@hailer/mcp 1.1.11 → 1.1.13

package/dist/app.js

@@ -8,9 +8,13 @@ const file_1 = require("./mcp/tools/file");
 const activity_1 = require("./mcp/tools/activity");
 const discussion_1 = require("./mcp/tools/discussion");
 const user_1 = require("./mcp/tools/user");
+const company_1 = require("./mcp/tools/company");
 const workflow_1 = require("./mcp/tools/workflow");
 const insight_1 = require("./mcp/tools/insight");
+const workflow_permissions_1 = require("./mcp/tools/workflow-permissions");
 const app_1 = require("./mcp/tools/app");
+// Vipunen plugin — Weaviate RAG knowledge base (conditional on WEAVIATE_HOST)
+const vipunen_1 = require("./plugins/vipunen");
 // Bot config and bug-fixer tools are dynamically imported only when MCP_CLIENT_ENABLED=true
 // This allows the npm package to work without these modules
 const core = new core_1.Core();
@@ -22,9 +26,6 @@ core.addTool(activity_1.listActivitiesTool);
 core.addTool(activity_1.showActivityByIdTool);
 core.addTool(activity_1.createActivityTool);
 core.addTool(activity_1.updateActivityTool);
-// core.addTool(searchActivitiesTool);
-// core.addTool(filterActivitiesTool);
-// core.addTool(activityToolsGuideTool);
 core.addTool(discussion_1.listMyDiscussionsTool);
 core.addTool(discussion_1.fetchDiscussionMessagesTool);
 core.addTool(discussion_1.fetchPreviousDiscussionMessagesTool);
@@ -35,8 +36,7 @@ core.addTool(discussion_1.inviteDiscussionMembersTool);
 core.addTool(discussion_1.getActivityFromDiscussionTool);
 core.addTool(user_1.searchWorkspaceUsersTool);
 core.addTool(user_1.getWorkspaceBalanceTool);
-// core.addTool(hailerGetInitTool);
-// core.addTool(validateUserIdTool);
+core.addTool(company_1.setUserRoleTool);
 core.addTool(workflow_1.getWorkflowSchemaTool);
 core.addTool(workflow_1.listWorkflowPhasesTool);
 core.addTool(workflow_1.listWorkflowsTool);
@@ -50,6 +50,10 @@ core.addTool(workflow_1.testFunctionFieldTool);
 core.addTool(workflow_1.listWorkflowsMinimalTool);
 core.addTool(workflow_1.countActivitiesTool);
 core.addTool(workflow_1.coreInitTool);
+core.addTool(workflow_permissions_1.listWorkflowPermissionsTool);
+core.addTool(workflow_permissions_1.grantWorkflowPermissionTool);
+core.addTool(workflow_permissions_1.revokeWorkflowPermissionTool);
+core.addTool(workflow_permissions_1.checkUserPermissionsTool);
 core.addTool(insight_1.createInsightTool);
 core.addTool(insight_1.previewInsightTool);
 core.addTool(insight_1.getInsightDataTool);
@@ -79,6 +83,15 @@ core.addTool(app_1.getProductManifestTool);
 // Marketplace app tools
 core.addTool(app_1.publishAppTool);
 core.addTool(app_1.installMarketplaceAppTool);
+// Vipunen tools (Weaviate RAG) — only registered when WEAVIATE_HOST is set
+const vipunenTools = (0, vipunen_1.registerVipunenTools)({
+    weaviateHost: config_1.environment.WEAVIATE_HOST,
+    weaviateApiKey: config_1.environment.WEAVIATE_API_KEY,
+    vipunenApiKeys: config_1.environment.VIPUNEN_API_KEYS,
+});
+for (const tool of vipunenTools) {
+    core.addTool(tool);
+}
 // Bot-internal tools - dynamically imported only when MCP_CLIENT_ENABLED=true
 // Wrapped in try/catch so global installs work (bot-config excluded from npm package)
 if (config_1.environment.MCP_CLIENT_ENABLED) {

package/dist/bot/bot-config.d.ts

@@ -4,18 +4,29 @@
  * Simple config reader for .bot-config/*.json files.
  * Extracts orchestrator credentials into a flat BotConfig interface.
  */
+import { ResponseMode } from './services/types';
+/** Who can talk to this bot */
+export type BotAccessLevel = 'all' | 'admin' | 'owner';
 export interface BotConfig {
+    activityId: string;
     workspaceId: string;
     workspaceName: string;
     email: string;
     password: string;
     displayName?: string;
+    systemPrompt?: string;
     enabled: boolean;
     apiHost: string;
+    /** Who can talk to this bot: 'all' (default), 'admin', or 'owner' */
+    accessLevel?: BotAccessLevel;
+    /** Workflow IDs the bot is allowed to access. Empty/undefined = all workflows. */
+    allowedWorkflows?: string[];
+    /** When the bot responds: 'always' (default), 'mention_only', 'reply_only', 'mention_or_reply' */
+    responseMode?: ResponseMode;
 }
 /**
  * Load all bot configs from .bot-config/*.json files.
- * Extracts orchestrator credentials into flat BotConfig objects.
+ * Falls back to BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS env vars.
  */
 export declare function loadBotConfigs(): BotConfig[];
 /**

package/dist/bot/bot-config.js

@@ -52,15 +52,66 @@ function getApiHost() {
 function getConfigDir() {
     return path.join(process.cwd(), '.bot-config');
 }
+/**
+ * Load bot configs from env vars (BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS).
+ * Returns empty array if no env vars are set.
+ */
+function loadEnvBotConfigs() {
+    // Multi-bot: BOT_ACCOUNTS JSON array
+    const botAccountsStr = process.env.BOT_ACCOUNTS;
+    if (botAccountsStr) {
+        try {
+            const accounts = JSON.parse(botAccountsStr);
+            const configs = accounts
+                .filter(a => a.email && a.password)
+                .map(a => ({
+                activityId: '',
+                workspaceId: 'env',
+                workspaceName: 'env',
+                email: a.email,
+                password: a.password,
+                displayName: a.displayName || process.env.BOT_DISPLAY_NAME || 'Dev AI',
+                enabled: true,
+                apiHost: getApiHost(),
+            }));
+            if (configs.length > 0) {
+                logger.info('Loaded bot configs from BOT_ACCOUNTS env', { count: configs.length });
+                return configs;
+            }
+        }
+        catch (error) {
+            logger.warn('Failed to parse BOT_ACCOUNTS env var', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    // Single bot: BOT_EMAIL + BOT_PASSWORD
+    const email = process.env.BOT_EMAIL;
+    const password = process.env.BOT_PASSWORD;
+    if (email && password) {
+        logger.info('Loaded bot config from BOT_EMAIL/BOT_PASSWORD env');
+        return [{
+                activityId: '',
+                workspaceId: 'env',
+                workspaceName: 'env',
+                email,
+                password,
+                displayName: process.env.BOT_DISPLAY_NAME || 'Dev AI',
+                enabled: true,
+                apiHost: getApiHost(),
+            }];
+    }
+    return [];
+}
 /**
  * Load all bot configs from .bot-config/*.json files.
- * Extracts orchestrator credentials into flat BotConfig objects.
+ * Falls back to BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS env vars.
  */
 function loadBotConfigs() {
     const configDir = getConfigDir();
     if (!fs.existsSync(configDir)) {
-        logger.warn('No .bot-config directory found');
-        return [];
+        logger.debug('No .bot-config directory found, checking env vars');
+        return loadEnvBotConfigs();
     }
     const files = fs.readdirSync(configDir).filter(f => f.endsWith('.json'));
     const configs = [];
@@ -68,21 +119,46 @@ function loadBotConfigs() {
         try {
             const filePath = path.join(configDir, file);
             const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+            // Load orchestrator
             const orch = raw.orchestrator;
-            const hasCredentials = !!orch?.email && !!orch?.password;
-            configs.push({
-                workspaceId: raw.workspaceId,
-                workspaceName: raw.workspaceName,
-                email: orch?.email ?? '',
-                password: orch?.password ?? '',
-                displayName: orch?.displayName,
-                enabled: hasCredentials,
-                apiHost: getApiHost(),
-            });
+            if (orch?.email && orch?.password) {
+                configs.push({
+                    activityId: orch.activityId || '',
+                    workspaceId: raw.workspaceId,
+                    workspaceName: raw.workspaceName,
+                    email: orch.email,
+                    password: orch.password,
+                    displayName: orch.displayName,
+                    systemPrompt: orch.systemPrompt,
+                    enabled: true,
+                    apiHost: getApiHost(),
+                    accessLevel: orch.accessLevel,
+                    allowedWorkflows: orch.allowedWorkflows,
+                    responseMode: orch.responseMode,
+                });
+            }
+            // Load specialists
+            if (Array.isArray(raw.specialists)) {
+                for (const spec of raw.specialists) {
+                    if (spec?.email && spec?.password && spec?.enabled !== false) {
+                        configs.push({
+                            activityId: spec.activityId || '',
+                            workspaceId: raw.workspaceId,
+                            workspaceName: raw.workspaceName,
+                            email: spec.email,
+                            password: spec.password,
+                            displayName: spec.displayName,
+                            systemPrompt: spec.systemPrompt,
+                            enabled: true,
+                            apiHost: getApiHost(),
+                        });
+                    }
+                }
+            }
             logger.debug('Loaded bot config', {
                 workspaceId: raw.workspaceId,
                 workspaceName: raw.workspaceName,
-                enabled: hasCredentials,
+                botCount: configs.filter(c => c.workspaceId === raw.workspaceId).length,
             });
         }
         catch (error) {
@@ -92,6 +168,11 @@ function loadBotConfigs() {
             });
         }
     }
+    // If no configs from files, fall back to env vars
+    if (configs.length === 0) {
+        logger.debug('No bot configs from files, checking env vars');
+        return loadEnvBotConfigs();
+    }
     logger.debug('Bot configs loaded', { total: configs.length });
     return configs;
 }
@@ -124,6 +205,9 @@ function saveBotConfig(config) {
             email: config.email,
             password: config.password,
             displayName: config.displayName,
+            systemPrompt: config.systemPrompt,
+            accessLevel: config.accessLevel,
+            allowedWorkflows: config.allowedWorkflows,
         } : null,
         specialists: existing.specialists ?? [],
         lastSynced: new Date().toISOString(),

package/dist/bot/bot-manager.d.ts

@@ -7,23 +7,33 @@
 import { ToolRegistry } from '../mcp/tool-registry';
 import { BotConfig } from './bot-config';
 interface BotUpdateEntry {
+    activityId: string;
     email: string;
     password: string;
     botType: string;
     enabled: boolean;
     displayName?: string;
+    systemPrompt?: string;
+    accessLevel?: string;
+    responseMode?: string;
 }
 export declare class BotManager {
     private toolRegistry;
     private anthropicApiKey;
+    /** Key: activityId → Bot instance */
     private bots;
+    /** Key: workspaceId → Set of activityIds (for cross-bot awareness) */
+    private workspaceBots;
     private apiHost;
     constructor(toolRegistry: ToolRegistry, anthropicApiKey: string);
+    /** Get all bot userIds in a workspace (for self-message guard) */
+    getBotUserIdsForWorkspace(workspaceId: string): Set<string>;
     startAll(): Promise<void>;
     startBot(config: BotConfig): Promise<void>;
-    stopBot(workspaceId: string): Promise<void>;
+    stopBot(botKey: string, workspaceId?: string): Promise<void>;
     stopAll(): Promise<void>;
     getStatus(): Array<{
+        activityId: string;
         workspaceId: string;
         connected: boolean;
         displayName: string;
@@ -31,8 +41,8 @@ export declare class BotManager {
     getBotCount(): number;
     /**
      * Handle hot reload from webhook updates.
-     * Only processes orchestrator bots. Workspace-isolated — only touches
-     * the bot for the specified workspaceId, never affects other workspaces.
+     * Supports all bot types. Routes by activityId so multiple bots
+     * can run in the same workspace independently.
      */
     handleBotUpdate(workspaceId: string, bot: BotUpdateEntry, action: 'add' | 'update' | 'remove'): Promise<void>;
 }

package/dist/bot/bot-manager.js

@@ -14,13 +14,29 @@ const logger = (0, logger_1.createLogger)({ component: 'bot-manager' });
 class BotManager {
     toolRegistry;
     anthropicApiKey;
+    /** Key: activityId → Bot instance */
     bots = new Map();
+    /** Key: workspaceId → Set of activityIds (for cross-bot awareness) */
+    workspaceBots = new Map();
     apiHost;
     constructor(toolRegistry, anthropicApiKey) {
         this.toolRegistry = toolRegistry;
         this.anthropicApiKey = anthropicApiKey;
         this.apiHost = process.env.BOT_API_BASE_URL || 'https://api.hailer.com';
     }
+    /** Get all bot userIds in a workspace (for self-message guard) */
+    getBotUserIdsForWorkspace(workspaceId) {
+        const ids = new Set();
+        const activityIds = this.workspaceBots.get(workspaceId);
+        if (activityIds) {
+            for (const actId of activityIds) {
+                const bot = this.bots.get(actId);
+                if (bot?.botUserId)
+                    ids.add(bot.botUserId);
+            }
+        }
+        return ids;
+    }
     async startAll() {
         const configs = (0, bot_config_1.loadBotConfigs)();
         const enabled = configs.filter(c => c.enabled);
@@ -37,11 +53,13 @@ class BotManager {
         logger.debug('Bot startup complete', { succeeded, failed });
     }
     async startBot(config) {
-        if (this.bots.has(config.workspaceId)) {
-            logger.warn('Bot already running', { workspaceId: config.workspaceId });
+        const botKey = config.activityId || config.workspaceId; // fallback for legacy configs
+        if (this.bots.has(botKey)) {
+            logger.warn('Bot already running', { activityId: botKey, workspaceId: config.workspaceId });
             return;
         }
         logger.debug('Starting bot', {
+            activityId: botKey,
             workspaceId: config.workspaceId,
             workspace: config.workspaceName,
         });
@@ -52,32 +70,53 @@ class BotManager {
             anthropicApiKey: this.anthropicApiKey,
             toolRegistry: this.toolRegistry,
             workspaceId: config.workspaceId,
+            systemPrompt: config.systemPrompt,
+            responseMode: config.responseMode,
+            botManager: this,
+            accessLevel: config.accessLevel,
+            allowedWorkflows: config.allowedWorkflows,
         });
         await bot.start();
-        this.bots.set(config.workspaceId, bot);
-        logger.debug('Bot started', { workspaceId: config.workspaceId });
+        this.bots.set(botKey, bot);
+        // Track in workspace lookup
+        if (!this.workspaceBots.has(config.workspaceId)) {
+            this.workspaceBots.set(config.workspaceId, new Set());
+        }
+        this.workspaceBots.get(config.workspaceId).add(botKey);
+        logger.debug('Bot started', { activityId: botKey, workspaceId: config.workspaceId });
     }
-    async stopBot(workspaceId) {
-        const bot = this.bots.get(workspaceId);
+    async stopBot(botKey, workspaceId) {
+        const bot = this.bots.get(botKey);
         if (!bot)
             return;
         await bot.stop();
-        this.bots.delete(workspaceId);
-        logger.debug('Bot stopped', { workspaceId });
+        this.bots.delete(botKey);
+        // Clean up workspace tracking
+        if (workspaceId) {
+            const wsSet = this.workspaceBots.get(workspaceId);
+            if (wsSet) {
+                wsSet.delete(botKey);
+                if (wsSet.size === 0)
+                    this.workspaceBots.delete(workspaceId);
+            }
+        }
+        logger.debug('Bot stopped', { activityId: botKey, workspaceId });
     }
     async stopAll() {
         logger.debug('Stopping all bots', { count: this.bots.size });
-        await Promise.allSettled(Array.from(this.bots.entries()).map(async ([wsId, bot]) => {
+        await Promise.allSettled(Array.from(this.bots.entries()).map(async ([botKey, bot]) => {
             await bot.stop();
-            logger.debug('Bot stopped', { workspaceId: wsId });
+            logger.debug('Bot stopped', { activityId: botKey });
         }));
         this.bots.clear();
+        this.workspaceBots.clear();
     }
     getStatus() {
-        return Array.from(this.bots.entries()).map(([wsId, bot]) => ({
-            workspaceId: wsId,
+        return Array.from(this.bots.entries()).map(([botKey, bot]) => ({
+            activityId: botKey,
+            workspaceId: bot.workspaceId || botKey,
             connected: bot.connected,
-            displayName: wsId,
+            displayName: bot.workspaceId || botKey,
         }));
     }
     getBotCount() {
@@ -85,48 +124,64 @@ class BotManager {
     }
     /**
      * Handle hot reload from webhook updates.
-     * Only processes orchestrator bots. Workspace-isolated — only touches
-     * the bot for the specified workspaceId, never affects other workspaces.
+     * Supports all bot types. Routes by activityId so multiple bots
+     * can run in the same workspace independently.
      */
     async handleBotUpdate(workspaceId, bot, action) {
-        if (bot.botType !== 'orchestrator') {
-            logger.debug('Ignoring non-orchestrator bot update', { workspaceId, botType: bot.botType });
+        const botKey = bot.activityId;
+        if (!botKey) {
+            logger.warn('Bot update missing activityId, skipping', { workspaceId });
             return;
         }
-        const running = this.bots.has(workspaceId);
+        const running = this.bots.has(botKey);
         if (action === 'remove' || !bot.enabled) {
             if (running) {
-                logger.info('Stopping bot (disabled via webhook)', { workspaceId });
-                await this.stopBot(workspaceId);
+                logger.info('Stopping bot (disabled via webhook)', { activityId: botKey, workspaceId });
+                await this.stopBot(botKey, workspaceId);
             }
             return;
         }
         // Validate credentials before proceeding
         if (!/.+@.+\..+/.test(bot.email) || !bot.password || bot.password.length < 6) {
-            logger.warn('Invalid bot credentials, skipping', { workspaceId });
+            logger.warn('Invalid bot credentials, skipping', { activityId: botKey, workspaceId });
             return;
         }
         // action is 'add' or 'update' with enabled=true
         if (running) {
-            // Restart — credentials or config may have changed
-            logger.info('Restarting bot (updated via webhook)', { workspaceId });
-            await this.stopBot(workspaceId);
+            const runningBot = this.bots.get(botKey);
+            // If only the system prompt changed, update it live — no restart needed
+            const credentialsChanged = runningBot.email !== bot.email || runningBot.password !== bot.password;
+            const accessLevelChanged = bot.accessLevel !== undefined && runningBot.accessLevel !== bot.accessLevel;
+            if (!credentialsChanged && !accessLevelChanged) {
+                logger.info('Updating bot config live (no restart needed)', { activityId: botKey, workspaceId });
+                runningBot.updateSystemPrompt(bot.systemPrompt);
+                runningBot.updateResponseMode(bot.responseMode);
+                return;
+            }
+            // Credentials changed — full restart required
+            logger.info('Restarting bot (credentials updated via webhook)', { activityId: botKey, workspaceId });
+            await this.stopBot(botKey, workspaceId);
         }
         const config = {
+            activityId: botKey,
             workspaceId,
             workspaceName: workspaceId,
             email: bot.email,
             password: bot.password,
             displayName: bot.displayName,
+            systemPrompt: bot.systemPrompt,
             enabled: true,
             apiHost: this.apiHost,
+            accessLevel: bot.accessLevel,
+            responseMode: bot.responseMode,
         };
         try {
             await this.startBot(config);
-            logger.info('Bot started via webhook', { workspaceId, displayName: bot.displayName });
+            logger.info('Bot started via webhook', { activityId: botKey, workspaceId, displayName: bot.displayName });
         }
         catch (error) {
             logger.error('Failed to start bot via webhook', {
+                activityId: botKey,
                 workspaceId,
                 error: error instanceof Error ? error.message : String(error),
             });

package/dist/bot/bot.d.ts

@@ -6,6 +6,8 @@
  * and posts responses back to discussions.
  */
 import { ToolRegistry } from '../mcp/tool-registry';
+import { ResponseMode } from './services/types';
+import { BotAccessLevel } from './bot-config';
 export declare class Bot {
     private logger;
     private clientManager;
@@ -18,12 +20,17 @@ export declare class Bot {
     private workspaceOverview;
     private userId;
     private _workspaceId;
+    private _systemPrompt;
+    private _responseMode;
     private conversationManager;
     private messageClassifier;
     private messageFormatter;
     private typingIndicator;
     private tokenBilling;
     private sessionLogger;
+    private hailerApi;
+    /** Cache of insightId → Set<workflowId> for permission checks on ID-based insight tools */
+    private insightWorkflowCache;
     private opLogger;
     private discussionStates;
     private processingDiscussions;
@@ -44,7 +51,10 @@ export declare class Bot {
     private permissionIndex;
     private adminUserIds;
     private ownerUserIds;
+    private workspaceMemberIds;
+    private membersLoaded;
     private config;
+    private botManager;
     constructor(config: {
         email: string;
         password: string;
@@ -53,11 +63,28 @@ export declare class Bot {
         model?: string;
         toolRegistry: ToolRegistry;
         workspaceId?: string;
+        systemPrompt?: string;
+        responseMode?: ResponseMode;
+        botManager?: any;
+        accessLevel?: BotAccessLevel;
+        allowedWorkflows?: string[];
     });
+    get email(): string;
+    get password(): string;
+    get accessLevel(): string;
+    /**
+     * Hot-update the system prompt without restarting the bot.
+     * Takes effect on the next message processed.
+     */
+    updateSystemPrompt(prompt: string | undefined): void;
+    updateResponseMode(mode: ResponseMode | undefined): void;
     get connected(): boolean;
     get workspaceId(): string | undefined;
+    /** Exposed for BotManager cross-bot awareness */
+    get botUserId(): string;
     start(): Promise<void>;
     stop(): Promise<void>;
+    private checkTriggerCondition;
     private handleSignal;
     private processDiscussion;
     /**
@@ -91,6 +118,11 @@ export declare class Bot {
      */
     private cleanupIncompleteExchange;
     private formatIncomingMessage;
+    /**
+     * Download image attachments and return Anthropic image content blocks.
+     * Falls back silently on errors — the text note still tells the LLM about the file.
+     */
+    private resolveImageAttachments;
     private formatOutgoingMessage;
     /**
      * Find bare 24-char hex IDs in text that aren't already inside hailerTags
@@ -99,6 +131,8 @@ export declare class Bot {
     private resolveBareIds;
     private getBotDisplayName;
     private buildSystemPrompt;
+    private static TOOL_STATUS_LABELS;
+    private getToolStatus;
     private getAnthropicTools;
     private sendMessage;
     /**
@@ -113,10 +147,22 @@ export declare class Bot {
      * Called when process.updated, workspace.updated, or cache.invalidate signals fire.
      */
     private refreshWorkspaceData;
+    /**
+     * Backfill workspaceCache.usersById with entries from network.members
+     * that are missing from init.users (which is only a partial user list).
+     */
+    private backfillWorkspaceCacheMembers;
     private buildPermissionIndex;
     private getOrCreateDiscussionState;
     private getUserContext;
     private getDefaultTeamId;
+    /** Get the current permission context for checkWorkflowAccess calls */
+    private getPermissionContext;
+    /**
+     * Post-filter list-type tool results to remove items the user can't access.
+     * Handles list_workflows, list_workflows_minimal, and list_insights.
+     */
+    private postFilterListResults;
     /**
      * Extract workflow ID from tool result for post-execution permission checks.
      * Returns the workflow ID if found, or undefined if extraction fails.