@kaddo/mcp 3.82.0 → 3.83.0

package/dist/index.js

@@ -11657,7 +11657,7 @@ function systemImpactCandidatesTool(root, args) {
 
 // ../cli/src/services/integrations.ts
 import matter13 from "gray-matter";
-import { parse as parseYaml12 } from "yaml";
+import { parse as parseYaml12, stringify as stringifyYaml6 } from "yaml";
 
 // ../cli/src/core/work-item-write.ts
 import fs5 from "fs";
@@ -11751,6 +11751,26 @@ function parseCredentials(raw, id, findings) {
   }
   return creds;
 }
+function parseSecrets(raw, id, findings) {
+  const secrets = {};
+  if (raw == null) return secrets;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    findings.push({ level: "blocking", id, message: `Integration "${id}": secrets must be a mapping of logical references.` });
+    return secrets;
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === "string" && value.trim()) {
+      if (value.length > 100 || /^(ghp_|sk-|xox[bpsa]-|glpat-|ey[A-Za-z0-9])/i.test(value)) {
+        findings.push({ level: "blocking", id, message: `Integration "${id}": secret "${key}" appears to contain an actual credential, not a reference name.` });
+        continue;
+      }
+      secrets[key] = value.trim();
+    } else {
+      findings.push({ level: "warning", id, message: `Integration "${id}": ignoring non-string secret entry "${key}".` });
+    }
+  }
+  return secrets;
+}
 function parseIntegrationsConfig(raw, opts) {
   const findings = [];
   const integrations = [];
@@ -11783,12 +11803,13 @@ function parseIntegrationsConfig(raw, opts) {
     const enabled = o2.enabled === void 0 ? true : o2.enabled === true || o2.enabled === "true";
     const config = o2.config && typeof o2.config === "object" && !Array.isArray(o2.config) ? o2.config : {};
     const credentials = parseCredentials(o2.credentials, id, findings);
+    const secrets = parseSecrets(o2.secrets, id, findings);
     const timeoutMs = typeof o2.timeout_ms === "number" ? o2.timeout_ms : typeof o2.timeoutMs === "number" ? o2.timeoutMs : void 0;
-    integrations.push({ id, adapter, enabled, config, credentials, timeoutMs });
+    integrations.push({ id, adapter, enabled, config, credentials, secrets, timeoutMs });
   }
   return { integrations, findings };
 }
-function resolveCredentials(integration, env) {
+async function resolveAllCredentials(integration, resolver, env) {
   const credentials = {};
   const missing = [];
   for (const [name, ref] of Object.entries(integration.credentials)) {
@@ -11796,9 +11817,91 @@ function resolveCredentials(integration, env) {
     if (value && value.length > 0) credentials[name] = value;
     else missing.push(ref.env);
   }
+  for (const [name, ref] of Object.entries(integration.secrets)) {
+    if (credentials[name]) continue;
+    const value = await resolver.resolve(ref);
+    if (value !== void 0) credentials[name] = value;
+    else missing.push(ref);
+  }
   return { credentials, missing };
 }
 
+// ../integrations/src/secrets.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { dirname as dirname2 } from "path";
+var SECRETS_FILENAME = ".secrets.json";
+function secretsPath(projectDir) {
+  return `${projectDir}/.kaddo/${SECRETS_FILENAME}`;
+}
+function loadStore(filePath) {
+  if (!existsSync2(filePath)) return {};
+  try {
+    const raw = readFileSync2(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    return {};
+  } catch {
+    return {};
+  }
+}
+function saveStore(filePath, store) {
+  mkdirSync(dirname2(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(store, null, 2) + "\n", "utf-8");
+}
+function createLocalSecretProvider(projectDir) {
+  const fp = secretsPath(projectDir);
+  return {
+    async get(key) {
+      const store = loadStore(fp);
+      const val = store[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set(key, value) {
+      const store = loadStore(fp);
+      store[key] = value;
+      saveStore(fp, store);
+    },
+    async delete(key) {
+      const store = loadStore(fp);
+      delete store[key];
+      saveStore(fp, store);
+    },
+    async exists(key) {
+      const store = loadStore(fp);
+      return key in store && store[key] !== void 0 && store[key] !== "";
+    }
+  };
+}
+function createEnvSecretProvider(env = process.env) {
+  return {
+    async get(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async delete() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async exists(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "";
+    }
+  };
+}
+function createCompositeResolver(...providers) {
+  return {
+    async resolve(reference) {
+      for (const provider of providers) {
+        const val = await provider.get(reference);
+        if (val !== void 0) return val;
+      }
+      return void 0;
+    }
+  };
+}
+
 // ../integrations/src/registry.ts
 var DuplicateAdapterError = class extends Error {
   constructor(id) {
@@ -11883,7 +11986,31 @@ function createMockAdapter(opts = {}) {
       id: MOCK_ADAPTER_ID,
       displayName: "Mock Work Source",
       version: "1.0.0",
-      description: "Deterministic offline reference adapter for validating the integration foundation."
+      description: "Deterministic offline reference adapter for validating the integration foundation.",
+      configSchema: {
+        simulate: {
+          type: "select",
+          required: false,
+          label: "Simulation mode",
+          description: "Controls what the mock adapter simulates during verify/read operations.",
+          options: [
+            { value: "available", label: "Available" },
+            { value: "unauthorized", label: "Unauthorized" },
+            { value: "rate-limited", label: "Rate Limited" },
+            { value: "unavailable", label: "Unavailable" },
+            { value: "timeout", label: "Timeout" }
+          ],
+          defaultValue: "available"
+        }
+      },
+      secretSchema: {
+        token: {
+          type: "string",
+          required: false,
+          label: "API Token",
+          description: "Optional token for testing secret handling (not used by the mock adapter)."
+        }
+      }
     },
     capabilities: {
       workItems: { list: true, read: true, import: true, write: false, statusSync: false, comments: false, webhooks: false }
@@ -11960,6 +12087,9 @@ function configStatus(integration, findings) {
   if (blocking || !registry.has(integration.adapter)) return "invalid-config";
   return "configured";
 }
+function secretResolver(dir, env) {
+  return createCompositeResolver(createLocalSecretProvider(dir), createEnvSecretProvider(env));
+}
 function listIntegrations(dir) {
   const { integrations, findings } = loadIntegrations(dir);
   return integrations.map((integration) => {
@@ -11973,6 +12103,8 @@ function listIntegrations(dir) {
       capabilities: adapter?.capabilities ?? null,
       metadata: adapter?.metadata ?? null,
       credentialRefs: Object.values(integration.credentials).map((c) => c.env),
+      secretRefs: Object.values(integration.secrets),
+      secretStatus: {},
       findings: findings.filter((f3) => f3.id === integration.id)
     };
   });
@@ -11981,15 +12113,16 @@ function requireIntegration(dir, id) {
   const { integrations, findings } = loadIntegrations(dir);
   const integration = integrations.find((i) => i.id === id);
   if (!integration) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured in this project.`);
-  return { integration, findings };
+  return { integration, findings, all: integrations };
 }
 function resolveAdapter(integration) {
   const adapter = registry.get(integration.adapter);
   if (!adapter) throw new IntegrationServiceError("ADAPTER_NOT_FOUND", `Unknown integration adapter "${integration.adapter}".`);
   return adapter;
 }
-function buildContext(integration, env) {
-  const { credentials, missing } = resolveCredentials(integration, env);
+async function buildContextWithSecrets(dir, integration, env) {
+  const resolver = secretResolver(dir, env);
+  const { credentials, missing } = await resolveAllCredentials(integration, resolver, env);
   return {
     context: { integrationId: integration.id, config: integration.config, credentials, timeoutMs: integration.timeoutMs ?? DEFAULT_TIMEOUT_MS },
     missing
@@ -12012,7 +12145,7 @@ async function verifyIntegration(dir, id, env = process.env) {
   if (cfgStatus === "disabled") return { id, status: "disabled", connection: null, missingCredentials: [] };
   if (cfgStatus === "invalid-config") return { id, status: "invalid-config", connection: null, missingCredentials: [] };
   const adapter = resolveAdapter(integration);
-  const { context, missing } = buildContext(integration, env);
+  const { context, missing } = await buildContextWithSecrets(dir, integration, env);
   try {
     const connection = await withTimeout(adapter.verifyConnection(context), context.timeoutMs);
     return { id, status: statusOf(connection), connection, missingCredentials: missing, message: connection.message };
@@ -12037,14 +12170,14 @@ async function listExternalWorkItems(dir, id, opts = {}, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.list) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot list work items.`);
-  const { context } = buildContext(integration, env);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
   return withTimeout(adapter.listWorkItems({ context, cursor: opts.cursor, pageSize: opts.pageSize, filters: opts.filters }), context.timeoutMs);
 }
 async function getExternalWorkItem(dir, id, externalId, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.read) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot read work items.`);
-  const { context } = buildContext(integration, env);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
   return withTimeout(adapter.getWorkItem({ context, externalId }), context.timeoutMs);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/mcp",
-  "version": "3.82.0",
+  "version": "3.83.0",
   "description": "MCP server for Kaddo project knowledge: read-only resources/tools/prompts plus safe derived generation under .kaddo/.",
   "license": "MIT",
   "repository": {