@meshagent/meshagent 0.44.12 → 0.45.0

package/dist/browser/toolkit-config.js

@@ -180,30 +180,19 @@ class Connector {
         if (connector == null && this.oauth == null) {
             return true;
         }
-        const token = await room.secrets.getOfflineOAuthToken({
-            connector,
-            oauth: this.oauth,
-            delegatedTo: agentName,
-        });
-        return token != null;
+        void room;
+        void agentName;
+        throw new Error("OAuth MCP connections require proxy-backed user secrets");
     }
     async authenticate(client, agent, redirectUri) {
         const connector = this.buildConnectorRef();
         if (connector == null && this.oauth == null) {
             return null;
         }
-        const localParticipant = client.localParticipant;
-        if (localParticipant == null) {
-            throw new Error("Connector.authenticate requires a local participant");
-        }
-        const agentName = agent.getAttribute("name");
-        return await client.secrets.requestOAuthToken({
-            fromParticipantId: localParticipant.id,
-            connector,
-            oauth: this.oauth,
-            redirectUri,
-            delegateTo: agentName == null ? null : String(agentName),
-        });
+        void client;
+        void agent;
+        void redirectUri;
+        throw new Error("OAuth MCP connections require proxy-backed user secrets");
     }
 }
 exports.Connector = Connector;
@@ -259,7 +248,25 @@ function roomServiceMcpServerUrl({ service, port, endpoint, }) {
     const fragment = baseUrl.hash;
     return `${baseUrl.protocol}//${userInfo}${bracketIpv6Host(baseUrl.hostname)}:${portValue}${joinedPath}${query}${fragment}`;
 }
-function mcpConnectorsFromRoomServices({ services, agentName, }) {
+function proxyMcpServerUrl({ serverUrl, useProxySecret, proxyConfig, }) {
+    const secretId = useProxySecret?.trim();
+    if (serverUrl == null || secretId == null || secretId.length === 0 || proxyConfig == null) {
+        return serverUrl;
+    }
+    const apiUrl = proxyConfig.apiUrl.trim().replace(/\/+$/, "");
+    if (apiUrl.length === 0 || proxyConfig.apiKey.trim().length === 0) {
+        throw new Error("meshagent_proxy_config requires apiUrl and apiKey");
+    }
+    const url = new URL(`${apiUrl}/proxy-request`);
+    url.searchParams.set("url", serverUrl);
+    url.searchParams.set("secret-id", secretId);
+    const user = proxyConfig.user?.trim();
+    if (user != null && user.length > 0) {
+        url.searchParams.set("user", user);
+    }
+    return url.toString();
+}
+function mcpConnectorsFromRoomServices({ services, agentName, meshagentProxyConfig, }) {
     const connectors = [];
     for (const service of services) {
         const filter = service.metadata.annotations?.["meshagent.agent.filter"];
@@ -276,12 +283,24 @@ function mcpConnectorsFromRoomServices({ services, agentName, }) {
                     name: mcp.label,
                     server: new MCPServer({
                         serverLabel: mcp.label,
-                        serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
-                        headers: headersFromEndpointSpec(mcp.headers),
+                        serverUrl: proxyMcpServerUrl({
+                            serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
+                            useProxySecret: mcp.use_proxy_secret,
+                            proxyConfig: meshagentProxyConfig,
+                        }),
+                        headers: mcp.use_proxy_secret != null && meshagentProxyConfig != null
+                            ? [
+                                ...(headersFromEndpointSpec(mcp.headers) ?? []),
+                                new MCPHeader({
+                                    name: "Authorization",
+                                    value: `Bearer ${meshagentProxyConfig.apiKey}`,
+                                }),
+                            ]
+                            : headersFromEndpointSpec(mcp.headers),
                         requireApproval: mcp.require_approval,
                         openaiConnectorId: mcp.openai_connector_id,
                     }),
-                    oauth: mcp.oauth,
+                    oauth: mcp.use_proxy_secret != null ? undefined : mcp.oauth,
                 }));
             }
         }

package/dist/esm/index.d.ts

@@ -24,7 +24,7 @@ export * from './runtime.js';
 export * from './schema.js';
 export * from './storage-client.js';
 export * from './services-client.js';
-export * from './secrets-client.js';
+export * from './sqlite-client.js';
 export * from './stream-controller.js';
 export * from './sync-client.js';
 export * from './api_keys.js';

package/dist/esm/index.js

@@ -24,7 +24,7 @@ export * from './runtime.js';
 export * from './schema.js';
 export * from './storage-client.js';
 export * from './services-client.js';
-export * from './secrets-client.js';
+export * from './sqlite-client.js';
 export * from './stream-controller.js';
 export * from './sync-client.js';
 export * from './api_keys.js';