@loicngr/kobo 2.1.26 → 2.1.28

package/dist/server/routes/mcp-credentials.js

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { createExternalMcpCredential, EXTERNAL_TOOL_CATALOGUE, listExternalMcpCredentials, revokeExternalMcpCredential, } from '../services/external-mcp-credentials-service.js';
+// Mounted behind the operator authentication gate; MCP credentials cannot reach it.
+const app = new Hono();
+app.use('*', bodyLimit({ maxSize: 32 * 1024 }));
+app.use('*', async (c, next) => {
+    c.header('Cache-Control', 'no-store');
+    await next();
+});
+app.get('/', (c) => c.json({
+    credentials: listExternalMcpCredentials(),
+    tools: EXTERNAL_TOOL_CATALOGUE.map((tool) => ({
+        name: tool.name,
+        readOnly: tool.annotations?.readOnlyHint === true,
+    })),
+}));
+app.post('/', async (c) => {
+    try {
+        return c.json(createExternalMcpCredential(await c.req.json()), 201);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : 'Invalid credential request' }, 400);
+    }
+});
+app.delete('/:id', (c) => {
+    revokeExternalMcpCredential(c.req.param('id'));
+    return c.json({ ok: true });
+});
+export default app;

package/dist/server/routes/mcp.js

@@ -4,14 +4,16 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprot
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
 import { MAX_MCP_ATTACHMENT_REQUEST_BYTES } from '../../shared/mcp-attachments.js';
-import { EXTERNAL_MEMORY_TOOL_DEFINITIONS, isMemoryToolName } from '../../shared/memory-tools.js';
-import { isProgressBarTool, PROGRESS_BAR_TOOLS } from '../../shared/progress-bar-tools.js';
-import { isWorkspaceCreationTool, WORKSPACE_CREATION_TOOLS } from '../../shared/workspace-creation-tools.js';
-import { EXTERNAL_MCP_TOOLS } from '../../shared/workspace-dialogue-tools.js';
-import { isWorkspaceGroupMessageTool, WORKSPACE_GROUP_MESSAGE_TOOLS, } from '../../shared/workspace-group-message-tools.js';
-import { isWorkspaceLifecycleTool, WORKSPACE_LIFECYCLE_TOOLS } from '../../shared/workspace-lifecycle-tools.js';
+import { isMemoryToolName } from '../../shared/memory-tools.js';
+import { isProgressBarTool } from '../../shared/progress-bar-tools.js';
+import { isWorkspaceCreationTool } from '../../shared/workspace-creation-tools.js';
+import { isWorkspaceGroupMessageTool } from '../../shared/workspace-group-message-tools.js';
+import { isWorkspaceLifecycleTool } from '../../shared/workspace-lifecycle-tools.js';
+import { getDb } from '../db/index.js';
+import { authenticateExternalMcpToken, EXTERNAL_TOOL_CATALOGUE, } from '../services/external-mcp-credentials-service.js';
 import { createMcpClientContext } from '../services/mcp-client-context.js';
 import { executeMemoryMcpTool } from '../services/memory-mcp-service.js';
+import { resolveWorkspaceMemoryScope } from '../services/memory-service.js';
 import { executeProgressBarTool, progressErrorData } from '../services/progress-bar-mcp-service.js';
 import { ProgressBarError } from '../services/progress-bar-service.js';
 import { executeWorkspaceCreationTool, WorkspaceCreationMcpError } from '../services/workspace-creation-mcp-service.js';
@@ -19,7 +21,16 @@ import { executeWorkspaceDialogueTool } from '../services/workspace-dialogue-ser
 import { executeWorkspaceGroupMessageTool, WorkspaceGroupMessageMcpError, } from '../services/workspace-group-message-mcp-service.js';
 import { executeWorkspaceLifecycleTool, WorkspaceLifecycleMcpError, } from '../services/workspace-lifecycle-mcp-service.js';
 import { prepareMemoryToolEnvelope } from '../utils/memory-token-budget.js';
+function authenticateRequest(authorization = '') {
+    return authenticateExternalMcpToken(authorization.startsWith('Bearer ') ? authorization.slice(7) : '');
+}
 const app = new Hono();
+app.use('*', async (c, next) => {
+    if (!authenticateRequest(c.req.header('Authorization')))
+        return c.json({ error: 'Dedicated MCP credential required' }, 401);
+    c.header('Cache-Control', 'no-store');
+    return next();
+});
 // Only creation and message envelopes may carry the larger, base64 attachment payload.
 // Other tools retain their existing 1 MiB limit, including malformed envelopes.
 app.use('*', bodyLimit({ maxSize: MAX_MCP_ATTACHMENT_REQUEST_BYTES }));
@@ -44,6 +55,9 @@ app.use('*', async (c, next) => {
                 return c.json({ error: 'MCP request is too large' }, 413);
         }
     }
+    // Uploads can outlive their credential. Never retain the pre-body principal.
+    if (!authenticateRequest(c.req.header('Authorization')))
+        return c.json({ error: 'Dedicated MCP credential required' }, 401);
     return next();
 });
 /** Dispatch only the supported MCP operations through the existing UI handlers. */
@@ -66,83 +80,27 @@ async function dispatchWorkspaceRequest(pathname, init) {
     throw new Error('Unsupported workspace operation');
 }
 app.all('/', async (c) => {
+    const currentPrincipal = () => {
+        const principal = authenticateRequest(c.req.header('Authorization'));
+        if (!principal)
+            throw new Error('MCP credential expired or revoked');
+        return principal;
+    };
     const server = new Server({ name: 'kobo-workspaces', version: '1.0.0' }, { capabilities: { tools: {} } });
     const transport = new WebStandardStreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
         enableJsonResponse: true,
         maxRequestBodySize: MAX_MCP_ATTACHMENT_REQUEST_BYTES,
     });
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({
-        tools: [
-            ...EXTERNAL_MCP_TOOLS,
-            ...WORKSPACE_CREATION_TOOLS,
-            ...WORKSPACE_LIFECYCLE_TOOLS,
-            ...WORKSPACE_GROUP_MESSAGE_TOOLS,
-            ...EXTERNAL_MEMORY_TOOL_DEFINITIONS,
-            ...PROGRESS_BAR_TOOLS,
-        ],
-    }));
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const principal = currentPrincipal();
+        return { tools: EXTERNAL_TOOL_CATALOGUE.filter((tool) => canUseExternalMcpTool(principal, tool.name)) };
+    });
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
-        const isMemory = isMemoryToolName(request.params.name);
-        try {
-            const source = createMcpClientContext(c.req.header('X-Kobo-Client-Name'), c.req.header('X-Kobo-Client-Transport') === 'stdio' ? 'stdio' : 'http', c.req.header('X-Kobo-Client-Name-Encoding'));
-            const data = isProgressBarTool(request.params.name)
-                ? executeProgressBarTool(request.params.name, request.params.arguments ?? {})
-                : isMemory
-                    ? executeMemoryMcpTool(request.params.name, request.params.arguments ?? {}, source)
-                    : isWorkspaceCreationTool(request.params.name)
-                        ? await executeWorkspaceCreationTool(request.params.name, request.params.arguments ?? {}, dispatchWorkspaceRequest)
-                        : isWorkspaceLifecycleTool(request.params.name)
-                            ? await executeWorkspaceLifecycleTool(request.params.name, request.params.arguments ?? {}, dispatchWorkspaceRequest)
-                            : isWorkspaceGroupMessageTool(request.params.name)
-                                ? executeWorkspaceGroupMessageTool(request.params.name, request.params.arguments ?? {}, source)
-                                : await executeWorkspaceDialogueTool(request.params.name, request.params.arguments ?? {}, source);
-            if (isMemory) {
-                const bounded = prepareMemoryToolEnvelope(data, { targetTokens: 1_000, transport: 'external' });
-                if (bounded.data.memoryOutputSuppressed === true)
-                    return { content: [], isError: true };
-                const { __mcpError, ...publicData } = bounded.data;
-                return {
-                    content: [{ type: 'text', text: JSON.stringify(publicData) }],
-                    structuredContent: publicData,
-                    ...(__mcpError === true || publicData.budgetExhausted === true ? { isError: true } : {}),
-                };
-            }
-            const structuredContent = data && typeof data === 'object' && !Array.isArray(data) ? data : undefined;
-            return {
-                content: [{ type: 'text', text: JSON.stringify(data) }],
-                ...(structuredContent ? { structuredContent } : {}),
-                ...(structuredContent?.accepted === false ? { isError: true } : {}),
-            };
-        }
-        catch (error) {
-            if (error instanceof ProgressBarError) {
-                const data = progressErrorData(error);
-                return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
-            }
-            if (error instanceof WorkspaceGroupMessageMcpError) {
-                const data = { error: error.message, status: error.status };
-                return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
-            }
-            if (error instanceof WorkspaceCreationMcpError || error instanceof WorkspaceLifecycleMcpError) {
-                const data = { error: error.message, status: error.status, stage: error.stage, details: error.details };
-                return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
-            }
-            if (isMemory) {
-                const bounded = prepareMemoryToolEnvelope({
-                    error: error instanceof Error ? error.message : String(error),
-                }, { targetTokens: 1_000, transport: 'external' });
-                return {
-                    isError: true,
-                    content: [{ type: 'text', text: JSON.stringify(bounded.data) }],
-                    structuredContent: bounded.data,
-                };
-            }
-            return {
-                isError: true,
-                content: [{ type: 'text', text: error instanceof Error ? error.message : String(error) }],
-            };
-        }
+        const source = createMcpClientContext(c.req.header('X-Kobo-Client-Name'), c.req.header('X-Kobo-Client-Transport') === 'stdio' ? 'stdio' : 'http', c.req.header('X-Kobo-Client-Name-Encoding'));
+        // This is the acceptance boundary: already-dispatched operations are not
+        // cancelled on later revocation, but every new call reloads the live grant.
+        return executeExternalMcpTool(request.params.name, request.params.arguments ?? {}, source, currentPrincipal());
     });
     try {
         await server.connect(transport);
@@ -155,4 +113,126 @@ app.all('/', async (c) => {
         await server.close();
     }
 });
+export async function executeExternalMcpTool(name, args, source, principal) {
+    const isMemory = isMemoryToolName(name);
+    try {
+        if (principal)
+            args = authorizeExternalMcpCall(principal, name, args);
+        let data = isProgressBarTool(name)
+            ? executeProgressBarTool(name, args)
+            : isMemory
+                ? executeMemoryMcpTool(name, args, source, principal && !principal.allWorkspaces ? principal.workspaceIds : undefined)
+                : isWorkspaceCreationTool(name)
+                    ? await executeWorkspaceCreationTool(name, args, dispatchWorkspaceRequest)
+                    : isWorkspaceLifecycleTool(name)
+                        ? await executeWorkspaceLifecycleTool(name, args, dispatchWorkspaceRequest)
+                        : isWorkspaceGroupMessageTool(name)
+                            ? executeWorkspaceGroupMessageTool(name, args, source)
+                            : await executeWorkspaceDialogueTool(name, args, source);
+        if (principal && !principal.allWorkspaces && name === 'list_workspaces' && Array.isArray(data)) {
+            data = data.filter((workspace) => principal.workspaceIds.includes(workspace.id));
+        }
+        if (isMemory) {
+            const bounded = prepareMemoryToolEnvelope(data, { targetTokens: 1_000, transport: 'external' });
+            if (bounded.data.memoryOutputSuppressed === true)
+                return { content: [], isError: true };
+            const { __mcpError, ...publicData } = bounded.data;
+            return {
+                content: [{ type: 'text', text: JSON.stringify(publicData) }],
+                structuredContent: publicData,
+                ...(__mcpError === true || publicData.budgetExhausted === true ? { isError: true } : {}),
+            };
+        }
+        const structuredContent = data && typeof data === 'object' && !Array.isArray(data) ? data : undefined;
+        return {
+            content: [{ type: 'text', text: JSON.stringify(data) }],
+            ...(structuredContent ? { structuredContent } : {}),
+            ...(structuredContent?.accepted === false ? { isError: true } : {}),
+        };
+    }
+    catch (error) {
+        if (error instanceof ProgressBarError) {
+            const data = progressErrorData(error);
+            return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
+        }
+        if (error instanceof WorkspaceGroupMessageMcpError) {
+            const data = { error: error.message, status: error.status };
+            return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
+        }
+        if (error instanceof WorkspaceCreationMcpError || error instanceof WorkspaceLifecycleMcpError) {
+            const data = { error: error.message, status: error.status, stage: error.stage, details: error.details };
+            return { isError: true, content: [{ type: 'text', text: JSON.stringify(data) }], structuredContent: data };
+        }
+        if (isMemory) {
+            const bounded = prepareMemoryToolEnvelope({
+                error: error instanceof Error ? error.message : String(error),
+            }, { targetTokens: 1_000, transport: 'external' });
+            return {
+                isError: true,
+                content: [{ type: 'text', text: JSON.stringify(bounded.data) }],
+                structuredContent: bounded.data,
+            };
+        }
+        return {
+            isError: true,
+            content: [{ type: 'text', text: error instanceof Error ? error.message : String(error) }],
+        };
+    }
+}
 export default app;
+const allWorkspaceOnly = new Set([
+    'create_workspace',
+    'diagnose_workspace_pr',
+    'preview_workspace_group_message',
+    'get_workspace_group_message',
+]);
+export function canUseExternalMcpTool(principal, name) {
+    return principal.tools.includes(name) && (principal.allWorkspaces || !allWorkspaceOnly.has(name));
+}
+export function authorizeExternalMcpCall(principal, name, args) {
+    const deny = () => {
+        throw new Error('MCP credential does not authorize this operation');
+    };
+    if (!canUseExternalMcpTool(principal, name))
+        return deny();
+    // Resource-wide grants still use each service's normal argument validation.
+    if (principal.allWorkspaces)
+        return args;
+    const definition = EXTERNAL_TOOL_CATALOGUE.find((tool) => tool.name === name);
+    if (!definition || Object.keys(args).some((key) => !Object.hasOwn(definition.inputSchema.properties ?? {}, key)))
+        return deny();
+    if (name === 'list_workspaces')
+        return args;
+    if (name === 'send_workspace_group_message') {
+        if (!Array.isArray(args.workspace_ids) ||
+            args.workspace_ids.some((id) => typeof id !== 'string' || !principal.workspaceIds.includes(id)))
+            return deny();
+        return args;
+    }
+    if (isMemoryToolName(name)) {
+        if (name === 'list_memory_scopes') {
+            if (args.workspace_id !== undefined &&
+                (typeof args.workspace_id !== 'string' || !principal.workspaceIds.includes(args.workspace_id)))
+                return deny();
+            return args;
+        }
+        // Workspace aggregate memory also includes global/project entries. Restricted
+        // keys use only the workspace-owned scope, never inherited memory.
+        let scope;
+        if (typeof args.scope_id === 'string')
+            scope = getDb()
+                .prepare("SELECT id, workspace_id FROM memory_scopes WHERE id = ? AND level = 'workspace'")
+                .get(args.scope_id);
+        else if (typeof args.workspace_id === 'string' && principal.workspaceIds.includes(args.workspace_id)) {
+            const resolved = resolveWorkspaceMemoryScope(args.workspace_id);
+            scope = { id: resolved.id, workspace_id: args.workspace_id };
+        }
+        if (!scope?.workspace_id || !principal.workspaceIds.includes(scope.workspace_id))
+            return deny();
+        const { workspace_id: _workspace, ...rest } = args;
+        return { ...rest, scope_id: scope.id };
+    }
+    if (typeof args.workspace_id !== 'string' || !principal.workspaceIds.includes(args.workspace_id))
+        return deny();
+    return args;
+}

package/dist/server/routes/workspaces.js

@@ -36,7 +36,7 @@ import { buildEngineHandoff } from '../services/engine-handoff-service.js';
 import { saveWorkspaceFile, shaOf } from '../services/file-editor-service.js';
 import { getForgeProvider } from '../services/forge/registry.js';
 import { resolveForge } from '../services/forge/resolve.js';
-import { ForgeUnavailableError } from '../services/forge/types.js';
+import { ForgeUnavailableError, MergePolicyError } from '../services/forge/types.js';
 import { computeGitStats } from '../services/git-stats-service.js';
 import { DEFAULT_NOTION_INITIAL_PROMPT, DEFAULT_SENTRY_INITIAL_PROMPT, renderNotionInitialPrompt, renderSentryInitialPrompt, } from '../services/initial-prompt-template-service.js';
 import * as notionService from '../services/notion-service.js';
@@ -4233,11 +4233,18 @@ app.post('/:id/merge-pr', async (c) => {
             }
             body = parsed;
         }
+        if (body.admin !== undefined && typeof body.admin !== 'boolean') {
+            return c.json({ error: 'admin must be a boolean' }, 400);
+        }
+        const admin = body.admin === true;
         const method = body.method;
         if (method !== undefined && !isMergeMethod(method)) {
             return c.json({ error: 'method must be merge, squash or rebase' }, 400);
         }
         const provider = getForgeProvider(resolveForge(workspace.projectPath));
+        if (admin && provider.id !== 'github') {
+            return c.json({ error: 'Administrator merge is only supported for GitHub', code: 'merge_admin_unsupported' }, 409);
+        }
         if (!provider.capabilities.canMergeRequest) {
             return c.json({ error: 'This project has no forge that can merge the PR', code: 'forge_unsupported' }, 409);
         }
@@ -4255,10 +4262,16 @@ app.post('/:id/merge-pr', async (c) => {
         if (snapshot?.state !== 'OPEN') {
             return c.json({ error: 'No open PR found for this workspace', code: 'pr_not_open' }, 409);
         }
-        if (!snapshot.readyToMerge) {
+        if (admin && snapshot.mergeable === 'CONFLICTING') {
+            return c.json({ error: 'Resolve merge conflicts before merging', code: 'pr_not_ready' }, 409);
+        }
+        if (!snapshot.readyToMerge && !admin) {
             return c.json({ error: 'This PR is not ready to merge', code: 'pr_not_ready' }, 409);
         }
-        if (method === undefined) {
+        if (admin) {
+            await provider.mergeRequest(workspace.worktreePath, snapshot.number, method, { admin: true });
+        }
+        else if (method === undefined) {
             await provider.mergeRequest(workspace.worktreePath, snapshot.number);
         }
         else {
@@ -4268,6 +4281,9 @@ app.post('/:id/merge-pr', async (c) => {
         return c.json({ success: true, merged: merged?.state === 'MERGED', branch: workspace.workingBranch });
     }
     catch (err) {
+        if (err instanceof MergePolicyError) {
+            return c.json({ error: err.message, code: err.code }, 409);
+        }
         if (err instanceof ForgeUnavailableError) {
             return c.json({ error: err.message, code: 'forge_unavailable' }, 409);
         }

package/dist/server/services/agent/orchestrator.js

@@ -3,7 +3,7 @@ import { nanoid } from 'nanoid';
 import { renderWorkflowPolicy } from '../../../shared/workflow-policy.js';
 import { getDb } from '../../db/index.js';
 import { assertAgentStopped } from '../../utils/agent-stop-result.js';
-import { ensureKoboHome, getCompiledMcpServerPath, getDbPath, getKoboHome, getMcpServerSourcePath, getSettingsPath, getSkillsPath, } from '../../utils/paths.js';
+import { ensureKoboHome, getCompiledMcpServerPath, getKoboHome, getMcpServerSourcePath, getSkillsPath, } from '../../utils/paths.js';
 import { assertWorkspaceLifecycleAvailable, workspaceLifecycleReason } from '../../utils/workspace-lifecycle-guard.js';
 import { cancelAutoLoopFinalReview, getAutoLoopReviewLaunch, isAutoLoopReview, prepareAutoLoopReviewReturn, retryAutoLoopReviewReturn, } from '../auto-loop-final-review-service.js';
 import { listLoopMessages, settleLoopMessages } from '../auto-loop-message-service.js';
@@ -11,6 +11,7 @@ import * as autoLoopService from '../auto-loop-service.js';
 import * as cleanupScriptService from '../cleanup-script-service.js';
 import * as cronService from '../cron-service.js';
 import { resolveForge } from '../forge/resolve.js';
+import { createInternalMcpCapability, revokeInternalMcpCapability } from '../internal-mcp-capability-service.js';
 import * as lifecycleHookService from '../lifecycle-hook-service.js';
 import { advanceMemoryConversationEpoch, allocateMemoryConversationKey, bindMemoryNativeConversation, createMemoryCapability, revokeMemoryCapability, } from '../memory-agent-runtime.js';
 import { buildMemoryContext, markMemoryContextFailed, markMemoryContextInitialized, markMemoryContextSubmitted, } from '../memory-context-service.js';
@@ -494,27 +495,19 @@ function readEffectiveSettingsSafe(projectPath) {
         };
     }
 }
-function buildMcpServers(workspaceId, extraEnv, memoryCapability) {
+function buildMcpServers(workspaceId, internalCapability, launchEnv) {
     const mcpServerCompiled = getCompiledMcpServerPath();
     const mcpServerSource = getMcpServerSourcePath();
-    const global = getGlobalSettings();
     return [
         {
             name: 'kobo-tasks',
             command: mcpServerCompiled ? 'node' : 'npx',
             args: mcpServerCompiled ? [mcpServerCompiled] : ['tsx', mcpServerSource],
             env: {
+                ...Object.fromEntries(Object.entries(launchEnv ?? {}).filter(([key, value]) => key !== 'KOBO_NETWORK_TOKEN' && typeof value === 'string')),
                 KOBO_WORKSPACE_ID: workspaceId,
-                ...extraEnv,
-                ...(memoryCapability ? { KOBO_MEMORY_SESSION_TOKEN: memoryCapability } : {}),
-                KOBO_DB_PATH: getDbPath(),
-                KOBO_SETTINGS_PATH: getSettingsPath(),
+                ...(internalCapability ? { KOBO_MCP_SESSION_TOKEN: internalCapability } : {}),
                 KOBO_BACKEND_URL: `http://127.0.0.1:${backendPort}`,
-                // Behind a proxy, even internal loopback requests require network auth.
-                // Per-launch memory/progress capabilities remain independently required.
-                ...(global.networkAccessBehindProxy && global.networkAccessToken
-                    ? { KOBO_NETWORK_TOKEN: global.networkAccessToken }
-                    : {}),
             },
         },
     ];
@@ -1361,11 +1354,16 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
 }
 const launchOptions = new WeakMap();
 const controllerProgressCapabilities = new WeakMap();
+const controllerInternalMcpCapabilities = new WeakMap();
 const controllerMemoryCapabilities = new WeakMap();
 const controllerMemoryConversationKeys = new WeakMap();
 const controllerMemoryContextIds = new WeakMap();
 const memoryCompactionStates = new WeakMap();
 function revokeControllerCapabilities(controller) {
+    const internalToken = controllerInternalMcpCapabilities.get(controller);
+    if (internalToken)
+        revokeInternalMcpCapability(internalToken);
+    controllerInternalMcpCapabilities.delete(controller);
     const progress = controllerProgressCapabilities.get(controller);
     if (progress)
         revokeProgressCapability(progress.token);
@@ -1574,6 +1572,17 @@ export function startAgent(workspaceId, workingDir, prompt, model, resume = fals
         }),
         readOnly: effectivePermissionMode === 'plan' || !!launch?.handoffGeneration,
     });
+    const progressCapability = createProgressCapability(workspaceId, agentSessionId);
+    const internalMcpCapability = createInternalMcpCapability({
+        workspaceId,
+        sessionId: agentSessionId,
+        readOnly: effectivePermissionMode === 'plan' || !!launch?.handoffGeneration || !!launch?.mcpEnv?.KOBO_FINAL_REVIEW_TOKEN,
+        env: {
+            ...launch?.mcpEnv,
+            KOBO_MEMORY_SESSION_TOKEN: memoryCapability.token,
+            KOBO_PROGRESS_SESSION_TOKEN: progressCapability.token,
+        },
+    });
     const unavailableIntegrations = [];
     const integrationServers = buildIntegrationMcpServers(getGlobalSettings(), engine.id, (name) => unavailableIntegrations.push(name));
     const options = {
@@ -1598,7 +1607,10 @@ export function startAgent(workspaceId, workingDir, prompt, model, resume = fals
             }
         })(),
         settings,
-        mcpServers: [...buildMcpServers(workspaceId, launch?.mcpEnv, memoryCapability.token), ...integrationServers],
+        mcpServers: [
+            ...buildMcpServers(workspaceId, internalMcpCapability.token, internalMcpCapability.env),
+            ...integrationServers,
+        ],
         env: ws ? buildAgentEnv(ws.projectPath) : undefined,
     };
     // Snapshot only application-owned launch instructions. Memory is appended
@@ -1629,20 +1641,18 @@ export function startAgent(workspaceId, workingDir, prompt, model, resume = fals
                 .run(new Date().toISOString(), workspaceId, prompt);
         };
     }
-    const progressCapability = createProgressCapability(workspaceId, agentSessionId);
-    const managedMcp = options.mcpServers?.find((server) => server.name === 'kobo-tasks');
-    if (managedMcp)
-        managedMcp.env.KOBO_PROGRESS_SESSION_TOKEN = progressCapability.token;
     try {
         beforeDispatch?.();
     }
     catch (error) {
+        revokeInternalMcpCapability(internalMcpCapability.token);
         revokeMemoryCapability(memoryCapability.token);
         revokeProgressCapability(progressCapability.token);
         throw error;
     }
     let controller;
     controller = new SessionController(workspaceId, agentSessionId, engine, (ev) => handleEvent(workspaceId, agentSessionId, controller, ev));
+    controllerInternalMcpCapabilities.set(controller, internalMcpCapability.token);
     controllerProgressCapabilities.set(controller, progressCapability);
     controllerMemoryCapabilities.set(controller, memoryCapability.token);
     controllerMemoryConversationKeys.set(controller, memoryCapability.conversationKey);

package/dist/server/services/external-mcp-credentials-service.js

@@ -0,0 +1,110 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { EXTERNAL_MEMORY_TOOL_DEFINITIONS } from '../../shared/memory-tools.js';
+import { PROGRESS_BAR_TOOLS } from '../../shared/progress-bar-tools.js';
+import { WORKSPACE_CREATION_TOOLS } from '../../shared/workspace-creation-tools.js';
+import { EXTERNAL_MCP_TOOLS } from '../../shared/workspace-dialogue-tools.js';
+import { WORKSPACE_GROUP_MESSAGE_TOOLS } from '../../shared/workspace-group-message-tools.js';
+import { WORKSPACE_LIFECYCLE_TOOLS } from '../../shared/workspace-lifecycle-tools.js';
+import { ensureKoboHome, getKoboHome } from '../utils/paths.js';
+export const EXTERNAL_TOOL_CATALOGUE = [
+    ...EXTERNAL_MCP_TOOLS,
+    ...WORKSPACE_CREATION_TOOLS,
+    ...WORKSPACE_LIFECYCLE_TOOLS,
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS,
+    ...EXTERNAL_MEMORY_TOOL_DEFINITIONS,
+    ...PROGRESS_BAR_TOOLS,
+];
+const MAX_KEYS = 100;
+const filename = () => path.join(getKoboHome(), 'mcp-credentials.json');
+function load() {
+    try {
+        const data = JSON.parse(fs.readFileSync(filename(), 'utf8'));
+        if (!Array.isArray(data) || data.length > MAX_KEYS)
+            throw new Error('Invalid MCP credential store');
+        return data;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function save(keys) {
+    ensureKoboHome();
+    const tmp = `${filename()}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(tmp, JSON.stringify(keys), { mode: 0o600, flag: 'wx' });
+        fs.renameSync(tmp, filename());
+    }
+    finally {
+        if (fs.existsSync(tmp))
+            fs.unlinkSync(tmp);
+    }
+}
+function publicCredential({ hash: _hash, ...credential }) {
+    return credential;
+}
+export function listExternalMcpCredentials() {
+    return load().map(publicCredential);
+}
+export function createExternalMcpCredential(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('Invalid credential request');
+    const args = input;
+    if (Object.keys(args).some((key) => !['name', 'tools', 'allWorkspaces', 'workspaceIds', 'expiresAt'].includes(key)))
+        throw new Error('Unknown credential field');
+    if (typeof args.name !== 'string' || !args.name.trim() || args.name.length > 120)
+        throw new Error('Name must contain 1–120 characters');
+    if (args.allWorkspaces !== undefined && typeof args.allWorkspaces !== 'boolean')
+        throw new Error('Invalid workspace scope');
+    const allWorkspaces = args.allWorkspaces === true;
+    const workspaceIds = args.workspaceIds ?? [];
+    if (!Array.isArray(workspaceIds) ||
+        workspaceIds.length > 200 ||
+        workspaceIds.some((id) => typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,200}$/.test(id)) ||
+        (!allWorkspaces && workspaceIds.length === 0) ||
+        (allWorkspaces && workspaceIds.length > 0))
+        throw new Error('Select workspace IDs or explicitly grant all workspaces');
+    const tools = args.tools ??
+        EXTERNAL_TOOL_CATALOGUE.filter((tool) => tool.annotations?.readOnlyHint === true).map((tool) => tool.name);
+    if (!Array.isArray(tools) ||
+        !tools.length ||
+        tools.length > EXTERNAL_TOOL_CATALOGUE.length ||
+        tools.some((name) => !EXTERNAL_TOOL_CATALOGUE.some((tool) => tool.name === name)))
+        throw new Error('Invalid tool grant');
+    let expiresAt = null;
+    if (args.expiresAt !== undefined && args.expiresAt !== null) {
+        const time = typeof args.expiresAt === 'string' ? Date.parse(args.expiresAt) : NaN;
+        if (!Number.isFinite(time) || time <= Date.now() || time > Date.now() + 366 * 86400000)
+            throw new Error('Expiry must be within the next 366 days');
+        expiresAt = new Date(time).toISOString();
+    }
+    const keys = load();
+    if (keys.length >= MAX_KEYS)
+        throw new Error('Revoke an existing MCP key before creating another');
+    const token = `kobo_mcp_${randomBytes(32).toString('base64url')}`;
+    const key = {
+        id: randomUUID(),
+        name: args.name.trim(),
+        tools: [...new Set(tools)],
+        allWorkspaces,
+        workspaceIds: [...new Set(workspaceIds)],
+        createdAt: new Date().toISOString(),
+        expiresAt,
+        hash: createHash('sha256').update(token).digest('hex'),
+    };
+    save([...keys, key]);
+    return { token, credential: publicCredential(key) };
+}
+export function revokeExternalMcpCredential(id) {
+    save(load().filter((key) => key.id !== id));
+}
+export function authenticateExternalMcpToken(token) {
+    if (!/^kobo_mcp_[A-Za-z0-9_-]{43}$/.test(token))
+        return null;
+    const hash = createHash('sha256').update(token).digest('hex');
+    const key = load().find((candidate) => candidate.hash === hash);
+    return key && (!key.expiresAt || Date.parse(key.expiresAt) > Date.now()) ? publicCredential(key) : null;
+}

package/dist/server/services/forge/github/provider.js

@@ -3,7 +3,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { MERGE_METHODS } from '../../../../shared/forge-merge.js';
 import { parseCliJson } from '../parse-cli-json.js';
-import { deriveReadyToMerge, truncatePrBody } from '../types.js';
+import { deriveReadyToMerge, MergePolicyError, truncatePrBody } from '../types.js';
 const execFileAsync = promisify(execFile);
 const CLI_TIMEOUT_MS = 30_000;
 function cliOptions(repoPath) {
@@ -194,8 +194,20 @@ export const githubProvider = {
     async changePrBase(repoPath, base) {
         await execFileAsync('gh', ['pr', 'edit', '--base', base], cliOptions(repoPath));
     },
-    async mergeRequest(repoPath, number, method = 'merge') {
-        await execFileAsync('gh', ['pr', 'merge', String(number), `--${method}`], cliOptions(repoPath));
+    async mergeRequest(repoPath, number, method = 'merge', options) {
+        const args = ['pr', 'merge', String(number), `--${method}`];
+        if (options?.admin === true)
+            args.push('--admin');
+        try {
+            await execFileAsync('gh', args, cliOptions(repoPath));
+        }
+        catch (error) {
+            // Only known policy refusals offer an override, never network/auth/unknown failures.
+            const message = error instanceof Error ? error.message : '';
+            if (/the base branch policy prohibits the merge/i.test(message))
+                throw new MergePolicyError();
+            throw error;
+        }
     },
     async deleteRemoteBranch(repoPath, branch) {
         await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));

package/dist/server/services/forge/types.js

@@ -35,3 +35,11 @@ export class ForgeUnavailableError extends Error {
         this.name = 'ForgeUnavailableError';
     }
 }
+/** A policy refusal that can be presented as an explicit administrator choice. */
+export class MergePolicyError extends Error {
+    code = 'merge_policy_blocked';
+    constructor() {
+        super('GitHub branch protection rules prevent this merge.');
+        this.name = 'MergePolicyError';
+    }
+}