@geminixiang/mikan 1.0.0-beta.76 → 1.0.0-beta.77

package/dist/harness/open-connector.js

@@ -1,11 +1,3 @@
-/**
- * OpenConnector is an ordinary MCP server with one deployment-provided
- * default. When a Slack office has not declared `open-connector` in global or
- * conversation settings, the host mints a runtime token for that office with
- * the startup admin token and writes a plain conversation `mcpServers` entry.
- * From then on the entry is loaded, tested, disabled, or removed like any
- * other MCP server; the admin token itself never leaves this module.
- */
 import { Type } from "@sinclair/typebox";
 import { existsSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
@@ -46,7 +38,6 @@ function requestSignal(signal) {
     const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
     return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
-/** Mint a runtime token that copies the deployment's current action policy. */
 async function createRuntimeToken(origin, adminToken, name, signal) {
     const headers = { Authorization: `Bearer ${adminToken}` };
     const policyValue = await readJson(await fetch(new URL("/api/runtime-policy", origin), { headers, signal: requestSignal(signal) }), "runtime policy request");
@@ -81,12 +72,6 @@ function isDeclared(office) {
     return (Object.hasOwn(scopes.global, OPEN_CONNECTOR_SERVER) ||
         Object.hasOwn(scopes.conversation, OPEN_CONNECTOR_SERVER));
 }
-/**
- * Fill in the deployment default for a Slack office that has not declared
- * `open-connector` anywhere. Writes the token as a conversation MCP entry;
- * throws when provisioning fails so the caller can report it. Any declared
- * entry (self-hosted, disabled, or global) is respected untouched.
- */
 export async function ensureDefaultOpenConnector(office, platformWorkspaceId, defaultServer, signal) {
     const adminToken = readEnv("OPENCONNECTOR_ADMIN_TOKEN");
     if (!defaultServer?.url || !adminToken || office.address.platform !== "slack")
@@ -104,7 +89,6 @@ export async function ensureDefaultOpenConnector(office, platformWorkspaceId, de
     const task = (async () => {
         const name = `mikan:slack:${platformWorkspaceId}:${office.address.conversationId}`;
         const token = await createRuntimeToken(new URL(url).origin, adminToken, name, signal);
-        // Re-read after the await: an operator may have declared the server meanwhile.
         if (isDeclared(office))
             return;
         const current = loadScopeMcpServers(office).conversation;
@@ -121,12 +105,6 @@ export async function ensureDefaultOpenConnector(office, platformWorkspaceId, de
         pending.delete(office.stateDir);
     }
 }
-/**
- * One-time conversion of pre-existing `open-connector-runtime-token.json`
- * files into conversation `mcpServers` entries for `defaultUrl`. Files whose
- * token was minted for another origin, or whose office already declares the
- * server, are left in place and reported. Run with the daemon stopped.
- */
 export function migrateLegacyOpenConnectorTokens(stateDir, defaultUrl, workspaceRoot = join(stateDir, "workspace")) {
     const origin = new URL(defaultUrl).origin;
     const report = { migrated: [], skipped: [] };

package/dist/harness/open-connector.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-connector.js","sourceRoot":"","sources":["../../src/harness/open-connector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,SAAS,GAEV,MAAM,oBAAoB,CAAC;AAI5B,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACnC;IACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;CACrB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,SAAiB;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,MAAoB;IAEpB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAC/F,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC1C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAClC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAChF,CAAC;QACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,EACF,wBAAwB,CACzB,CAAC;IACF,IACE,CAAC,QAAQ,CAAC,aAAa,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,mBAAuC,EACvC,aAA0C,EAC1C,MAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACtF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,GAAG,CAAC,UAAU,CACZ,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,iCAAiC,EAClE,mCAAmC,CACpC,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,GAAG,eAAe,mBAAmB,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtF,+EAA+E;QAC/E,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;QACzD,0BAA0B,CAAC,MAAM,EAAE;YACjC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;SAC9E,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,2CAA2C,CAAC,CAAC;IAC5F,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAgB,EAChB,UAAkB,EAClB,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAA+B,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,MAAM,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAU,CAAC,CACtF,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,qBAAqB,sBAAsB,EAAE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,0BAA0B,CAChC,UAAU,EACV,iBAAiB,EACjB,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,MAAM,EAAE,CACrD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;QACzD,0BAA0B,CAAC,MAAM,EAAE;YACjC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;SAC3F,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACnB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * OpenConnector is an ordinary MCP server with one deployment-provided\n * default. When a Slack office has not declared `open-connector` in global or\n * conversation settings, the host mints a runtime token for that office with\n * the startup admin token and writes a plain conversation `mcpServers` entry.\n * From then on the entry is loaded, tested, disabled, or removed like any\n * other MCP server; the admin token itself never leaves this module.\n */\nimport { Type } from \"@sinclair/typebox\";\nimport { existsSync, readdirSync, rmSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { readEnv } from \"../env-manifest.js\";\nimport * as log from \"../log.js\";\nimport { loadScopeMcpServers, updateConversationSettings } from \"../settings/index.js\";\nimport { isRecord, readJsonSchemaFileIfExists } from \"../file-guards.js\";\nimport {\n  createWorkspace,\n  isOfficeKey,\n  listRegisteredOffices,\n  officeKey,\n  type Office,\n} from \"../office/index.js\";\nimport type { OfficeKey } from \"../types.js\";\nimport type { McpServerConfig } from \"./types.js\";\n\nconst OPEN_CONNECTOR_SERVER = \"open-connector\";\nconst LEGACY_TOKEN_FILE = \"open-connector-runtime-token.json\";\nconst REQUEST_TIMEOUT_MS = 10_000;\nconst pending = new Map<string, Promise<void>>();\n\nconst LegacyTokenSchema = Type.Object(\n  {\n    version: Type.Literal(1),\n    origin: Type.String(),\n    name: Type.String(),\n    id: Type.String(),\n    token: Type.String(),\n  },\n  { additionalProperties: false },\n);\n\nfunction stringArray(value: unknown, field: string): string[] {\n  if (!Array.isArray(value) || !value.every((item) => typeof item === \"string\")) {\n    throw new Error(`OpenConnector returned an invalid ${field}`);\n  }\n  return value;\n}\n\nasync function readJson(response: Response, operation: string): Promise<unknown> {\n  if (!response.ok) {\n    throw new Error(`OpenConnector ${operation} failed with HTTP ${response.status}`);\n  }\n  try {\n    return await response.json();\n  } catch (error) {\n    throw new Error(`OpenConnector ${operation} returned invalid JSON`, { cause: error });\n  }\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n  const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);\n  return signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\n/** Mint a runtime token that copies the deployment's current action policy. */\nasync function createRuntimeToken(\n  origin: string,\n  adminToken: string,\n  name: string,\n  signal?: AbortSignal,\n): Promise<string> {\n  const headers = { Authorization: `Bearer ${adminToken}` };\n  const policyValue = await readJson(\n    await fetch(new URL(\"/api/runtime-policy\", origin), { headers, signal: requestSignal(signal) }),\n    \"runtime policy request\",\n  );\n  if (!isRecord(policyValue) || !isRecord(policyValue.deployment)) {\n    throw new Error(\"OpenConnector returned an invalid runtime policy\");\n  }\n  const deployment = policyValue.deployment;\n  const responseValue = await readJson(\n    await fetch(new URL(\"/api/runtime-tokens\", origin), {\n      method: \"POST\",\n      headers: { ...headers, \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        name,\n        allowedActions: stringArray(deployment.allowedActions, \"allowedActions policy\"),\n        blockedActions: stringArray(deployment.blockedActions, \"blockedActions policy\"),\n        allowedProxies: stringArray(deployment.allowedProxies, \"allowedProxies policy\"),\n      }),\n      signal: requestSignal(signal),\n    }),\n    \"runtime token creation\",\n  );\n  if (\n    !isRecord(responseValue) ||\n    typeof responseValue.token !== \"string\" ||\n    !isRecord(responseValue.record) ||\n    responseValue.record.name !== name\n  ) {\n    throw new Error(\"OpenConnector returned an invalid runtime token\");\n  }\n  return responseValue.token;\n}\n\nfunction defaultEntry(url: string, token: string): McpServerConfig {\n  return { url, headers: { Authorization: `Bearer ${token}` } };\n}\n\nfunction isDeclared(office: Office): boolean {\n  const scopes = loadScopeMcpServers(office);\n  return (\n    Object.hasOwn(scopes.global, OPEN_CONNECTOR_SERVER) ||\n    Object.hasOwn(scopes.conversation, OPEN_CONNECTOR_SERVER)\n  );\n}\n\n/**\n * Fill in the deployment default for a Slack office that has not declared\n * `open-connector` anywhere. Writes the token as a conversation MCP entry;\n * throws when provisioning fails so the caller can report it. Any declared\n * entry (self-hosted, disabled, or global) is respected untouched.\n */\nexport async function ensureDefaultOpenConnector(\n  office: Office,\n  platformWorkspaceId: string | undefined,\n  defaultServer: McpServerConfig | undefined,\n  signal?: AbortSignal,\n): Promise<void> {\n  const adminToken = readEnv(\"OPENCONNECTOR_ADMIN_TOKEN\");\n  if (!defaultServer?.url || !adminToken || office.address.platform !== \"slack\") return;\n  if (!platformWorkspaceId) {\n    log.logWarning(\n      `[${office.address.conversationId}] OpenConnector default skipped`,\n      \"Slack workspace ID is unavailable\",\n    );\n    return;\n  }\n  if (isDeclared(office)) return;\n\n  const inflight = pending.get(office.stateDir);\n  if (inflight) return inflight;\n  const url = defaultServer.url;\n  const task = (async () => {\n    const name = `mikan:slack:${platformWorkspaceId}:${office.address.conversationId}`;\n    const token = await createRuntimeToken(new URL(url).origin, adminToken, name, signal);\n    // Re-read after the await: an operator may have declared the server meanwhile.\n    if (isDeclared(office)) return;\n    const current = loadScopeMcpServers(office).conversation;\n    updateConversationSettings(office, {\n      mcpServers: { ...current, [OPEN_CONNECTOR_SERVER]: defaultEntry(url, token) },\n    });\n    log.logInfo(`[${office.address.conversationId}] Provisioned default OpenConnector token`);\n  })();\n  pending.set(office.stateDir, task);\n  try {\n    await task;\n  } finally {\n    pending.delete(office.stateDir);\n  }\n}\n\nexport interface LegacyTokenMigrationReport {\n  migrated: OfficeKey[];\n  skipped: { key: OfficeKey; reason: string }[];\n}\n\n/**\n * One-time conversion of pre-existing `open-connector-runtime-token.json`\n * files into conversation `mcpServers` entries for `defaultUrl`. Files whose\n * token was minted for another origin, or whose office already declares the\n * server, are left in place and reported. Run with the daemon stopped.\n */\nexport function migrateLegacyOpenConnectorTokens(\n  stateDir: string,\n  defaultUrl: string,\n  workspaceRoot = join(stateDir, \"workspace\"),\n): LegacyTokenMigrationReport {\n  const origin = new URL(defaultUrl).origin;\n  const report: LegacyTokenMigrationReport = { migrated: [], skipped: [] };\n  const conversationsDir = join(stateDir, \"conversations\");\n  if (!existsSync(conversationsDir)) return report;\n  const workspace = createWorkspace({ root: workspaceRoot, stateDir });\n  const registered = new Map(\n    listRegisteredOffices(stateDir).map((record) => [officeKey(record), record] as const),\n  );\n  for (const entry of readdirSync(conversationsDir, { withFileTypes: true })) {\n    if (!entry.isDirectory() || !isOfficeKey(entry.name)) continue;\n    const key = entry.name;\n    const legacyPath = join(conversationsDir, key, LEGACY_TOKEN_FILE);\n    if (!existsSync(legacyPath)) continue;\n    const record = registered.get(key);\n    if (!record) {\n      report.skipped.push({ key, reason: \"office is not registered\" });\n      continue;\n    }\n    const office = workspace.office(record);\n    if (isDeclared(office)) {\n      report.skipped.push({ key, reason: `${OPEN_CONNECTOR_SERVER} is already declared` });\n      continue;\n    }\n    let state;\n    try {\n      state = readJsonSchemaFileIfExists(\n        legacyPath,\n        LegacyTokenSchema,\n        (detail) => `Malformed legacy token file: ${detail}`,\n      );\n    } catch (error) {\n      report.skipped.push({ key, reason: error instanceof Error ? error.message : String(error) });\n      continue;\n    }\n    if (!state) continue;\n    if (state.origin !== origin) {\n      report.skipped.push({ key, reason: `token origin ${state.origin} differs` });\n      continue;\n    }\n    const current = loadScopeMcpServers(office).conversation;\n    updateConversationSettings(office, {\n      mcpServers: { ...current, [OPEN_CONNECTOR_SERVER]: defaultEntry(defaultUrl, state.token) },\n    });\n    rmSync(legacyPath);\n    report.migrated.push(key);\n  }\n  return report;\n}\n"]}
+{"version":3,"file":"open-connector.js","sourceRoot":"","sources":["../../src/harness/open-connector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,SAAS,GAEV,MAAM,oBAAoB,CAAC;AAI5B,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACnC;IACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;CACrB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,SAAiB;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,MAAoB;IAEpB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAC/F,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC1C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAClC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAChF,CAAC;QACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,EACF,wBAAwB,CACzB,CAAC;IACF,IACE,CAAC,QAAQ,CAAC,aAAa,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,mBAAuC,EACvC,aAA0C,EAC1C,MAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACtF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,GAAG,CAAC,UAAU,CACZ,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,iCAAiC,EAClE,mCAAmC,CACpC,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,GAAG,eAAe,mBAAmB,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;QACzD,0BAA0B,CAAC,MAAM,EAAE;YACjC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;SAC9E,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,2CAA2C,CAAC,CAAC;IAC5F,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,gCAAgC,CAC9C,QAAgB,EAChB,UAAkB,EAClB,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAA+B,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,MAAM,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAU,CAAC,CACtF,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,qBAAqB,sBAAsB,EAAE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,0BAA0B,CAChC,UAAU,EACV,iBAAiB,EACjB,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,MAAM,EAAE,CACrD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;QACzD,0BAA0B,CAAC,MAAM,EAAE;YACjC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;SAC3F,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACnB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { Type } from \"@sinclair/typebox\";\nimport { existsSync, readdirSync, rmSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { readEnv } from \"../env-manifest.js\";\nimport * as log from \"../log.js\";\nimport { loadScopeMcpServers, updateConversationSettings } from \"../settings/index.js\";\nimport { isRecord, readJsonSchemaFileIfExists } from \"../file-guards.js\";\nimport {\n  createWorkspace,\n  isOfficeKey,\n  listRegisteredOffices,\n  officeKey,\n  type Office,\n} from \"../office/index.js\";\nimport type { OfficeKey } from \"../types.js\";\nimport type { McpServerConfig } from \"./types.js\";\n\nconst OPEN_CONNECTOR_SERVER = \"open-connector\";\nconst LEGACY_TOKEN_FILE = \"open-connector-runtime-token.json\";\nconst REQUEST_TIMEOUT_MS = 10_000;\nconst pending = new Map<string, Promise<void>>();\n\nconst LegacyTokenSchema = Type.Object(\n  {\n    version: Type.Literal(1),\n    origin: Type.String(),\n    name: Type.String(),\n    id: Type.String(),\n    token: Type.String(),\n  },\n  { additionalProperties: false },\n);\n\nfunction stringArray(value: unknown, field: string): string[] {\n  if (!Array.isArray(value) || !value.every((item) => typeof item === \"string\")) {\n    throw new Error(`OpenConnector returned an invalid ${field}`);\n  }\n  return value;\n}\n\nasync function readJson(response: Response, operation: string): Promise<unknown> {\n  if (!response.ok) {\n    throw new Error(`OpenConnector ${operation} failed with HTTP ${response.status}`);\n  }\n  try {\n    return await response.json();\n  } catch (error) {\n    throw new Error(`OpenConnector ${operation} returned invalid JSON`, { cause: error });\n  }\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n  const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);\n  return signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\nasync function createRuntimeToken(\n  origin: string,\n  adminToken: string,\n  name: string,\n  signal?: AbortSignal,\n): Promise<string> {\n  const headers = { Authorization: `Bearer ${adminToken}` };\n  const policyValue = await readJson(\n    await fetch(new URL(\"/api/runtime-policy\", origin), { headers, signal: requestSignal(signal) }),\n    \"runtime policy request\",\n  );\n  if (!isRecord(policyValue) || !isRecord(policyValue.deployment)) {\n    throw new Error(\"OpenConnector returned an invalid runtime policy\");\n  }\n  const deployment = policyValue.deployment;\n  const responseValue = await readJson(\n    await fetch(new URL(\"/api/runtime-tokens\", origin), {\n      method: \"POST\",\n      headers: { ...headers, \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        name,\n        allowedActions: stringArray(deployment.allowedActions, \"allowedActions policy\"),\n        blockedActions: stringArray(deployment.blockedActions, \"blockedActions policy\"),\n        allowedProxies: stringArray(deployment.allowedProxies, \"allowedProxies policy\"),\n      }),\n      signal: requestSignal(signal),\n    }),\n    \"runtime token creation\",\n  );\n  if (\n    !isRecord(responseValue) ||\n    typeof responseValue.token !== \"string\" ||\n    !isRecord(responseValue.record) ||\n    responseValue.record.name !== name\n  ) {\n    throw new Error(\"OpenConnector returned an invalid runtime token\");\n  }\n  return responseValue.token;\n}\n\nfunction defaultEntry(url: string, token: string): McpServerConfig {\n  return { url, headers: { Authorization: `Bearer ${token}` } };\n}\n\nfunction isDeclared(office: Office): boolean {\n  const scopes = loadScopeMcpServers(office);\n  return (\n    Object.hasOwn(scopes.global, OPEN_CONNECTOR_SERVER) ||\n    Object.hasOwn(scopes.conversation, OPEN_CONNECTOR_SERVER)\n  );\n}\n\nexport async function ensureDefaultOpenConnector(\n  office: Office,\n  platformWorkspaceId: string | undefined,\n  defaultServer: McpServerConfig | undefined,\n  signal?: AbortSignal,\n): Promise<void> {\n  const adminToken = readEnv(\"OPENCONNECTOR_ADMIN_TOKEN\");\n  if (!defaultServer?.url || !adminToken || office.address.platform !== \"slack\") return;\n  if (!platformWorkspaceId) {\n    log.logWarning(\n      `[${office.address.conversationId}] OpenConnector default skipped`,\n      \"Slack workspace ID is unavailable\",\n    );\n    return;\n  }\n  if (isDeclared(office)) return;\n\n  const inflight = pending.get(office.stateDir);\n  if (inflight) return inflight;\n  const url = defaultServer.url;\n  const task = (async () => {\n    const name = `mikan:slack:${platformWorkspaceId}:${office.address.conversationId}`;\n    const token = await createRuntimeToken(new URL(url).origin, adminToken, name, signal);\n    if (isDeclared(office)) return;\n    const current = loadScopeMcpServers(office).conversation;\n    updateConversationSettings(office, {\n      mcpServers: { ...current, [OPEN_CONNECTOR_SERVER]: defaultEntry(url, token) },\n    });\n    log.logInfo(`[${office.address.conversationId}] Provisioned default OpenConnector token`);\n  })();\n  pending.set(office.stateDir, task);\n  try {\n    await task;\n  } finally {\n    pending.delete(office.stateDir);\n  }\n}\n\nexport interface LegacyTokenMigrationReport {\n  migrated: OfficeKey[];\n  skipped: { key: OfficeKey; reason: string }[];\n}\n\nexport function migrateLegacyOpenConnectorTokens(\n  stateDir: string,\n  defaultUrl: string,\n  workspaceRoot = join(stateDir, \"workspace\"),\n): LegacyTokenMigrationReport {\n  const origin = new URL(defaultUrl).origin;\n  const report: LegacyTokenMigrationReport = { migrated: [], skipped: [] };\n  const conversationsDir = join(stateDir, \"conversations\");\n  if (!existsSync(conversationsDir)) return report;\n  const workspace = createWorkspace({ root: workspaceRoot, stateDir });\n  const registered = new Map(\n    listRegisteredOffices(stateDir).map((record) => [officeKey(record), record] as const),\n  );\n  for (const entry of readdirSync(conversationsDir, { withFileTypes: true })) {\n    if (!entry.isDirectory() || !isOfficeKey(entry.name)) continue;\n    const key = entry.name;\n    const legacyPath = join(conversationsDir, key, LEGACY_TOKEN_FILE);\n    if (!existsSync(legacyPath)) continue;\n    const record = registered.get(key);\n    if (!record) {\n      report.skipped.push({ key, reason: \"office is not registered\" });\n      continue;\n    }\n    const office = workspace.office(record);\n    if (isDeclared(office)) {\n      report.skipped.push({ key, reason: `${OPEN_CONNECTOR_SERVER} is already declared` });\n      continue;\n    }\n    let state;\n    try {\n      state = readJsonSchemaFileIfExists(\n        legacyPath,\n        LegacyTokenSchema,\n        (detail) => `Malformed legacy token file: ${detail}`,\n      );\n    } catch (error) {\n      report.skipped.push({ key, reason: error instanceof Error ? error.message : String(error) });\n      continue;\n    }\n    if (!state) continue;\n    if (state.origin !== origin) {\n      report.skipped.push({ key, reason: `token origin ${state.origin} differs` });\n      continue;\n    }\n    const current = loadScopeMcpServers(office).conversation;\n    updateConversationSettings(office, {\n      mcpServers: { ...current, [OPEN_CONNECTOR_SERVER]: defaultEntry(defaultUrl, state.token) },\n    });\n    rmSync(legacyPath);\n    report.migrated.push(key);\n  }\n  return report;\n}\n"]}

package/dist/harness/presenter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presenter.d.ts","sourceRoot":"","sources":["../../src/harness/presenter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAEV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOtD,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,aAAa,CAAC;AACnF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AA+DxE,wBAAgB,cAAc,IAAI,kBAAkB,CAkCnD;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IACP,SAAS,EAAE,qBAAqB,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GACA,eAAe,CAsEjB;AAOD,wBAAgB,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEzF;AA0KD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;IACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAsFD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG/E;AAucD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;CAC7D,GAAG,IAAI,CAiBP"}
+{"version":3,"file":"presenter.d.ts","sourceRoot":"","sources":["../../src/harness/presenter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAEV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOtD,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,aAAa,CAAC;AACnF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAmGxE,wBAAgB,cAAc,IAAI,kBAAkB,CAEnD;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IACP,SAAS,EAAE,qBAAqB,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GACA,eAAe,CA2CjB;AAOD,wBAAgB,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEzF;AA6JD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;IACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AA8ED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG/E;AAkcD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;CAC7D,GAAG,IAAI,CAiBP"}

package/dist/harness/presenter.js

@@ -37,7 +37,7 @@ function createEmptyUsageTotals() {
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
     };
 }
-export function createRunState() {
+function createRunStateDefaults() {
     return {
         responder: null,
         logCtx: null,
@@ -72,45 +72,23 @@ export function createRunState() {
         triggerAttribution: undefined,
     };
 }
+export function createRunState() {
+    return createRunStateDefaults();
+}
 export function activateRunPresentation(runState, context) {
     endOutstandingOperationSpans(runState);
-    runState.responder = context.responder;
-    runState.logCtx = {
-        conversationId: context.sessionConversation,
-        userName: context.userName,
-        conversationName: undefined,
-        sessionId: context.sessionUuid,
-    };
-    runState.pendingTools.clear();
-    runState.toolProgress.clear();
-    runState.subagentProgress.clear();
-    runState.completedSubagentProgress = [];
-    runState.subagentToolCalls.clear();
-    runState.subagentProgressShown = false;
-    runState.suppressResponseDeltas = false;
-    runState.lastSubagentProgressAt = 0;
     if (runState.toolProgressTimer)
         clearTimeout(runState.toolProgressTimer);
-    runState.toolProgressTimer = undefined;
-    runState.totalUsage = createEmptyUsageTotals();
-    runState.llmCallCount = 0;
-    runState.toolCallCount = 0;
-    runState.toolErrorCount = 0;
-    runState.toolInputCharacters = 0;
-    runState.toolOutputCharacters = 0;
-    runState.assistantMessageCount = 0;
-    runState.outputCharacters = 0;
-    runState.reasoningTokens = 0;
-    runState.retryCount = 0;
-    runState.compactionCount = 0;
-    runState.budgetExceeded = false;
-    runState.firstTokenLatencyMs = undefined;
-    runState.responseModel = undefined;
-    runState.stopReason = "stop";
-    runState.errorMessage = undefined;
-    runState.reportedLlmError = false;
-    runState.finalResponseHandledByTool = false;
-    runState.triggerAttribution = context.triggerAttribution;
+    Object.assign(runState, createRunStateDefaults(), {
+        responder: context.responder,
+        logCtx: {
+            conversationId: context.sessionConversation,
+            userName: context.userName,
+            conversationName: undefined,
+            sessionId: context.sessionUuid,
+        },
+        triggerAttribution: context.triggerAttribution,
+    });
     const { responder } = context;
     let queueChain = Promise.resolve();
     runState.queue = {
@@ -127,9 +105,7 @@ export function activateRunPresentation(runState, context) {
                     try {
                         await responder.respondDiagnostic(`Error: ${errMsg}`, { style: "error" });
                     }
-                    catch {
-                        // Ignore
-                    }
+                    catch { }
                 }
             });
         },
@@ -157,16 +133,11 @@ export function isEventTriggerAttribution(triggerAttribution) {
 function extractToolLabel(toolName, args) {
     const label = args?.label;
     const text = typeof label === "string" ? label.trim() || toolName : toolName;
-    // Jev judgments are calibrated probabilities, not the model's own guess,
-    // and jev_browser drives a real external browser; name the tool so the
-    // user can tell which steps came from either. Guard against doubling the
-    // name when no real label was supplied and text fell back to toolName.
     if ((toolName === "jev" || toolName === "jev_browser") && text !== toolName) {
         return `${toolName} · ${text}`;
     }
     return text;
 }
-/** Non-subagent tool activity lines; subagent calls render as the dashboard. */
 function formatToolProgress(runState) {
     const lines = Array.from(runState.toolProgress.entries()).flatMap(([toolCallId, item]) => {
         if (runState.subagentToolCalls.has(toolCallId))
@@ -180,13 +151,6 @@ function formatResponseWithToolProgress(text, runState) {
     const progress = formatToolProgress(runState);
     return [progress, text].filter(Boolean).join("\n\n");
 }
-/**
- * The one dashboard render path. A responder that overrides
- * `replaceSubagentProgress` converts the snapshot for a pipeline that is not
- * response-source Markdown (Telegram HTML); every other platform receives the
- * Markdown dashboard — "dashboard, blank line, answer" — through
- * `replaceResponse`, the same conversion as any response.
- */
 async function replaceWithSubagentDashboard(responder, snapshot, finalText, options) {
     if (responder.replaceSubagentProgress) {
         await responder.replaceSubagentProgress(snapshot, finalText);
@@ -211,7 +175,6 @@ function subagentProgressDelay(runState) {
         return 0;
     return Math.max(0, runState.lastSubagentProgressAt + SUBAGENT_PROGRESS_THROTTLE_MS - Date.now());
 }
-/** Record that a subagent dashboard reached the channel, for throttling the next one. */
 function markSubagentProgressShown(runState, snapshot) {
     if (!snapshot)
         return;
@@ -309,7 +272,6 @@ export async function finalizeRunResponse(responder, session, runState, options)
     if (published && runState.stopReason === "stop" && (didWork || options?.initialTask))
         await responder.notifyCompletion?.();
 }
-/** `[SILENT]` means the run leaves no message behind. */
 async function deleteForSilentResponse(responder) {
     try {
         await responder.deleteResponse();
@@ -320,12 +282,6 @@ async function deleteForSilentResponse(responder) {
         log.logWarning("Failed to delete message for silent response", errMsg);
     }
 }
-/**
- * The profile every completed subagent node ran under, when the run resolved
- * to exactly one. A fan-out across different profiles (or any node that did
- * not complete) has no single "who answered this" identity, so callers keep
- * the manager's own identity rather than guessing.
- */
 function resolveSingleCompletedProfile(runState) {
     const nodes = runState.completedSubagentProgress.flatMap((snapshot) => snapshot.nodes);
     if (nodes.length === 0)
@@ -338,7 +294,6 @@ function resolveSingleCompletedProfile(runState) {
         return undefined;
     return nodes.every((node) => node.status === "completed") ? profile : undefined;
 }
-/** Replace the in-progress message with the run's answer, or a subagent dashboard plus it. */
 async function publishFinalResponse(responder, runState, finalText, options) {
     try {
         const finalResponse = appendTriggerAttribution(finalText, runState.triggerAttribution, options?.triggerSessionLink);
@@ -453,7 +408,6 @@ export async function reportUsageSummary(ctx) {
         await waitForQueue();
     }
 }
-/** The joined text parts of a structured tool result, when it carries any. */
 function toolResultContentText(result) {
     if (!result || typeof result !== "object" || !("content" in result))
         return undefined;
@@ -698,17 +652,14 @@ function recordAssistantUsage(message, context) {
         cost_total_usd: message.usage.cost.total,
     });
 }
-/** Stream one thinking block to the channel and the diagnostic surface. */
 function presentThinking(thinking, context) {
     log.logThinking(context.logCtx, thinking);
     context.queue.enqueue(() => context.responder.respond(`_${thinking}_`), "thinking main");
     context.queue.enqueue(() => context.responder.respondDiagnostic(`_${thinking}_`), "thinking diagnostic");
 }
-/** Emit the assistant's answer as the run's final message. */
 function presentFinalText(text, context) {
     const finalText = appendTriggerAttribution(formatResponseWithToolProgress(text, context.runState), context.runState.triggerAttribution);
     log.logResponse(context.logCtx, text);
-    // Subagent dashboard finalization must preserve "dashboard, blank line, answer".
     if (context.runState.completedSubagentProgress.length > 0)
         return;
     if (context.responder.finishResponse) {
@@ -745,7 +696,6 @@ function handleMessageEnd(event, context) {
     context.runState.outputCharacters += message.content.reduce((total, part) => total + (part.type === "text" ? part.text.length : 0), 0);
     if (message.stopReason) {
         context.runState.stopReason = message.stopReason;
-        // The settling message clears any stale error left by a recovered retry.
         context.runState.errorMessage = message.errorMessage;
     }
     recordAssistantUsage(message, context);