@hoilab/ada-cli 0.84.22 → 0.85.1

package/dist/core/mcp/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/core/mcp/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AA+BlC,MAAM,OAAO,QAAS,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,YAAY,OAAe,EAAE,IAAI,GAAG,CAAC,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,MAAM,OAAO,SAAS;IACb,GAAG,CAAS;IACZ,OAAO,CAAyB;IAChC,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACxB,MAAM,GAAG,CAAC,CAAC;IACnB,2EAA2E;IACnE,SAAS,CAAU;IACnB,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,OAAyB;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,CAAC;IAEO,YAAY;QACnB,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,kBAAkB;YAClC,8DAA8D;YAC9D,MAAM,EAAE,qCAAqC;YAC7C,GAAG,IAAI,CAAC,OAAO;SACf,CAAC;QACF,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,4DAA4D;IACpD,MAAM,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAY;QACzD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC/C,IAAI,CAAC;gBACJ,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACR,mBAAmB;YACpB,CAAC;QACF,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAAgC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnF,MAAM,EAAE,UAAU,CAAC,MAAM;aACzB,CAAC,CAAC;YAEH,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,aAAa;gBAAE,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC;YAElD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,8DAA8D;gBAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxD,MAAM,IAAI,QAAQ,CAAC,yBAAyB,IAAI,CAAC,GAAG,UAAU,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpG,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzF,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC,CAAC,mCAAmC;YACvE,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACxF,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,IAAK,KAA2B,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACxD,MAAM,IAAI,QAAQ,CAAC,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,UAAU;QACf,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE;YAC5B,eAAe,EAAE,gBAAgB;YACjC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE;SAC7C,CAAC,CAAC;QACH,2EAA2E;QAC3E,MAAM,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,SAAS;QACd,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAsC,CAAC;QACnF,OAAO,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACzD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAE3D,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IAC9E,CAAC;CACD"}

package/dist/core/mcp/manager.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Gestor de integraciones MCP.
+ *
+ * Diferencias deliberadas con el competidor, todas a nuestro favor:
+ *
+ * - El protocolo se habla en TypeScript (`client.ts`), no en un kernel Python.
+ * - Los tokens salen del **Vault cifrado**, no de un `auth.json` en claro.
+ * - Se exponen al modelo EXACTAMENTE DOS tools (`mcp_list_tools`,
+ *   `mcp_call_tool`), no una por cada tool remota: un servidor con 40 tools no
+ *   puede inflar el prompt ni desplazar el prefijo cacheable.
+ * - Solo en la sesión principal (anti-recursión): un subagente no alcanza Jira.
+ *
+ * Y una regla suya que SÍ copiamos porque no es obvia y la acertaron: si el
+ * usuario redefine un servidor del catálogo con su propia URL, esa entrada NO
+ * hereda las credenciales del builtin. Si no, el token emitido para el endpoint
+ * oficial acabaría enviándose a una URL arbitraria.
+ */
+import { type McpCallResult, McpClient, type McpTool } from "./client.ts";
+export interface McpServerConfig {
+    url: string;
+    /** Cabeceras estáticas (p. ej. una API key propia). */
+    headers?: Record<string, string>;
+    /** Variable de entorno con el bearer token. */
+    bearerTokenEnvVar?: string;
+    /** Nombre del secreto en el Vault. Preferido sobre la variable de entorno. */
+    vaultSecret?: string;
+    enabled?: boolean;
+}
+export interface McpCatalogEntry {
+    server: string;
+    label: string;
+    url: string;
+}
+/** Catálogo mínimo. Se mantiene corto a propósito: cada entrada es soporte. */
+export declare const BUILTIN_MCP_CATALOG: readonly McpCatalogEntry[];
+export declare function getCatalogEntry(server: string): McpCatalogEntry | undefined;
+export interface ResolvedIntegration {
+    server: string;
+    label: string;
+    url: string;
+    headers?: Record<string, string>;
+    bearerTokenEnvVar?: string;
+    vaultSecret?: string;
+    enabled: boolean;
+    /** Viene de la config del usuario (puede redefinir un nombre del catálogo). */
+    userDeclared: boolean;
+}
+export interface McpManagerOptions {
+    getServers: () => Record<string, McpServerConfig> | undefined;
+    /** Lee un secreto del Vault. Devuelve undefined si está bloqueado. */
+    getVaultSecret?: (name: string) => Promise<string | undefined>;
+    /** Inyectable para tests. */
+    createClient?: (integration: ResolvedIntegration, token?: string) => McpClient;
+    /**
+     * `fetch` con el que hablar con los servidores MCP.
+     *
+     * Existe para que las salidas queden en el libro de sesión. Sin esto, el
+     * informe para el DPO escribía «No hubo transferencias» sobre una sesión que
+     * había hablado con un MCP remoto — y contactar con un servidor de terceros
+     * ES una transferencia (art. 44 RGPD). Ver `core/web/registro-red.ts`.
+     */
+    fetchImpl?: typeof fetch;
+}
+export declare class McpManager {
+    private options;
+    private integrations;
+    private clients;
+    constructor(options: McpManagerOptions);
+    /** Re-lee la configuración. Llamar tras un reload de sesión. */
+    refresh(): void;
+    list(): ResolvedIntegration[];
+    /**
+     * Token de una integración.
+     *
+     * Regla de seguridad: una entrada del usuario que redefine un nombre del
+     * catálogo NO hereda credenciales del builtin — solo se autentica con lo que
+     * ella misma declara (vault o variable de entorno). Sin esto, el token del
+     * endpoint oficial podría acabar en una URL arbitraria.
+     */
+    tokenFor(integration: ResolvedIntegration): Promise<string | undefined>;
+    isAvailable(integration: ResolvedIntegration): Promise<boolean>;
+    private clientFor;
+    listTools(server: string): Promise<McpTool[]>;
+    callTool(server: string, tool: string, args: Record<string, unknown>): Promise<McpCallResult>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/core/mcp/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,aAAa,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,SAAS,eAAe,EAGzD,CAAC;AAEF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE3E;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,CAAC;IAC9D,sEAAsE;IACtE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/D,6BAA6B;IAC7B,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;IAC/E;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB;AAED,qBAAa,UAAU;IACtB,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,OAAO,CAAgC;gBAEnC,OAAO,EAAE,iBAAiB;IAKtC,gEAAgE;IAChE,OAAO,IAAI,IAAI;IA2Bf,IAAI,IAAI,mBAAmB,EAAE;IAI7B;;;;;;;OAOG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYvE,WAAW,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;YAKvD,SAAS;IA0BjB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI7C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;CAGnG"}

package/dist/core/mcp/manager.js

@@ -0,0 +1,124 @@
+/**
+ * Gestor de integraciones MCP.
+ *
+ * Diferencias deliberadas con el competidor, todas a nuestro favor:
+ *
+ * - El protocolo se habla en TypeScript (`client.ts`), no en un kernel Python.
+ * - Los tokens salen del **Vault cifrado**, no de un `auth.json` en claro.
+ * - Se exponen al modelo EXACTAMENTE DOS tools (`mcp_list_tools`,
+ *   `mcp_call_tool`), no una por cada tool remota: un servidor con 40 tools no
+ *   puede inflar el prompt ni desplazar el prefijo cacheable.
+ * - Solo en la sesión principal (anti-recursión): un subagente no alcanza Jira.
+ *
+ * Y una regla suya que SÍ copiamos porque no es obvia y la acertaron: si el
+ * usuario redefine un servidor del catálogo con su propia URL, esa entrada NO
+ * hereda las credenciales del builtin. Si no, el token emitido para el endpoint
+ * oficial acabaría enviándose a una URL arbitraria.
+ */
+import { anotarRedDeLaSesion, fetchConRegistro } from "../web/registro-red.js";
+import { McpClient } from "./client.js";
+/** Catálogo mínimo. Se mantiene corto a propósito: cada entrada es soporte. */
+export const BUILTIN_MCP_CATALOG = [
+    { server: "linear", label: "Linear", url: "https://mcp.linear.app/mcp" },
+    { server: "notion", label: "Notion", url: "https://mcp.notion.com/mcp" },
+];
+export function getCatalogEntry(server) {
+    return BUILTIN_MCP_CATALOG.find((entry) => entry.server === server);
+}
+export class McpManager {
+    options;
+    integrations = new Map();
+    clients = new Map();
+    constructor(options) {
+        this.options = options;
+        this.refresh();
+    }
+    /** Re-lee la configuración. Llamar tras un reload de sesión. */
+    refresh() {
+        const resolved = new Map();
+        for (const entry of BUILTIN_MCP_CATALOG) {
+            resolved.set(entry.server, {
+                server: entry.server,
+                label: entry.label,
+                url: entry.url,
+                enabled: false, // sin credenciales no está disponible
+                userDeclared: false,
+            });
+        }
+        for (const [server, config] of Object.entries(this.options.getServers() ?? {})) {
+            resolved.set(server, {
+                server,
+                label: server,
+                url: config.url,
+                headers: config.headers,
+                bearerTokenEnvVar: config.bearerTokenEnvVar,
+                vaultSecret: config.vaultSecret,
+                enabled: config.enabled !== false,
+                userDeclared: true,
+            });
+        }
+        this.integrations = resolved;
+        this.clients.clear();
+    }
+    list() {
+        return [...this.integrations.values()];
+    }
+    /**
+     * Token de una integración.
+     *
+     * Regla de seguridad: una entrada del usuario que redefine un nombre del
+     * catálogo NO hereda credenciales del builtin — solo se autentica con lo que
+     * ella misma declara (vault o variable de entorno). Sin esto, el token del
+     * endpoint oficial podría acabar en una URL arbitraria.
+     */
+    async tokenFor(integration) {
+        if (integration.vaultSecret && this.options.getVaultSecret) {
+            const secret = await this.options.getVaultSecret(integration.vaultSecret);
+            if (secret)
+                return secret;
+        }
+        if (integration.bearerTokenEnvVar) {
+            const value = process.env[integration.bearerTokenEnvVar]?.trim();
+            if (value)
+                return value;
+        }
+        return undefined;
+    }
+    async isAvailable(integration) {
+        if (!integration.enabled)
+            return false;
+        return (await this.tokenFor(integration)) !== undefined;
+    }
+    async clientFor(server) {
+        const integration = this.integrations.get(server);
+        if (!integration)
+            throw new Error(`Servidor MCP desconocido: ${server}. Usa /mcp para ver los configurados.`);
+        if (!integration.enabled)
+            throw new Error(`El servidor MCP '${server}' está desactivado.`);
+        const cached = this.clients.get(server);
+        if (cached)
+            return cached;
+        const token = await this.tokenFor(integration);
+        if (!token) {
+            throw new Error(`Sin credenciales para '${server}'. Guarda el token en el vault (/vault add) y referencia vaultSecret, o define ${integration.bearerTokenEnvVar ?? "un bearerTokenEnvVar"}.`);
+        }
+        const client = this.options.createClient?.(integration, token) ??
+            new McpClient({
+                url: integration.url,
+                headers: integration.headers,
+                bearerToken: token,
+                // El publicado por la sesión si no nos han pasado uno: `resource-loader`
+                // construye este manager y no tiene el libro a mano.
+                fetchImpl: this.options.fetchImpl ?? fetchConRegistro(fetch, anotarRedDeLaSesion()),
+            });
+        this.clients.set(server, client);
+        return client;
+    }
+    async listTools(server) {
+        return (await this.clientFor(server)).listTools();
+    }
+    async callTool(server, tool, args) {
+        return (await this.clientFor(server)).callTool(tool, args);
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/core/mcp/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/core/mcp/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAsB,SAAS,EAAgB,MAAM,aAAa,CAAC;AAmB1E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAA+B;IAC9D,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACxE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,4BAA4B,EAAE;CACxE,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC7C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AACrE,CAAC;AA+BD,MAAM,OAAO,UAAU;IACd,OAAO,CAAoB;IAC3B,YAAY,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE/C,YAAY,OAA0B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;IAED,gEAAgE;IAChE,OAAO;QACN,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,EAAE,sCAAsC;gBACtD,YAAY,EAAE,KAAK;aACnB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAChF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;gBACpB,MAAM;gBACN,KAAK,EAAE,MAAM;gBACb,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK;gBACjC,YAAY,EAAE,IAAI;aAClB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,IAAI;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAgC;QAC9C,IAAI,WAAW,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC1E,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;YACjE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAgC;QACjD,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,SAAS,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,uCAAuC,CAAC,CAAC;QAC9G,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,qBAAqB,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACd,0BAA0B,MAAM,kFAAkF,WAAW,CAAC,iBAAiB,IAAI,sBAAsB,GAAG,CAC5K,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GACX,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;YAC/C,IAAI,SAAS,CAAC;gBACb,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,WAAW,EAAE,KAAK;gBAClB,yEAAyE;gBACzE,qDAAqD;gBACrD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;aACnF,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,IAA6B;QACzE,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;CACD"}

package/dist/core/mcp/oauth.d.ts

@@ -0,0 +1,138 @@
+/**
+ * OAuth 2.0 + PKCE para servidores MCP.
+ *
+ * Ada-owned: no existe en upstream pi. Implementa el flujo que omp tiene en
+ * `mcp/oauth-flow.ts` + `mcp/oauth-discovery.ts` + `mcp/oauth-credentials.ts`:
+ *
+ * - PKCE S256 (RFC 7636): verifier 43-128 chars, challenge = BASE64URL(SHA256(verifier))
+ * - Descubrimiento RFC 8414 / RFC 9728 con resource indicators (RFC 8707)
+ * - Registro dinámico de cliente RFC 7591
+ * - Callback localhost (loopback) — el redirect_uri es http://127.0.0.1:{port}/callback
+ * - Refresh token
+ *
+ * Diferencia con el bearer estático que teníamos (`core/mcp/client.ts`): sin
+ * esto ningún servidor MCP corporativo detrás de un IdP es utilizable.
+ *
+ * Verificación CAP: `grep -rn "PKCE\|code_verifier\|code_challenge" packages/coding-agent/src/core/mcp`
+ * antes de este fichero devolvía 0 resultados (solo comentario en client.ts sobre
+ * bearer). Ver `AUDITORIA-OMP.md` MCP-01.
+ */
+export interface PKCEPair {
+    /** 43-128 chars de [A-Za-z0-9-._~]; BASE64URL sin padding de 32 bytes aleatorios = 43. */
+    verifier: string;
+    /** BASE64URL(SHA256(verifier)), sin padding. */
+    challenge: string;
+    method: "S256";
+}
+/**
+ * BASE64URL sin padding.
+ * Usa Buffer.toString("base64url") cuando está disponible (Node >=15),
+ * con fallback manual para entornos sin soporte.
+ */
+export declare function base64UrlEncode(buf: Buffer | Uint8Array): string;
+/** SHA256(verifier) → BASE64URL */
+export declare function computeChallenge(verifier: string): string;
+/**
+ * Genera un par PKCE S256.
+ *
+ * - verifier: 32 bytes aleatorios → 43 chars base64url (dentro de 43-128)
+ * - challenge: BASE64URL(SHA256(verifier))
+ * - method: siempre "S256" (plain está prohibido en este módulo)
+ */
+export declare function generatePKCEPair(): PKCEPair;
+export interface OAuthConfig {
+    /** Issuer del authorization server (si lo publica). */
+    issuer?: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    /** RFC 7591 — si está presente, el cliente puede registrarse dinámicamente. */
+    registrationEndpoint?: string;
+    scopesSupported?: string[];
+    /** Resource indicator (RFC 8707) — normalmente la URL del servidor MCP. */
+    resource?: string;
+}
+export interface OAuthDiscoveryOptions {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/**
+ * Descubre la configuración OAuth del servidor MCP.
+ *
+ * Orden (como en omp `oauth-discovery.ts:225-375`):
+ *  1. RFC 9728 — Protected Resource Metadata en
+ *     `/.well-known/oauth-protected-resource` (y variante con path).
+ *     Si responde con `authorization_servers`, se resuelve el primero.
+ *  2. RFC 8414 — Authorization Server Metadata en
+ *     `/.well-known/oauth-authorization-server`.
+ *  3. OpenID Discovery como fallback (`/.well-known/openid-configuration`).
+ *
+ * Además, si el servidor MCP responde 401 con `WWW-Authenticate: Bearer
+ * resource_metadata="..."`, ese URL tiene prioridad (no lo probamos aquí por
+ * no hacer una petición extra al MCP en discovery puro; el caller puede pasar
+ * la URL del header si la tiene).
+ */
+export declare function discoverOAuthConfig(serverUrl: string, options?: OAuthDiscoveryOptions): Promise<OAuthConfig>;
+export interface RegisterClientOptions {
+    registrationEndpoint: string;
+    /** Nombre visible del cliente (aparece en la pantalla de consentimiento). */
+    clientName?: string;
+    /** URIs de redirección — para MCP siempre localhost loopback. */
+    redirectUris: string[];
+    scope?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export interface RegisteredClient {
+    clientId: string;
+    clientSecret?: string;
+}
+export declare function registerClient(options: RegisterClientOptions): Promise<RegisteredClient>;
+/**
+ * Construye la URL de autorización para redirigir al usuario.
+ *
+ * El caller abre esta URL en el navegador y espera el callback en
+ * `redirectUri` (http://127.0.0.1:{port}/callback).
+ */
+export declare function buildAuthorizationUrl(config: OAuthConfig, params: {
+    clientId: string;
+    redirectUri: string;
+    pkce: PKCEPair;
+    scope?: string;
+    state?: string;
+    resource?: string;
+}): string;
+/** Valida que una redirect_uri sea loopback (callback localhost). */
+export declare function isLoopbackRedirectUri(uri: string): boolean;
+export interface TokenResponse {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    tokenType: string;
+    scope?: string;
+    raw?: unknown;
+}
+export interface ExchangeCodeOptions {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    code: string;
+    /** code_verifier del PKCE — debe ser el verifier original, no el challenge. */
+    verifier: string;
+    redirectUri: string;
+    resource?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare function exchangeCodeForToken(options: ExchangeCodeOptions): Promise<TokenResponse>;
+export interface RefreshOptions {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    refreshToken: string;
+    scope?: string;
+    resource?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare function refreshAccessToken(options: RefreshOptions): Promise<TokenResponse>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/core/mcp/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,WAAW,QAAQ;IACxB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAOhE;AAED,mCAAmC;AACnC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAU3C;AAMD,MAAM,WAAW,WAAW;IAC3B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,WAAW,CAAC,CAkFtB;AAiCD,MAAM,WAAW,qBAAqB;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyC9F;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GACC,MAAM,CAgBR;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAS1D;AAMD,MAAM,WAAW,aAAa;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqD/F;AAED,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA8CxF"}