse(await readFile(new URL(file, import.meta.url), 'utf8'));
     for (const [name, service] of Object.entries(compose.services ?? {})) {

package/src/core/env.js

@@ -121,9 +121,10 @@ export function ensureManagerScaffold({ log = () => {} } = {}) {
           const missing = Object.keys(example).filter((key) => !(key in current));
           const currentServers = current.mcpServers;
           const exampleServers = example.mcpServers;
+          const disabledServers = new Set(Array.isArray(current.disabledMcpServers) ? current.disabledMcpServers.map(String) : []);
           const missingServers = currentServers && typeof currentServers === 'object' && !Array.isArray(currentServers)
             && exampleServers && typeof exampleServers === 'object' && !Array.isArray(exampleServers)
-            ? Object.keys(exampleServers).filter((key) => !(key in currentServers))
+            ? Object.keys(exampleServers).filter((key) => !(key in currentServers) && !disabledServers.has(key))
             : [];
           if (missing.length > 0) {
             for (const key of missing) current[key] = example[key];

package/src/core/env.test.js

@@ -102,6 +102,20 @@ test('scaffold never overwrites an existing chatAccess, including explicit null'
   });
 });
 
+test('scaffold does not restore a packaged MCP explicitly removed in the UI', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    writeFileSync(endpointsFile, JSON.stringify({
+      mcpServers: {},
+      disabledMcpServers: ['cme'],
+    }, null, 2));
+    ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+    assert.equal(after.mcpServers.cme, undefined);
+    assert.ok(after.mcpServers.documents);
+  });
+});
+
 test('scaffold leaves an invalid endpoints file strictly alone', () => {
   withTempManagerDir((dir) => {
     const endpointsFile = join(dir, 'mcp.endpoints.json');

package/src/core/googleGrants.js

@@ -0,0 +1,38 @@
+/**
+ * Droits Gmail demandés à Google, et ce qu'ils ouvrent réellement.
+ *
+ * Les identifiants (`read`, `send`, `modify`) sont ceux de Google — `modify`
+ * vient du scope `gmail.modify` — et ceux de `GOOGLE_GRANTS` dans
+ * agent-connectors. Leur inventer un synonyme côté manager créerait une
+ * troisième orthographe à tenir à jour, exactement le travers qui avait donné
+ * une seconde paire de variables OAuth préfixées. On décrit, on ne renomme pas.
+ *
+ * Cette table est la source unique : la valeur par défaut de
+ * `/connector auth`, l'aide de la complétion et le rendu de `/connector list`
+ * en découlent tous, donc ils ne peuvent pas diverger.
+ */
+export const GOOGLE_GRANT_LABELS = Object.freeze({
+  read: 'read messages and collect them into the workspace',
+  send: 'send email from your account (subject to the recipient allow-list)',
+  modify: 'mark read/unread, archive, label, star, trash (never permanent deletion)',
+});
+
+export const GOOGLE_GRANTS = Object.freeze(Object.keys(GOOGLE_GRANT_LABELS));
+
+/**
+ * Droits demandés quand l'opérateur n'en nomme aucun.
+ *
+ * Tout ce que l'agent sait faire. Un défaut plus étroit promet des actions que
+ * l'autorisation ne couvre pas : `/connector auth google` ne demandait que
+ * `read`, alors que l'agent expose l'envoi et la gestion de boîte — Donna
+ * proposait « marquer comme lu », et l'action échouait après coup. Comme
+ * l'autorisation Google est incrémentale, un droit ajouté plus tard coûte un
+ * aller-retour de consentement supplémentaire, pas moins d'accès.
+ */
+export function defaultGoogleGrants() {
+  return [...GOOGLE_GRANTS];
+}
+
+export function describeGoogleGrant(grant) {
+  return GOOGLE_GRANT_LABELS[grant] ?? null;
+}

package/src/core/googleGrants.test.js

@@ -0,0 +1,59 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { GOOGLE_GRANTS, GOOGLE_GRANT_LABELS, defaultGoogleGrants } from './googleGrants.js';
+
+const connectorsSrc = (file) =>
+  readFileSync(fileURLToPath(new URL(`../../../agent-external/agent-connectors/src/${file}`, import.meta.url)), 'utf8');
+
+test('the grant names mirror the agent, spelling included', () => {
+  // `modify` est le nom de Google (scope gmail.modify) et celui de l'agent.
+  // Un synonyme côté manager créerait une troisième orthographe à tenir à jour
+  // — le travers qui avait déjà donné une seconde paire de variables OAuth.
+  const tokens = connectorsSrc('googleTokens.ts');
+  const declared = tokens.match(/GOOGLE_GRANTS: readonly GoogleGrant\[\] = \[([^\]]+)\]/)?.[1] ?? '';
+  const agentGrants = [...declared.matchAll(/'([a-z]+)'/g)].map(([, grant]) => grant);
+
+  assert.deepEqual([...GOOGLE_GRANTS].sort(), agentGrants.sort());
+});
+
+test('every grant is described in plain words, never left as a bare token', () => {
+  for (const grant of GOOGLE_GRANTS) {
+    const label = GOOGLE_GRANT_LABELS[grant];
+    assert.ok(label && label.length > 10, `${grant} needs a human description`);
+    assert.notEqual(label, grant);
+  }
+});
+
+test('the default asks for everything the agent can actually do', () => {
+  // Un défaut plus étroit promet des actions que l'autorisation ne couvre pas :
+  // `/connector auth google` ne demandait que `read`, et l'envoi comme le
+  // marquage échouaient après coup, en ressemblant à des fonctions absentes.
+  assert.deepEqual(defaultGoogleGrants().sort(), [...GOOGLE_GRANTS].sort());
+
+  // Chaque droit du défaut doit ouvrir quelque chose de réellement exposé.
+  const server = connectorsSrc('server.ts');
+  const contract = connectorsSrc('contract.ts');
+  assert.match(contract, /CAPABILITY_ID = 'external-source\.collect'/, 'read feeds the collect capability');
+  assert.match(contract, /SEND_CAPABILITY_ID = 'communication\.send-email'/, 'send has a capability');
+  assert.match(server, /'connectors_gmail_modify'/, 'modify has a tool');
+});
+
+test('the default grants are not mutated by the caller', () => {
+  const first = defaultGoogleGrants();
+  first.push('bogus');
+  assert.deepEqual(defaultGoogleGrants().sort(), [...GOOGLE_GRANTS].sort());
+});
+
+test('the destructive Gmail tool needs approval and stays out of chat mode', () => {
+  const script = readFileSync(fileURLToPath(new URL('../../wiki-workspace', import.meta.url)), 'utf8');
+  const block = script.slice(script.indexOf('config.mcpServers.connectors ??='), script.indexOf('delete connectorAccess.allowActions'));
+  const approval = block.slice(block.indexOf('requireApproval'), block.indexOf('chatAccess'));
+  const chatAllow = block.slice(block.indexOf('connectorAccess.allow ='));
+
+  assert.match(approval, /connectors_gmail_modify/, 'a destructive tool must be approval-gated');
+  // /chat est en lecture seule : une mutation n'y a pas sa place, elle passe
+  // par /agent où l'allow-list ne s'applique pas.
+  assert.ok(!chatAllow.includes('connectors_gmail_modify'), 'chat mode must stay read-only');
+});

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.15.34';
+const WIKI_MANAGER_VERSION = '0.15.38';
 
 function envValue(key) {
   const filePath = managerEnvFile();

package/src/core/mcp.test.js

@@ -1,5 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import './mcpEndpoints.test.js';
 import { mkdtemp, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/src/core/mcpEndpoints.js

@@ -0,0 +1,96 @@
+import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { managerMcpEndpointsFile } from './env.js';
+
+const PROTECTED_SERVERS = new Set(['wiki', 'production', 'llm-wiki', 'wiki-production']);
+
+function readDocument() {
+  const filePath = managerMcpEndpointsFile();
+  const raw = existsSync(filePath) ? JSON.parse(readFileSync(filePath, 'utf8')) : {};
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    throw new Error('mcp.endpoints.json must contain a JSON object.');
+  }
+  raw.mcpServers ??= {};
+  raw.disabledMcpServers = Array.isArray(raw.disabledMcpServers)
+    ? raw.disabledMcpServers.map(String).filter(Boolean)
+    : [];
+  raw.chatAccess ??= { maxToolIterations: 8, servers: {} };
+  raw.chatAccess.servers ??= {};
+  return { filePath, raw };
+}
+
+function writeDocument(filePath, raw) {
+  const temporary = `${filePath}.tmp.${process.pid}`;
+  writeFileSync(temporary, `${JSON.stringify(raw, null, 2)}\n`, { mode: 0o600 });
+  chmodSync(temporary, 0o600);
+  renameSync(temporary, filePath);
+}
+
+function normalizeName(value) {
+  const name = String(value ?? '').trim();
+  if (!name || name.length > 80 || !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(name)) {
+    throw new Error('MCP server name must use letters, numbers, dots, underscores or hyphens.');
+  }
+  if (PROTECTED_SERVERS.has(name)) throw new Error(`Built-in MCP server cannot be changed: ${name}`);
+  return name;
+}
+
+function normalizeUrl(value) {
+  const url = String(value ?? '').trim();
+  let parsed;
+  try { parsed = new URL(url); } catch { throw new Error('MCP server URL is invalid.'); }
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('MCP server URL must use HTTP or HTTPS.');
+  return url;
+}
+
+export function listManagedMcpEndpoints() {
+  const { raw } = readDocument();
+  return Object.entries(raw.mcpServers).map(([name, endpoint]) => ({
+    name,
+    url: String(endpoint?.url ?? ''),
+    bearer: String(endpoint?.headers?.Authorization ?? endpoint?.headers?.authorization ?? '').replace(/^Bearer\s+/i, ''),
+    allow: raw.chatAccess?.servers?.[name]?.allow ?? null,
+  }));
+}
+
+export function upsertManagedMcpEndpoint({ name: rawName, previousName: rawPreviousName = null, url: rawUrl, bearer = '' } = {}) {
+  const name = normalizeName(rawName);
+  const previousName = rawPreviousName ? normalizeName(rawPreviousName) : name;
+  const url = normalizeUrl(rawUrl);
+  const { filePath, raw } = readDocument();
+  if (previousName !== name && !Object.hasOwn(raw.mcpServers, previousName)) {
+    throw new Error(`MCP server to rename was not found: ${previousName}`);
+  }
+  if (previousName !== name && Object.hasOwn(raw.mcpServers, name)) {
+    throw new Error(`MCP server already exists: ${name}`);
+  }
+  const previous = raw.mcpServers[previousName] && typeof raw.mcpServers[previousName] === 'object'
+    ? raw.mcpServers[previousName]
+    : {};
+  const headers = { ...(previous.headers ?? {}) };
+  delete headers.authorization;
+  delete headers.Authorization;
+  if (String(bearer).trim()) headers.Authorization = `Bearer ${String(bearer).trim()}`;
+  const managedBy = previous.managedBy === 'serve-ui' ? 'serve-ui' : (Object.keys(previous).length ? null : 'serve-ui');
+  raw.mcpServers[name] = { ...previous, url, ...(managedBy ? { managedBy } : {}), ...(Object.keys(headers).length ? { headers } : {}) };
+  if (!Object.keys(headers).length) delete raw.mcpServers[name].headers;
+  if (previousName !== name) {
+    delete raw.mcpServers[previousName];
+    delete raw.chatAccess.servers[previousName];
+    if (!raw.disabledMcpServers.includes(previousName)) raw.disabledMcpServers.push(previousName);
+  }
+  raw.chatAccess.servers[name] = { allow: '*' };
+  raw.disabledMcpServers = raw.disabledMcpServers.filter((item) => item !== name);
+  writeDocument(filePath, raw);
+  return { name, previousName, url, allow: '*', hasBearer: Boolean(String(bearer).trim()), origin: managedBy ? 'ui' : 'global' };
+}
+
+export function deleteManagedMcpEndpoint(rawName) {
+  const name = normalizeName(rawName);
+  const { filePath, raw } = readDocument();
+  const existed = Object.hasOwn(raw.mcpServers, name);
+  delete raw.mcpServers[name];
+  delete raw.chatAccess.servers[name];
+  if (!raw.disabledMcpServers.includes(name)) raw.disabledMcpServers.push(name);
+  writeDocument(filePath, raw);
+  return { name, deleted: existed };
+}

package/src/core/mcpEndpoints.test.js

@@ -0,0 +1,126 @@
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { deleteManagedMcpEndpoint, listManagedMcpEndpoints, upsertManagedMcpEndpoint } from './mcpEndpoints.js';
+import { buildMcpStatus, discoverMcpTools, resetMcpSessionsForTests } from './mcp.js';
+import { chatAllowedTools } from '../shell/repl.js';
+import { buildAgentSystemPrompt } from '../agent/graph.js';
+
+async function withEndpoints(fn) {
+  const root = await mkdtemp(join(tmpdir(), 'wiki-manager-mcp-endpoints-'));
+  const envFile = join(root, '.env');
+  writeFileSync(envFile, '', 'utf8');
+  writeFileSync(join(root, 'mcp.endpoints.json'), JSON.stringify({
+    mcpServers: { cme: { url: 'http://localhost:3336/mcp/' } },
+    chatAccess: { maxToolIterations: 8, servers: { cme: { allow: ['cme_status'] } } },
+  }), 'utf8');
+  const previous = process.env.WIKI_MANAGER_ENV_FILE;
+  process.env.WIKI_MANAGER_ENV_FILE = envFile;
+  try { await fn(root); } finally {
+    if (previous === undefined) delete process.env.WIKI_MANAGER_ENV_FILE;
+    else process.env.WIKI_MANAGER_ENV_FILE = previous;
+  }
+}
+
+test('UI-managed MCP endpoints persist with bearer auth and chat wildcard access', async () => {
+  await withEndpoints(async (root) => {
+    upsertManagedMcpEndpoint({ name: 'exa', url: 'https://mcp.exa.ai/mcp', bearer: 'secret' });
+    const raw = JSON.parse(readFileSync(join(root, 'mcp.endpoints.json'), 'utf8'));
+    assert.equal(raw.mcpServers.exa.url, 'https://mcp.exa.ai/mcp');
+    assert.equal(raw.mcpServers.exa.headers.Authorization, 'Bearer secret');
+    assert.equal(raw.chatAccess.servers.exa.allow, '*');
+    assert.deepEqual(listManagedMcpEndpoints().find((item) => item.name === 'exa'), {
+      name: 'exa', url: 'https://mcp.exa.ai/mcp', bearer: 'secret', allow: '*',
+    });
+  });
+});
+
+test('deleting an external MCP removes endpoint and chat access without touching others', async () => {
+  await withEndpoints(async (root) => {
+    upsertManagedMcpEndpoint({ name: 'exa', url: 'https://mcp.exa.ai/mcp' });
+    assert.equal(deleteManagedMcpEndpoint('cme').deleted, true);
+    const raw = JSON.parse(readFileSync(join(root, 'mcp.endpoints.json'), 'utf8'));
+    assert.equal(raw.mcpServers.cme, undefined);
+    assert.equal(raw.chatAccess.servers.cme, undefined);
+    assert.deepEqual(raw.disabledMcpServers, ['cme']);
+    assert.equal(raw.mcpServers.exa.url, 'https://mcp.exa.ai/mcp');
+    upsertManagedMcpEndpoint({ name: 'cme', url: 'http://localhost:3336/mcp/' });
+    const restored = JSON.parse(readFileSync(join(root, 'mcp.endpoints.json'), 'utf8'));
+    assert.deepEqual(restored.disabledMcpServers, []);
+  });
+});
+
+test('built-in workspace MCP endpoints cannot be changed from the connectors UI', async () => {
+  await withEndpoints(async () => {
+    assert.throws(() => deleteManagedMcpEndpoint('llm-wiki'), /cannot be changed/);
+    assert.throws(
+      () => upsertManagedMcpEndpoint({ name: 'wiki-production', url: 'https://example.test/mcp' }),
+      /cannot be changed/,
+    );
+  });
+});
+
+test('renaming a persisted MCP moves endpoint, chat access and deletion identity atomically', async () => {
+  await withEndpoints(async (root) => {
+    upsertManagedMcpEndpoint({ name: 'exa', url: 'https://mcp.exa.ai/mcp', bearer: 'first' });
+    const renamed = upsertManagedMcpEndpoint({
+      name: 'exa-search', previousName: 'exa', url: 'https://mcp.exa.ai/mcp', bearer: 'second',
+    });
+    assert.equal(renamed.previousName, 'exa');
+    const raw = JSON.parse(readFileSync(join(root, 'mcp.endpoints.json'), 'utf8'));
+    assert.equal(raw.mcpServers.exa, undefined);
+    assert.equal(raw.chatAccess.servers.exa, undefined);
+    assert.equal(raw.mcpServers['exa-search'].headers.Authorization, 'Bearer second');
+    assert.equal(raw.chatAccess.servers['exa-search'].allow, '*');
+    assert.ok(raw.disabledMcpServers.includes('exa'));
+  });
+});
+
+test('a UI-added MCP is rediscovered for both chat wildcard and direct agent tools', async () => {
+  await withEndpoints(async () => {
+    upsertManagedMcpEndpoint({ name: 'exa', url: 'https://mcp.exa.ai/mcp', bearer: 'secret' });
+    const originalFetch = globalThis.fetch;
+    const seenAuthorization = [];
+    resetMcpSessionsForTests();
+    globalThis.fetch = async (_url, init) => {
+      const body = JSON.parse(init.body);
+      seenAuthorization.push(init.headers.authorization);
+      if (body.method === 'initialize') {
+        return {
+          ok: true, status: 200,
+          headers: { get: (name) => name === 'mcp-session-id' ? 'exa-session' : null },
+          text: async () => '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18"}}',
+        };
+      }
+      if (body.method === 'notifications/initialized') {
+        return { ok: true, status: 202, headers: { get: () => null }, text: async () => '' };
+      }
+      return {
+        ok: true, status: 200, headers: { get: () => null },
+        text: async () => JSON.stringify({
+          jsonrpc: '2.0', id: 2,
+          result: { tools: [
+            { name: 'web_search_exa', inputSchema: { type: 'object', properties: {} } },
+            { name: 'get_code_context_exa', inputSchema: { type: 'object', properties: {} } },
+          ] },
+        }),
+      };
+    };
+    try {
+      const session = { workspace: 'docs', workspaceEnv: {}, wikircConfig: {}, commands: [] };
+      session.mcp = await discoverMcpTools(buildMcpStatus(session));
+      const chatTools = chatAllowedTools(session).map((tool) => tool.function.name).sort();
+      assert.deepEqual(chatTools, ['exa__get_code_context_exa', 'exa__web_search_exa']);
+      const agentPrompt = buildAgentSystemPrompt({ session });
+      assert.match(agentPrompt, /exa__web_search_exa/);
+      assert.match(agentPrompt, /exa__get_code_context_exa/);
+      assert.ok(seenAuthorization.includes('Bearer secret'));
+    } finally {
+      globalThis.fetch = originalFetch;
+      resetMcpSessionsForTests();
+    }
+  });
+});