@mgsoftwarebv/mg-dashboard-mcp 7.4.23 → 7.4.25

package/dist/index.js

@@ -22,7 +22,7 @@ import { sql, or, eq, and, inArray, like, desc } from 'drizzle-orm';
 import { once } from 'events';
 import { lookup } from 'dns/promises';
 import { connect } from 'tls';
-import { pgEnum, pgTable, timestamp, text, jsonb, integer, uuid, uniqueIndex, index, bigint, boolean, customType, date, real, check, doublePrecision, primaryKey, foreignKey } from 'drizzle-orm/pg-core';
+import { pgEnum, pgTable, timestamp, text, jsonb, integer, uuid, uniqueIndex, index, bigint, boolean, customType, date, real, check, numeric, bigserial, doublePrecision, primaryKey, foreignKey } from 'drizzle-orm/pg-core';
 import { HeadObjectCommand, ListObjectsV2Command, DeleteObjectsCommand, S3Client, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, GetObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
 var __defProp = Object.defineProperty;
@@ -724,10 +724,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-env": "settings"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql33 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql36 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null | tr -d '[:space:]')`,
+    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql36}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$ROW"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -749,8 +749,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2, projectRef: projectRef || "" };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql33 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null`;
+  const sql36 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql36}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -832,8 +832,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql33 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null`;
+      const sql36 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql36}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -1011,9 +1011,9 @@ ${raw2.substring(0, 500)}` }] };
           return { content: [{ type: "text", text: `No environment variables for ${project}/${env}.` }] };
         }
         const lines = vars.map((v) => `${v.isSecret ? "[secret]" : "        "}  ${v.name}`).sort();
-        const text22 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
+        const text23 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
 ` + "-".repeat(50) + "\n" + lines.join("\n");
-        return { content: [{ type: "text", text: text22 }] };
+        return { content: [{ type: "text", text: text23 }] };
       }
       if (action === "get") {
         const key2 = String(args2.key ?? "");
@@ -1100,9 +1100,9 @@ async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
     return { content: [{ type: "text", text: `Invalid API response:
 ${rawJson.substring(0, 500)}` }] };
   }
-  let text22 = formatRunDetail(run);
-  if (logs) text22 += "\n\n--- Logs ---\n" + logs;
-  return { content: [{ type: "text", text: text22 }] };
+  let text23 = formatRunDetail(run);
+  if (logs) text23 += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text: text23 }] };
 }
 async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
   const pollInterval = 3e3;
@@ -1124,10 +1124,10 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
       continue;
     }
     if (TERMINAL_STATUSES.has(run.status)) {
-      let text22 = formatRunDetail(run);
+      let text23 = formatRunDetail(run);
       const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-      if (logs) text22 += "\n\n--- Logs ---\n" + logs;
-      return { content: [{ type: "text", text: text22 }] };
+      if (logs) text23 += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text: text23 }] };
     }
   }
   return {
@@ -1317,6 +1317,56 @@ async function proxyJson(ctx, route, body) {
   };
 }
 
+// src/git-credential-tools.ts
+var GIT_CREDENTIAL_TOOL_NAME = "git-credential";
+var GIT_CREDENTIAL_TOOLS = [
+  {
+    name: GIT_CREDENTIAL_TOOL_NAME,
+    description: "Issue a 15-minute mggit access token for git.mgsoftware.nl (username=token, Basic password). Bound to owner/name + write bit. Intended for git credential helpers and agents that need to clone/fetch/push. Not a git runner \u2014 do not use this to execute git commands. Requires module git_hosting.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: {
+          type: "string",
+          description: "Repository as owner/name (e.g. MGSoftwareBV/mg-dashboard)."
+        },
+        write: {
+          type: "boolean",
+          description: "Request push rights (default true). Fetch-only: false."
+        }
+      },
+      required: ["repo"]
+    }
+  }
+];
+async function handleGitCredentialTool(args2, ctx) {
+  const repo = typeof args2.repo === "string" ? args2.repo.trim() : "";
+  if (!repo) {
+    return { content: [{ type: "text", text: "Error: repo is required (owner/name)" }] };
+  }
+  const write = args2.write !== false;
+  const res = await fetch(`${ctx.dashboardBaseUrl.replace(/\/$/, "")}/api/git/credential`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${ctx.apiKey}`
+    },
+    body: JSON.stringify({ repo, write })
+  });
+  const text23 = await res.text().catch(() => "");
+  if (!res.ok) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: git-credential failed (${res.status}). ${text23.slice(0, 300)}`
+        }
+      ]
+    };
+  }
+  return { content: [{ type: "text", text: text23 || "{}" }] };
+}
+
 // src/mailserver-tools.ts
 var MAILSERVER_TOOL_NAME = "mailserver";
 var MAILSERVER_ACTIONS = [
@@ -1391,11 +1441,11 @@ function tokenFromDotenv(content) {
   for (const line of content.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq5 = trimmed.indexOf("=");
-    if (eq5 < 1) continue;
-    const key = trimmed.slice(0, eq5).trim();
+    const eq6 = trimmed.indexOf("=");
+    if (eq6 < 1) continue;
+    const key = trimmed.slice(0, eq6).trim();
     if (key !== "MAILSERVER_MCP_TOKEN") continue;
-    let value = trimmed.slice(eq5 + 1).trim();
+    let value = trimmed.slice(eq6 + 1).trim();
     if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
       value = value.slice(1, -1);
     }
@@ -1500,12 +1550,12 @@ async function mailserverFetch(deps, plan) {
     },
     body: plan.body ? JSON.stringify(plan.body) : void 0
   });
-  const text22 = await res.text();
-  let json = text22;
+  const text23 = await res.text();
+  let json = text23;
   try {
-    json = text22 ? JSON.parse(text22) : null;
+    json = text23 ? JSON.parse(text23) : null;
   } catch {
-    json = { error: text22.slice(0, 500) };
+    json = { error: text23.slice(0, 500) };
   }
   return { status: res.status, json };
 }
@@ -4789,10 +4839,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index19) {
+  catchall(index20) {
     return new _ZodObject({
       ...this._def,
-      catchall: index19
+      catchall: index20
     });
   }
   pick(mask) {
@@ -5110,9 +5160,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index19 = 0; index19 < a.length; index19++) {
-      const itemA = a[index19];
-      const itemB = b[index19];
+    for (let index20 = 0; index20 < a.length; index20++) {
+      const itemA = a[index20];
+      const itemB = b[index20];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -5318,10 +5368,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index19) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index20) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index19, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index19, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index20, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index20, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -6336,6 +6386,8 @@ pgTable(
     verifyNote: text("verify_note"),
     dirty: boolean("dirty").notNull().default(false),
     vaultSyncedAt: timestamp("vault_synced_at", { withTimezone: true }),
+    /** Flattened frontmatter aliases for tsv weight A. */
+    aliasesText: text("aliases_text").notNull().default(""),
     /** Reviewer / itemized-phase lease holder. */
     claimedBy: text("claimed_by"),
     claimedAt: timestamp("claimed_at", { withTimezone: true }),
@@ -6532,6 +6584,7 @@ pgTable(
     topId: text("top_id"),
     caller: text("caller"),
     repo: text("repo"),
+    confident: boolean("confident"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [index("idx_team_memory_search_log_created").on(table.createdAt)]
@@ -6558,6 +6611,9 @@ pgTable(
     reviewed: boolean("reviewed").notNull().default(false),
     reviewNotes: text("review_notes"),
     reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+    inputBytes: integer("input_bytes"),
+    inputTokens: integer("input_tokens"),
+    outputTokens: integer("output_tokens"),
     startedAt: timestamp("started_at", { withTimezone: true }),
     finishedAt: timestamp("finished_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -6588,6 +6644,7 @@ pgTable(
     evidenceRefs: text("evidence_refs").array().notNull().default([]),
     dedupeKey: text("dedupe_key").notNull(),
     source: text("source").notNull().default("auto"),
+    ledgerId: uuid("ledger_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -6599,6 +6656,138 @@ pgTable(
     )
   ]
 );
+pgTable(
+  "wiki_page_chunk",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    pageId: uuid("page_id").notNull(),
+    slug: text("slug").notNull(),
+    headingPath: text("heading_path").notNull().default(""),
+    chunkIndex: integer("chunk_index").notNull().default(0),
+    content: text("content").notNull().default(""),
+    embeddingVec: vector("embedding_vec", {
+      dimensions: WIKI_EMBEDDING_DIMENSIONS
+    }),
+    embeddingModel: text("embedding_model"),
+    embeddedAt: timestamp("embedded_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("wiki_page_chunk_page_id_chunk_index_key").on(
+      table.pageId,
+      table.chunkIndex
+    ),
+    index("idx_wiki_page_chunk_slug").on(table.slug)
+  ]
+);
+pgTable("brain_config", {
+  key: text("key").primaryKey(),
+  value: jsonb("value").$type().notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedBy: text("updated_by")
+});
+pgTable(
+  "brain_metrics_daily",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    metricDate: date("metric_date").notNull(),
+    callerClass: text("caller_class").notNull(),
+    wikiSearches: integer("wiki_searches").notNull().default(0),
+    confidentHits: integer("confident_hits").notNull().default(0),
+    misses: integer("misses").notNull().default(0),
+    hitAt1: real("hit_at_1"),
+    hitAt3: real("hit_at_3"),
+    searchToRead: real("search_to_read"),
+    tmFallbacks: integer("tm_fallbacks").notNull().default(0),
+    reviewerRuns: integer("reviewer_runs").notNull().default(0),
+    reviewerAvgInputBytes: integer("reviewer_avg_input_bytes"),
+    tokensPerPhase: jsonb("tokens_per_phase").$type().notNull().default({}),
+    pagesPromoted: integer("pages_promoted").notNull().default(0),
+    pagesDemoted: integer("pages_demoted").notNull().default(0),
+    thrashCount: integer("thrash_count").notNull().default(0),
+    flagsPer100Reads: real("flags_per_100_reads"),
+    verifierDisagreeRate: real("verifier_disagree_rate"),
+    verifyGateIdle: boolean("verify_gate_idle").notNull().default(false),
+    verifyGateActing: boolean("verify_gate_acting"),
+    draftsOlder14d: integer("drafts_older_14d").notNull().default(0),
+    developersHarvested24h: integer("developers_harvested_24h").notNull().default(0),
+    teamMemoryCited: integer("team_memory_cited").notNull().default(0),
+    extras: jsonb("extras").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("brain_metrics_daily_metric_date_caller_class_key").on(
+      table.metricDate,
+      table.callerClass
+    )
+  ]
+);
+pgTable(
+  "brain_change_ledger",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    scope: text("scope").notNull(),
+    tier: text("tier").notNull(),
+    kind: text("kind").notNull(),
+    hypothesis: text("hypothesis").notNull().default(""),
+    target: text("target"),
+    beforeValue: jsonb("before_value"),
+    afterValue: jsonb("after_value"),
+    baselineMetrics: jsonb("baseline_metrics"),
+    outcomeMetrics: jsonb("outcome_metrics"),
+    verdict: text("verdict").notNull().default("pending"),
+    evidenceRefs: text("evidence_refs").array().notNull().default([]),
+    createdBy: text("created_by"),
+    suggestionId: uuid("suggestion_id"),
+    ticketNumber: text("ticket_number"),
+    ticketId: text("ticket_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    verdictAt: timestamp("verdict_at", { withTimezone: true }),
+    revertedAt: timestamp("reverted_at", { withTimezone: true })
+  },
+  (table) => [
+    index("idx_brain_change_ledger_verdict").on(table.verdict, table.createdAt),
+    index("idx_brain_change_ledger_scope").on(table.scope, table.createdAt)
+  ]
+);
+pgTable(
+  "wiki_search_shadow",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    query: text("query").notNull(),
+    caller: text("caller"),
+    servedSlug: text("served_slug"),
+    servedScore: real("served_score"),
+    shadowSlug: text("shadow_slug"),
+    shadowScore: real("shadow_score"),
+    ledgerId: uuid("ledger_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [index("idx_wiki_search_shadow_created").on(table.createdAt)]
+);
+pgTable("wiki_eval_snapshot", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable(
+  "wiki_eval_label",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    snapshotId: uuid("snapshot_id").notNull(),
+    query: text("query").notNull(),
+    caller: text("caller"),
+    positiveSlug: text("positive_slug"),
+    isNegative: boolean("is_negative").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [index("idx_wiki_eval_label_snapshot").on(table.snapshotId)]
+);
+pgTable("wiki_status_dirty", {
+  slug: text("slug").primaryKey(),
+  markedAt: timestamp("marked_at", { withTimezone: true }).notNull().defaultNow(),
+  reason: text("reason")
+});
 
 // ../db/src/schema/agent-memory.ts
 pgTable(
@@ -6639,7 +6828,8 @@ pgTable(
     ),
     index("idx_agent_memory_repo").on(table.gitRepository),
     index("idx_agent_memory_user").on(table.userId),
-    index("idx_agent_memory_kind").on(table.kind)
+    index("idx_agent_memory_kind").on(table.kind),
+    index("idx_agent_memory_automated_created").on(table.createdAt).where(sql`kind = 'automated'`)
   ]
 );
 var contentSourceType = pgEnum("content_source_type", [
@@ -7084,6 +7274,133 @@ pgTable(
     index("dns_migration_mailbox_migration_idx").on(table.migrationId)
   ]
 );
+pgTable(
+  "git_repo",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    /** `owner/name`, the canonical id on mggit and GitHub. */
+    fullName: text("full_name").notNull(),
+    owner: text("owner").notNull(),
+    name: text("name").notNull(),
+    source: text("source").$type().notNull().default("mirror"),
+    /** GitHub clone URL the repo follows while it is a mirror. */
+    upstreamUrl: text("upstream_url"),
+    /** Full ref names mggit follows (`refs/heads/main`, `refs/tags/v1`). */
+    followRefs: jsonb("follow_refs").$type().notNull().default([]),
+    /** Sync job keeps the follow list current and the repo present on mggit. */
+    mirrorEnabled: boolean("mirror_enabled").notNull().default(true),
+    /** Present on mggit (repo created). */
+    existsOnMggit: boolean("exists_on_mggit").notNull().default(false),
+    githubArchived: boolean("github_archived").notNull().default(false),
+    githubPrivate: boolean("github_private").notNull().default(true),
+    githubDefaultBranch: text("github_default_branch"),
+    githubPushedAt: timestamp("github_pushed_at", { withTimezone: true }),
+    branchCount: integer("branch_count").notNull().default(0),
+    tagCount: integer("tag_count").notNull().default(0),
+    /** Latest WAL seq seen in an event for this repo. */
+    lastSeq: bigint("last_seq", { mode: "number" }).notNull().default(0),
+    lastEventAt: timestamp("last_event_at", { withTimezone: true }),
+    followState: jsonb("follow_state").$type().notNull().default({}),
+    /** Refs where GitHub and mggit disagree after the last sync (name → {github, mggit}). */
+    behindRefs: jsonb("behind_refs").$type().notNull().default({}),
+    lastSyncAt: timestamp("last_sync_at", { withTimezone: true }),
+    lastSyncError: text("last_sync_error"),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_repo_full_name_uidx").on(table.fullName),
+    index("git_repo_source_idx").on(table.source, table.mirrorEnabled),
+    index("git_repo_last_event_idx").on(table.lastEventAt)
+  ]
+);
+pgTable(
+  "git_ref_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    repoFullName: text("repo_full_name").notNull(),
+    /** `_walgit.seq` (uint64 as string on the wire). */
+    seq: bigint("seq", { mode: "number" }).notNull(),
+    refName: text("ref_name").notNull(),
+    /** `branch` | `tag` | `` */
+    refType: text("ref_type").notNull().default(""),
+    /** `create` | `update` | `delete` */
+    action: text("action").notNull(),
+    oldOid: text("old_oid").notNull(),
+    newOid: text("new_oid").notNull(),
+    /** Authenticated principal (`upstream` for mirror follows). */
+    pusher: text("pusher").notNull().default(""),
+    correlationId: text("correlation_id"),
+    entryKind: text("entry_kind"),
+    /** `X-Walgit-Delivery` of the batch that carried it. */
+    deliveryId: text("delivery_id"),
+    receivedAt: timestamp("received_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_ref_event_dedup_uidx").on(
+      table.repoFullName,
+      table.seq,
+      table.refName
+    ),
+    index("git_ref_event_repo_received_idx").on(
+      table.repoFullName,
+      table.receivedAt
+    ),
+    index("git_ref_event_received_idx").on(table.receivedAt),
+    index("git_ref_event_pusher_idx").on(table.pusher)
+  ]
+);
+pgTable(
+  "git_access_log",
+  {
+    id: bigserial("id", { mode: "number" }).primaryKey(),
+    ts: timestamp("ts", { withTimezone: true }).notNull(),
+    /** nginx `$request_id`; dedup key for re-shipped batches. */
+    requestId: text("request_id").notNull(),
+    ip: text("ip").notNull().default(""),
+    principal: text("principal").notNull().default(""),
+    repo: text("repo").notNull().default(""),
+    /** `advertise` | `fetch` | `push` | `api` | `` */
+    op: text("op").notNull().default(""),
+    method: text("method").notNull().default(""),
+    uri: text("uri").notNull().default(""),
+    status: integer("status").notNull().default(0),
+    bytesIn: bigint("bytes_in", { mode: "number" }).notNull().default(0),
+    bytesOut: bigint("bytes_out", { mode: "number" }).notNull().default(0),
+    durationMs: numeric("duration_ms", { precision: 12, scale: 3 }).notNull().default("0"),
+    userAgent: text("user_agent").notNull().default(""),
+    upstreamStatus: text("upstream_status").notNull().default(""),
+    receivedAt: timestamp("received_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_access_log_request_id_uidx").on(table.requestId),
+    index("git_access_log_ts_idx").on(table.ts),
+    index("git_access_log_repo_ts_idx").on(table.repo, table.ts),
+    index("git_access_log_principal_ts_idx").on(table.principal, table.ts),
+    index("git_access_log_op_status_idx").on(table.op, table.status)
+  ]
+);
+pgTable(
+  "git_credential_grant",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    tokenHash: text("token_hash").notNull(),
+    userId: uuid("user_id").notNull(),
+    apiKeyId: uuid("api_key_id").notNull(),
+    repo: text("repo").notNull(),
+    write: boolean("write").notNull().default(true),
+    principal: text("principal").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    issuedIp: text("issued_ip").notNull().default(""),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_credential_grant_token_hash_uidx").on(table.tokenHash),
+    index("git_credential_grant_expires_idx").on(table.expiresAt),
+    index("git_credential_grant_user_idx").on(table.userId, table.expiresAt)
+  ]
+);
 var directoryLinkType = pgEnum("directory_link_type", [
   "dofollow",
   "nofollow",
@@ -7888,6 +8205,22 @@ pgTable(
     )
   ]
 );
+
+// ../platform/dist/utils/permissions.js
+var MODULE_KEYS = [
+  "users",
+  "ssh_servers",
+  "wiki",
+  "ci_cd",
+  "settings",
+  "cursor_remote",
+  "code_battle",
+  "git_hosting"
+];
+({
+  modules: Object.fromEntries(MODULE_KEYS.map((k) => [k, false]))});
+({
+  modules: Object.fromEntries(MODULE_KEYS.map((k) => [k, true]))});
 var SSH_POOL_IDLE_MS = 6e4;
 var sshPool = /* @__PURE__ */ new Map();
 function poolKey(options) {
@@ -9140,6 +9473,24 @@ function hourBucket(now = /* @__PURE__ */ new Date()) {
     )
   );
 }
+var GITHUB_API_STAT_FLUSH_EVERY = 50;
+var pendingGithubApiStats = /* @__PURE__ */ new Map();
+var pendingGithubApiStatIncrements = 0;
+function githubApiStatMapKey(tokenKey, jobId, bucket) {
+  return `${tokenKey}	${jobId}	${bucket}`;
+}
+function mergeGithubApiStatDelta(current, add) {
+  if (!current) return { ...add };
+  return {
+    tokenKey: add.tokenKey,
+    jobId: add.jobId,
+    hourBucket: add.hourBucket,
+    requestCount: current.requestCount + add.requestCount,
+    errorCount: current.errorCount + add.errorCount,
+    cacheHitCount: current.cacheHitCount + add.cacheHitCount,
+    breakerHitCount: current.breakerHitCount + add.breakerHitCount
+  };
+}
 function cacheKeyFor(url, tokenKey) {
   return createHash("sha256").update(`${tokenKey}:${url}`).digest("hex");
 }
@@ -9336,28 +9687,54 @@ async function forceConsumeBudget(tokenKey) {
 }
 async function recordStat(input) {
   const bucket = hourBucket().toISOString();
-  await getDb().execute(sql`
-    INSERT INTO github_api_stat (
-      token_key, job_id, hour_bucket, request_count, error_count,
-      cache_hit_count, breaker_hit_count, updated_at
-    )
-    VALUES (
-      ${input.tokenKey},
-      ${input.jobId},
-      ${bucket}::timestamptz,
-      ${input.breakerHit ? 0 : 1},
-      ${input.error ? 1 : 0},
-      ${input.cacheHit ? 1 : 0},
-      ${input.breakerHit ? 1 : 0},
-      now()
-    )
-    ON CONFLICT (token_key, job_id, hour_bucket) DO UPDATE SET
-      request_count = github_api_stat.request_count + ${input.breakerHit ? 0 : 1},
-      error_count = github_api_stat.error_count + ${input.error ? 1 : 0},
-      cache_hit_count = github_api_stat.cache_hit_count + ${input.cacheHit ? 1 : 0},
-      breaker_hit_count = github_api_stat.breaker_hit_count + ${input.breakerHit ? 1 : 0},
-      updated_at = now()
-  `);
+  const key = githubApiStatMapKey(input.tokenKey, input.jobId, bucket);
+  const add = {
+    tokenKey: input.tokenKey,
+    jobId: input.jobId,
+    hourBucket: bucket,
+    requestCount: input.breakerHit ? 0 : 1,
+    errorCount: input.error ? 1 : 0,
+    cacheHitCount: input.cacheHit ? 1 : 0,
+    breakerHitCount: input.breakerHit ? 1 : 0
+  };
+  pendingGithubApiStats.set(
+    key,
+    mergeGithubApiStatDelta(pendingGithubApiStats.get(key), add)
+  );
+  pendingGithubApiStatIncrements += 1;
+  if (pendingGithubApiStatIncrements >= GITHUB_API_STAT_FLUSH_EVERY) {
+    await flushPendingGithubApiStats();
+  }
+}
+async function flushPendingGithubApiStats() {
+  const rows = [...pendingGithubApiStats.values()];
+  pendingGithubApiStats.clear();
+  pendingGithubApiStatIncrements = 0;
+  for (const row of rows) {
+    await getDb().execute(sql`
+      INSERT INTO github_api_stat (
+        token_key, job_id, hour_bucket, request_count, error_count,
+        cache_hit_count, breaker_hit_count, updated_at
+      )
+      VALUES (
+        ${row.tokenKey},
+        ${row.jobId},
+        ${row.hourBucket}::timestamptz,
+        ${row.requestCount},
+        ${row.errorCount},
+        ${row.cacheHitCount},
+        ${row.breakerHitCount},
+        now()
+      )
+      ON CONFLICT (token_key, job_id, hour_bucket) DO UPDATE SET
+        request_count = github_api_stat.request_count + ${row.requestCount},
+        error_count = github_api_stat.error_count + ${row.errorCount},
+        cache_hit_count = github_api_stat.cache_hit_count + ${row.cacheHitCount},
+        breaker_hit_count = github_api_stat.breaker_hit_count + ${row.breakerHitCount},
+        updated_at = now()
+    `);
+  }
+  return rows.length;
 }
 async function recordBreakerHit(input) {
   await recordStat({
@@ -10397,7 +10774,7 @@ async function writeAuditLog(entry) {
     );
   }
 }
-var MODULE_KEYS = [
+var MODULE_KEYS2 = [
   "users",
   "ssh_servers",
   "wiki",
@@ -10405,11 +10782,12 @@ var MODULE_KEYS = [
   "domains",
   "settings",
   "cursor_remote",
-  "code_battle"
+  "code_battle",
+  "git_hosting"
 ];
-var FULL_PERMISSIONS = {
+var FULL_PERMISSIONS2 = {
   modules: Object.fromEntries(
-    MODULE_KEYS.map((k) => [k, true])
+    MODULE_KEYS2.map((k) => [k, true])
   ),
   resources: { ssh_servers: ["*"] }
 };
@@ -10417,12 +10795,12 @@ function parsePermissions(raw) {
   if (!raw || typeof raw !== "object") return null;
   return raw;
 }
-function resolvePermissions(roleName, roleDefaults, userOverrides) {
-  if (roleName === "superadmin") return FULL_PERMISSIONS;
+function resolvePermissions2(roleName, roleDefaults, userOverrides) {
+  if (roleName === "superadmin") return FULL_PERMISSIONS2;
   const base = parsePermissions(roleDefaults);
   const overrides = parsePermissions(userOverrides);
   const modules = {};
-  for (const key of MODULE_KEYS) {
+  for (const key of MODULE_KEYS2) {
     const userVal = overrides?.modules?.[key];
     const roleVal = base?.modules?.[key];
     modules[key] = userVal !== void 0 ? userVal : roleVal !== void 0 ? roleVal : false;
@@ -10471,6 +10849,7 @@ var TOOL_MODULE_MAP = {
   "cursor-remote-list": "cursor_remote",
   "cursor-remote-run": "cursor_remote",
   "ai-company": "ssh_servers",
+  "git-credential": "git_hosting",
   // cursor-skill intentionally unmapped — any valid API key may pull shared skills
   ...TRIGGER_TOOL_MODULE_MAP
 };
@@ -10614,7 +10993,7 @@ async function validateApiKey(key) {
   const roleName = userData.role_name || "user";
   const roleDefaults = userData.role_default_permissions ?? {};
   const userOverrides = userData.permissions ?? null;
-  const permissions = resolvePermissions(roleName, roleDefaults, userOverrides);
+  const permissions = resolvePermissions2(roleName, roleDefaults, userOverrides);
   const allowedServerIds = intersectServerAccess(
     data.allowed_server_ids,
     permissions.resources.ssh_servers
@@ -10625,9 +11004,9 @@ async function validateApiKey(key) {
     WHERE id = ${data.id}
       AND (last_used_at IS NULL OR last_used_at < now() - interval '60 seconds')
   `);
-  const moduleCount = MODULE_KEYS.filter((k) => permissions.modules[k]).length;
+  const moduleCount = MODULE_KEYS2.filter((k) => permissions.modules[k]).length;
   console.error(
-    `Authenticated as user ${data.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS.length})`
+    `Authenticated as user ${data.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS2.length})`
   );
   return {
     apiKeyId: data.id,
@@ -10861,7 +11240,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
   const roleName = userData.role_name || "user";
   const roleDefaults = userData.role_default_permissions ?? {};
   const userOverrides = userData.permissions ?? null;
-  const permissions = resolvePermissions(roleName, roleDefaults, userOverrides);
+  const permissions = resolvePermissions2(roleName, roleDefaults, userOverrides);
   const allowedServerIds = intersectServerAccess(
     apiRow.allowed_server_ids,
     permissions.resources.ssh_servers
@@ -10878,9 +11257,9 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
             AND (last_used_at IS NULL OR last_used_at < now() - interval '60 seconds')`
     )
   ]);
-  const moduleCount = MODULE_KEYS.filter((k) => permissions.modules[k]).length;
+  const moduleCount = MODULE_KEYS2.filter((k) => permissions.modules[k]).length;
   console.error(
-    `Authenticated via SSH key "${keyRow.name}" (fp ${fingerprint.slice(0, 24)}...) as user ${apiRow.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS.length})`
+    `Authenticated via SSH key "${keyRow.name}" (fp ${fingerprint.slice(0, 24)}...) as user ${apiRow.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS2.length})`
   );
   return {
     apiKeyId: apiRow.id,
@@ -11044,7 +11423,7 @@ function getEncryptionKey() {
     throw new Error("ENCRYPTION_KEY must be a 64-character hex string");
   return buf;
 }
-function encrypt(text22) {
+function encrypt(text23) {
   const key = getEncryptionKey();
   const iv = randomBytes(ENC_IV_LENGTH);
   const cipher = createCipheriv(
@@ -11052,7 +11431,7 @@ function encrypt(text22) {
     new Uint8Array(key),
     new Uint8Array(iv)
   );
-  let encrypted = cipher.update(text22, "utf8", "hex");
+  let encrypted = cipher.update(text23, "utf8", "hex");
   encrypted += cipher.final("hex");
   const authTag = cipher.getAuthTag();
   return Buffer.concat([
@@ -11789,10 +12168,10 @@ async function r2GetObjectRange(bucket, key, range) {
     const body = result.Body;
     if (!body?.transformToString)
       throw new Error("R2 returned no readable body");
-    const text22 = await body.transformToString();
+    const text23 = await body.transformToString();
     const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
     return `${header}
-${text22}`;
+${text23}`;
   } catch (e) {
     throw r2WrapError(bucket, key, e);
   }
@@ -12155,15 +12534,15 @@ async function sftpRead(opts, filePath, proxy, options) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            const text22 = Buffer.concat(
+            const text23 = Buffer.concat(
               chunks.map((ch) => new Uint8Array(ch))
             ).toString("utf-8");
             if (!isWholeFileRequest) {
               const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
               resolve(`${header}
-${text22}`);
+${text23}`);
             } else {
-              resolve(text22);
+              resolve(text23);
             }
           });
           rs.on("error", (e) => {
@@ -12319,11 +12698,11 @@ function getKnownContainers(serverId, maxAgeMs = 5 * 6e4) {
   if (Date.now() - e.capturedAt > maxAgeMs) return void 0;
   return e.names;
 }
-function truncateForLLM(text22, maxBytes) {
-  const totalBytes = Buffer.byteLength(text22, "utf8");
+function truncateForLLM(text23, maxBytes) {
+  const totalBytes = Buffer.byteLength(text23, "utf8");
   if (totalBytes <= maxBytes)
-    return { text: text22, truncated: false, totalBytes, shownBytes: totalBytes };
-  const buf = Buffer.from(text22, "utf8");
+    return { text: text23, truncated: false, totalBytes, shownBytes: totalBytes };
+  const buf = Buffer.from(text23, "utf8");
   let cut = maxBytes;
   while (cut > 0 && (buf[cut] & 192) === 128) cut--;
   const head = buf.subarray(0, cut).toString("utf8");
@@ -12354,10 +12733,10 @@ function postprocessResult(result, meta) {
   if (!result.content?.length) return result;
   if (RAW_JSON_TOOLS.has(meta.toolName)) return result;
   const block = result.content[0];
-  let text22 = String(block.text ?? "");
-  const trunc = truncateForLLM(text22, RESPONSE_MAX_BYTES);
+  let text23 = String(block.text ?? "");
+  const trunc = truncateForLLM(text23, RESPONSE_MAX_BYTES);
   if (trunc.truncated) {
-    text22 = trunc.text + "\n\n... " + buildTruncationHint(
+    text23 = trunc.text + "\n\n... " + buildTruncationHint(
       meta.toolName,
       meta.args,
       trunc.totalBytes,
@@ -12371,11 +12750,11 @@ function postprocessResult(result, meta) {
     const parts = [`took ${tookStr}`, sizeStr];
     if (meta.serverIdLabel) parts.push(`server: ${meta.serverIdLabel}`);
     if (meta.cached) parts.push("cached");
-    text22 = `${text22}
+    text23 = `${text23}
 
 [${parts.join(", ")}]`;
   }
-  return { ...result, content: [{ ...block, text: text22 }] };
+  return { ...result, content: [{ ...block, text: text23 }] };
 }
 function buildPipelineScript(commands, shell, marker, stopOnError) {
   if (shell === "powershell") {
@@ -13161,11 +13540,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql33) {
-  return sql33.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql36) {
+  return sql36.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql33) {
-  return createHash("sha256").update(sql33.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+function migrationSha256(sql36) {
+  return createHash("sha256").update(sql36.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -15177,6 +15556,7 @@ var TOOLS = [
     }
   },
   ...MAILSERVER_TOOLS,
+  ...GIT_CREDENTIAL_TOOLS,
   ...HERMES_COMPANY_TOOLS,
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
@@ -15498,7 +15878,7 @@ async function executeToolCall(name, a, _serverId) {
             ]
           };
         }
-        const lines = data.hits.map((hit, index19) => {
+        const lines = data.hits.map((hit, index20) => {
           const when = hit.lastMessageAt ? new Date(hit.lastMessageAt).toISOString().slice(0, 10) : "unknown date";
           const repo = hit.repo ?? "unknown repo";
           const sim = hit.similarity !== null ? ` \xB7 ${(hit.similarity * 100).toFixed(0)}% match` : "";
@@ -15508,7 +15888,7 @@ async function executeToolCall(name, a, _serverId) {
             ...Array.isArray(hit.tech) ? hit.tech.slice(0, 4) : []
           ].filter(Boolean);
           const tags = facets.length > 0 ? ` \xB7 ${facets.join(", ")}` : "";
-          return `${index19 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
+          return `${index20 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
    id: ${hit.id}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 500)}`;
         });
@@ -15715,12 +16095,12 @@ Searchable via search-team-memory once indexing completes (usually immediate).`
             ]
           };
         }
-        const lines = data.hits.map((hit, index19) => {
+        const lines = data.hits.map((hit, index20) => {
           const sim = hit.similarity !== null ? ` \xB7 ${Math.round(hit.similarity * 100)}% match` : "";
           const tags = hit.tags.length ? ` \xB7 ${hit.tags.slice(0, 5).join(", ")}` : "";
           const sources = hit.sources.length ? `
    sources: ${hit.sources.slice(0, 6).map((s) => `${s.type}:${s.ref}`).join(", ")}` : "";
-          return `${index19 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
+          return `${index20 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
    slug: ${hit.slug}${sources}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 400)}`;
         });
@@ -15898,7 +16278,7 @@ Archived sources (${archiveOnly.length}):
         let formatItems2 = function(items) {
           if (items.length === 0) return "(none)";
           return items.map(
-            (item, index19) => `${index19 + 1}. [${item.status} \xB7 ${item.folder} \xB7 updated ${item.updated ?? "unknown"}] ${item.title}
+            (item, index20) => `${index20 + 1}. [${item.status} \xB7 ${item.folder} \xB7 updated ${item.updated ?? "unknown"}] ${item.title}
    slug: ${item.slug}`
           ).join("\n");
         };
@@ -15924,10 +16304,10 @@ Archived sources (${archiveOnly.length}):
           };
         }
         const data = await res.json();
-        const countLine = Object.entries(data.counts).sort(([left], [right]) => left.localeCompare(right)).map(([status, count]) => `${status} ${count}`).join(" \xB7 ");
-        const flagLines = data.flags.length === 0 ? "(none)" : data.flags.map((flag, index19) => {
+        const countLine = Object.entries(data.counts).sort(([left], [right]) => left.localeCompare(right)).map(([status, count2]) => `${status} ${count2}`).join(" \xB7 ");
+        const flagLines = data.flags.length === 0 ? "(none)" : data.flags.map((flag, index20) => {
           const detail = flag.detail.replace(/\s+/g, " ").slice(0, 240);
-          return `${index19 + 1}. [${flag.kind} \xB7 ${flag.folder}${flag.status ? ` \xB7 page ${flag.status}` : ""}] ${flag.title}
+          return `${index20 + 1}. [${flag.kind} \xB7 ${flag.folder}${flag.status ? ` \xB7 page ${flag.status}` : ""}] ${flag.title}
    slug: ${flag.slug}
    ${detail}`;
         }).join("\n");
@@ -16834,14 +17214,14 @@ ${renderOne(r)}`);
         const dryRun = a.dryRun === true;
         const confirmAbove = a.confirmAbove !== void 0 ? Math.max(0, Number(a.confirmAbove)) : void 0;
         const confirmCount = a.confirmCount !== void 0 ? Number(a.confirmCount) : void 0;
-        const guard = (count, sizeBytes, where) => {
-          if (confirmAbove !== void 0 && count > confirmAbove) {
-            if (confirmCount === count) return null;
+        const guard = (count2, sizeBytes, where) => {
+          if (confirmAbove !== void 0 && count2 > confirmAbove) {
+            if (confirmCount === count2) return null;
             return {
               content: [
                 {
                   type: "text",
-                  text: `Refusing to delete ${count} item(s) (${formatBytes(sizeBytes)}) under ${where}: exceeds confirmAbove=${confirmAbove}. To proceed, re-issue the call with confirmCount: ${count}.`
+                  text: `Refusing to delete ${count2} item(s) (${formatBytes(sizeBytes)}) under ${where}: exceeds confirmAbove=${confirmAbove}. To proceed, re-issue the call with confirmCount: ${count2}.`
                 }
               ]
             };
@@ -17093,8 +17473,8 @@ ${sample.join("\n")}${files.length > 5 ? `
             };
           const filtered = sortRows(applyFilter(only.rows));
           if (format === "json") {
-            const text23 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
-            return { content: [{ type: "text", text: text23 }] };
+            const text24 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+            return { content: [{ type: "text", text: text24 }] };
           }
           if (groupByProject) {
             const groups = /* @__PURE__ */ new Map();
@@ -17121,8 +17501,8 @@ ${sample.join("\n")}${files.length > 5 ? `
           }
           const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
           const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
-          const text22 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
-          return { content: [{ type: "text", text: text22 }] };
+          const text23 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+          return { content: [{ type: "text", text: text23 }] };
         }
         if (format === "json") {
           const lines = [];
@@ -18945,6 +19325,12 @@ Install: GET https://dashboard.mgsoftware.nl/api/downloads/versions.txt then \u2
           token
         });
       }
+      case GIT_CREDENTIAL_TOOL_NAME: {
+        return handleGitCredentialTool(a, {
+          dashboardBaseUrl,
+          apiKey: apiKey ?? ""
+        });
+      }
       case HERMES_COMPANY_TOOL_NAME: {
         return handleHermesCompanyTool(a, {
           userId: ctx.userId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mgsoftwarebv/mg-dashboard-mcp",
-  "version": "7.4.23",
+  "version": "7.4.25",
   "description": "MCP Server for MG Dashboard - SSH, SFTP, Docker, domains, DNS, and environment config tools for Cursor",
   "type": "module",
   "main": "dist/index.js",