@numa-tech/numa 1.16.0 → 1.17.0

package/dist/mcp-gateway/runtime.d.ts

@@ -0,0 +1,141 @@
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import type { AuthConfig } from "../config.js";
+import { type KeycloakFetchDependencies } from "../oauth.js";
+import { type GatewayBinding } from "./profile.js";
+export type RuntimeDependencies = KeycloakFetchDependencies & {
+    timeoutMs?: number;
+};
+export declare function serviceEndpoint(binding: GatewayBinding, service: string): string;
+export declare function gatewayFetch(binding: GatewayBinding, auth: AuthConfig, dependencies?: RuntimeDependencies, exactEndpoint?: string): typeof fetch;
+export declare function gatewayTransport(binding: GatewayBinding, auth: AuthConfig, service: string, dependencies?: RuntimeDependencies): StreamableHTTPClientTransport;
+export declare function listGatewayTools(binding: GatewayBinding, auth: AuthConfig, service: string, dependencies?: RuntimeDependencies): Promise<{
+    tools: {
+        inputSchema: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: Record<string, object> | undefined;
+            required?: string[] | undefined;
+        };
+        name: string;
+        description?: string | undefined;
+        outputSchema?: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: Record<string, object> | undefined;
+            required?: string[] | undefined;
+        } | undefined;
+        annotations?: {
+            title?: string | undefined;
+            readOnlyHint?: boolean | undefined;
+            destructiveHint?: boolean | undefined;
+            idempotentHint?: boolean | undefined;
+            openWorldHint?: boolean | undefined;
+        } | undefined;
+        execution?: {
+            taskSupport?: "optional" | "required" | "forbidden" | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+        icons?: {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: "light" | "dark" | undefined;
+        }[] | undefined;
+        title?: string | undefined;
+    }[];
+}>;
+export declare function callGatewayTool(binding: GatewayBinding, auth: AuthConfig, service: string, tool: string, argumentsValue: Record<string, unknown>, dependencies?: RuntimeDependencies): Promise<{
+    [x: string]: unknown;
+    content: ({
+        type: "text";
+        text: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "image";
+        data: string;
+        mimeType: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "audio";
+        data: string;
+        mimeType: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "resource";
+        resource: {
+            uri: string;
+            text: string;
+            mimeType?: string | undefined;
+            _meta?: Record<string, unknown> | undefined;
+        } | {
+            uri: string;
+            blob: string;
+            mimeType?: string | undefined;
+            _meta?: Record<string, unknown> | undefined;
+        };
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        uri: string;
+        name: string;
+        type: "resource_link";
+        description?: string | undefined;
+        mimeType?: string | undefined;
+        size?: number | undefined;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: {
+            [x: string]: unknown;
+        } | undefined;
+        icons?: {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: "light" | "dark" | undefined;
+        }[] | undefined;
+        title?: string | undefined;
+    })[];
+    _meta?: {
+        [x: string]: unknown;
+        progressToken?: string | number | undefined;
+        "io.modelcontextprotocol/related-task"?: {
+            taskId: string;
+        } | undefined;
+    } | undefined;
+    structuredContent?: Record<string, unknown> | undefined;
+    isError?: boolean | undefined;
+} | {
+    [x: string]: unknown;
+    toolResult: unknown;
+    _meta?: {
+        [x: string]: unknown;
+        progressToken?: string | number | undefined;
+        "io.modelcontextprotocol/related-task"?: {
+            taskId: string;
+        } | undefined;
+    } | undefined;
+}>;
+export declare function gatewayCatalog(binding: GatewayBinding, auth: AuthConfig, service?: string, dependencies?: RuntimeDependencies): Promise<Record<string, any>>;
+export declare function runGatewayBridge(binding: GatewayBinding, auth: AuthConfig, service: string): Promise<void>;

package/dist/mcp-gateway/runtime.js

@@ -0,0 +1,148 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { PACKAGE_VERSION } from "../branding.js";
+import { fetchWithKeycloakIdentity } from "../oauth.js";
+import { bridgeMcpTransports } from "../ai-registry/bridge.js";
+import { AiRegistryError } from "../ai-registry/errors.js";
+import { gatewayError } from "./profile.js";
+const MAX_BYTES = 4 * 1024 * 1024;
+export function serviceEndpoint(binding, service) {
+    if (service === "@catalog")
+        return binding.baseUrl + "/catalog/mcp" + (binding.metadata.publishedEndpoints !== undefined ? `?gatewayId=${encodeURIComponent(binding.metadata.gatewayId)}` : "");
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/u.test(service))
+        throw gatewayError("Invalid MCP service name.");
+    if (binding.metadata.publishedEndpoints !== undefined) {
+        const endpoint = binding.metadata.publishedEndpoints.find(e => e.serviceId === service);
+        if (!endpoint)
+            throw gatewayError("MCP service has no published endpoint in this gateway profile.");
+        return endpoint.url;
+    }
+    return `${binding.baseUrl}/services/${service}/mcp`;
+}
+export function gatewayFetch(binding, auth, dependencies = {}, exactEndpoint) {
+    return async (input, init = {}) => {
+        const url = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+        const base = new URL(binding.baseUrl);
+        const catalogPath = base.pathname + "/api/v1/catalog";
+        const catalogRequest = url.pathname === catalogPath || /^\/[a-z0-9][a-z0-9-]{0,62}$/u.test(url.pathname.slice(catalogPath.length)) && url.pathname.startsWith(catalogPath + "/");
+        const validQuery = !url.search || (catalogRequest || url.pathname === base.pathname + "/catalog/mcp") && [...url.searchParams.keys()].every(k => k === "gatewayId") && url.searchParams.getAll("gatewayId").length === 1 && url.searchParams.get("gatewayId") === binding.metadata.gatewayId;
+        const allowedPath = exactEndpoint ? url.origin + url.pathname === new URL(exactEndpoint).origin + new URL(exactEndpoint).pathname && url.search === new URL(exactEndpoint).search : catalogRequest || url.pathname.startsWith(base.pathname + "/");
+        if (url.origin !== base.origin || !allowedPath || url.username || url.password || !validQuery || url.hash) {
+            throw gatewayError("MCP request escaped the selected gateway application.");
+        }
+        const timeout = AbortSignal.timeout(dependencies.timeoutMs ?? 60_000);
+        const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+        const response = await fetchWithKeycloakIdentity(auth, url.toString(), () => ({ ...init, signal, redirect: "manual", headers: new Headers(init.headers) }), {
+            ...dependencies, retryUnauthorized: false
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel();
+            throw gatewayError("MCP gateway redirects are refused.");
+        }
+        if (Number(response.headers.get("content-length")) > MAX_BYTES) {
+            await response.body?.cancel();
+            throw gatewayError("MCP gateway response exceeds the size limit.");
+        }
+        if (!response.body)
+            return response;
+        let size = 0;
+        const bounded = response.body.pipeThrough(new TransformStream({
+            transform(chunk, controller) {
+                size += chunk.byteLength;
+                if (size > MAX_BYTES)
+                    throw gatewayError("MCP gateway response exceeds the size limit.");
+                controller.enqueue(chunk);
+            }
+        }));
+        return new Response(bounded, { status: response.status, statusText: response.statusText, headers: response.headers });
+    };
+}
+export function gatewayTransport(binding, auth, service, dependencies = {}) {
+    if (binding.metadata.publishedEndpoints?.find(e => e.serviceId === service)?.transport === "sse")
+        throw gatewayError("Direct SSE providers are not supported by this bridge; publish a Streamable HTTP Router endpoint.");
+    return new StreamableHTTPClientTransport(new URL(serviceEndpoint(binding, service)), { fetch: gatewayFetch(binding, auth, dependencies, serviceEndpoint(binding, service)) });
+}
+function safeError(error) {
+    if (error instanceof AiRegistryError)
+        return error;
+    const code = error?.code;
+    const status = error?.status ?? (typeof code === "number" && code >= 400 && code <= 599 ? code : undefined);
+    if (status === 401 || status === 403)
+        return new AiRegistryError(`MCP gateway access denied (HTTP ${status}).`, "mcp_gateway_forbidden", status);
+    if (typeof code === "string" && /login|auth|token/iu.test(code))
+        return gatewayError("MCP identity is unavailable; run numa mcp login for the selected namespace or supply its machine credential file.", "mcp_gateway_login_required");
+    return gatewayError("MCP gateway request failed; check namespace identity, connectivity and service state.", "mcp_gateway_request_failed");
+}
+async function withClient(binding, auth, service, dependencies, operation) {
+    const client = new Client({ name: "numa-mcp-gateway", version: PACKAGE_VERSION });
+    let timer;
+    try {
+        return await Promise.race([
+            (async () => { await client.connect(gatewayTransport(binding, auth, service, dependencies)); return operation(client); })(),
+            new Promise((_resolve, reject) => { timer = setTimeout(() => reject(gatewayError("MCP operation timed out.", "mcp_gateway_timeout")), dependencies.timeoutMs ?? 60_000); })
+        ]);
+    }
+    catch (error) {
+        throw safeError(error);
+    }
+    finally {
+        clearTimeout(timer);
+        await client.close().catch(() => undefined);
+    }
+}
+export async function listGatewayTools(binding, auth, service, dependencies = {}) {
+    return withClient(binding, auth, service, dependencies, async (client) => {
+        const tools = [];
+        let cursor;
+        const seen = new Set();
+        for (let page = 0; page < 32; page++) {
+            const result = await client.listTools(cursor ? { cursor } : undefined);
+            tools.push(...result.tools);
+            if (tools.length > 4096)
+                throw gatewayError("Too many MCP tools.");
+            cursor = result.nextCursor;
+            if (!cursor)
+                return { tools };
+            if (seen.has(cursor))
+                throw gatewayError("MCP tools pagination repeated a cursor.");
+            seen.add(cursor);
+        }
+        throw gatewayError("MCP tools pagination exceeded its limit.");
+    });
+}
+export async function callGatewayTool(binding, auth, service, tool, argumentsValue, dependencies = {}) {
+    return withClient(binding, auth, service, dependencies, client => client.callTool({ name: tool, arguments: argumentsValue }, undefined, { timeout: dependencies.timeoutMs ?? 60_000 }));
+}
+export async function gatewayCatalog(binding, auth, service, dependencies = {}) {
+    if (service)
+        serviceEndpoint(binding, service);
+    try {
+        const response = await gatewayFetch(binding, auth, dependencies)(binding.baseUrl + "/api/v1/catalog" + (service ? `/${service}` : "") + (binding.metadata.publishedEndpoints !== undefined ? `?gatewayId=${encodeURIComponent(binding.metadata.gatewayId)}` : ""));
+        if (!response.ok)
+            throw new AiRegistryError(`MCP directory request failed (HTTP ${response.status}).`, "mcp_gateway_catalog_failed", response.status);
+        const value = await response.json();
+        const rows = service ? [value] : value.services;
+        if (!Array.isArray(rows) || rows.length > 256)
+            throw gatewayError("Invalid MCP directory response.");
+        for (const row of rows) {
+            if (typeof row.serviceId !== "string" || row.url !== serviceEndpoint(binding, row.serviceId) || row.transport !== (binding.metadata.publishedEndpoints?.find(e => e.serviceId === row.serviceId)?.transport ?? "streamable-http") || (row.gatewayId !== undefined && row.gatewayId !== binding.metadata.gatewayId) || !Array.isArray(row.tools))
+                throw gatewayError("MCP directory returned an endpoint outside the selected gateway binding.");
+        }
+        if (service && value.serviceId !== service)
+            throw gatewayError("MCP directory service identity mismatch.");
+        return value;
+    }
+    catch (error) {
+        throw safeError(error);
+    }
+}
+export async function runGatewayBridge(binding, auth, service) {
+    try {
+        await bridgeMcpTransports(new StdioServerTransport(), gatewayTransport(binding, auth, service));
+    }
+    catch (error) {
+        throw safeError(error);
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/mcp-gateway/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/mcp-gateway/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,yBAAyB,EAAkC,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAuB,MAAM,cAAc,CAAC;AAEjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAGlC,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,gEAAgE,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,aAAa,OAAO,MAAM,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,IAAgB,EAAE,YAAY,GAAwB,EAAE,EAAE,aAAsB;IACpI,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC;QACtD,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;QACjL,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7R,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QACnP,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1G,MAAM,YAAY,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YAC1J,GAAG,YAAY,EAAE,iBAAiB,EAAE,KAAK;SAC1C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;YAC/D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;YACpF,SAAS,CAAC,KAAK,EAAE,UAAU;gBACzB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,SAAS;oBAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;gBACzF,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACjI,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,SAAS,KAAK,KAAK;QAAE,MAAM,YAAY,CAAC,mGAAmG,CAAC,CAAC;IAC1N,OAAO,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;AAChL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,MAAM,MAAM,GAAI,KAA8C,EAAE,MAAM,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtJ,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,eAAe,CAAC,mCAAmC,MAAM,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACjJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,mHAAmH,EAAE,4BAA4B,CAAC,CAAC;IACxO,OAAO,YAAY,CAAC,uFAAuF,EAAE,4BAA4B,CAAC,CAAC;AAC7I,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAiC,EAAE,SAAyC;IACnK,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAClF,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3H,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACnL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;YACnC,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACvI,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;QACrE,MAAM,KAAK,GAAsD,EAAE,CAAC;QACpE,IAAI,MAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,cAAuC,EAAE,YAAY,GAAwB,EAAE;IAC7L,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1L,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAgB,EAAE,YAAY,GAAwB,EAAE;IACtI,IAAI,OAAO;QAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,iBAAiB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,QAAQ,CAAC,MAAM,IAAI,EAAE,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;QACrG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,YAAY,CAAC,0EAA0E,CAAC,CAAC;QAClb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO;YAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe;IAC/F,IAAI,CAAC;QAAC,MAAM,mBAAmB,CAAC,IAAI,oBAAoB,EAAE,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IACxG,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -34,7 +34,7 @@
     "typecheck": "turbo run typecheck root:typecheck",
     "root:typecheck": "tsc --noEmit",
     "test": "turbo run test root:test",
-    "root:test": "node --import tsx --test src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/group-client.test.ts src/authorization/group-commands.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/group-client.test.ts src/authorization/group-commands.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -57,8 +57,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.16.0",
-    "@tokensrc/codex": "1.16.0",
+    "@numa-tech/cli-auth": "1.17.0",
+    "@tokensrc/codex": "1.17.0",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",

package/skills/numa-cli/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: numa-cli
 metadata:
-  version: "1.3.0"
+  version: "1.3.1"
 description: Numa CLI 与 Skills/MCP 统一入口。用于 numa command not found、npx/Windows 启动、登录及环境检查、发现和安装企业 Skill、依赖与自动更新、项目 registry 锁定同步、上传审核发布，以及 CLI 自身的 stdio MCP、OSS/企微工具和 Agent 安装接入。其他 Numa 业务 Skill 依赖本 Skill；企微、Notion、OSS 和部署任务交给对应专用 Skill，Nacos 基础设施管理交给 numa-nacos。
 ---
 

package/skills/numa-cli/numa-skill.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
   "name": "numa-cli",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "dependencies": []
 }

package/skills/numa-cli/references/cli-mcp.md

@@ -41,14 +41,14 @@ JSON 配置合并保留无关条目。同名替换只有已获覆盖授权时使
 
 默认 `--auth-mode browser`，先用相同系统用户运行 `numa login`，MCP 复用该用户的登录缓存。显式 browser 会清除 MCP 子进程继承的机器 Client ID/Secret 设置；不会替用户切换平台 profile。Issuer/API 由 platform profile 与既有配置规则提供，不在安装器里写死本地或生产地址。
 
-机器身份使用用户明确指定的 Client 与 Secret 文件，不能仅凭三条地址/模式变量取得凭据：
+机器身份使用用户明确指定的 Client 与 Secret 或 Secret 文件，不能仅凭三条地址/模式变量取得凭据：
 
 ```sh
 numa mcp install-cli --agent workbuddy --auth-mode client_credentials \
   --client-id CONFIRMED_CLIENT --client-secret-file /ABS/PROTECTED_SECRET_FILE --plan --json
 ```
 
-核对计划后执行时去掉 `--plan`。配置只记录文件路径，不读取或复制其内容；运行时由现有认证库校验文件保护。不要传字面 Secret，不使用公开 `mcp-client` 作为机器身份。机器模式失败不回退到个人登录。安装成功仅证明配置写入；使用 `numa_auth_status`、业务只读查询进一步核对实际身份和授权。
+核对计划后执行时去掉 `--plan`。配置只记录文件路径，不读取或复制其内容；运行时由现有认证库校验文件保护。从 CLI 1.16.1 起，也可使用 `--client-secret "$NUMA_KEYCLOAK_CLIENT_SECRET"` 直接传值，与 `--client-secret-file` 互斥。直接模式将实际值保存到客户端环境配置，并清空继承的 Secret 文件路径；预览脱敏，交互向导隐藏输入。不使用公开 `mcp-client` 作为机器身份。机器模式失败不回退到个人登录。安装成功仅证明配置写入；使用 `numa_auth_status`、业务只读查询进一步核对实际身份和授权。
 
 ## ChatGPT 本地 stdio 接入
 
@@ -106,7 +106,7 @@ numa mcp install-cli --agent workbuddy --scope user --modules oss \
 `mcp install-cli --env NAME=VALUE` 可重复，写入 MCP 子进程环境并保留生成器原有变量；值支持等号和空字符串。
 重复变量名会拒绝。敏感字段在输出计划中隐藏，向导用隐藏输入；实际值写入私有客户端配置或 Tunnel launcher。
 不要把秘密写进聊天、命令示例或共享日志。CLI 身份字段使用专门的 `--auth-mode`、`--client-id`、
-`--client-secret-file`，禁止通过 `--env` 覆盖身份模式、Client ID、Secret 或 Secret 文件路径。
+`--client-secret` 或 `--client-secret-file`，禁止通过 `--env` 覆盖身份模式、Client ID、Secret 或 Secret 文件路径。
 普通业务配置可通过环境变量追加；不修改 `.zshenv`，不自行换平台地址。
 
 企业 `mcp install NAME --transport bridge --env NAME=VALUE` 也支持本地启动环境。