@michael-joseph-miller/ant-bot 0.1.5 → 0.2.1

package/dist/server.js

@@ -2,7 +2,9 @@ import { createRequire as __antbotCreateRequire } from 'node:module';
 const require = __antbotCreateRequire(import.meta.url);
 import {
   ApprovalDecisionRequest,
+  ConnectorConfigSchema,
   CreateBotRequest,
+  CreateConnectorRequest,
   CreateRoutineRequest,
   CreateRuleRequest,
   CreateSkillRequest,
@@ -14,8 +16,9 @@ import {
   ScreencastClientFrameSchema,
   SettingsPatchSchema,
   SettingsSchema,
-  UpdateBotRequest
-} from "./chunk-4XML2GPY.js";
+  UpdateBotRequest,
+  UpdateConnectorRequest
+} from "./chunk-F3D2K4WZ.js";
 import {
   findWebDist,
   nodeLocateDeps,
@@ -162,7 +165,27 @@ var MigrationError = class extends Error {
 var BASELINE_VERSION = 1;
 var BASELINE_SENTINEL_TABLE = "bots";
 var MIGRATIONS = [
-  { version: BASELINE_VERSION, name: "baseline", up: SCHEMA_SQL }
+  { version: BASELINE_VERSION, name: "baseline", up: SCHEMA_SQL },
+  {
+    version: 2,
+    name: "connectors",
+    // Plain CREATE TABLE, not IF NOT EXISTS: the ledger already guarantees this runs once, and
+    // this module exists precisely because IF NOT EXISTS turns a real conflict into silence.
+    up: `
+CREATE TABLE connectors (
+  id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  config_json TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL
+);
+CREATE TABLE bot_connectors (
+  bot_id TEXT NOT NULL, connector_id TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  PRIMARY KEY (bot_id, connector_id)
+);
+`
+  }
 ];
 var SCHEMA_VERSION_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
@@ -338,6 +361,14 @@ var toSkill = (r) => ({
   source: r.source,
   createdAt: r.created_at
 });
+var toConnector = (r) => ({
+  id: r.id,
+  name: r.name,
+  description: r.description,
+  config: ConnectorConfigSchema.parse(JSON.parse(r.config_json)),
+  enabled: b(r.enabled),
+  createdAt: r.created_at
+});
 var toRoutine = (r) => ({
   id: r.id,
   botId: r.bot_id,
@@ -467,6 +498,28 @@ var Store = class {
     this.db.prepare(`DELETE FROM routines WHERE bot_id=?`).run(id);
     if (bot.threadId) this.db.prepare(`DELETE FROM threads WHERE id=?`).run(bot.threadId);
   }
+  /**
+   * Clear a bot's conversation and its SDK session, keeping everything that defines the bot.
+   *
+   * Deliberately narrow. Memory, skills, connectors, routines and the bot's files all survive —
+   * those are the bot. What goes is the accumulated conversation: the messages in its thread and
+   * the `session_id` the SDK resumes from, which is what makes a turn carry prior context.
+   *
+   * Messages are deleted rather than the thread, so the thread id every other row points at
+   * stays valid; the FTS triggers keep the search index in step.
+   */
+  resetBotSession(id) {
+    const bot = this.getBot(id);
+    if (!bot) return null;
+    let messagesDeleted = 0;
+    if (bot.threadId) {
+      const info = this.db.prepare(`DELETE FROM messages WHERE thread_id=?`).run(bot.threadId);
+      messagesDeleted = info.changes;
+      this.db.prepare(`UPDATE threads SET last_read_at=0 WHERE id=?`).run(bot.threadId);
+    }
+    this.db.prepare(`UPDATE bots SET session_id=NULL, attention='none' WHERE id=?`).run(id);
+    return { messagesDeleted };
+  }
   duplicateBot(id) {
     const src = this.getBot(id);
     if (!src) return null;
@@ -479,6 +532,8 @@ var Store = class {
     });
     for (const bs of this.db.prepare(`SELECT * FROM bot_skills WHERE bot_id=?`).all(id))
       this.db.prepare(`INSERT OR REPLACE INTO bot_skills (bot_id,skill_id,enabled) VALUES (?,?,?)`).run(copy.id, bs.skill_id, bs.enabled);
+    for (const bc of this.db.prepare(`SELECT * FROM bot_connectors WHERE bot_id=?`).all(id))
+      this.db.prepare(`INSERT OR REPLACE INTO bot_connectors (bot_id,connector_id,enabled) VALUES (?,?,?)`).run(copy.id, bc.connector_id, bc.enabled);
     for (const r of this.listRoutines(id))
       this.createRoutine({ botId: copy.id, name: r.name, cronExpr: r.cronExpr, timezone: r.timezone, instructionMd: r.instructionMd, enabled: false });
     return copy;
@@ -697,6 +752,53 @@ var Store = class {
       `SELECT s.* FROM skills s JOIN bot_skills bs ON bs.skill_id=s.id WHERE bs.bot_id=? AND bs.enabled=1`
     ).all(botId).map(toSkill);
   }
+  /* ---- connectors ---- */
+  createConnector(c) {
+    const id = newId();
+    this.db.prepare(
+      `INSERT INTO connectors (id,name,description,config_json,enabled,created_at) VALUES (?,?,?,?,?,?)`
+    ).run(id, c.name, c.description ?? "", JSON.stringify(c.config), i(c.enabled, true), now());
+    return this.getConnector(id);
+  }
+  getConnector(id) {
+    const r = this.db.prepare(`SELECT * FROM connectors WHERE id=?`).get(id);
+    return r ? toConnector(r) : null;
+  }
+  getConnectorByName(name) {
+    const r = this.db.prepare(`SELECT * FROM connectors WHERE name=?`).get(name);
+    return r ? toConnector(r) : null;
+  }
+  listConnectors() {
+    return this.db.prepare(`SELECT * FROM connectors ORDER BY name ASC`).all().map(toConnector);
+  }
+  /** Patch in place. No rename: the name is baked into every `mcp__<name>__<tool>` a rule may match. */
+  updateConnector(id, patch) {
+    const existing = this.getConnector(id);
+    if (!existing) return null;
+    this.db.prepare(`UPDATE connectors SET description=?, config_json=?, enabled=? WHERE id=?`).run(
+      patch.description ?? existing.description,
+      JSON.stringify(patch.config ?? existing.config),
+      i(patch.enabled ?? existing.enabled),
+      id
+    );
+    return this.getConnector(id);
+  }
+  deleteConnector(id) {
+    this.db.prepare(`DELETE FROM connectors WHERE id=?`).run(id);
+    this.db.prepare(`DELETE FROM bot_connectors WHERE connector_id=?`).run(id);
+  }
+  setBotConnectors(botId, connectorIds) {
+    this.db.prepare(`DELETE FROM bot_connectors WHERE bot_id=?`).run(botId);
+    const stmt = this.db.prepare(`INSERT OR REPLACE INTO bot_connectors (bot_id,connector_id,enabled) VALUES (?,?,1)`);
+    for (const c of connectorIds) stmt.run(botId, c);
+  }
+  /** Assigned AND account-wide enabled — disabling a connector takes it away from every bot at once. */
+  listBotConnectors(botId) {
+    return this.db.prepare(
+      `SELECT c.* FROM connectors c JOIN bot_connectors bc ON bc.connector_id=c.id
+       WHERE bc.bot_id=? AND bc.enabled=1 AND c.enabled=1 ORDER BY c.name ASC`
+    ).all(botId).map(toConnector);
+  }
   /* ---- routines ---- */
   createRoutine(r) {
     const count = this.db.prepare(`SELECT COUNT(*) c FROM routines WHERE bot_id=?`).get(r.botId).c;
@@ -1239,6 +1341,9 @@ async function* runTurn(req) {
       switch (m.type) {
         case "system":
           if (m.subtype === "init" && m.session_id) yield { kind: "session", sessionId: m.session_id };
+          if (m.subtype === "init" && Array.isArray(m.mcp_servers)) {
+            yield { kind: "mcp_status", mcpStatus: m.mcp_servers };
+          }
           break;
         case "stream_event": {
           const ev = m.event;
@@ -1457,6 +1562,12 @@ You share one computer with every other bot on this account.
     parts.push(`## Your skills
 ${ctx.skills.map((s) => `- **${s.name}** (${s.slug}): ${s.description}`).join("\n")}
 Read the skill file before following it.`);
+  }
+  if (ctx.connectors?.length) {
+    parts.push(`## Your connectors
+${ctx.connectors.map((c) => `- **${c.name}**${c.description ? `: ${c.description}` : ""}`).join("\n")}
+Their tools appear as \`mcp__<connector>__<tool>\`. Prefer a connector's tools over driving the
+browser for the same service \u2014 it is faster, and it does not depend on a page's layout.`);
   }
   const others = ctx.roster.filter((r) => r.slug !== bot.slug);
   if (others.length) {
@@ -1713,10 +1824,12 @@ Pick the one you need and install just it, e.g. ${args.source.replace(/^https?:\
     const botDir = path5.join(workspace, "bots", bot.slug);
     fs4.mkdirSync(botDir, { recursive: true });
     const botSkills = store.listBotSkills(bot.id);
+    const connectors = await this.deps.connectorServers?.(bot.id);
     const systemPrompt = buildSystemPrompt({
       bot,
       workspace,
       skills: botSkills,
+      connectors: connectors?.mounted ?? [],
       roster: store.listBots().map((x) => ({ slug: x.slug, name: x.name, title: x.title })),
       isGroup
     });
@@ -1727,6 +1840,7 @@ Pick the one you need and install just it, e.g. ${args.source.replace(/^https?:\
     const mcpServers = { antbot: this.buildToolServer(bot, job.threadId, job.hops) };
     const browser = this.deps.browserTools?.(bot.id);
     if (browser) mcpServers.browser = browser;
+    if (connectors) Object.assign(mcpServers, connectors.servers);
     try {
       for await (const ev of runTurn({
         prompt: job.prompt,
@@ -1808,6 +1922,25 @@ Pick the one you need and install just it, e.g. ${args.source.replace(/^https?:\
       case "session":
         if (ev.sessionId) store.updateBot(bot.id, { sessionId: ev.sessionId });
         break;
+      // A connector that does not come up gives the bot no tools and no way to say why — it
+      // simply behaves as though the connector were never assigned. Surfacing the SDK's own
+      // verdict is the difference between "my bot ignores my connector" and a stated reason.
+      case "mcp_status": {
+        const bad = (ev.mcpStatus ?? []).filter((m) => m.status !== "connected");
+        if (!bad.length) break;
+        for (const m of bad) {
+          log6.warn(`connector "${m.name}" did not connect for ${bot.slug}: ${m.status}${m.error ? ` \u2014 ${m.error}` : ""}`);
+        }
+        bus.publish({
+          type: "notify",
+          botId: bot.id,
+          threadId: job.threadId,
+          title: "Connector unavailable",
+          body: bad.map((m) => `${m.name}: ${describeMcpStatus(m.status)}`).join("; "),
+          level: "warn"
+        });
+        break;
+      }
       case "text":
         if (ev.text) {
           const cur = store.getMessage(msgId);
@@ -1871,6 +2004,20 @@ Pick the one you need and install just it, e.g. ${args.source.replace(/^https?:\
     }
   }
 };
+function describeMcpStatus(status) {
+  switch (status) {
+    case "needs-auth":
+      return "needs authentication \u2014 the server rejected the credentials it was given (or was given none)";
+    case "failed":
+      return "failed to start \u2014 check the command or URL with `antbot connector test`";
+    case "pending":
+      return "did not finish connecting in time";
+    case "disabled":
+      return "is disabled";
+    default:
+      return status;
+  }
+}
 function summarizeTool(name, input) {
   const o = input ?? {};
   const s = (k) => typeof o[k] === "string" ? o[k] : "";
@@ -1883,10 +2030,73 @@ function summarizeTool(name, input) {
   if (name.includes("list_skills")) return "list installed skills";
   if (name.includes("remember")) return `memory: ${s("title")}`;
   if (name.startsWith("browser_") || name.includes("browser")) return [s("url"), s("selector"), s("text")].filter(Boolean).join(" ").slice(0, 160);
+  const mcp = /^mcp__([^_]+(?:_[^_]+)*)__(.+)$/.exec(name);
+  if (mcp) return `${mcp[1]}: ${mcp[2]} ${JSON.stringify(input ?? {})}`.slice(0, 160);
   const j = JSON.stringify(input ?? {});
   return j.length > 160 ? `${j.slice(0, 160)}\u2026` : j;
 }
 
+// daemon/src/bots/connectors.ts
+var SECRET_REF_RE = /\{\{secret:([A-Za-z0-9_.-]+)\}\}/g;
+function extractSecretRefs(config) {
+  const values = config.transport === "stdio" ? Object.values(config.env) : Object.values(config.headers);
+  const names = [];
+  for (const v of values) {
+    for (const m of v.matchAll(SECRET_REF_RE)) {
+      const name = m[1];
+      if (!names.includes(name)) names.push(name);
+    }
+  }
+  return names;
+}
+function computeMissingSecrets(connector, available) {
+  return extractSecretRefs(connector.config).filter((n) => !available.has(n));
+}
+function planConnectorMount(assigned, available) {
+  const plan = { mount: [], skipped: [] };
+  for (const connector of assigned) {
+    const missing = computeMissingSecrets(connector, available);
+    if (missing.length) plan.skipped.push({ connector, missing });
+    else plan.mount.push(connector);
+  }
+  return plan;
+}
+var MissingSecretError = class extends Error {
+  constructor(connectorName, secretName) {
+    super(`Connector "${connectorName}" references secret "${secretName}", which could not be read.`);
+    this.connectorName = connectorName;
+    this.secretName = secretName;
+    this.name = "MissingSecretError";
+  }
+  connectorName;
+  secretName;
+};
+function substitute(value, connectorName, secrets) {
+  return value.replace(SECRET_REF_RE, (_full, name) => {
+    const resolved = secrets.get(name);
+    if (resolved == null) throw new MissingSecretError(connectorName, name);
+    return resolved;
+  });
+}
+var substituteAll = (record, connectorName, secrets) => Object.fromEntries(Object.entries(record).map(([k, v]) => [k, substitute(v, connectorName, secrets)]));
+function buildMcpServerConfig(connector, secrets) {
+  const c = connector.config;
+  if (c.transport === "stdio") {
+    return {
+      type: "stdio",
+      command: c.command,
+      args: c.args,
+      env: substituteAll(c.env, connector.name, secrets)
+    };
+  }
+  return {
+    type: c.transport,
+    url: c.url,
+    headers: substituteAll(c.headers, connector.name, secrets),
+    ...c.tools ? { tools: c.tools } : {}
+  };
+}
+
 // daemon/src/config/config.ts
 import fs6 from "node:fs";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
@@ -2132,7 +2342,29 @@ var SecretsService = class {
   list() {
     return [...this.names];
   }
-  /** Build an env overlay for a tool subprocess. Values never touch the transcript. */
+  /**
+   * Look up exactly the named secrets, for mounting a connector.
+   *
+   * Scoped on purpose. The unscoped `envOverlay()` below hands every stored secret to whatever
+   * asks; a connector should only ever see the ones its own config references, so that adding a
+   * third-party MCP server does not widen the blast radius of every other credential.
+   *
+   * A name with nothing behind it maps to null rather than being dropped, so the caller can tell
+   * "missing" from "empty string" and skip the connector instead of mounting it half-configured.
+   */
+  async resolve(names) {
+    const out = /* @__PURE__ */ new Map();
+    for (const n of new Set(names)) {
+      out.set(n, this.names.has(n) ? await this.backend.get(n) : null);
+    }
+    return out;
+  }
+  /**
+   * Build an env overlay for a tool subprocess. Values never touch the transcript.
+   *
+   * Unused, and unscoped — it returns every secret at once. `resolve()` above is what connectors
+   * use. Kept only because removing it is a separate decision; do not reach for it.
+   */
   async envOverlay() {
     const out = {};
     for (const n of this.names) {
@@ -2212,6 +2444,36 @@ async function createApp(opts = {}) {
       } catch {
         return void 0;
       }
+    },
+    /**
+     * Resolve this bot's connectors into mountable MCP servers.
+     *
+     * This is the only place a secret value is read for a turn, and the values live nowhere but
+     * the returned config — not in the row, not in a log line, not in anything a route returns.
+     * A connector missing a credential is dropped rather than mounted broken or allowed to fail
+     * the turn; the human was already warned on the connectors screen.
+     */
+    connectorServers: async (botId) => {
+      const assigned = store.listBotConnectors(botId);
+      if (!assigned.length) return { servers: {}, mounted: [] };
+      const available = new Set(app.secrets?.list() ?? []);
+      const { mount, skipped } = planConnectorMount(assigned, available);
+      for (const s of skipped) {
+        log8.warn(`connector "${s.connector.name}" not mounted \u2014 missing secret(s): ${s.missing.join(", ")}`);
+      }
+      const servers = {};
+      const mounted = [];
+      for (const connector of mount) {
+        const refs = extractSecretRefs(connector.config);
+        try {
+          const secrets = refs.length ? await app.secrets.resolve(refs) : /* @__PURE__ */ new Map();
+          servers[connector.name] = buildMcpServerConfig(connector, secrets);
+          mounted.push({ name: connector.name, description: connector.description });
+        } catch (err) {
+          log8.warn(`connector "${connector.name}" not mounted`, err.message);
+        }
+      }
+      return { servers, mounted };
     }
   });
   try {
@@ -2456,6 +2718,17 @@ function registerCoreRoutes(f, app) {
     store.deleteBot(req.params.id);
     return { ok: true };
   });
+  f.post("/api/bots/:id/reset", async (req, reply) => {
+    const bot = store.getBot(req.params.id);
+    if (!bot) return reply.code(404).send({ error: "No such bot" });
+    if (bot.state === "running" || bot.state === "queued") {
+      return reply.code(409).send({ error: "This bot is working. Stop it first, then start fresh." });
+    }
+    const result = store.resetBotSession(bot.id);
+    if (!result) return reply.code(404).send({ error: "No such bot" });
+    if (bot.threadId) bus.publish({ type: "thread.updated", threadId: bot.threadId, botId: bot.id, threadId2: bot.threadId });
+    return { ok: true, ...result };
+  });
   f.post("/api/bots/:id/duplicate", async (req, reply) => {
     try {
       const copy = store.duplicateBot(req.params.id);
@@ -2496,6 +2769,15 @@ function registerCoreRoutes(f, app) {
     store.setBotSkills(req.params.id, req.body?.skillIds ?? []);
     return { ok: true };
   });
+  f.get("/api/bots/:id/connectors", async (req, reply) => {
+    if (!store.getBot(req.params.id)) return reply.code(404).send({ error: "No such bot" });
+    return store.listBotConnectors(req.params.id);
+  });
+  f.put("/api/bots/:id/connectors", async (req, reply) => {
+    if (!store.getBot(req.params.id)) return reply.code(404).send({ error: "No such bot" });
+    store.setBotConnectors(req.params.id, req.body?.connectorIds ?? []);
+    return { ok: true };
+  });
   f.get("/api/threads", async () => store.listThreads());
   f.post("/api/threads", async (req, reply) => {
     const parsed = CreateThreadRequest.safeParse(req.body);
@@ -2585,6 +2867,176 @@ ${attachments.map((a) => `- ${a.name} \u2192 ${a.path}`).join("\n")}` : "";
 // daemon/src/api/routes-ops.ts
 import fs9 from "node:fs";
 import path10 from "node:path";
+
+// daemon/src/bots/mcpProbe.ts
+import { spawn } from "node:child_process";
+var log10 = logger("mcp-probe");
+var PROTOCOL_VERSION = "2025-06-18";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var MAX_DESCRIPTION = 200;
+function parseToolsResult(result) {
+  const tools = result?.tools;
+  if (!Array.isArray(tools)) return [];
+  return tools.filter((t) => typeof t === "object" && t !== null).map((t) => ({
+    name: String(t.name ?? ""),
+    description: String(t.description ?? "").slice(0, MAX_DESCRIPTION)
+  })).filter((t) => t.name.length > 0);
+}
+var rpc = (id, method, params) => `${JSON.stringify({ jsonrpc: "2.0", id, method, ...params ? { params } : {} })}
+`;
+var notify = (method) => `${JSON.stringify({ jsonrpc: "2.0", method })}
+`;
+var failed = (error) => ({ ok: false, tools: [], error });
+async function probeStdio(cfg, timeoutMs) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(cfg.command, cfg.args ?? [], {
+        // The server's own env plus the connector's — a connector that needs PATH still gets it.
+        env: { ...process.env, ...cfg.env ?? {} },
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch (err) {
+      return resolve(failed(err.message));
+    }
+    let settled = false;
+    let stderr = "";
+    let buffer = "";
+    const finish = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve(r);
+    };
+    const timer = setTimeout(
+      () => finish(failed(`timed out after ${timeoutMs}ms${stderr ? `: ${stderr.trim().slice(0, 200)}` : ""}`)),
+      timeoutMs
+    );
+    child.on("error", (err) => finish(failed(err.message)));
+    child.on(
+      "exit",
+      (code) => finish(failed(`server exited with code ${code}${stderr ? `: ${stderr.trim().slice(0, 200)}` : ""}`))
+    );
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    child.stdout?.on("data", (d) => {
+      buffer += d.toString();
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        let msg;
+        try {
+          msg = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (msg.id === 1) {
+          try {
+            child.stdin?.write(notify("notifications/initialized"));
+            child.stdin?.write(rpc(2, "tools/list"));
+          } catch (err) {
+            finish(failed(err.message));
+          }
+        } else if (msg.id === 2) {
+          if (msg.error) return finish(failed(JSON.stringify(msg.error).slice(0, 200)));
+          finish({ ok: true, tools: parseToolsResult(msg.result) });
+        }
+      }
+    });
+    try {
+      child.stdin?.write(
+        rpc(1, "initialize", {
+          protocolVersion: PROTOCOL_VERSION,
+          capabilities: {},
+          clientInfo: { name: "ant-bot", version: "1.0.0" }
+        })
+      );
+    } catch (err) {
+      finish(failed(err.message));
+    }
+  });
+}
+async function probeHttp(cfg, timeoutMs) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  const base = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    ...cfg.headers ?? {}
+  };
+  const readBody = async (res) => {
+    const text = await res.text();
+    const line = text.split("\n").find((l) => l.startsWith("data:"));
+    try {
+      return JSON.parse(line ? line.slice(5).trim() : text);
+    } catch {
+      return null;
+    }
+  };
+  try {
+    const initRes = await fetch(cfg.url, {
+      method: "POST",
+      signal: ac.signal,
+      headers: base,
+      body: rpc(1, "initialize", {
+        protocolVersion: PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "ant-bot", version: "1.0.0" }
+      })
+    });
+    if (!initRes.ok) return failed(`initialize returned HTTP ${initRes.status}`);
+    const session = initRes.headers.get("mcp-session-id");
+    const withSession = session ? { ...base, "mcp-session-id": session } : base;
+    await readBody(initRes);
+    await fetch(cfg.url, { method: "POST", signal: ac.signal, headers: withSession, body: notify("notifications/initialized") }).catch(() => void 0);
+    const listRes = await fetch(cfg.url, {
+      method: "POST",
+      signal: ac.signal,
+      headers: withSession,
+      body: rpc(2, "tools/list")
+    });
+    if (!listRes.ok) return failed(`tools/list returned HTTP ${listRes.status}`);
+    const body = await readBody(listRes);
+    if (body?.error) return failed(JSON.stringify(body.error).slice(0, 200));
+    return { ok: true, tools: parseToolsResult(body?.result) };
+  } catch (err) {
+    const e = err;
+    return failed(e.name === "AbortError" ? `timed out after ${timeoutMs}ms` : e.message);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function probeConnector(config, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const type = config.type;
+  try {
+    if (type === "stdio") {
+      return await probeStdio(config, timeoutMs);
+    }
+    if (type === "http") {
+      const result = await probeHttp(config, timeoutMs);
+      const headers = config.headers ?? {};
+      const authed = Object.keys(headers).some((h) => /^(authorization|x-api-key|api-key)$/i.test(h));
+      if (result.ok && !authed) {
+        result.authHint = "This server was reached without any credential. If it needs one, the tools will list here but a bot will still see none \u2014 add an Authorization header, e.g. {{secret:NAME}}.";
+      }
+      return result;
+    }
+    if (type === "sse") return failed("testing is not supported for sse connectors \u2014 assign it to a bot and run a turn");
+    return failed(`unknown transport: ${String(type)}`);
+  } catch (err) {
+    log10.warn("probe threw", err);
+    return failed(err.message);
+  }
+}
+
+// daemon/src/api/routes-ops.ts
 function registerOpsRoutes(f, app) {
   const { store, gateway, bus } = app;
   f.get("/api/approvals", async () => store.listPendingApprovals());
@@ -2618,6 +3070,45 @@ function registerOpsRoutes(f, app) {
     store.deleteRule(rule.id);
     return { ok: true };
   });
+  f.get("/api/connectors", async () => {
+    const available = new Set(app.secrets?.list() ?? []);
+    return store.listConnectors().map((c) => ({ ...c, missingSecrets: computeMissingSecrets(c, available) }));
+  });
+  f.post("/api/connectors", async (req, reply) => {
+    const parsed = CreateConnectorRequest.safeParse(req.body);
+    if (!parsed.success) return reply.code(400).send({ error: parsed.error.issues[0]?.message ?? "Invalid body" });
+    if (store.getConnectorByName(parsed.data.name)) {
+      return reply.code(409).send({ error: `A connector named "${parsed.data.name}" already exists` });
+    }
+    return store.createConnector(parsed.data);
+  });
+  f.patch("/api/connectors/:id", async (req, reply) => {
+    const parsed = UpdateConnectorRequest.safeParse(req.body);
+    if (!parsed.success) return reply.code(400).send({ error: "Invalid body" });
+    const updated = store.updateConnector(req.params.id, parsed.data);
+    if (!updated) return reply.code(404).send({ error: "No such connector" });
+    return updated;
+  });
+  f.delete("/api/connectors/:id", async (req, reply) => {
+    if (!store.getConnector(req.params.id)) return reply.code(404).send({ error: "No such connector" });
+    store.deleteConnector(req.params.id);
+    return { ok: true };
+  });
+  f.post("/api/connectors/:id/test", async (req, reply) => {
+    const connector = store.getConnector(req.params.id);
+    if (!connector) return reply.code(404).send({ error: "No such connector" });
+    const refs = extractSecretRefs(connector.config);
+    const missing = computeMissingSecrets(connector, new Set(app.secrets?.list() ?? []));
+    if (missing.length) {
+      return { ok: false, tools: [], error: `missing secret(s): ${missing.join(", ")}` };
+    }
+    try {
+      const secrets = refs.length && app.secrets ? await app.secrets.resolve(refs) : /* @__PURE__ */ new Map();
+      return await probeConnector(buildMcpServerConfig(connector, secrets));
+    } catch (err) {
+      return { ok: false, tools: [], error: err.message };
+    }
+  });
   f.get("/api/skills", async () => store.listSkills());
   f.post("/api/skills", async (req, reply) => {
     const parsed = CreateSkillRequest.safeParse(req.body);
@@ -2855,7 +3346,7 @@ function registerOpsRoutes(f, app) {
 }
 
 // daemon/src/api/server.ts
-var log10 = logger("server");
+var log11 = logger("server");
 var require_ = createRequire(import.meta.url);
 function resolveWebDist() {
   return findWebDist(
@@ -2972,9 +3463,9 @@ async function startServer(opts = {}) {
         if (req.url.startsWith("/api")) return reply.code(404).send({ error: "Not found" });
         return reply.sendFile("index.html");
       });
-      log10.info(`serving UI from ${dist}`);
+      log11.info(`serving UI from ${dist}`);
     } else {
-      log10.warn("web UI not built \u2014 run `pnpm --filter @antbot/ui build`");
+      log11.warn("web UI not built \u2014 run `pnpm --filter @antbot/ui build`");
       fastify.setNotFoundHandler((req, reply) => {
         if (req.url.startsWith("/api")) return reply.code(404).send({ error: "Not found" });
         return reply.type("text/html").send(
@@ -2989,7 +3480,7 @@ async function startServer(opts = {}) {
     }
   }
   fastify.setErrorHandler((err, _req, reply) => {
-    log10.error("request failed", err);
+    log11.error("request failed", err);
     const e = err;
     const code = e.statusCode && e.statusCode >= 400 ? e.statusCode : 500;
     reply.code(code).send({ error: e.message ?? "Internal error" });
@@ -2999,13 +3490,13 @@ async function startServer(opts = {}) {
   await fastify.listen({ port, host });
   const url = `http://${host}:${port}`;
   const delivered = drainMailbox(app);
-  if (delivered) log10.info(`redelivered ${delivered} queued handoff message(s)`);
+  if (delivered) log11.info(`redelivered ${delivered} queued handoff message(s)`);
   const stale = app.store.listBots().filter((b2) => b2.state === "running" || b2.state === "queued");
   for (const b2 of stale) app.store.updateBot(b2.id, { state: "idle" });
   app.db.prepare(`UPDATE messages SET streaming=0 WHERE streaming=1`).run();
   app.db.prepare(`UPDATE approvals SET status='expired', reason='Daemon restarted' WHERE status='pending'`).run();
   app.db.prepare(`UPDATE routine_runs SET status='interrupted', finished_at=? WHERE status='running'`).run(Date.now());
-  log10.info(`ant-bot listening on ${url}`);
+  log11.info(`ant-bot listening on ${url}`);
   return {
     fastify,
     app,