@hailer/mcp 0.1.17 → 0.2.1

package/dist/core.js

@@ -8,23 +8,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Core = void 0;
 const logger_1 = require("./lib/logger");
 const config_1 = require("./config");
-const factory_1 = require("./agents/factory");
 const mcp_server_1 = require("./mcp-server");
 const tool_registry_1 = require("./mcp/tool-registry");
-const giuseppe_1 = require("./agents/giuseppe");
 const UserContextCache_1 = require("./mcp/UserContextCache");
-const bot_config_1 = require("./mcp/tools/bot-config");
 const webhook_handler_1 = require("./mcp/webhook-handler");
 class Core {
     logger;
     appConfig;
     toolRegistry;
     mcpServer;
-    daemonManager = null;
-    statusLogInterval;
-    bugReportsModule;
-    daemonInitInProgress = false;
-    initialDaemonReady = false; // Prevents restart attempts before first daemon init
+    daemonManagers = new Map(); // workspace ID -> DaemonManager
+    statusLogIntervals = new Map(); // workspace ID -> interval
+    bugReportsModules = new Map(); // workspace ID -> BugReportsModule
+    daemonInitInProgress = new Set(); // workspace IDs currently initializing
+    initialDaemonReady = new Set(); // workspace IDs that have completed first init
     constructor() {
         // Initialize logger first
         this.logger = (0, logger_1.createLogger)({
@@ -65,14 +62,15 @@ class Core {
                     await this.startMCPServer();
                 }
             }
-            // Initialize bot config persistence (reads config from Hailer Agent Directory)
-            await this.initBotConfig();
-            // Start client/daemon AFTER MCP server is ready
+            // Start client/daemon services ONLY if MCP_CLIENT_ENABLED=true
             if (this.appConfig.server.enableClient) {
+                // Initialize bot config persistence (reads config from Hailer Agent Directory)
+                await this.initBotConfig();
+                // Start daemons for all workspaces with orchestrator
                 await this.startMCPClient();
+                // Start Bug Monitor service (reads config from Hailer)
+                await this.startBugMonitor();
             }
-            // Start Bug Monitor service (reads config from Hailer)
-            await this.startBugMonitor();
             this.setupGracefulShutdown();
             this.logger.info('All configured services started successfully');
         }
@@ -93,61 +91,117 @@ class Core {
         await this.mcpServer.start();
         this.logger.info('MCP Server service started');
     }
+    /**
+     * Start MCP Client (daemons) for all workspaces with enabled orchestrators
+     */
     async startMCPClient() {
-        if (this.daemonInitInProgress) {
-            this.logger.debug('Daemon init already in progress, skipping startMCPClient');
+        this.logger.info('Starting Chat Agent Daemons for all enabled workspaces');
+        // Load all workspace configs
+        const { loadBotConfigs } = require('./bot-config');
+        const botContexts = loadBotConfigs();
+        // Find all workspaces with enabled orchestrators
+        const workspacesWithOrchestrator = botContexts.filter((ctx) => ctx.getOrchestratorCredentials());
+        if (workspacesWithOrchestrator.length === 0) {
+            this.logger.info('No workspaces with orchestrator found - skipping daemon start');
             return;
         }
-        this.logger.info('Starting Chat Agent Daemon (persistent conversation mode)');
-        this.daemonInitInProgress = true;
-        try {
-            await this.initializeDaemonMode();
-            this.initialDaemonReady = true; // Mark daemon as ready for restart signals
-            this.logger.info('Chat Agent Daemon started');
-        }
-        catch (error) {
-            this.logger.warn('Daemon mode failed to start - server will continue without client capabilities', {
-                error: error instanceof Error ? error.message : String(error)
-            });
-        }
-        finally {
-            this.daemonInitInProgress = false;
-        }
+        this.logger.info('Found workspaces with orchestrator', {
+            count: workspacesWithOrchestrator.length,
+            workspaces: workspacesWithOrchestrator.map((ctx) => ({
+                id: ctx.workspaceId,
+                name: ctx.workspaceName
+            }))
+        });
+        // Start daemon for each workspace
+        const startPromises = workspacesWithOrchestrator.map(async (ctx) => {
+            const workspaceId = ctx.workspaceId;
+            if (this.daemonInitInProgress.has(workspaceId)) {
+                this.logger.debug('Daemon init already in progress, skipping', { workspaceId });
+                return;
+            }
+            this.daemonInitInProgress.add(workspaceId);
+            try {
+                await this.initializeDaemonMode(workspaceId);
+                this.initialDaemonReady.add(workspaceId);
+                this.logger.info('Chat Agent Daemon started', { workspaceId });
+            }
+            catch (error) {
+                this.logger.warn('Daemon mode failed to start for workspace - continuing with other workspaces', {
+                    workspaceId,
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+            finally {
+                this.daemonInitInProgress.delete(workspaceId);
+            }
+        });
+        // Wait for all daemons to start (or fail)
+        await Promise.allSettled(startPromises);
+        this.logger.info('Chat Agent Daemons initialization complete', {
+            successCount: this.daemonManagers.size,
+            totalAttempted: workspacesWithOrchestrator.length
+        });
     }
+    /**
+     * Start Bug Monitor for all workspaces with running daemons
+     * Each workspace gets its own bug monitor instance
+     */
     async startBugMonitor() {
         try {
-            // Get first configured account for Bug Reports Module
+            // Get all configured accounts
             const accounts = Object.entries(this.appConfig.hailerAccounts);
             if (accounts.length === 0) {
                 this.logger.info('No Hailer accounts configured - Bug Reports Module disabled');
                 return;
             }
-            const [apiKey] = accounts[0];
-            const userContext = await UserContextCache_1.UserContextCache.getContext(apiKey);
-            this.bugReportsModule = new giuseppe_1.BugReportsModule(userContext);
-            // Register bot user IDs to ignore (so bug monitor only processes human messages)
-            if (this.daemonManager) {
-                const daemonStatus = this.daemonManager.getStatus();
-                for (const daemon of daemonStatus) {
-                    this.bugReportsModule.registerBotUser(daemon.botId);
-                    this.logger.debug('Registered bot user for bug monitor to ignore', { botId: daemon.botId });
+            // Start bug monitor for each workspace that has a running daemon
+            for (const [workspaceId, daemonManager] of this.daemonManagers) {
+                try {
+                    // Find the appropriate API key for this workspace
+                    // For now, use the first account (could be enhanced to match workspace-specific accounts)
+                    const [apiKey] = accounts[0];
+                    const userContext = await UserContextCache_1.UserContextCache.getContext(apiKey);
+                    // Dynamic import - agents only needed when client is enabled
+                    const { BugReportsModule } = require('./agents/bug-fixer');
+                    const bugReportsModule = new BugReportsModule(userContext);
+                    // Register bot user IDs to ignore (so bug monitor only processes human messages)
+                    const daemonStatus = daemonManager.getStatus();
+                    for (const daemon of daemonStatus) {
+                        bugReportsModule.registerBotUser(daemon.botId);
+                        this.logger.debug('Registered bot user for bug monitor to ignore', {
+                            workspaceId,
+                            botId: daemon.botId
+                        });
+                    }
+                    // Register bug fixer disabled handler to trigger HAL response (BEFORE start!)
+                    bugReportsModule.onBugFixerDisabled(async (bug) => {
+                        if (bug.discussionId) {
+                            const context = `[System notification: A new bug report "${bug.name}" was detected, but Bug Fixer (the auto-fix bot) is currently disabled. The user may ask how to enable Bug Fixer or want to know more about this bug. Be helpful and explain they can enable Bug Fixer in the AI Hub app.]`;
+                            await daemonManager.triggerHalResponse(bug.discussionId, bug.id, context);
+                        }
+                    });
+                    await bugReportsModule.start();
+                    if (bugReportsModule.isRunning()) {
+                        this.bugReportsModules.set(workspaceId, bugReportsModule);
+                        const config = bugReportsModule.getConfig();
+                        this.logger.info('Bug Reports Module started', {
+                            workspaceId,
+                            autoFix: config.autoFix,
+                            interval: `${config.intervalMs / 1000}s`
+                        });
+                    }
                 }
-            }
-            // Register giuseppe disabled handler to trigger HAL response (BEFORE start!)
-            this.bugReportsModule.onGiuseppeDisabled(async (bug) => {
-                if (this.daemonManager && bug.discussionId) {
-                    const context = `[System notification: A new bug report "${bug.name}" was detected, but Giuseppe (the auto-fix bot) is currently disabled. The user may ask how to enable Giuseppe or want to know more about this bug. Be helpful and explain they can enable Giuseppe in the AI Hub app.]`;
-                    await this.daemonManager.triggerHalResponse(bug.discussionId, bug.id, context);
+                catch (error) {
+                    this.logger.warn('Bug Reports Module failed to start for workspace - continuing with other workspaces', {
+                        workspaceId,
+                        error: error instanceof Error ? error.message : String(error)
+                    });
                 }
-            });
-            await this.bugReportsModule.start();
-            if (this.bugReportsModule.isRunning()) {
-                const config = this.bugReportsModule.getConfig();
-                this.logger.info('Bug Reports Module started', {
-                    autoFix: config.autoFix,
-                    interval: `${config.intervalMs / 1000}s`
-                });
             }
+            this.logger.info('Bug Reports Module initialization complete', {
+                successCount: this.bugReportsModules.size,
+                totalAttempted: this.daemonManagers.size
+            });
         }
         catch (error) {
             this.logger.warn('Bug Reports Module failed to start - server will continue without bug monitoring', {
@@ -165,11 +219,28 @@ class Core {
             }
             const [apiKey] = accounts[0];
             const userContext = await UserContextCache_1.UserContextCache.getContext(apiKey);
-            await (0, bot_config_1.initBotConfigPersistence)(userContext.hailer);
+            // Dynamic import - bot-config only needed when client is enabled
+            const { initBotConfigPersistence, onDaemonRestartNeeded } = require('./bot-config');
+            await initBotConfigPersistence(userContext.hailer);
             this.logger.info('Bot config persistence initialized');
+            // Register webhook handler early so it can trigger daemon start
+            this.registerWebhookHandler();
             // Register callback for daemon restart when new orchestrator is discovered
-            (0, bot_config_1.onDaemonRestartNeeded)(() => {
-                this.attemptDaemonRestart();
+            // This is called when orchestrator config changes in any workspace
+            onDaemonRestartNeeded(() => {
+                // Restart all workspaces with orchestrator enabled
+                const { loadBotConfigs } = require('./bot-config');
+                const configs = loadBotConfigs();
+                for (const ctx of configs) {
+                    if (ctx.getOrchestratorCredentials()) {
+                        this.attemptDaemonRestart(0, ctx.workspaceId).catch(err => {
+                            this.logger.error('Failed to restart daemon after config change', {
+                                workspaceId: ctx.workspaceId,
+                                error: err
+                            });
+                        });
+                    }
+                }
             });
         }
         catch (error) {
@@ -178,49 +249,125 @@ class Core {
             });
         }
     }
+    /**
+     * Register webhook handler for bot config updates
+     * Called early so webhooks can trigger daemon start even if initial start failed
+     */
+    registerWebhookHandler() {
+        (0, webhook_handler_1.onBotUpdate)((workspaceId, bot, action) => {
+            this.logger.info('Webhook bot update received', { workspaceId, botType: bot.botType, action, enabled: bot.enabled });
+            if (bot.botType === 'orchestrator') {
+                if (action === 'remove') {
+                    // Orchestrator disabled - stop daemon for this workspace only
+                    this.logger.info('Orchestrator disabled via webhook, stopping daemon', { workspaceId });
+                    const manager = this.daemonManagers.get(workspaceId);
+                    if (manager) {
+                        manager.stopAll().catch((err) => {
+                            this.logger.error('Failed to stop daemons after orchestrator removal', { workspaceId, err });
+                        }).then(() => {
+                            // Clean up after stopping
+                            this.daemonManagers.delete(workspaceId);
+                            const interval = this.statusLogIntervals.get(workspaceId);
+                            if (interval) {
+                                clearInterval(interval);
+                                this.statusLogIntervals.delete(workspaceId);
+                            }
+                            this.initialDaemonReady.delete(workspaceId);
+                        });
+                    }
+                }
+                else {
+                    // Orchestrator added/updated - start or restart daemon for this workspace
+                    this.logger.info('Orchestrator config changed via webhook, triggering daemon start/restart', { workspaceId });
+                    this.attemptDaemonRestart(0, workspaceId).catch(err => {
+                        this.logger.error('Failed to restart daemon after orchestrator webhook update', { workspaceId, err });
+                    });
+                }
+            }
+            else {
+                // Specialist changed - hot-reload without losing orchestrator context
+                this.logger.info('Specialist config changed via webhook, hot-reloading', {
+                    workspaceId,
+                    botType: bot.botType,
+                    enabled: bot.enabled
+                });
+                const manager = this.daemonManagers.get(workspaceId);
+                if (manager && bot.botType) {
+                    manager.hotReloadSpecialist(bot.email, bot.password, bot.botType, bot.enabled, bot.userId || undefined).then((success) => {
+                        if (success) {
+                            this.logger.info('Specialist hot-reloaded successfully', {
+                                workspaceId,
+                                botType: bot.botType,
+                                enabled: bot.enabled
+                            });
+                        }
+                    }).catch((err) => {
+                        this.logger.error('Failed to hot-reload specialist', {
+                            workspaceId,
+                            botType: bot.botType,
+                            error: err
+                        });
+                    });
+                }
+            }
+        });
+        this.logger.debug('Webhook handler registered');
+    }
     /**
      * Attempt to restart daemon mode when bot state changes
-     * Stops existing daemons and starts fresh with updated configuration
+     * Stops existing daemon for a specific workspace and starts fresh with updated configuration
      * Includes retry logic for transient connection failures
+     *
+     * @param retryCount - Number of retry attempts made so far
+     * @param workspaceId - REQUIRED workspace ID to restart daemon for
      */
     async attemptDaemonRestart(retryCount = 0, workspaceId) {
         const MAX_RETRIES = 3;
         const RETRY_DELAY_MS = 5000;
-        // Skip restart if initial daemon hasn't been created yet
-        // (signals can fire before first daemon init completes)
-        if (!this.initialDaemonReady) {
-            this.logger.debug('Skipping daemon restart - initial daemon not yet ready');
-            return;
+        // If initial daemon for this workspace never started, check if we now have config to start it
+        if (!this.initialDaemonReady.has(workspaceId)) {
+            // Check if config now exists for this workspace
+            const { loadBotConfigs } = require('./bot-config');
+            const configs = loadBotConfigs();
+            const workspaceConfig = configs.find((ctx) => ctx.workspaceId === workspaceId && ctx.getOrchestratorCredentials());
+            if (!workspaceConfig) {
+                this.logger.debug('Skipping daemon start - no orchestrator config yet', { workspaceId });
+                return;
+            }
+            this.logger.info('Config now available, attempting first daemon start', { workspaceId });
+            // Continue to start daemon for first time
         }
-        if (this.daemonInitInProgress) {
-            this.logger.debug('Daemon init already in progress, skipping');
+        if (this.daemonInitInProgress.has(workspaceId)) {
+            this.logger.debug('Daemon init already in progress, skipping', { workspaceId });
             return;
         }
-        this.logger.info('Restarting daemons after bot state change', { retryCount });
-        this.daemonInitInProgress = true;
+        this.logger.info('Restarting daemon after bot state change', { workspaceId, retryCount });
+        this.daemonInitInProgress.add(workspaceId);
         try {
-            // Stop existing daemons if running
-            if (this.daemonManager) {
-                this.logger.info('Stopping existing daemons for restart');
-                if (this.statusLogInterval) {
-                    clearInterval(this.statusLogInterval);
-                    this.statusLogInterval = undefined;
+            // Stop existing daemon for this workspace if running
+            const existingManager = this.daemonManagers.get(workspaceId);
+            if (existingManager) {
+                this.logger.info('Stopping existing daemon for restart', { workspaceId });
+                const interval = this.statusLogIntervals.get(workspaceId);
+                if (interval) {
+                    clearInterval(interval);
+                    this.statusLogIntervals.delete(workspaceId);
                 }
-                await this.daemonManager.stopAll();
-                this.daemonManager = null;
+                await existingManager.stopAll();
+                this.daemonManagers.delete(workspaceId);
             }
-            // Start fresh with updated bot state
+            // Start fresh with updated bot state for this workspace
             await this.initializeDaemonMode(workspaceId);
-            // Verify orchestrator was created successfully (daemonManager is set by initializeDaemonMode)
-            // Use explicit re-read to help TypeScript understand the state change
-            const newManager = this.daemonManager;
+            // Verify daemon was created successfully
+            const newManager = this.daemonManagers.get(workspaceId);
             if (!newManager) {
                 throw new Error('Daemon manager was not created');
             }
             if (!newManager.getOrchestrator()) {
                 throw new Error('Daemon manager created but no orchestrator available');
             }
-            this.logger.info('Daemons successfully restarted after state change');
+            this.logger.info('Daemon successfully restarted after state change', { workspaceId });
+            this.initialDaemonReady.add(workspaceId);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
@@ -229,110 +376,95 @@ class Core {
                 errorMessage.includes('No orchestrator');
             if (isTransientError && retryCount < MAX_RETRIES) {
                 this.logger.warn('Daemon restart failed with transient error, scheduling retry', {
+                    workspaceId,
                     error: errorMessage,
                     retryCount: retryCount + 1,
                     retryDelayMs: RETRY_DELAY_MS
                 });
                 // Reset flag before scheduling retry
-                this.daemonInitInProgress = false;
+                this.daemonInitInProgress.delete(workspaceId);
                 setTimeout(() => {
                     this.attemptDaemonRestart(retryCount + 1, workspaceId);
                 }, RETRY_DELAY_MS);
                 return;
             }
             this.logger.warn('Daemon restart failed', {
+                workspaceId,
                 error: errorMessage,
                 retriesExhausted: retryCount >= MAX_RETRIES
             });
         }
         finally {
-            this.daemonInitInProgress = false;
+            this.daemonInitInProgress.delete(workspaceId);
         }
     }
+    /**
+     * Initialize daemon for a specific workspace
+     *
+     * @param workspaceId - REQUIRED workspace ID to initialize daemon for
+     */
     async initializeDaemonMode(workspaceId) {
         this.logger.info('Initializing Chat Agent Daemon', { workspaceId });
         // Check for orchestrator mode via environment variable
-        const orchestratorMode = process.env.DAEMON_ORCHESTRATOR_MODE === 'true';
-        this.logger.info(`Daemon mode: ${orchestratorMode ? 'ORCHESTRATOR' : 'STANDARD'}`);
-        this.daemonManager = await (0, factory_1.createDaemonManager)({ orchestratorMode, workspaceId });
-        if (!this.daemonManager) {
-            throw new Error('Failed to create daemon manager');
+        const orchestratorMode = process.env.DAEMON_ORCHESTRATOR_MODE !== 'false';
+        this.logger.info(`Daemon mode: ${orchestratorMode ? 'ORCHESTRATOR' : 'STANDARD'}`, { workspaceId });
+        // Dynamic import - agents only needed when client is enabled
+        const { createDaemonManager } = require('./agents/factory');
+        const daemonManager = await createDaemonManager({ orchestratorMode, workspaceId });
+        if (!daemonManager) {
+            throw new Error(`Failed to create daemon manager for workspace ${workspaceId}`);
         }
-        const status = this.daemonManager.getStatus();
+        // Store the manager for this workspace
+        this.daemonManagers.set(workspaceId, daemonManager);
+        const status = daemonManager.getStatus();
         this.logger.info('Chat Agent Daemon initialized and ready', {
+            workspaceId,
             daemonCount: status.length,
-            bots: status.map(s => s.botId),
+            bots: status.map((s) => s.botId),
             orchestratorMode
         });
-        // Wire webhook updates to daemon hot-reload
-        (0, webhook_handler_1.onBotUpdate)((workspaceId, bot, action) => {
-            this.logger.info('Webhook bot update received', { workspaceId, botType: bot.botType, action, enabled: bot.enabled });
-            if (bot.botType === 'orchestrator') {
-                if (action === 'remove') {
-                    // Orchestrator disabled - stop daemons, don't restart
-                    this.logger.info('Orchestrator disabled via webhook, stopping daemons');
-                    this.daemonManager?.stopAll().catch(err => {
-                        this.logger.error('Failed to stop daemons after orchestrator removal', err);
-                    });
-                }
-                else {
-                    // Orchestrator added/updated - restart daemons
-                    this.logger.info('Orchestrator config changed via webhook, triggering daemon restart');
-                    this.attemptDaemonRestart(0, workspaceId).catch(err => {
-                        this.logger.error('Failed to restart daemon after orchestrator webhook update', err);
-                    });
-                }
-            }
-            else {
-                // Specialist changed - hot-reload without losing orchestrator context
-                this.logger.info('Specialist config changed via webhook, hot-reloading', {
-                    botType: bot.botType,
-                    enabled: bot.enabled
-                });
-                if (this.daemonManager && bot.botType) {
-                    this.daemonManager.hotReloadSpecialist(bot.email, bot.password, bot.botType, bot.enabled, bot.userId || undefined).then(success => {
-                        if (success) {
-                            this.logger.info('Specialist hot-reloaded successfully', {
-                                botType: bot.botType,
-                                enabled: bot.enabled
-                            });
-                        }
-                        else {
-                            this.logger.warn('Specialist hot-reload failed', { botType: bot.botType });
-                        }
-                    }).catch(err => {
-                        this.logger.error('Error during specialist hot-reload', err);
-                    });
-                }
-            }
-        });
-        // Start periodic status logging (every 60s)
-        this.statusLogInterval = this.daemonManager.startStatusLogging(60000);
-        this.logger.info('Daemon status logging started (every 60s)');
+        // Start periodic status logging (every 60s) for this workspace
+        const interval = daemonManager.startStatusLogging(60000);
+        this.statusLogIntervals.set(workspaceId, interval);
+        this.logger.info('Daemon status logging started (every 60s)', { workspaceId });
     }
     /**
-     * Get daemon status (for HTTP endpoint)
+     * Get daemon status for all workspaces (for HTTP endpoint)
      */
     getDaemonStatus() {
-        return this.daemonManager?.getStatus() || null;
+        const allStatus = {};
+        for (const [workspaceId, manager] of this.daemonManagers) {
+            allStatus[workspaceId] = manager.getStatus();
+        }
+        return allStatus;
     }
     async stop() {
         this.logger.info('Stopping Hailer MCP application');
         try {
-            // Stop status logging
-            if (this.statusLogInterval) {
-                clearInterval(this.statusLogInterval);
+            // Stop all status logging intervals
+            for (const [workspaceId, interval] of this.statusLogIntervals) {
+                clearInterval(interval);
+                this.logger.debug('Stopped status logging', { workspaceId });
             }
-            // Stop Bug Reports Module
-            if (this.bugReportsModule) {
-                await this.bugReportsModule.stop();
+            this.statusLogIntervals.clear();
+            // Stop all Bug Reports Modules
+            for (const [workspaceId, module] of this.bugReportsModules) {
+                await module.stop();
+                this.logger.debug('Stopped Bug Reports Module', { workspaceId });
             }
-            // Cleanup bot config (clear timers and callbacks)
-            (0, bot_config_1.cleanupBotConfig)();
-            if (this.daemonManager) {
-                this.daemonManager.stopAll();
-                this.logger.info('Chat Agent Daemon stopped');
+            this.bugReportsModules.clear();
+            // Cleanup bot config (clear timers and callbacks) - only if client was enabled
+            if (this.appConfig.server.enableClient) {
+                const { cleanupBotConfig } = require('./bot-config');
+                cleanupBotConfig();
             }
+            // Stop all daemon managers
+            const stopPromises = Array.from(this.daemonManagers.entries()).map(async ([workspaceId, manager]) => {
+                await manager.stopAll();
+                this.logger.info('Chat Agent Daemon stopped', { workspaceId });
+            });
+            await Promise.all(stopPromises);
+            this.daemonManagers.clear();
             if (this.mcpServer) {
                 await this.mcpServer.stop();
                 this.logger.info('MCP Server stopped');

package/dist/mcp/UserContextCache.js

@@ -105,6 +105,24 @@ class UserContextCache {
             const init = await client.socket.request('v2.core.init', [
                 ['processes', 'users', 'network', 'networks', 'teams']
             ]);
+            // Validate single workspace access - MCP requires bot credentials with access to one workspace only
+            const workspaceCount = Object.keys(init.networks || {}).length;
+            if (workspaceCount > 1) {
+                const networks = (init.networks || {});
+                const workspaceNames = Object.values(networks)
+                    .map((ws) => ws.name)
+                    .join(', ');
+                logger.error('Multi-workspace credentials detected', {
+                    workspaceCount,
+                    workspaces: workspaceNames,
+                    apiKey: apiKey.substring(0, 8) + '...'
+                });
+                // Clean up the connection before throwing - prevents dangling socket
+                (0, hailer_clients_1.disconnectHailerClientByApiKey)(apiKey);
+                throw new Error(`Multi-workspace credentials detected (${workspaceCount} workspaces: ${workspaceNames}). ` +
+                    `MCP requires bot credentials with access to a single workspace. ` +
+                    `Please use the bot account created during 'hailer-sdk init'.`);
+            }
             // Create workspace cache from init data
             const appConfig = (0, config_1.createApplicationConfig)();
             const workspaceCache = (0, workspace_cache_1.createWorkspaceCache)(init, appConfig.mcpConfig);

package/dist/mcp/hailer-clients.d.ts

@@ -55,8 +55,16 @@ export declare const subscribeToSignal: (apiKey: string, eventType: SignalType |
 /**
  * Register new bot credentials for dynamic bot creation
  * Returns an API key that can be used to create a connection
+ *
+ * @param botId - Unique bot identifier
+ * @param email - Bot's Hailer email
+ * @param password - Bot's Hailer password
+ * @param options - Optional configuration
+ * @param options.allowedGroups - Tool groups this bot can access (e.g., ['read', 'write', 'bot_internal'])
  */
-export declare function registerBotCredentials(botId: string, email: string, password: string): string;
+export declare function registerBotCredentials(botId: string, email: string, password: string, options?: {
+    allowedGroups?: string[];
+}): string;
 /**
  * Unregister bot credentials and disconnect
  */

package/dist/mcp/hailer-clients.js

@@ -332,16 +332,26 @@ exports.subscribeToSignal = subscribeToSignal;
 /**
  * Register new bot credentials for dynamic bot creation
  * Returns an API key that can be used to create a connection
+ *
+ * @param botId - Unique bot identifier
+ * @param email - Bot's Hailer email
+ * @param password - Bot's Hailer password
+ * @param options - Optional configuration
+ * @param options.allowedGroups - Tool groups this bot can access (e.g., ['read', 'write', 'bot_internal'])
  */
-function registerBotCredentials(botId, email, password) {
+function registerBotCredentials(botId, email, password, options) {
     const apiKey = `bot-${botId}-${Date.now()}`;
-    // Add to environment CLIENT_CONFIGS
+    // Add to environment CLIENT_CONFIGS with optional tool access config
     config_1.environment.CLIENT_CONFIGS[apiKey] = {
         email,
         password,
         apiBaseUrl: 'https://api.hailer.com',
+        ...(options?.allowedGroups && { allowedGroups: options.allowedGroups }),
     };
-    logger.info('Bot credentials registered', { botId });
+    logger.info('Bot credentials registered', {
+        botId,
+        hasAllowedGroups: !!options?.allowedGroups
+    });
     return apiKey;
 }
 /**

package/dist/mcp/signal-handler.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignalHandler = void 0;
 const logger_1 = require("../lib/logger");
-const bot_config_1 = require("./tools/bot-config");
+const bot_config_1 = require("../bot-config");
 const logger = (0, logger_1.createLogger)({ component: 'signal-handler' });
 class SignalHandler {
     client;