@mgsoftwarebv/mg-dashboard-mcp 7.0.13 → 7.0.15

package/dist/index.js

@@ -683,10 +683,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-run": "ci_cd"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql23 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql25 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql23}" 2>/dev/null | tr -d '[:space:]')`,
+    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql25}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$KEY"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -707,8 +707,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2 };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql23 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql23}" 2>/dev/null`;
+  const sql25 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql25}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -790,8 +790,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql23 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql23}" 2>/dev/null`;
+      const sql25 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql25}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -6188,6 +6188,145 @@ async function reconfigureQuickStages(profileId, releaseType, detectedApps) {
     `);
   }
 }
+function normalizeRepoIdentifier(value) {
+  if (!value) return null;
+  let s = value.trim().toLowerCase();
+  if (!s) return null;
+  s = s.replace(/^ssh:\/\/git@github\.com\//, "");
+  s = s.replace(/^git@github\.com:/, "");
+  s = s.replace(/^https?:\/\/(www\.)?github\.com\//, "");
+  s = s.replace(/^github\.com\//, "");
+  s = s.replace(/\.git$/, "");
+  s = s.replace(/[/]+$/, "");
+  const parts = s.split("/").filter(Boolean);
+  if (parts.length >= 2) {
+    s = parts.slice(-2).join("/");
+  }
+  return s || null;
+}
+async function queueAgentRun(args2) {
+  const db2 = getDb();
+  const gitMode = args2.gitMode ?? "worktree";
+  const model = args2.model ?? null;
+  const metadata = args2.metadata ?? {};
+  const conversationRows = await db2.execute(sql`
+    INSERT INTO agent_conversation (
+      user_id, host_id, workspace_id, runtime, source, title, status, model, metadata
+    ) VALUES (
+      ${args2.userId}, ${args2.workspace.host_id}, ${args2.workspace.id},
+      'local', ${args2.source}, ${args2.title}, 'running', ${model},
+      ${JSON.stringify(metadata)}::jsonb
+    )
+    RETURNING id
+  `);
+  const conversationId = conversationRows[0]?.id;
+  if (!conversationId) return null;
+  const runRows = await db2.execute(sql`
+    INSERT INTO agent_run (
+      conversation_id, workspace_id, host_id, user_id, runtime, status,
+      prompt, model, git_mode, source
+    ) VALUES (
+      ${conversationId}, ${args2.workspace.id}, ${args2.workspace.host_id},
+      ${args2.userId}, 'local', 'queued', ${args2.prompt}, ${model}, ${gitMode},
+      ${args2.source}
+    )
+    RETURNING id
+  `);
+  const runId = runRows[0]?.id;
+  if (!runId) return null;
+  const payload = {
+    runId,
+    conversationId,
+    workspacePath: args2.workspace.path,
+    prompt: args2.prompt,
+    model,
+    gitMode,
+    sdkAgentId: null,
+    contextReplay: null,
+    ...metadata
+  };
+  await db2.execute(sql`
+    INSERT INTO agent_host_command (host_id, user_id, run_id, command_type, payload)
+    VALUES (
+      ${args2.workspace.host_id}, ${args2.userId}, ${runId}, 'start_run',
+      ${JSON.stringify(payload)}::jsonb
+    )
+  `);
+  return { conversationId, runId };
+}
+function toTarget(row) {
+  return {
+    workspaceId: row.workspace_id,
+    hostId: row.host_id,
+    hostName: row.host_name,
+    hostOnline: row.host_online === true,
+    ownerUserId: row.owner_user_id,
+    ownerName: row.owner_name,
+    ownerEmail: row.owner_email,
+    path: row.path,
+    name: row.name,
+    gitRepository: row.git_repository,
+    gitBranch: row.git_branch,
+    defaultGitMode: row.default_git_mode === "in_place" ? "in_place" : "worktree",
+    lastSyncedAt: row.last_synced_at
+  };
+}
+async function listRemoteWorkspaces() {
+  const rows = await getDb().execute(sql`
+    SELECT
+      w.id AS workspace_id,
+      w.host_id,
+      h.name AS host_name,
+      (h.last_seen_at IS NOT NULL AND h.last_seen_at > now() - interval '45 seconds')
+        AS host_online,
+      w.user_id AS owner_user_id,
+      u.full_name AS owner_name,
+      u.email AS owner_email,
+      w.path, w.name, w.git_repository, w.git_branch,
+      w.default_git_mode, w.last_synced_at
+    FROM agent_workspace w
+    INNER JOIN agent_host h ON h.id = w.host_id
+    LEFT JOIN "user" u ON u.id = w.user_id
+    WHERE w.status = 'active' AND h.revoked_at IS NULL
+    ORDER BY host_online DESC, w.last_synced_at DESC NULLS LAST
+  `);
+  return Array.from(rows).map(toTarget);
+}
+function matchesWho(target, who) {
+  const needle = who.trim().toLowerCase();
+  if (!needle) return true;
+  const name = (target.ownerName ?? "").toLowerCase();
+  const email = (target.ownerEmail ?? "").toLowerCase();
+  return name.includes(needle) || email.includes(needle);
+}
+function matchesProject(target, project) {
+  const repoTarget = normalizeRepoIdentifier(project);
+  if (repoTarget && normalizeRepoIdentifier(target.gitRepository) === repoTarget) {
+    return true;
+  }
+  const needle = project.trim().toLowerCase();
+  if (!needle) return false;
+  return target.name.toLowerCase().includes(needle) || target.path.toLowerCase().includes(needle);
+}
+async function resolveRemoteTarget(args2) {
+  const online = (await listRemoteWorkspaces()).filter((t) => t.hostOnline);
+  let matches = online.filter((t) => matchesProject(t, args2.project));
+  if (args2.who) {
+    matches = matches.filter((t) => matchesWho(t, args2.who));
+  }
+  if (matches.length === 0) {
+    return { ok: false, reason: "none", candidates: online };
+  }
+  if (matches.length === 1) {
+    return { ok: true, target: matches[0] };
+  }
+  if (args2.branch) {
+    const onBranch = matches.filter((t) => t.gitBranch === args2.branch);
+    if (onBranch.length === 1) return { ok: true, target: onBranch[0] };
+    if (onBranch.length > 1) matches = onBranch;
+  }
+  return { ok: false, reason: "ambiguous", candidates: matches };
+}
 var args = process.argv.slice(2);
 function getArg2(name) {
   return args.find((a) => a.startsWith(`--${name}=`))?.split("=").slice(1).join("=");
@@ -6370,7 +6509,9 @@ var MODULE_KEYS = [
   "wiki",
   "ci_cd",
   "domains",
-  "settings"
+  "settings",
+  "cursor_remote",
+  "code_battle"
 ];
 var FULL_PERMISSIONS = {
   modules: Object.fromEntries(
@@ -6433,8 +6574,15 @@ var TOOL_MODULE_MAP = {
   "domain-list": "domains",
   "dns-list": "domains",
   "dns-record": "domains",
+  "cursor-remote-list": "cursor_remote",
+  "cursor-remote-run": "cursor_remote",
   ...TRIGGER_TOOL_MODULE_MAP
 };
+function normalizeAllowedTools(value) {
+  if (!Array.isArray(value)) return null;
+  const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
+  return tools.length > 0 ? tools : null;
+}
 var authContext = null;
 var currentClientIp;
 function extractClientIp(req) {
@@ -6463,7 +6611,7 @@ async function validateApiKey(key) {
     return null;
   }
   const apiKeyRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE api_key_hash = ${keyHash} AND is_active = true
     LIMIT 1
@@ -6515,6 +6663,7 @@ async function validateApiKey(key) {
     apiKeyName: data.name || "Unknown",
     userId: data.created_by,
     allowedServerIds,
+    allowedTools: normalizeAllowedTools(data.allowed_tools),
     permissions,
     roleName
   };
@@ -6709,7 +6858,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     return null;
   }
   const apiRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE id = ${keyRow.api_key_id} AND is_active = true
     LIMIT 1
@@ -6763,6 +6912,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     apiKeyName: `${apiRow.name || "Unknown"} (ssh: ${keyRow.name})`,
     userId: apiRow.created_by,
     allowedServerIds,
+    allowedTools: normalizeAllowedTools(apiRow.allowed_tools),
     permissions,
     roleName
   };
@@ -8991,11 +9141,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql23) {
-  return sql23.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql25) {
+  return sql25.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql23) {
-  return createHash("sha256").update(normaliseMigrationSql(sql23), "utf8").digest("hex");
+function migrationSha256(sql25) {
+  return createHash("sha256").update(normaliseMigrationSql(sql25), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -10200,13 +10350,64 @@ var TOOLS = [
       }
     }
   },
+  // ----- Cursor Remote (Agent Control) -----
+  {
+    name: "cursor-remote-list",
+    description: "List the paired developer machines (agent hosts) and their workspaces that a headless Cursor agent run can be started on, across the whole team. Each workspace shows its owner, git repository + branch, online status and default git mode. Call this FIRST to discover valid `who` (owner) and `project` (repo/workspace) values before calling cursor-remote-run. Only online hosts can run.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        onlineOnly: {
+          type: "boolean",
+          description: "Only return workspaces whose host is currently online (default false \u2014 shows all active pairings with an online flag)."
+        }
+      }
+    }
+  },
+  {
+    name: "cursor-remote-run",
+    description: "Start a headless Cursor agent run on a teammate's machine to make a code change. Resolve `who` (workspace owner name/email) + `project` (repo 'org/repo', URL, or workspace name) to a single online workspace, then queue the run via the agent-host daemon (@cursor/sdk). Use this when an AI (e.g. a ticket assistant) should hand a self-contained, well-scoped fix prompt to a developer's PC. Default git mode is 'worktree': the change runs in an isolated worktree and ends in a DIFF APPROVAL the owner reviews on the dashboard/mobile \u2014 nothing lands on their branch automatically. Returns the conversationId + runId and a dashboard link to follow progress. Call cursor-remote-list first if unsure about who/project.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        who: {
+          type: "string",
+          description: "Workspace owner to target, matched case-insensitively against full name or email (e.g. 'Sidney'). Optional, but recommended when several people have the same repo paired."
+        },
+        project: {
+          type: "string",
+          description: "The repository ('MGSoftwareBV/mg-dashboard', a GitHub URL), or the workspace name/path. Matched against the paired workspaces."
+        },
+        prompt: {
+          type: "string",
+          description: "The full, self-contained instruction for the agent. Write it as an optimized, scoped task: what to change, relevant files/areas, and acceptance criteria. The agent has no other context."
+        },
+        model: {
+          type: "string",
+          description: "Optional Cursor model slug to run with (e.g. a Sonnet-tier model). Omit to use the host default."
+        },
+        gitMode: {
+          type: "string",
+          enum: ["worktree", "in_place"],
+          description: "'worktree' (default, recommended): isolated worktree + diff approval. 'in_place': applies directly in the working tree (no isolation) \u2014 use only when explicitly desired."
+        },
+        branch: {
+          type: "string",
+          description: "Optional: prefer a workspace already checked out on this branch when several match."
+        }
+      },
+      required: ["project", "prompt"]
+    }
+  },
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
 var MCP_VERSION = "7.0.5";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
+  const allowedTools = authContext.allowedTools;
   const accessible = TOOLS.filter((tool) => {
+    if (allowedTools && !allowedTools.includes(tool.name)) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
     return authContext.permissions.modules[requiredModule] === true;
@@ -10219,6 +10420,16 @@ async function handleCallTool(request) {
   }
   const { name, arguments: toolArgs } = request.params;
   const a = toolArgs || {};
+  if (authContext.allowedTools && !authContext.allowedTools.includes(name)) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Access denied: this API key is restricted to a specific tool allowlist and may not call "${name}". Allowed: ${authContext.allowedTools.join(", ")}`
+        }
+      ]
+    };
+  }
   const requiredModule = TOOL_MODULE_MAP[name];
   if (requiredModule && authContext.permissions.modules[requiredModule] !== true) {
     return {
@@ -10424,6 +10635,131 @@ ${facets.join(", ")}` : ""),
           ]
         };
       }
+      // ----- Cursor Remote (Agent Control) -----
+      case "cursor-remote-list": {
+        const onlineOnly = a.onlineOnly === true;
+        const all = await listRemoteWorkspaces();
+        const workspaces = onlineOnly ? all.filter((w) => w.hostOnline) : all;
+        if (workspaces.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: onlineOnly ? "No online agent-host workspaces found. Ask the developer to start their MG Agent Host." : "No paired agent-host workspaces found."
+              }
+            ]
+          };
+        }
+        const payload = workspaces.map((w) => ({
+          owner: w.ownerName ?? w.ownerEmail ?? w.ownerUserId,
+          online: w.hostOnline,
+          host: w.hostName,
+          project: w.name,
+          repo: w.gitRepository,
+          branch: w.gitBranch,
+          defaultGitMode: w.defaultGitMode,
+          path: w.path,
+          lastSyncedAt: w.lastSyncedAt
+        }));
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  count: payload.length,
+                  onlineCount: workspaces.filter((w) => w.hostOnline).length,
+                  workspaces: payload,
+                  hint: "Use `who` (owner) + `project` (repo or project name) with cursor-remote-run. Only online workspaces can run."
+                },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
+      case "cursor-remote-run": {
+        const project = typeof a.project === "string" ? a.project.trim() : "";
+        const prompt = typeof a.prompt === "string" ? a.prompt.trim() : "";
+        if (!project) {
+          return { content: [{ type: "text", text: "Error: project is required" }] };
+        }
+        if (!prompt) {
+          return { content: [{ type: "text", text: "Error: prompt is required" }] };
+        }
+        const who = typeof a.who === "string" ? a.who.trim() : null;
+        const branch = typeof a.branch === "string" ? a.branch.trim() : null;
+        const model = typeof a.model === "string" ? a.model.trim() : null;
+        const gitMode = a.gitMode === "in_place" ? "in_place" : "worktree";
+        const resolution = await resolveRemoteTarget({ who, project, branch });
+        if (!resolution.ok) {
+          const describe = (c) => `  - ${c.ownerName ?? c.ownerEmail ?? c.ownerUserId} \xB7 ${c.name}${c.gitRepository ? ` (${c.gitRepository}${c.gitBranch ? `@${c.gitBranch}` : ""})` : ""}`;
+          const candidates = resolution.candidates.map(describe).join("\n");
+          const intro = resolution.reason === "ambiguous" ? `Multiple online workspaces match \u2014 narrow it down with \`who\` (and/or \`branch\`):` : `No online workspace matched who=${who ?? "(any)"} project="${project}". Online candidates:`;
+          return {
+            content: [
+              {
+                type: "text",
+                text: `${intro}
+${candidates || "  (none online \u2014 start the MG Agent Host)"}`
+              }
+            ]
+          };
+        }
+        const target = resolution.target;
+        const title = prompt.split("\n")[0]?.slice(0, 80) || "Remote agent run";
+        const queued = await queueAgentRun({
+          workspace: {
+            id: target.workspaceId,
+            host_id: target.hostId,
+            path: target.path,
+            git_branch: target.gitBranch,
+            git_repository: target.gitRepository
+          },
+          userId: target.ownerUserId,
+          prompt,
+          title,
+          source: "mcp_remote",
+          model,
+          gitMode,
+          metadata: {
+            requestedBy: ctx.userId,
+            who: who ?? null,
+            project
+          }
+        });
+        if (!queued) {
+          return {
+            content: [{ type: "text", text: "Error: failed to queue the agent run" }]
+          };
+        }
+        const conversationUrl = `${dashboardBaseUrl}/cursor-remote?conversation=${queued.conversationId}`;
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  status: "queued",
+                  owner: target.ownerName ?? target.ownerEmail ?? target.ownerUserId,
+                  host: target.hostName,
+                  project: target.name,
+                  repo: target.gitRepository,
+                  branch: target.gitBranch,
+                  gitMode,
+                  conversationId: queued.conversationId,
+                  runId: queued.runId,
+                  conversationUrl,
+                  note: gitMode === "worktree" ? "Runs in an isolated worktree and ends in a diff approval the owner reviews \u2014 nothing lands on their branch automatically." : "Runs in_place in the working tree (no isolation)."
+                },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
       // ----- Servers -----
       case "list-servers": {
         const data = ctx.allowedServerIds !== null ? await db.execute(sql`