@hed-hog/core 0.0.399 → 0.0.400

package/dist/mcp/mcp-audit.service.d.ts

@@ -2,6 +2,8 @@ import { PrismaService } from '@hed-hog/api-prisma';
 import { AccessLogService } from '../access-log/access-log.service';
 interface AuditRecord {
     userId: number;
+    /** Client OAuth externo, ou null para o caminho interno. */
+    clientId?: string | null;
     toolName: string;
     input: Record<string, any>;
     success: boolean;
@@ -13,6 +15,21 @@ export declare class McpAuditService {
     private readonly accessLogService;
     private readonly logger;
     constructor(prisma: PrismaService, accessLogService: AccessLogService);
+    /**
+     * Campos que carregam o conteúdo de um arquivo. Serializá-los custa memória à toa e o
+     * que sobraria no log são mil caracteres de base64, que não dizem nada sobre a chamada.
+     */
+    private static readonly REDACTED_FIELDS;
+    /**
+     * Troca o conteúdo de arquivo por uma marca antes de serializar.
+     *
+     * Sem isto, `JSON.stringify` de uma chamada com `fileBase64` monta uma string de
+     * dezenas de MB só para o `slice(0, 1000)` logo abaixo jogar fora quase tudo — e o
+     * pedaço que fica é base64, não a informação que a auditoria quer. Com a troca, o log
+     * passa a mostrar os demais argumentos (o id do título, a modalidade escolhida), que é
+     * o que permite reconstruir o que foi feito.
+     */
+    private redact;
     record(data: AuditRecord): Promise<void>;
 }
 export {};

package/dist/mcp/mcp-audit.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-audit.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,gBAAgB;IAG/C,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAuB/C"}
+{"version":3,"file":"mcp-audit.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,gBAAgB;IAGrD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAiC;IAExE;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAgBR,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA0B/C"}

package/dist/mcp/mcp-audit.service.js

@@ -23,17 +23,41 @@ let McpAuditService = McpAuditService_1 = class McpAuditService {
         this.accessLogService = accessLogService;
         this.logger = new common_1.Logger(McpAuditService_1.name);
     }
+    /**
+     * Troca o conteúdo de arquivo por uma marca antes de serializar.
+     *
+     * Sem isto, `JSON.stringify` de uma chamada com `fileBase64` monta uma string de
+     * dezenas de MB só para o `slice(0, 1000)` logo abaixo jogar fora quase tudo — e o
+     * pedaço que fica é base64, não a informação que a auditoria quer. Com a troca, o log
+     * passa a mostrar os demais argumentos (o id do título, a modalidade escolhida), que é
+     * o que permite reconstruir o que foi feito.
+     */
+    redact(input) {
+        if (!input || typeof input !== 'object') {
+            return input;
+        }
+        const copy = Object.assign({}, input);
+        for (const field of McpAuditService_1.REDACTED_FIELDS) {
+            if (typeof copy[field] === 'string') {
+                copy[field] = `<redacted: ${copy[field].length} chars>`;
+            }
+        }
+        return copy;
+    }
     async record(data) {
-        var _a;
-        const sanitized = JSON.stringify(data.input).slice(0, 1000);
+        var _a, _b;
+        const sanitized = JSON.stringify(this.redact(data.input)).slice(0, 1000);
         try {
             await this.prisma.mcp_tool_call_log.create({
                 data: {
                     user_id: data.userId || null,
+                    // Sem isto a auditoria nao distingue uma acao feita pelo Claude
+                    // Desktop de uma feita pelo Claude Code com chave fixa.
+                    client_id: (_a = data.clientId) !== null && _a !== void 0 ? _a : null,
                     tool_name: data.toolName,
                     input: sanitized,
                     success: data.success,
-                    error: (_a = data.error) !== null && _a !== void 0 ? _a : null,
+                    error: (_b = data.error) !== null && _b !== void 0 ? _b : null,
                     duration_ms: data.durationMs,
                 },
             });
@@ -49,6 +73,11 @@ let McpAuditService = McpAuditService_1 = class McpAuditService {
     }
 };
 exports.McpAuditService = McpAuditService;
+/**
+ * Campos que carregam o conteúdo de um arquivo. Serializá-los custa memória à toa e o
+ * que sobraria no log são mil caracteres de base64, que não dizem nada sobre a chamada.
+ */
+McpAuditService.REDACTED_FIELDS = ['fileBase64', 'chunkBase64'];
 exports.McpAuditService = McpAuditService = McpAuditService_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => access_log_service_1.AccessLogService))),

package/dist/mcp/mcp-audit.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-audit.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAwE;AACxE,yEAAoE;AAY7D,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YACmB,MAAqB,EAEtC,gBAAmD;QAFlC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAkB;QALpC,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAMxD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,IAAiB;;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACzC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;oBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,IAAI;oBACzB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhCY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qCAAgB,CAAC,CAAC,CAAA;qCADlB,0BAAa;QAEH,qCAAgB;GAN1C,eAAe,CAgC3B"}
+{"version":3,"file":"mcp-audit.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAwE;AACxE,yEAAoE;AAc7D,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YACmB,MAAqB,EAEtC,gBAAmD;QAFlC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAkB;QALpC,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAMxD,CAAC;IAQJ;;;;;;;;OAQG;IACK,MAAM,CAAC,KAA0B;QACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,qBAA6B,KAAK,CAAE,CAAC;QAE/C,KAAK,MAAM,KAAK,IAAI,iBAAe,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACzC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;oBAC5B,gEAAgE;oBAChE,wDAAwD;oBACxD,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,IAAI;oBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,IAAI;oBACzB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;;AAjEU,0CAAe;AAS1B;;;GAGG;AACqB,+BAAe,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,AAAhC,CAAiC;0BAb7D,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qCAAgB,CAAC,CAAC,CAAA;qCADlB,0BAAa;QAEH,qCAAgB;GAN1C,eAAe,CAkE3B"}

package/dist/mcp/mcp-permission.service.d.ts

@@ -0,0 +1,64 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { SettingService } from '../setting/setting.service';
+/**
+ * Quais tools MCP um usuário pode ver e chamar.
+ *
+ * Existe como service — e não inline no guard — porque a mesma resposta é usada
+ * em dois lugares que precisam concordar: o `tools/list`, que decide o que o
+ * cliente enxerga, e o `tools/call`, que decide o que ele executa. Duplicar a
+ * consulta é o caminho conhecido para os dois divergirem: tool que aparece na
+ * lista e devolve 403, ou — pior — tool que some da lista mas continua
+ * chamável.
+ *
+ * A fonte da verdade é a tabela `route` com `type = 'MCP'`, populada pelos
+ * arquivos `route.yaml` das libraries. Tool que existe em código mas não tem
+ * rota semeada não é concedida a ninguém.
+ */
+export declare class McpPermissionService {
+    private readonly prisma;
+    private readonly setting;
+    /**
+     * Curto de propósito: o preço de errar é uma mudança de papel demorar até
+     * meio minuto para valer, e o ganho é não repetir a consulta a cada uma das
+     * centenas de tools de um `tools/list`. O cache é por processo, e a API roda
+     * com várias réplicas — o limite real de propagação é sempre o TTL, nunca a
+     * réplica que respondeu.
+     */
+    private static readonly CACHE_TTL_MS;
+    /** Teto de usuários em cache antes de podar o que já expirou. */
+    private static readonly CACHE_MAX_ENTRIES;
+    /**
+     * Usado quando a setting nao pode ser lida. Escrita no nucleo de seguranca:
+     * usuarios, papeis, rotas, telas, settings e revogacao de sessao. Ler esses
+     * dominios continua liberado — o que se nega e alterar.
+     */
+    private static readonly DEFAULT_DENIED_TOOLS;
+    private readonly cache;
+    constructor(prisma: PrismaService, setting: SettingService);
+    /**
+     * `viaConnector` marca a chamada como vinda de um cliente OAuth externo.
+     *
+     * Um token de conector herda os papeis INTEIROS de quem autorizou — para um
+     * admin, todas as tools do sistema ao alcance de um prompt. Como o conteudo
+     * que o agente le pode vir de fora (um documento, um chamado, um e-mail), o
+     * papel sozinho nao e uma fronteira suficiente: e preciso um teto que valha
+     * mesmo para quem pode tudo.
+     *
+     * A negativa NAO se aplica ao caminho interno (chave `hedhog_mcp_`, JWT de
+     * login, mcp-chat): ali quem chama e o proprio operador, com a tela na frente.
+     */
+    getAllowedToolNames(userId: number, viaConnector?: boolean): Promise<Set<string>>;
+    canCall(userId: number, toolName: string, viaConnector?: boolean): Promise<boolean>;
+    /**
+     * A lista vem de setting, e nao de constante, porque a fronteira do que um
+     * agente externo pode fazer muda com o uso — e mudar isso nao deve exigir
+     * deploy. O `getSettingValues` ja e cacheado por versao, entao ler aqui e
+     * barato.
+     *
+     * Falha de leitura NAO abre a porta: sem conseguir a lista, o servico assume
+     * o padrao embutido. Uma setting apagada por engano nao pode virar permissao.
+     */
+    private getDeniedTools;
+    private remember;
+}
+//# sourceMappingURL=mcp-permission.service.d.ts.map

package/dist/mcp/mcp-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAO5D;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAoB;IAqC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAtC1B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAU;IAE9C,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAEhD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAc1C;IAEF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,MAAM,EAAE,aAAa,EAErB,OAAO,EAAE,cAAc;IAG1C;;;;;;;;;;;OAWG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkDjB,OAAO,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,UAAQ,GACnB,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;OAQG;YACW,cAAc;IAgB5B,OAAO,CAAC,QAAQ;CAkBjB"}

package/dist/mcp/mcp-permission.service.js

@@ -0,0 +1,178 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var McpPermissionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPermissionService = void 0;
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const setting_service_1 = require("../setting/setting.service");
+/** Setting com as tools que nenhum cliente OAuth externo pode chamar. */
+const DENIED_TOOLS_SETTING = 'mcp-connector-denied-tools';
+/**
+ * Quais tools MCP um usuário pode ver e chamar.
+ *
+ * Existe como service — e não inline no guard — porque a mesma resposta é usada
+ * em dois lugares que precisam concordar: o `tools/list`, que decide o que o
+ * cliente enxerga, e o `tools/call`, que decide o que ele executa. Duplicar a
+ * consulta é o caminho conhecido para os dois divergirem: tool que aparece na
+ * lista e devolve 403, ou — pior — tool que some da lista mas continua
+ * chamável.
+ *
+ * A fonte da verdade é a tabela `route` com `type = 'MCP'`, populada pelos
+ * arquivos `route.yaml` das libraries. Tool que existe em código mas não tem
+ * rota semeada não é concedida a ninguém.
+ */
+let McpPermissionService = McpPermissionService_1 = class McpPermissionService {
+    constructor(prisma, setting) {
+        this.prisma = prisma;
+        this.setting = setting;
+        this.cache = new Map();
+    }
+    /**
+     * `viaConnector` marca a chamada como vinda de um cliente OAuth externo.
+     *
+     * Um token de conector herda os papeis INTEIROS de quem autorizou — para um
+     * admin, todas as tools do sistema ao alcance de um prompt. Como o conteudo
+     * que o agente le pode vir de fora (um documento, um chamado, um e-mail), o
+     * papel sozinho nao e uma fronteira suficiente: e preciso um teto que valha
+     * mesmo para quem pode tudo.
+     *
+     * A negativa NAO se aplica ao caminho interno (chave `hedhog_mcp_`, JWT de
+     * login, mcp-chat): ali quem chama e o proprio operador, com a tela na frente.
+     */
+    async getAllowedToolNames(userId, viaConnector = false) {
+        // Sem usuário não há concessão. A guarda não é teórica: `user_id: undefined`
+        // faz o Prisma *descartar* o filtro, e `role_user: { some: {} }` casaria com
+        // qualquer rota ligada a qualquer papel — liberando tudo em vez de nada.
+        if (!userId)
+            return new Set();
+        // A chave inclui a origem: o mesmo usuario tem conjuntos diferentes pelo
+        // conector e pelo caminho interno, e uma chave so por id serviria o conjunto
+        // errado para quem usa os dois.
+        const cacheKey = viaConnector ? `c:${userId}` : `i:${userId}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.names;
+        }
+        const rows = await this.prisma.route.findMany({
+            where: {
+                type: 'MCP',
+                tool_name: { not: null },
+                role_route: {
+                    some: {
+                        role: {
+                            role_user: {
+                                some: { user_id: userId },
+                            },
+                        },
+                    },
+                },
+            },
+            select: { tool_name: true },
+        });
+        const names = new Set(rows
+            .map((row) => row.tool_name)
+            .filter((name) => Boolean(name)));
+        if (viaConnector) {
+            for (const denied of await this.getDeniedTools()) {
+                names.delete(denied);
+            }
+        }
+        this.remember(cacheKey, names);
+        return names;
+    }
+    async canCall(userId, toolName, viaConnector = false) {
+        const allowed = await this.getAllowedToolNames(userId, viaConnector);
+        return allowed.has(toolName);
+    }
+    /**
+     * A lista vem de setting, e nao de constante, porque a fronteira do que um
+     * agente externo pode fazer muda com o uso — e mudar isso nao deve exigir
+     * deploy. O `getSettingValues` ja e cacheado por versao, entao ler aqui e
+     * barato.
+     *
+     * Falha de leitura NAO abre a porta: sem conseguir a lista, o servico assume
+     * o padrao embutido. Uma setting apagada por engano nao pode virar permissao.
+     */
+    async getDeniedTools() {
+        try {
+            const values = await this.setting.getSettingValues([DENIED_TOOLS_SETTING]);
+            const raw = values[DENIED_TOOLS_SETTING];
+            const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+            if (Array.isArray(parsed) && parsed.length > 0) {
+                return parsed.map((t) => String(t));
+            }
+        }
+        catch (_a) {
+            // cai no padrao abaixo
+        }
+        return McpPermissionService_1.DEFAULT_DENIED_TOOLS;
+    }
+    remember(cacheKey, names) {
+        if (this.cache.size >= McpPermissionService_1.CACHE_MAX_ENTRIES) {
+            const now = Date.now();
+            for (const [key, entry] of this.cache) {
+                if (entry.expiresAt <= now)
+                    this.cache.delete(key);
+            }
+            // Todas ainda válidas: o cache inteiro sai. Esvaziar custa uma consulta
+            // por usuário ativo; deixar crescer sem teto custa memória para sempre.
+            if (this.cache.size >= McpPermissionService_1.CACHE_MAX_ENTRIES) {
+                this.cache.clear();
+            }
+        }
+        this.cache.set(cacheKey, {
+            expiresAt: Date.now() + McpPermissionService_1.CACHE_TTL_MS,
+            names,
+        });
+    }
+};
+exports.McpPermissionService = McpPermissionService;
+/**
+ * Curto de propósito: o preço de errar é uma mudança de papel demorar até
+ * meio minuto para valer, e o ganho é não repetir a consulta a cada uma das
+ * centenas de tools de um `tools/list`. O cache é por processo, e a API roda
+ * com várias réplicas — o limite real de propagação é sempre o TTL, nunca a
+ * réplica que respondeu.
+ */
+McpPermissionService.CACHE_TTL_MS = 30000;
+/** Teto de usuários em cache antes de podar o que já expirou. */
+McpPermissionService.CACHE_MAX_ENTRIES = 500;
+/**
+ * Usado quando a setting nao pode ser lida. Escrita no nucleo de seguranca:
+ * usuarios, papeis, rotas, telas, settings e revogacao de sessao. Ler esses
+ * dominios continua liberado — o que se nega e alterar.
+ */
+McpPermissionService.DEFAULT_DENIED_TOOLS = [
+    'core.roles.create', 'core.roles.delete', 'core.roles.menus.update',
+    'core.roles.routes.update', 'core.roles.screens.update', 'core.roles.update',
+    'core.roles.users.update',
+    'core.routes.create', 'core.routes.delete', 'core.routes.roles.update',
+    'core.routes.screens.update', 'core.routes.update',
+    'core.screens.create', 'core.screens.delete', 'core.screens.roles.update',
+    'core.screens.routes.update', 'core.screens.update',
+    'core.sessions.revoke', 'core.sessions.revoke-all', 'core.sessions.revoke-all-other',
+    'core.settings.delete', 'core.settings.set', 'core.settings.set-many',
+    'core.settings.update-from-slug',
+    'core.users.assign-role', 'core.users.create', 'core.users.delete',
+    'core.users.remove-role', 'core.users.reset-password', 'core.users.update',
+    'core.users.verify-identifier',
+];
+exports.McpPermissionService = McpPermissionService = McpPermissionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => setting_service_1.SettingService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        setting_service_1.SettingService])
+], McpPermissionService);
+//# sourceMappingURL=mcp-permission.service.js.map

package/dist/mcp/mcp-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAgE;AAChE,gEAA4D;AAI5D,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AAEI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAoC/B,YACmB,MAAqB,EAEtC,OAAwC;QAFvB,WAAM,GAAN,MAAM,CAAe;QAErB,YAAO,GAAP,OAAO,CAAgB;QALzB,UAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAMpD,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAc,EACd,YAAY,GAAG,KAAK;QAEpB,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE9B,yEAAyE;QACzE,6EAA6E;QAC7E,gCAAgC;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE;gBACL,IAAI,EAAE,KAAY;gBAClB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACxB,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,SAAS,EAAE;gCACT,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;6BAC1B;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBACjD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAgB,EAChB,YAAY,GAAG,KAAK;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAE/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QAED,OAAO,sBAAoB,CAAC,oBAAoB,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,KAAkB;QACnD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAoB,CAAC,iBAAiB,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAoB,CAAC,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAoB,CAAC,YAAY;YACzD,KAAK;SACN,CAAC,CAAC;IACL,CAAC;;AA9JU,oDAAoB;AAC/B;;;;;;GAMG;AACqB,iCAAY,GAAG,KAAM,AAAT,CAAU;AAE9C,iEAAiE;AACzC,sCAAiB,GAAG,GAAG,AAAN,CAAO;AAEhD;;;;GAIG;AACqB,yCAAoB,GAAG;IAC7C,mBAAmB,EAAE,mBAAmB,EAAE,yBAAyB;IACnE,0BAA0B,EAAE,2BAA2B,EAAE,mBAAmB;IAC5E,yBAAyB;IACzB,oBAAoB,EAAE,oBAAoB,EAAE,0BAA0B;IACtE,4BAA4B,EAAE,oBAAoB;IAClD,qBAAqB,EAAE,qBAAqB,EAAE,2BAA2B;IACzE,4BAA4B,EAAE,qBAAqB;IACnD,sBAAsB,EAAE,0BAA0B,EAAE,gCAAgC;IACpF,sBAAsB,EAAE,mBAAmB,EAAE,wBAAwB;IACrE,gCAAgC;IAChC,wBAAwB,EAAE,mBAAmB,EAAE,mBAAmB;IAClE,wBAAwB,EAAE,2BAA2B,EAAE,mBAAmB;IAC1E,8BAA8B;CAC/B,AAd2C,CAc1C;+BAhCS,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAuCR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADhB,0BAAa;QAEZ,gCAAc;GAvC/B,oBAAoB,CA+JhC"}

package/dist/mcp/mcp-server.service.d.ts

@@ -1,11 +1,13 @@
 import { Request, Response } from 'express';
 import { McpAuditService } from './mcp-audit.service';
+import { McpPermissionService } from './mcp-permission.service';
 import { McpRegistryService } from './mcp-registry.service';
 import { McpContext } from './types/mcp-context.type';
 export declare class McpServerService {
     private readonly registry;
     private readonly audit;
-    constructor(registry: McpRegistryService, audit: McpAuditService);
+    private readonly permissions;
+    constructor(registry: McpRegistryService, audit: McpAuditService, permissions: McpPermissionService);
     handleRequest(req: Request, res: Response, context: McpContext): Promise<void>;
     private buildServer;
 }

package/dist/mcp/mcp-server.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,eAAe;IAGnC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASpF,OAAO,CAAC,WAAW;CA0DpB"}
+{"version":3,"file":"mcp-server.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFX,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,oBAAoB;IAG9C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAepF,OAAO,CAAC,WAAW;CA0EpB"}

package/dist/mcp/mcp-server.service.js

@@ -15,35 +15,53 @@ const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamable
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const common_1 = require("@nestjs/common");
 const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_permission_service_1 = require("./mcp-permission.service");
 const mcp_registry_service_1 = require("./mcp-registry.service");
 let McpServerService = class McpServerService {
-    constructor(registry, audit) {
+    constructor(registry, audit, permissions) {
         this.registry = registry;
         this.audit = audit;
+        this.permissions = permissions;
     }
     async handleRequest(req, res, context) {
         const server = this.buildServer(context);
         const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
             sessionIdGenerator: undefined,
+            // Sem sessão o transporte só atende POST, e aí o SSE não compra nada: não
+            // há stream para retomar nem notificação do servidor para empurrar. O que
+            // ele custa é real — um `tools/list` de centenas de KB atravessa o ingress
+            // como um único evento, sujeito ao buffering do nginx. JSON puro entrega a
+            // mesma resposta sem esse caminho.
+            enableJsonResponse: true,
         });
         await server.connect(transport);
         await transport.handleRequest(req, res, req.body);
     }
     buildServer(context) {
         const server = new index_js_1.Server({ name: 'hedhog-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
-        server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-            tools: this.registry.getAll().map((e) => {
-                var _a;
-                return ({
-                    name: e.definition.name,
-                    description: e.definition.description,
-                    inputSchema: (_a = e.definition.inputSchema) !== null && _a !== void 0 ? _a : {
-                        type: 'object',
-                        properties: {},
-                    },
-                });
-            }),
-        }));
+        // A lista sai filtrada pelas mesmas permissões que o McpPermissionGuard
+        // aplica no tools/call. Sem isso o cliente recebe as centenas de tools do
+        // registry inteiro e descobre o que pode usar tomando 403 — além de gastar
+        // o contexto da conversa com ferramentas que nunca vão funcionar.
+        server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+            const allowed = await this.permissions.getAllowedToolNames(context.userId, context.clientId !== null);
+            return {
+                tools: this.registry
+                    .getAll()
+                    .filter((e) => allowed.has(e.definition.name))
+                    .map((e) => {
+                    var _a;
+                    return ({
+                        name: e.definition.name,
+                        description: e.definition.description,
+                        inputSchema: (_a = e.definition.inputSchema) !== null && _a !== void 0 ? _a : {
+                            type: 'object',
+                            properties: {},
+                        },
+                    });
+                }),
+            };
+        });
         server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             var _a;
             const toolName = request.params.name;
@@ -60,6 +78,7 @@ let McpServerService = class McpServerService {
                 const result = await entry.handler(args, Object.assign(Object.assign({}, context), { toolName }));
                 await this.audit.record({
                     userId: context.userId,
+                    clientId: context.clientId,
                     toolName,
                     input: args,
                     success: true,
@@ -70,6 +89,7 @@ let McpServerService = class McpServerService {
             catch (e) {
                 await this.audit.record({
                     userId: context.userId,
+                    clientId: context.clientId,
                     toolName,
                     input: args,
                     success: false,
@@ -89,6 +109,7 @@ exports.McpServerService = McpServerService;
 exports.McpServerService = McpServerService = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [mcp_registry_service_1.McpRegistryService,
-        mcp_audit_service_1.McpAuditService])
+        mcp_audit_service_1.McpAuditService,
+        mcp_permission_service_1.McpPermissionService])
 ], McpServerService);
 //# sourceMappingURL=mcp-server.service.js.map

package/dist/mcp/mcp-server.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wEAAmE;AACnE,0FAAmG;AACnG,iEAG4C;AAC5C,2CAA4C;AAE5C,2DAAsD;AACtD,iEAA4D;AAIrD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,QAA4B,EAC5B,KAAsB;QADtB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,OAAmB;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,WAAW,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;;gBAAC,OAAA,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;oBACvB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW;oBACrC,WAAW,EAAE,MAAA,CAAC,CAAC,UAAU,CAAC,WAAW,mCAAI;wBACvC,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE;qBACf;iBACF,CAAC,CAAA;aAAA,CAAC;SACJ,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,MAAM,CAAC,SAAS,mCAAI,EAAE,CAAwB,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,kCAAO,OAAO,KAAE,QAAQ,IAAG,CAAC;gBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,OAAO;oBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAzEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGkB,yCAAkB;QACrB,mCAAe;GAH9B,gBAAgB,CAyE5B"}
+{"version":3,"file":"mcp-server.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wEAAmE;AACnE,0FAAmG;AACnG,iEAG4C;AAC5C,2CAA4C;AAE5C,2DAAsD;AACtD,qEAAgE;AAChE,iEAA4D;AAIrD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,QAA4B,EAC5B,KAAsB,EACtB,WAAiC;QAFjC,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAiB;QACtB,gBAAW,GAAX,WAAW,CAAsB;IACjD,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,OAAmB;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,mCAAmC;YACnC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,WAAW,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACxD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,QAAQ;qBACjB,MAAM,EAAE;qBACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;qBAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;;oBAAC,OAAA,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;wBACvB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW;wBACrC,WAAW,EAAE,MAAA,CAAC,CAAC,UAAU,CAAC,WAAW,mCAAI;4BACvC,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,EAAE;yBACf;qBACF,CAAC,CAAA;iBAAA,CAAC;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,MAAM,CAAC,SAAS,mCAAI,EAAE,CAAwB,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,kCAAO,OAAO,KAAE,QAAQ,IAAG,CAAC;gBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,OAAO;oBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAhGY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGkB,yCAAkB;QACrB,mCAAe;QACT,6CAAoB;GAJzC,gBAAgB,CAgG5B"}

package/dist/mcp/mcp.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAIa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBvE"}
+{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAOa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBvE"}

package/dist/mcp/mcp.controller.js

@@ -19,6 +19,7 @@ const setting_service_1 = require("../setting/setting.service");
 const allow_mcp_token_decorator_1 = require("./decorators/allow-mcp-token.decorator");
 const mcp_auth_guard_1 = require("./guards/mcp-auth.guard");
 const mcp_permission_guard_1 = require("./guards/mcp-permission.guard");
+const mcp_challenge_filter_1 = require("./filters/mcp-challenge.filter");
 const mcp_server_service_1 = require("./mcp-server.service");
 let McpController = class McpController {
     constructor(mcpServer, setting) {
@@ -26,7 +27,7 @@ let McpController = class McpController {
         this.setting = setting;
     }
     async handle(req, res) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         const settings = await this.setting.getSettingValues(['mcp-enabled']);
         if (settings['mcp-enabled'] === false) {
             res.status(503).json({ message: 'MCP server is disabled.' });
@@ -41,6 +42,9 @@ let McpController = class McpController {
             sessionId: String(auth.sessionId),
             locale,
             toolName,
+            // `cid` so existe no token emitido pelo fluxo OAuth. Chave hedhog_mcp_ e
+            // JWT de login nao o tem, e e essa ausencia que marca o caminho interno.
+            clientId: (_f = auth.cid) !== null && _f !== void 0 ? _f : null,
         });
     }
 };
@@ -56,7 +60,11 @@ __decorate([
 exports.McpController = McpController = __decorate([
     (0, api_1.NoRole)(),
     (0, allow_mcp_token_decorator_1.AllowMcpToken)(),
-    (0, common_1.UseGuards)(mcp_auth_guard_1.McpAuthGuard, mcp_permission_guard_1.McpPermissionGuard),
+    (0, common_1.UseGuards)(mcp_auth_guard_1.McpAuthGuard, mcp_permission_guard_1.McpPermissionGuard)
+    // Captura tambem o 401 do AuthGuard global, que roda ANTES dos guards acima — e
+    // que e justamente quem responde a sondagem sem token de um cliente OAuth.
+    ,
+    (0, common_1.UseFilters)(mcp_challenge_filter_1.McpChallengeFilter),
     (0, common_1.Controller)('mcp'),
     __metadata("design:paramtypes", [mcp_server_service_1.McpServerService,
         setting_service_1.SettingService])

package/dist/mcp/mcp.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAsC;AACtC,2CAAsE;AAEtE,gEAA4D;AAC5D,sFAAuE;AACvE,4DAAuD;AACvD,wEAAmE;AACnE,6DAAwD;AAMjD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAA2B,EAC3B,OAAuB;QADvB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;QAC/B,MAAM,MAAM,GACV,MAAA,MAAA,MAAA,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,mCAAI,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAW,CAAC;QAC7B,MAAM,QAAQ,GACZ,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,MAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5BY,sCAAa;AAOlB;IADL,IAAA,YAAG,GAAE;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAoBvC;wBA3BU,aAAa;IAJzB,IAAA,YAAM,GAAE;IACR,IAAA,yCAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAY,EAAE,yCAAkB,CAAC;IAC3C,IAAA,mBAAU,EAAC,KAAK,CAAC;qCAGc,qCAAgB;QAClB,gCAAc;GAH/B,aAAa,CA4BzB"}
+{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAsC;AACtC,2CAAkF;AAElF,gEAA4D;AAC5D,sFAAuE;AACvE,4DAAuD;AACvD,wEAAmE;AACnE,yEAAoE;AACpE,6DAAwD;AASjD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAA2B,EAC3B,OAAuB;QADvB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;QAC/B,MAAM,MAAM,GACV,MAAA,MAAA,MAAA,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,mCAAI,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAW,CAAC;QAC7B,MAAM,QAAQ,GACZ,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,MAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM;YACN,QAAQ;YACR,yEAAyE;YACzE,yEAAyE;YACzE,QAAQ,EAAE,MAAA,IAAI,CAAC,GAAG,mCAAI,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/BY,sCAAa;AAOlB;IADL,IAAA,YAAG,GAAE;IACQ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAuBvC;wBA9BU,aAAa;IAPzB,IAAA,YAAM,GAAE;IACR,IAAA,yCAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAY,EAAE,yCAAkB,CAAC;IAC5C,gFAAgF;IAChF,2EAA2E;;IAC1E,IAAA,mBAAU,EAAC,yCAAkB,CAAC;IAC9B,IAAA,mBAAU,EAAC,KAAK,CAAC;qCAGc,qCAAgB;QAClB,gCAAc;GAH/B,aAAa,CA+BzB"}

package/dist/mcp/mcp.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.module.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.module.ts"],"names":[],"mappings":"AAsDA,qBA0Da,SAAS;CAAG"}
+{"version":3,"file":"mcp.module.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.module.ts"],"names":[],"mappings":"AAwDA,qBA4Da,SAAS;CAAG"}

package/dist/mcp/mcp.module.js

@@ -31,11 +31,13 @@ const setting_module_1 = require("../setting/setting.module");
 const token_module_1 = require("../token/token.module");
 const user_module_1 = require("../user/user.module");
 const webhook_integration_module_1 = require("../webhook-integration/webhook-integration.module");
+const mcp_challenge_filter_1 = require("./filters/mcp-challenge.filter");
 const mcp_auth_guard_1 = require("./guards/mcp-auth.guard");
 const mcp_permission_guard_1 = require("./guards/mcp-permission.guard");
 const mcp_api_key_controller_1 = require("./mcp-api-key.controller");
 const mcp_api_key_service_1 = require("./mcp-api-key.service");
 const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_permission_service_1 = require("./mcp-permission.service");
 const mcp_registry_service_1 = require("./mcp-registry.service");
 const mcp_server_service_1 = require("./mcp-server.service");
 const mcp_controller_1 = require("./mcp.controller");
@@ -95,8 +97,10 @@ exports.McpModule = McpModule = __decorate([
             mcp_registry_service_1.McpRegistryService,
             mcp_server_service_1.McpServerService,
             mcp_audit_service_1.McpAuditService,
+            mcp_permission_service_1.McpPermissionService,
             mcp_auth_guard_1.McpAuthGuard,
             mcp_permission_guard_1.McpPermissionGuard,
+            mcp_challenge_filter_1.McpChallengeFilter,
             mcp_api_key_service_1.McpApiKeyService,
             mcp_chat_service_1.McpChatService,
             core_settings_mcp_tools_1.CoreSettingsMcpTools,
@@ -120,7 +124,7 @@ exports.McpModule = McpModule = __decorate([
             core_mcp_chat_mcp_tools_1.CoreMcpChatMcpTools,
             core_system_mcp_tools_1.CoreSystemMcpTools,
         ],
-        exports: [mcp_registry_service_1.McpRegistryService, mcp_server_service_1.McpServerService, mcp_api_key_service_1.McpApiKeyService],
+        exports: [mcp_registry_service_1.McpRegistryService, mcp_server_service_1.McpServerService, mcp_api_key_service_1.McpApiKeyService, mcp_permission_service_1.McpPermissionService],
     })
 ], McpModule);
 //# sourceMappingURL=mcp.module.js.map

package/dist/mcp/mcp.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.module.js","sourceRoot":"","sources":["../../src/mcp/mcp.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4DAA2D;AAC3D,oDAAmD;AACnD,2CAAoD;AACpD,uCAA+C;AAC/C,+CAA2C;AAC3C,yDAAqD;AACrD,oEAAgE;AAChE,qDAAiD;AACjD,kGAA6F;AAC7F,qDAAiD;AACjD,oEAA+D;AAC/D,mEAA8D;AAC9D,qDAAiD;AACjD,6EAAyE;AACzE,8DAA0D;AAC1D,qDAAiD;AACjD,wDAAoD;AACpD,2DAAuD;AACvD,iEAA6D;AAC7D,8DAA0D;AAC1D,8DAA0D;AAC1D,wDAAoD;AACpD,qDAAiD;AACjD,kGAA6F;AAC7F,4DAAuD;AACvD,wEAAmE;AACnE,qEAA+D;AAC/D,+DAAyD;AACzD,2DAAsD;AACtD,iEAA4D;AAC5D,6DAAwD;AACxD,qDAAiD;AACjD,iEAA2D;AAC3D,2FAAoF;AACpF,+EAAyE;AACzE,yFAAkF;AAClF,uEAAiE;AACjE,iGAA0F;AAC1F,qEAA+D;AAC/D,+EAAwE;AACxE,6EAAsE;AACtE,uEAAiE;AACjE,uFAAiF;AACjF,2EAAqE;AACrE,uEAAiE;AACjE,yEAAmE;AACnE,2EAAqE;AACrE,6EAAuE;AACvE,6EAAuE;AACvE,yEAAmE;AACnE,uEAAiE;AACjE,6EAAuE;AACvE,uEAAkE;AA4D3D,IAAM,SAAS,GAAf,MAAM,SAAS;CAAG,CAAA;AAAZ,8BAAS;oBAAT,SAAS;IA1DrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,sBAAe;YACf,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,mCAAe,CAAC;YACjC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAgB,CAAC;YAClC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qDAAwB,CAAC;YAC1C,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wCAAkB,CAAC;YACpC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC;YACjC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qDAAwB,CAAC;YAC1C,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,oBAAQ,CAAC;YAC1B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC;SAC/B;QACD,WAAW,EAAE,CAAC,8BAAa,EAAE,4CAAmB,CAAC;QACjD,SAAS,EAAE;YACT,yCAAkB;YAClB,qCAAgB;YAChB,mCAAe;YACf,6BAAY;YACZ,yCAAkB;YAClB,sCAAgB;YAChB,iCAAc;YACd,8CAAoB;YACpB,wCAAiB;YACjB,wCAAiB;YACjB,0CAAkB;YAClB,wCAAiB;YACjB,4CAAmB;YACnB,4CAAmB;YACnB,8CAAoB;YACpB,wCAAiB;YACjB,sCAAgB;YAChB,+CAAoB;YACpB,wDAAyB;YACzB,gDAAqB;YACrB,2DAA0B;YAC1B,8CAAoB;YACpB,yDAAyB;YACzB,iEAA6B;YAC7B,kCAAc;YACd,6CAAmB;YACnB,0CAAkB;SACnB;QACD,OAAO,EAAE,CAAC,yCAAkB,EAAE,qCAAgB,EAAE,sCAAgB,CAAC;KAClE,CAAC;GACW,SAAS,CAAG"}
+{"version":3,"file":"mcp.module.js","sourceRoot":"","sources":["../../src/mcp/mcp.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4DAA2D;AAC3D,oDAAmD;AACnD,2CAAoD;AACpD,uCAA+C;AAC/C,+CAA2C;AAC3C,yDAAqD;AACrD,oEAAgE;AAChE,qDAAiD;AACjD,kGAA6F;AAC7F,qDAAiD;AACjD,oEAA+D;AAC/D,mEAA8D;AAC9D,qDAAiD;AACjD,6EAAyE;AACzE,8DAA0D;AAC1D,qDAAiD;AACjD,wDAAoD;AACpD,2DAAuD;AACvD,iEAA6D;AAC7D,8DAA0D;AAC1D,8DAA0D;AAC1D,wDAAoD;AACpD,qDAAiD;AACjD,kGAA6F;AAC7F,yEAAoE;AACpE,4DAAuD;AACvD,wEAAmE;AACnE,qEAA+D;AAC/D,+DAAyD;AACzD,2DAAsD;AACtD,qEAAgE;AAChE,iEAA4D;AAC5D,6DAAwD;AACxD,qDAAiD;AACjD,iEAA2D;AAC3D,2FAAoF;AACpF,+EAAyE;AACzE,yFAAkF;AAClF,uEAAiE;AACjE,iGAA0F;AAC1F,qEAA+D;AAC/D,+EAAwE;AACxE,6EAAsE;AACtE,uEAAiE;AACjE,uFAAiF;AACjF,2EAAqE;AACrE,uEAAiE;AACjE,yEAAmE;AACnE,2EAAqE;AACrE,6EAAuE;AACvE,6EAAuE;AACvE,yEAAmE;AACnE,uEAAiE;AACjE,6EAAuE;AACvE,uEAAkE;AA8D3D,IAAM,SAAS,GAAf,MAAM,SAAS;CAAG,CAAA;AAAZ,8BAAS;oBAAT,SAAS;IA5DrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,sBAAe;YACf,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,mCAAe,CAAC;YACjC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAgB,CAAC;YAClC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qDAAwB,CAAC;YAC1C,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wCAAkB,CAAC;YACpC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC;YACjC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qDAAwB,CAAC;YAC1C,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,oBAAQ,CAAC;YAC1B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC;SAC/B;QACD,WAAW,EAAE,CAAC,8BAAa,EAAE,4CAAmB,CAAC;QACjD,SAAS,EAAE;YACT,yCAAkB;YAClB,qCAAgB;YAChB,mCAAe;YACf,6CAAoB;YACpB,6BAAY;YACZ,yCAAkB;YAClB,yCAAkB;YAClB,sCAAgB;YAChB,iCAAc;YACd,8CAAoB;YACpB,wCAAiB;YACjB,wCAAiB;YACjB,0CAAkB;YAClB,wCAAiB;YACjB,4CAAmB;YACnB,4CAAmB;YACnB,8CAAoB;YACpB,wCAAiB;YACjB,sCAAgB;YAChB,+CAAoB;YACpB,wDAAyB;YACzB,gDAAqB;YACrB,2DAA0B;YAC1B,8CAAoB;YACpB,yDAAyB;YACzB,iEAA6B;YAC7B,kCAAc;YACd,6CAAmB;YACnB,0CAAkB;SACnB;QACD,OAAO,EAAE,CAAC,yCAAkB,EAAE,qCAAgB,EAAE,sCAAgB,EAAE,6CAAoB,CAAC;KACxF,CAAC;GACW,SAAS,CAAG"}

package/dist/mcp/tools/core-ai.mcp-tools.js

@@ -32,15 +32,8 @@ let CoreAiMcpTools = class CoreAiMcpTools {
         return this.aiService.chat({ message: args.message, context: args.context });
     }
     async listAgents(args, _context) {
-        var _a, _b, _c, _d, _e;
-        return this.aiService.listAgents({
-            page: (_a = args.page) !== null && _a !== void 0 ? _a : 1,
-            pageSize: (_b = args.pageSize) !== null && _b !== void 0 ? _b : 20,
-            search: (_c = args.search) !== null && _c !== void 0 ? _c : '',
-            sortField: (_d = args.sortField) !== null && _d !== void 0 ? _d : 'id',
-            sortOrder: (_e = args.sortOrder) !== null && _e !== void 0 ? _e : 'asc',
-            fields: '',
-        });
+        var _a, _b, _c, _d;
+        return this.aiService.listAgents(Object.assign(Object.assign({ page: (_a = args.page) !== null && _a !== void 0 ? _a : 1, pageSize: (_b = args.pageSize) !== null && _b !== void 0 ? _b : 20, search: (_c = args.search) !== null && _c !== void 0 ? _c : '' }, (args.sortField ? { sortField: args.sortField } : {})), { sortOrder: (_d = args.sortOrder) !== null && _d !== void 0 ? _d : 'asc', fields: '' }));
     }
     async getAgent(args, _context) {
         return this.aiService.getAgentById(args.agentId);