@koda-sl/baker-cli 0.417.0 → 0.418.0

package/README.md

@@ -865,7 +865,7 @@ baker ads x targeting-constants --constant tv_shows --locale en-US
 
 ### ChatGPT Ads (`baker ads chatgpt`)
 
-Read the company's ChatGPT Ads account (OpenAI's ads inside ChatGPT conversations) and how it performs, and stage changes to it that apply when the chat is published. The company connects one account in the dashboard (Brain → Integrations → ChatGPT Ads) with an API key from its Ads Manager; the key stays in Baker and never reaches the CLI, so there is no account id to pass.
+Read the company's ChatGPT Ads account (OpenAI's ads inside ChatGPT conversations) and how it performs, and stage changes to it that apply when the chat is published. The company connects one account with an API key from its Ads Manager, pasted in the chat's connect card (`request_connection` `{ platform: "chatgpt-ads" }`) or in Brain → Integrations → ChatGPT Ads; the key stays in Baker and never reaches the CLI, so there is no account id to pass.
 
 | Subcommand | What it returns |
 |---|---|
@@ -3730,12 +3730,13 @@ Permissions enforced server-side:
 
 ---
 
-### `baker mcp connected | list | add | remove`
+### `baker mcp connected | catalog | list | add | remove`
 
 See everything a chat can reach — managed integrations, custom servers, and connected platforms — and manage **custom MCP servers** by pointing the agent at any remote HTTPS MCP endpoint. Registered tools appear as `mcp__<name>__*` on the next chat message.
 
 ```bash
 baker mcp connected
+baker mcp catalog --search notion
 baker mcp list
 baker mcp add --name weather --url https://mcp.example.com/mcp
 baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-…"
@@ -3744,6 +3745,7 @@ baker mcp remove --name weather
 ```
 
 - `connected` returns three lists. `managed` and `custom` are MCP tools the agent calls directly; `platforms` are the accounts the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager, LinkedIn Ads), each with its login and the resources it may read. A platform has **no** `mcp__*` tools — it is read through its own command family — so it is listed here to keep the agent from concluding a working connection is missing.
+- `catalog --search <name> [--limit 1-20]` searches the managed apps a user can connect when a vendor has no MCP server of its own. Each app reports its slug (`app`), how the user connects it (`sign-in` or `key`; apps that need no sign-in cannot be connected and are left out) — never a managed copy of one of Baker's own connections: those come back under `platforms`, to ask for with `{ platform }` and whether this chat already reaches it (`connected`).
 - `--url` must be the **full MCP endpoint** (commonly ending in `/mcp`), HTTPS and public; loopback / private / cloud-metadata hosts are rejected. A bare domain frequently accepts the OAuth sign-in and then serves no tools, so every address is handshake-checked after it changes: `connected` and `list` report `usable: false` plus a `problem` (and a `suggestedAddress` when the server advertises a better endpoint) for a server that isn't serving tools, or `lastCheck: failed` when the last check only hit an outage — that one may work anyway, and a later turn re-checks it automatically. Repointing a server at a different host clears its saved sign-in: a token belongs to the host that issued it, so the server has to be connected again.
 - Scope is two independent choices — audience (just you / everyone) × level (this company / whole org):
   - `--scope company` (default) — everyone in this company.

package/dist/cli.js

@@ -34614,7 +34614,7 @@ var chatgptAdsConversionReportRequestSchema = z38.object({
 var CHATGPT_ADS_TRUNCATED_HEADER = "X-Baker-Truncated";
 
 // src/commands/ads/chatgpt/shared.ts
-var CONNECT_EXPLANATION = "ChatGPT Ads is connected from the dashboard, with the API key from the company's ChatGPT Ads Manager (Settings \u2192 API keys): Brain \u2192 Integrations \u2192 ChatGPT Ads. Tell the user exactly that, and never ask them to paste the key in this chat \u2014 `request_connection` does not cover ChatGPT Ads. Carry on with the rest of the task and say what stays unavailable until it is connected.";
+var CONNECT_EXPLANATION = 'Ask for ChatGPT Ads with request_connection `{ platform: "chatgpt-ads" }`: the card asks for the API key from the company\'s ChatGPT Ads Manager (Settings \u2192 API keys), and the user pastes it there \u2014 never ask for it in this chat. If they skip it, carry on with the rest of the task and say what stays unavailable until it is connected.';
 var OPENAI_ADS_DOCS = "https://developers.openai.com/ads";
 var CHATGPT_ADS_REFERENCE = {
   account: `${OPENAI_ADS_DOCS}/api-reference/ad-account.md`,
@@ -34691,7 +34691,7 @@ function chatgptFailure(err, reference = CHATGPT_ADS_REFERENCE.overview) {
         message: err.message,
         fix: {
           action: "authenticate",
-          explanation: `${err.message} Tell the user; never ask them to paste the key in this chat.`
+          explanation: `${err.message} Open request_connection \`{ platform: "chatgpt-ads" }\` so they can replace the key in the card; never ask them to paste it in this chat.`
         },
         retryable: false
       }
@@ -93825,9 +93825,60 @@ Subcommands:
   }
 });
 
+// ../api/src/mcp-catalog.ts
+import { z as z65 } from "zod";
+var MCP_CATALOG_DEFAULT_LIMIT = 8;
+var MCP_CATALOG_DESCRIPTION_MAX = 160;
+var mcpCatalogRequestSchema = z65.object({
+  search: z65.string().trim().min(1, "Provide --search").max(100),
+  limit: z65.coerce.number().int().min(1).max(20).default(MCP_CATALOG_DEFAULT_LIMIT)
+});
+var mcpCatalogConnectSchema = z65.enum(["sign-in", "key"]);
+var mcpCatalogEntrySchema = z65.object({
+  /** The toolkit slug — what request_connection `{ app }` takes. */
+  app: z65.string(),
+  name: z65.string(),
+  description: z65.string().max(MCP_CATALOG_DESCRIPTION_MAX),
+  connect: mcpCatalogConnectSchema,
+  connected: z65.boolean()
+});
+var mcpCatalogResponseSchema = z65.object({
+  apps: z65.array(mcpCatalogEntrySchema),
+  /** The company has managed apps switched off: nothing here can be connected, so `apps` is empty. */
+  managedDisabled: z65.boolean().optional(),
+  /** Baker's own connections this search matched — ask for these with `{ platform }`, never a managed copy. */
+  platforms: z65.array(z65.string()).optional()
+});
+
 // src/commands/mcp/index.ts
 import { defineCommand as defineCommand211 } from "citty";
 
+// src/commands/mcp/catalog.ts
+var PREFER_VENDOR_HINT = 'The vendor\'s own MCP server comes before any app here. If you have not yet, WebSearch "<vendor> MCP server" and WebFetch its official docs for the remote https address and how it signs in, then ask for it with request_connection `{ server: { name, url, auth, keyHeader } }`. Only when the vendor has none, ask for an app from this catalog with request_connection `{ app: "<slug>", reason }` \u2014 the user connects it in the chat and its tools load right after, in this same turn.';
+var ALREADY_CONNECTED_HINT = "An app marked connected is already reachable \u2014 use its mcp__composio_* tools; do not ask again.";
+var NO_MATCH_HINT = "Nothing in the catalog matches. WebSearch for the vendor's official remote MCP server (its docs, its developer site) before telling the user it can't be connected \u2014 if one exists, ask for it with request_connection `{ server }`. Only when the web shows no official remote server either, say plainly this tool can't be connected yet and offer a Task.";
+var MANAGED_DISABLED_HINT = "Managed apps are switched off for this company, so none can be connected here. Use the vendor's own MCP server \u2014 WebSearch \"<vendor> MCP server\" and WebFetch its official docs, then request_connection `{ server }`; when it has none, say plainly this tool can't be connected yet and offer a Task.";
+function firstPartyHint(platforms) {
+  const asks = platforms.map((p) => `request_connection \`{ platform: "${p}" }\``).join(" or ");
+  return `This is one of Baker's own connections \u2014 ask for it with ${asks}. It is the one Baker's commands, staging and publish work with, so never connect it as a catalog app or as an MCP server, even one the vendor publishes or the user names. If it is already connected, read it with its own baker command family instead.`;
+}
+function catalogHints(apps, { managedDisabled = false, platforms = [] } = {}) {
+  if (platforms.length > 0) {
+    return [firstPartyHint(platforms)];
+  }
+  if (managedDisabled) {
+    return [MANAGED_DISABLED_HINT];
+  }
+  const hints2 = [PREFER_VENDOR_HINT];
+  if (apps.some((a) => a.connected)) {
+    hints2.push(ALREADY_CONNECTED_HINT);
+  }
+  if (apps.length === 0) {
+    hints2.push(NO_MATCH_HINT);
+  }
+  return hints2;
+}
+
 // src/commands/mcp/platforms.ts
 function readsKey(label) {
   const [first = "", ...rest] = label.split(" ");
@@ -93937,7 +93988,7 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
         );
       }
       hints2.push(
-        "Not listed anywhere = not connected. Managed app (Slack, Attio, \u2026) \u2192 the user connects it in the dashboard: Brain \u2192 Integrations \u2192 More apps. Platform (HubSpot, Google Ads, GA4, \u2026) \u2192 Brain \u2192 Integrations \u2192 Platforms. Custom HTTPS MCP endpoint \u2192 `baker mcp add`."
+        "Not listed anywhere = not connected \u2014 connect it from the chat with request_connection, never by sending the user to the dashboard: a Baker platform (HubSpot, Google Ads, GA4, \u2026) \u2192 { platform }; anything else \u2192 the vendor's own MCP server FIRST: use the address the user gave you, or WebSearch '<vendor> MCP server' and WebFetch its official docs for the remote https address and how it signs in, then { server: { name, url, auth, keyHeader } }; only when the vendor has none \u2192 `baker mcp catalog --search <name>`, then { app }. Research before you ask the user anything. What they connect loads into this same turn."
       );
       writeJson({
         ok: true,
@@ -93949,6 +94000,61 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
     }
   }
 });
+var catalogArgs = {
+  search: { type: "string", description: "App or vendor name, e.g. notion, clarity, pipedrive", required: true },
+  limit: { type: "string", description: "Max apps to return, 1-20 (default 8)", required: false }
+};
+registerSchema({
+  command: "mcp.catalog",
+  description: "Search the managed apps you can ask the user to connect when a vendor has no MCP server of its own. Each app says how the user connects it (sign-in | key) and whether this chat already reaches it. Example: baker mcp catalog --search notion",
+  args: catalogArgs
+});
+var catalogCommand2 = defineCommand211({
+  meta: {
+    name: "catalog",
+    description: `Managed apps you can ask the user to connect when a vendor has no MCP server of its own.
+
+For a tool \`baker mcp connected\` does not list whose vendor has no official remote MCP server:
+  baker mcp catalog --search notion
+  baker mcp catalog --search "microsoft clarity" --limit 3
+
+Each app: app (slug for request_connection), name, description, connect (sign-in | key), connected.
+Prefer the vendor's own MCP server when it publishes one; a catalog app is the fallback.`
+  },
+  args: catalogArgs,
+  run: async ({ args: args8 }) => {
+    const parsed = mcpCatalogRequestSchema.safeParse({ search: args8.search, limit: args8.limit });
+    if (!parsed.success) {
+      writeJson({
+        ok: false,
+        error: { code: "VALIDATION_ERROR", message: parsed.error.issues[0]?.message ?? "Invalid arguments" }
+      });
+      process.exit(1);
+    }
+    try {
+      const user = actingUserId();
+      const data = await apiGet("/api/mcp/catalog", {
+        search: parsed.data.search,
+        limit: String(parsed.data.limit),
+        ...user ? { actingUserId: user } : {}
+      });
+      writeJson({
+        ok: true,
+        data: {
+          apps: data.apps,
+          ...data.platforms?.length ? { platforms: data.platforms } : {},
+          ...data.managedDisabled ? { managedDisabled: true } : {}
+        },
+        hints: catalogHints(data.apps, {
+          managedDisabled: data.managedDisabled === true,
+          platforms: data.platforms ?? []
+        })
+      });
+    } catch (err) {
+      fail10(err);
+    }
+  }
+});
 registerSchema({
   command: "mcp.list",
   description: "List the custom MCP servers this company's chats see (org + company + your own user scope).",
@@ -93995,6 +94101,8 @@ var addCommand2 = defineCommand211({
   meta: {
     name: "add",
     description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.
+For a server the USER asks for, use request_connection { server } instead: they confirm who can use it,
+type any key into the card (never the chat), and its tools load in this same turn.
 
 Scope: company (default \u2014 every chat in the company) | org (all companies in the org; needs an admin key) | user (only the current message sender).
 
@@ -94075,6 +94183,7 @@ Managed here are **company-scoped** servers; user- and org-scoped servers are ma
 
 Start here:
   baker mcp connected   # everything this chat can reach: managed integrations, custom servers, connected platforms
+  baker mcp catalog --search notion   # managed apps you can connect when a vendor has no MCP server of its own
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
@@ -94084,6 +94193,7 @@ Full guide: __tooling__/docs/tools/baker/mcp.md`
   },
   subCommands: {
     connected: connectedCommand,
+    catalog: catalogCommand2,
     list: listCommand18,
     add: addCommand2,
     remove: removeCommand6
@@ -94094,8 +94204,8 @@ Full guide: __tooling__/docs/tools/baker/mcp.md`
 import { defineCommand as defineCommand217 } from "citty";
 
 // ../api/src/media-sources.ts
-import { z as z65 } from "zod";
-var mediaSourcePlatformSchema = z65.enum([
+import { z as z66 } from "zod";
+var mediaSourcePlatformSchema = z66.enum([
   "instagram",
   "tiktok",
   "youtube",
@@ -94103,55 +94213,55 @@ var mediaSourcePlatformSchema = z65.enum([
   "facebook",
   "google_drive"
 ]);
-var mediaSourceRefreshIntervalSchema = z65.enum(["never", "daily", "weekly", "monthly"]);
-var mediaSourceSyncStatusSchema = z65.enum(["idle", "fetching", "processing", "error"]);
-var mediaSourceHalfSchema = z65.object({
-  sourceId: z65.string(),
+var mediaSourceRefreshIntervalSchema = z66.enum(["never", "daily", "weekly", "monthly"]);
+var mediaSourceSyncStatusSchema = z66.enum(["idle", "fetching", "processing", "error"]);
+var mediaSourceHalfSchema = z66.object({
+  sourceId: z66.string(),
   syncStatus: mediaSourceSyncStatusSchema,
-  storedCount: z65.number().optional(),
-  pendingItems: z65.number().optional(),
-  failedItems: z65.number().optional(),
-  lastSyncedAt: z65.number().optional(),
-  errorMessage: z65.string().optional()
-});
-var mediaSourceSummarySchema = z65.object({
-  key: z65.string(),
+  storedCount: z66.number().optional(),
+  pendingItems: z66.number().optional(),
+  failedItems: z66.number().optional(),
+  lastSyncedAt: z66.number().optional(),
+  errorMessage: z66.string().optional()
+});
+var mediaSourceSummarySchema = z66.object({
+  key: z66.string(),
   platform: mediaSourcePlatformSchema,
-  platformLabel: z65.string(),
-  handle: z65.string(),
-  label: z65.string(),
-  profileUrl: z65.string(),
-  profileImageUrl: z65.string().optional(),
+  platformLabel: z66.string(),
+  handle: z66.string(),
+  label: z66.string(),
+  profileUrl: z66.string(),
+  profileImageUrl: z66.string().optional(),
   refreshInterval: mediaSourceRefreshIntervalSchema,
   /** Absent for a platform that feeds no images (YouTube). */
   images: mediaSourceHalfSchema.optional(),
   videos: mediaSourceHalfSchema.optional(),
-  createdAt: z65.number()
+  createdAt: z66.number()
 });
-var mediaSourceProfileSchema = z65.object({
+var mediaSourceProfileSchema = z66.object({
   platform: mediaSourcePlatformSchema,
-  handle: z65.string(),
-  displayName: z65.string(),
-  avatarUrl: z65.string(),
-  bio: z65.string(),
-  followers: z65.number().optional(),
-  postCount: z65.number().optional(),
-  isPrivate: z65.boolean(),
-  profileUrl: z65.string(),
-  channelId: z65.string().optional()
-});
-var mediaSourcesAddRequestSchema = z65.object({
+  handle: z66.string(),
+  displayName: z66.string(),
+  avatarUrl: z66.string(),
+  bio: z66.string(),
+  followers: z66.number().optional(),
+  postCount: z66.number().optional(),
+  isPrivate: z66.boolean(),
+  profileUrl: z66.string(),
+  channelId: z66.string().optional()
+});
+var mediaSourcesAddRequestSchema = z66.object({
   /** A profile URL or a Drive folder link, or an @handle together with `platform`. */
-  input: z65.string().trim().min(1, "Pass the account's profile URL or @handle"),
+  input: z66.string().trim().min(1, "Pass the account's profile URL or @handle"),
   /** Needed only when `input` is a bare handle; a URL names its own platform. */
   platform: mediaSourcePlatformSchema.optional(),
   /** Auto-sync cadence. Omitted = weekly, for every platform. */
   every: mediaSourceRefreshIntervalSchema.optional()
 });
-var mediaSourceKeySchema = z65.string().trim().regex(/^(instagram|tiktok|youtube|linkedin|facebook|google_drive):.+$/, "Pass a source key like tiktok:nike");
-var mediaSourcesSyncRequestSchema = z65.object({ key: mediaSourceKeySchema });
-var mediaSourcesRemoveRequestSchema = z65.object({ key: mediaSourceKeySchema });
-var mediaSourcesScheduleRequestSchema = z65.object({
+var mediaSourceKeySchema = z66.string().trim().regex(/^(instagram|tiktok|youtube|linkedin|facebook|google_drive):.+$/, "Pass a source key like tiktok:nike");
+var mediaSourcesSyncRequestSchema = z66.object({ key: mediaSourceKeySchema });
+var mediaSourcesRemoveRequestSchema = z66.object({ key: mediaSourceKeySchema });
+var mediaSourcesScheduleRequestSchema = z66.object({
   key: mediaSourceKeySchema,
   every: mediaSourceRefreshIntervalSchema
 });