@nimbus-dev/connectors 0.2.3 → 0.2.4

package/connectors/apple/src/server.ts

@@ -12,6 +12,7 @@
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { requireProcessEnv } from "../../../shared/mcp-tool-kit.ts";
 import {
   createAppleCalDavClient,
@@ -39,7 +40,10 @@ try {
   // non-fatal; listEvents/list tools will re-discover on demand
 }
 
-const server = new McpServer({ name: "nimbus-apple", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-apple", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAppleTools(server, {
   client: createAppleImapClient(email, appPw),

package/connectors/aws/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerAwsTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-aws", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-aws", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAwsTools(mcp);
 

package/connectors/azure/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerAzureTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-azure", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-azure", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerAzureTools(mcp);
 

package/connectors/bitbucket/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerBitbucketTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-bitbucket", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-bitbucket", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerBitbucketTools(server);
 

package/connectors/circleci/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerCircleciTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-circleci", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-circleci", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerCircleciTools(mcp);
 

package/connectors/confluence/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerConfluenceTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-confluence", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-confluence", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerConfluenceTools(server);
 

package/connectors/fastmail/src/server.ts

@@ -1,9 +1,13 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { createFetchJmapClient } from "./jmap-client.ts";
 import { registerFastmailTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-fastmail", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-fastmail", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 registerFastmailTools(server, createFetchJmapClient());
 
 await server.connect(new StdioServerTransport());

package/connectors/gcp/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGcpTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-gcp", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-gcp", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGcpTools(mcp);
 

package/connectors/github/src/server.ts

@@ -1,10 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGithubTools } from "./tools.ts";
 
 const server = new McpServer(
   { name: "nimbus-github", version: "0.1.0" },
   {
+    capabilities: CONSENT_SERVER_CAPABILITIES,
     // Machine-readable security tiering, so a client can surface it rather than relying on a
     // human having read the NOTICE file.
     instructions:

package/connectors/github-actions/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGithubActionsTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-github-actions", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-github-actions", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGithubActionsTools(mcp);
 

package/connectors/gitlab/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGitlabTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-gitlab", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-gitlab", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGitlabTools(server);
 

package/connectors/gmail/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGmailTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-gmail", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-gmail", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGmailTools(server);
 

package/connectors/google-drive/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerGoogleDriveTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-google-drive", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-google-drive", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerGoogleDriveTools(server);
 

package/connectors/iac/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerIacTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-iac", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-iac", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerIacTools(mcp);
 

package/connectors/iac/src/tools.ts

@@ -1,5 +1,8 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { z } from "zod";
-import { awsCliArg, awsCliDocument, cliArg } from "../../../shared/cli-json-kit.ts";
+import { awsCliArg, cliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -9,6 +12,49 @@ import {
 } from "../../../shared/mcp-tool-kit.ts";
 import { runCliOkThrowing } from "../../../shared/run-cli-json.ts";
 
+/**
+ * The most a template may be when it is deployed without an S3 bucket, which this tool does not
+ * take: `aws cloudformation deploy` refuses a larger one itself, and only after the prompt.
+ */
+const TEMPLATE_MAX_BYTES = 51_200;
+
+/**
+ * A CloudFormation template. It reaches the AWS CLI as a file, never as an argument (see
+ * {@link withTemplateFile}), so none of the argument rules apply to it: a YAML template may well
+ * start with `---`. Its size is refused here, in the schema, because no consent can lift it: a
+ * larger template would be put to the human, spend a unit of write budget, and then fail. The
+ * character bound is the one a client is shown; no string over it can be within the byte bound.
+ */
+const templateDocument = z
+  .string()
+  .min(1)
+  .max(TEMPLATE_MAX_BYTES)
+  .refine((t) => new TextEncoder().encode(t).length <= TEMPLATE_MAX_BYTES, {
+    message: `must be at most ${String(TEMPLATE_MAX_BYTES)} bytes as UTF-8, the most aws cloudformation deploy takes without an S3 bucket`,
+  });
+
+/**
+ * Run `body` with `template` written to a file of its own, removed afterwards however `body` ends.
+ *
+ * `aws cloudformation deploy` takes a template only as `--template-file`, and passing one as an
+ * argument would not work anyway: a template can run past the 32,767 characters a Windows command
+ * line holds, and an `aws` that is a batch file, as a pip-installed v1 is, has cmd.exe parse every
+ * quote in it.
+ */
+async function withTemplateFile<T>(
+  template: string,
+  body: (path: string) => Promise<T>,
+): Promise<T> {
+  const dir = await mkdtemp(join(tmpdir(), "nimbus-cfn-"));
+  try {
+    const path = join(dir, "template");
+    await writeFile(path, template, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    return await body(path);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
 /** Tool names exposed by this connector — for contract/introspection tests. */
 export const IAC_TOOL_NAMES = [
   "iac_terraform_plan",
@@ -42,9 +88,12 @@ export function registerIacTools(
     "Run terraform plan in a directory.",
     z.object({ workingDirectory: cliArg }),
     async (p) => {
-      await runCliOkThrowing(["terraform", "-chdir", p.workingDirectory, "plan", "-input=false"], {
-        ...processEnv,
-      });
+      await runCliOkThrowing(
+        ["terraform", `-chdir=${p.workingDirectory}`, "plan", "-input=false"],
+        {
+          ...processEnv,
+        },
+      );
       return jsonResult({ ok: true });
     },
   );
@@ -60,7 +109,7 @@ export function registerIacTools(
     z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
-        ["terraform", "-chdir", p.workingDirectory, "apply", "-auto-approve", "-input=false"],
+        ["terraform", `-chdir=${p.workingDirectory}`, "apply", "-auto-approve", "-input=false"],
         { ...processEnv },
       );
       return jsonResult({ ok: true });
@@ -82,7 +131,7 @@ export function registerIacTools(
     z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
-        ["terraform", "-chdir", p.workingDirectory, "destroy", "-auto-approve", "-input=false"],
+        ["terraform", `-chdir=${p.workingDirectory}`, "destroy", "-auto-approve", "-input=false"],
         { ...processEnv },
       );
       return jsonResult({ ok: true });
@@ -99,22 +148,30 @@ export function registerIacTools(
     "Deploy a CloudFormation stack via AWS CLI.",
     z.object({
       stackName: awsCliArg,
-      templateBody: awsCliDocument,
+      templateBody: templateDocument,
     }),
     async (p) => {
-      await runCliOkThrowing(
-        [
-          "aws",
-          "cloudformation",
-          "deploy",
-          "--stack-name",
-          p.stackName,
-          "--template-body",
-          p.templateBody,
-          "--capabilities",
-          "CAPABILITY_IAM",
-        ],
-        { ...processEnv },
+      await withTemplateFile(p.templateBody, (templateFile) =>
+        runCliOkThrowing(
+          [
+            "aws",
+            "cloudformation",
+            "deploy",
+            "--stack-name",
+            p.stackName,
+            "--template-file",
+            templateFile,
+            "--capabilities",
+            "CAPABILITY_IAM",
+            // A deploy of a template that changes nothing has done what was asked, not failed.
+            "--no-fail-on-empty-changeset",
+          ],
+          // The file is UTF-8. Left to itself the CLI reads it in the locale's encoding, and on a
+          // Windows machine using cp1252 a template holding "Á" fails to decode while one holding
+          // "é" deploys as "é". AWS CLI v2 reads AWS_CLI_FILE_ENCODING and ignores PYTHONUTF8; v1,
+          // plain Python, reads PYTHONUTF8 and ignores the other. Both are set.
+          { ...processEnv, AWS_CLI_FILE_ENCODING: "UTF-8", PYTHONUTF8: "1" },
+        ),
       );
       return jsonResult({ ok: true });
     },

package/connectors/imap/src/server.ts

@@ -10,6 +10,7 @@
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { envInt } from "../../../shared/imap-tool-kit.ts";
 import { createImapFlowClient, createNodemailerMailer } from "../../../shared/imapflow-adapter.ts";
 import { requireProcessEnv } from "../../../shared/mcp-tool-kit.ts";
@@ -22,7 +23,10 @@ const SMTPS_PORT = 465;
 
 const smtpPort = envInt("IMAP_SMTP_PORT", DEFAULT_SMTP_PORT);
 
-const server = new McpServer({ name: "nimbus-imap", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-imap", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerImapTools(
   server,

package/connectors/jenkins/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerJenkinsTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-jenkins", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-jenkins", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerJenkinsTools(mcp);
 

package/connectors/jira/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerJiraTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-jira", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-jira", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerJiraTools(server);
 

package/connectors/kubernetes/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerKubernetesTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-kubernetes", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-kubernetes", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerKubernetesTools(mcp);
 

package/connectors/linear/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerLinearTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-linear", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-linear", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerLinearTools(server);
 

package/connectors/notion/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerNotionTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-notion", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-notion", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerNotionTools(server);
 

package/connectors/obsidian/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerObsidianTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-obsidian", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-obsidian", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerObsidianTools(server);
 

package/connectors/onedrive/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerOnedriveTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-onedrive", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-onedrive", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerOnedriveTools(server);
 

package/connectors/outlook/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerOutlookTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-outlook", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-outlook", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerOutlookTools(server);
 

package/connectors/pagerduty/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerPagerdutyTools } from "./tools.ts";
 
-const mcp = new McpServer({ name: "nimbus-pagerduty", version: "0.1.0" });
+const mcp = new McpServer(
+  { name: "nimbus-pagerduty", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerPagerdutyTools(mcp);
 

package/connectors/protonmail/src/server.ts

@@ -9,6 +9,7 @@
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { optionalEnv } from "../../../shared/env-json-api.ts";
 import { envInt } from "../../../shared/imap-tool-kit.ts";
 import { createImapFlowClient, createNodemailerMailer } from "../../../shared/imapflow-adapter.ts";
@@ -28,7 +29,10 @@ const DEFAULT_SMTP_PORT = 1025;
  */
 const BRIDGE_TLS = { secure: false, rejectUnauthorized: false } as const;
 
-const server = new McpServer({ name: "nimbus-protonmail", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-protonmail", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerProtonmailTools(
   server,

package/connectors/slack/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerSlackTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-slack", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-slack", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerSlackTools(server);
 

package/connectors/teams/src/server.ts

@@ -1,8 +1,12 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerTeamsTools } from "./tools.ts";
 
-const server = new McpServer({ name: "nimbus-teams", version: "0.1.0" });
+const server = new McpServer(
+  { name: "nimbus-teams", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
 
 registerTeamsTools(server);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-dev/connectors",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "publishConfig": {
     "access": "public"
   },

package/shared/cli-json-kit.ts

@@ -29,12 +29,7 @@
 
 import { z } from "zod";
 import { optionalEnv } from "./env-json-api.ts";
-import {
-  awsCliArgProblem,
-  awsCliDocumentProblem,
-  azCliArgProblem,
-  cliArgProblem,
-} from "./safe-cli-arg.ts";
+import { awsCliArgProblem, azCliArgProblem, cliArgProblem } from "./safe-cli-arg.ts";
 
 /** Body-snippet length in the thrown error. The value every connector used. */
 export const DEFAULT_STDERR_SNIPPET = 400;
@@ -68,13 +63,6 @@ export const cliArg = cliArgSchema(cliArgProblem);
  */
 export const awsCliArg = cliArgSchema(awsCliArgProblem);
 
-/**
- * A DOCUMENT passed to the `aws` CLI as one argument — a CloudFormation template body. Unlike
- * {@link awsCliArg} it may span lines and run past 1024 characters; it still may not start with `-`
- * or with a prefix that makes the CLI read it from somewhere else.
- */
-export const awsCliDocument = cliArgSchema(awsCliDocumentProblem);
-
 /**
  * A value passed to the `az` CLI as an argument: {@link cliArg}, and not one `az` would replace by
  * a file's contents — a leading `@`, or `=@` anywhere.

package/shared/consent-kit.ts

@@ -59,6 +59,19 @@ export type ConsentServer = {
   sendLoggingMessage(params: { level: "info" | "warning"; data: unknown }): Promise<void>;
 };
 
+/**
+ * What a connector with write tools constructs its `McpServer` with:
+ * `new McpServer(info, { capabilities: CONSENT_SERVER_CAPABILITIES })`.
+ *
+ * The kit tells the client about every gated outcome with `notifications/message`, and the SDK
+ * sends that only for a server that declared the MCP `logging` capability. No connector did, so
+ * each notification was dropped without a word. It must be declared at construction: that is the
+ * only moment the SDK installs its `logging/setLevel` handler, and a server that declared the
+ * capability later would refuse a client setting the level. `scripts/connector-boot.test.ts`
+ * fails a connector whose manifest declares a write and whose booted server does not declare it.
+ */
+export const CONSENT_SERVER_CAPABILITIES = { logging: {} };
+
 export type WriteToolConfig<T> = {
   /** Action type this tool performs, e.g. "repo.branch.delete". Machine-readable, not prose. */
   readonly mutates: string;
@@ -185,23 +198,32 @@ export function createWriteToolRegistrar(
     outcome: AuditOutcome,
     detail: Record<string, unknown>,
   ): Promise<void> {
-    // Meant as a client-visible channel, but it reaches no client today: the SDK sends
-    // `notifications/message` only for a server that declared the MCP `logging` capability, and
-    // no connector declares it. The durable log below is the only record.
-    await server.sendLoggingMessage({
-      level: outcome === "executed" ? "info" : "warning",
-      data: { connector: cfg.connector, tool, outcome },
-    });
-    // Durable channel: only when the operator configured a path. An append that fails rejects, and
-    // every record before the mutation is awaited, so a write whose entry did not land never runs.
-    if (auditLog !== undefined && auditLog !== "") {
-      await appendAuditEntry(auditLog, {
-        ts: new Date().toISOString(),
-        connector: cfg.connector,
-        tool,
-        outcome,
-        detail,
-      });
+    try {
+      // Durable channel first: only when the operator configured a path. An append that fails
+      // rejects, and every record before the mutation is awaited, so a write whose entry did not
+      // land never runs.
+      if (auditLog !== undefined && auditLog !== "") {
+        await appendAuditEntry(auditLog, {
+          ts: new Date().toISOString(),
+          connector: cfg.connector,
+          tool,
+          outcome,
+          detail,
+        });
+      }
+    } finally {
+      // Then the client-visible channel, told of every record attempted, one whose append failed
+      // included. It reaches the client because the connector declared the MCP `logging`
+      // capability (CONSENT_SERVER_CAPABILITIES), and a client may filter it by level. Best
+      // effort, and after the durable log: a client that has gone away mid-write must not keep the
+      // `executed` or `failed` record of a write that ran out of the log, and since the capability
+      // made this channel live, a dead pipe is where a send now fails.
+      await server
+        .sendLoggingMessage({
+          level: outcome === "executed" ? "info" : "warning",
+          data: { connector: cfg.connector, tool, outcome },
+        })
+        .catch(() => undefined);
     }
   }
 

package/shared/nimbus-spawn.ts

@@ -16,6 +16,36 @@ import { batchArgumentRefusal } from "./windows-batch-args.ts";
 
 export type SpawnResult = { code: number; stdout: string; stderr: string };
 
+/**
+ * The child's environment: `base` with `overrides` laid over it.
+ *
+ * On Windows a variable's name is case-insensitive, so an override replaces the base's variable
+ * whatever its spelling, instead of sitting beside it as a second one that the child may or may
+ * not see in its place. And the search path is spelled `PATH`, the only spelling Bun resolves a
+ * bare command through. A process started from PowerShell, cmd or Explorer has `Path`, and with it
+ * a bare `az` or `gcloud`, which are the batch files `az.cmd` and `gcloud.cmd` there, did not start
+ * at all: Bun 1.3.14 answered ENOENT, while an `.exe` such as `aws.exe` still started.
+ *
+ * Elsewhere names are case-sensitive, and the two are merged as written.
+ */
+export function childEnvironment(
+  base: Record<string, string | undefined>,
+  overrides: Record<string, string | undefined>,
+  platform: NodeJS.Platform = process.platform,
+): Record<string, string | undefined> {
+  if (platform !== "win32") {
+    return { ...base, ...overrides };
+  }
+  const byName = new Map<string, readonly [string, string | undefined]>();
+  for (const source of [base, overrides]) {
+    for (const [key, value] of Object.entries(source)) {
+      const name = key.toUpperCase();
+      byName.set(name, [name === "PATH" ? "PATH" : key, value]);
+    }
+  }
+  return Object.fromEntries(byName.values());
+}
+
 /**
  * The child's environment for `env`, and why `command` must not be spawned with it, if it must
  * not. Nothing is spawned for a refused command: it resolves as a failure whose stderr says so.
@@ -24,7 +54,7 @@ function prepareSpawn(
   command: readonly string[],
   env: Record<string, string | undefined>,
 ): { childEnv: Record<string, string | undefined>; refusal: SpawnResult | undefined } {
-  const childEnv = { ...process.env, ...env };
+  const childEnv = childEnvironment(process.env, env);
   const refusal = batchArgumentRefusal(command, childEnv);
   return {
     childEnv,

package/shared/run-read-only-mcp-connector.ts

@@ -1,5 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "./consent-kit.ts";
 import {
   createRegisterSimpleTool,
   createZodToolRegistrar,
@@ -41,7 +42,12 @@ export function buildReadOnlyMcpConnector(
   register: (reg: ZodToolRegistrar, server: unknown) => void,
   options?: BuildReadOnlyMcpConnectorOptions,
 ): unknown {
-  const make = options?.createServer ?? ((info) => new McpServer(info));
+  // Every server built here declares the MCP `logging` capability, since the consent kit's
+  // notifications reach a client only through it. A truly read-only connector sends no log
+  // message, so declaring it costs that connector nothing.
+  const make =
+    options?.createServer ??
+    ((info) => new McpServer(info, { capabilities: CONSENT_SERVER_CAPABILITIES }));
   const mcp = make({ name: serverName, version: "0.1.0" });
   const reg = createZodToolRegistrar(createRegisterSimpleTool(mcp));
   register(reg, mcp);

package/shared/safe-cli-arg.ts

@@ -124,26 +124,6 @@ export function awsCliArgProblem(value: unknown): string | undefined {
   return cliArgProblem(value) ?? awsPrefixProblem(value) ?? awsShorthandProblem(value);
 }
 
-/**
- * Why `value` must not be passed to the AWS CLI as a DOCUMENT — a CloudFormation template body —
- * or `undefined` when it may.
- *
- * A document legitimately spans lines and runs past the 1024 characters an argument is held to,
- * so of the argument rules only the two about where the CLI looks remain: a leading `-`, which the
- * CLI would parse as an option, and a loading prefix, which would make it read the "document" from
- * a file. `@=` is not among them: shorthand syntax applies to structure parameters, and a template
- * body is a string.
- */
-export function awsCliDocumentProblem(value: unknown): string | undefined {
-  if (typeof value !== "string" || value.length === 0) {
-    return "must be a non-empty string";
-  }
-  if (value.startsWith("-")) {
-    return 'must not start with "-" (argv flag smuggling is not allowed)';
-  }
-  return awsPrefixProblem(value);
-}
-
 // ---------------------------------------------------------------------------
 // az
 // ---------------------------------------------------------------------------

package/shared/windows-batch-args.ts

@@ -28,9 +28,9 @@
  * AWS resource name, an Azure app, cluster or node pool name, or a subscription id. An Azure
  * resource group may hold `(` and `)`, but never a space, so the runtime never quotes it and
  * `az.cmd` already failed on it as above. What did work and is now refused: an Azure subscription
- * passed by a display name holding one of these characters and a space — its id still works — and
- * a CloudFormation template body, whenever the `aws` that runs is a batch file: a pip-installed v1
- * found on `PATH` before any `aws.exe`.
+ * passed by a display name holding one of these characters and a space — its id still works. A
+ * CloudFormation template, full of quotes, was refused too whenever the `aws` that runs is a batch
+ * file, until it began to reach `aws` as a file instead of an argument.
  *
  * Which file runs is decided the way the runtime decides it — see {@link mayRunAsBatchFile} — so
  * an `aws.exe` found first is never refused, whatever batch file of that name comes later.
@@ -183,11 +183,12 @@ function firstHolderIsBatch(bases: readonly string[], exists: (path: string) =>
  *    and libuv starts only a `.com` or an `.exe`: never a batch file.
  *
  * It says yes where Bun could change without notice, and nowhere else: a PATH variable counts in
- * any spelling, not only `PATH` — today Bun reads no other, and a bare `az` with only `Path` set
- * does not start at all — and each is searched both as written and with whitespace and quotes
- * stripped from its entries; a name written with a `/` is looked up in its directory as one with
- * a `\` is; and the first place holding the name answers yes if it holds a `.cmd` or `.bat` by
- * that name, even beside an `.exe` Bun would try first.
+ * any spelling, not only `PATH` — Bun reads no other, though `nimbus-spawn.ts` respells the
+ * variable `PATH` before every spawn, so a bare `az` under `Path` starts too — and each is searched
+ * both as written and with whitespace and quotes stripped from its entries; a name written with a
+ * `/` is looked up in its directory as one with a `\` is; and the first place holding the name
+ * answers yes if it holds a `.cmd` or `.bat` by that name, even beside an `.exe` Bun would try
+ * first.
  */
 export function mayRunAsBatchFile(
   bin: string,