@openhands/agent-canvas 1.5.1 → 1.6.1

package/dist/api/mcp-service/mcp-service.api.js

@@ -3,10 +3,11 @@ import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { getActiveBackend as t, getRegisteredBackends as n } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as r } from "../agent-server-client-options.js";
 import { getCredentialValidationForServer as i } from "../../utils/mcp-credential-validation.js";
-import { substituteRedactedMcpCredentials as a } from "./mcp-redacted-credentials.js";
+import { redactMcpSecrets as a } from "../../utils/redact-mcp-secrets.js";
+import { substituteRedactedMcpCredentials as o } from "./mcp-redacted-credentials.js";
 //#region src/api/mcp-service/mcp-service.api.ts
-var o = 120;
-function s(e) {
+var s = 120;
+function c(e) {
 	return e.type === "stdio" ? {
 		transport: "stdio",
 		command: e.command,
@@ -19,19 +20,46 @@ function s(e) {
 		...e.auth ? { auth: e.auth } : {}
 	};
 }
-function c(e) {
-	return e.auth?.strategy === "oauth2" ? o : e.timeout;
+function l(e) {
+	return e.auth?.strategy === "oauth2" ? s : e.timeout;
 }
-async function l(e) {
-	let t = i(e), n = s(await a(e)), r = c(e);
+async function u(e) {
+	let t = i(e), n = await o(e), r = c(n), a = l(e);
 	return {
-		server: n,
-		...e.name ? { name: e.name } : {},
-		...r === void 0 ? {} : { timeout: r },
-		...t ? { tool_call: t.toolCall } : {}
+		request: {
+			server: r,
+			...e.name ? { name: e.name } : {},
+			...a === void 0 ? {} : { timeout: a },
+			...t ? { tool_call: t.toolCall } : {}
+		},
+		substituted: n
+	};
+}
+function d(e, t) {
+	return e.ok ? e.tool_result ? {
+		...e,
+		tool_result: {
+			...e.tool_result,
+			text: a(e.tool_result.text, ...t)
+		}
+	} : e : {
+		...e,
+		error: a(e.error, ...t)
 	};
 }
-function u() {
+function f(e, t, n) {
+	let r = d(e, n);
+	if (r.ok && t && r.tool_result && r.tools.includes(t.toolCall.name)) {
+		let e = t.interpret(r.tool_result);
+		if (e) return {
+			ok: !1,
+			error: e,
+			error_kind: "credentials"
+		};
+	}
+	return r;
+}
+function p() {
 	if (t().backend.kind === "local") {
 		let { host: e, apiKey: t } = r();
 		return {
@@ -46,15 +74,15 @@ function u() {
 	};
 	throw Error("OAuth authorization requires a reachable local backend.");
 }
-function d() {
-	let { host: t, apiKey: n } = u();
+function m() {
+	let { host: t, apiKey: n } = p();
 	return new e({
 		host: t,
 		...n ? { apiKey: n } : {},
-		timeout: o * 1e3 + 5e3
+		timeout: s * 1e3 + 5e3
 	});
 }
-function f(e) {
+function h(e) {
 	return e.status === "succeeded" ? {
 		ok: !0,
 		tools: e.tools ?? [],
@@ -66,9 +94,9 @@ function f(e) {
 		error_kind: e.error_kind || "unknown"
 	};
 }
-var p = (e) => new Promise((t) => {
+var g = (e) => new Promise((t) => {
 	window.setTimeout(t, e);
-}), m = class n {
+}), _ = class n {
 	static async testServer(n) {
 		if (t().backend.kind === "cloud") return {
 			ok: !0,
@@ -79,22 +107,14 @@ var p = (e) => new Promise((t) => {
 			...s ? { apiKey: s } : {}
 		});
 		try {
-			let e = await l(n), t = await c.testServer(e);
-			if (t.ok && a && t.tool_result) {
-				let e = a.interpret(t.tool_result);
-				if (e) return {
-					ok: !1,
-					error: e,
-					error_kind: "credentials"
-				};
-			}
-			return t;
+			let { request: e, substituted: t } = await u(n);
+			return f(await c.testServer(e), a, [t, n]);
 		} finally {
 			c.close();
 		}
 	}
 	static async startOAuth(e) {
-		let t = d();
+		let t = m();
 		try {
 			return await n.startOAuthWithClient(t, e);
 		} finally {
@@ -102,7 +122,7 @@ var p = (e) => new Promise((t) => {
 		}
 	}
 	static async getOAuthStatus(e) {
-		let t = d();
+		let t = m();
 		try {
 			return await n.getOAuthStatusWithClient(t, e);
 		} finally {
@@ -110,7 +130,7 @@ var p = (e) => new Promise((t) => {
 		}
 	}
 	static async submitOAuthCallback(e, t) {
-		let r = d();
+		let r = m();
 		try {
 			return await n.submitOAuthCallbackWithClient(r, e, t);
 		} finally {
@@ -118,33 +138,33 @@ var p = (e) => new Promise((t) => {
 		}
 	}
 	static async authorizeOAuth(e) {
-		let t = window.open("about:blank", "_blank"), r = d();
+		let t = i(e), r = (n) => f(n, t, [e]), a = window.open("about:blank", "_blank"), o = m();
 		try {
-			let i = await n.startOAuthWithClient(r, e);
-			if (!i.ok || !i.job_id || !i.authorization_url) return t?.close(), {
+			let t = await n.startOAuthWithClient(o, e);
+			if (!t.ok || !t.job_id || !t.authorization_url) return a?.close(), r({
 				ok: !1,
-				error: i.error || "Could not start OAuth authorization",
-				error_kind: i.error_kind || "unknown"
-			};
-			let a = await n.getOAuthStatusWithClient(r, i.job_id);
+				error: t.error || "Could not start OAuth authorization",
+				error_kind: t.error_kind || "unknown"
+			});
+			let i = await n.getOAuthStatusWithClient(o, t.job_id);
 			for (let e = 0; e < 20; e += 1) {
-				if (a.status === "succeeded" || a.status === "failed") return t?.close(), f(a);
-				if (a.callback_ready) break;
-				await p(250), a = await n.getOAuthStatusWithClient(r, i.job_id);
+				if (i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
+				if (i.callback_ready) break;
+				await g(250), i = await n.getOAuthStatusWithClient(o, t.job_id);
 			}
-			t && (t.location.href = i.authorization_url);
-			for (let e = 0; e < o; e += 1) if (await p(1e3), a = await n.getOAuthStatusWithClient(r, i.job_id), a.status === "succeeded" || a.status === "failed") return t?.close(), f(a);
+			a && (a.location.href = t.authorization_url);
+			for (let e = 0; e < s; e += 1) if (await g(1e3), i = await n.getOAuthStatusWithClient(o, t.job_id), i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
 			return {
 				ok: !1,
 				error: "OAuth authorization timed out",
 				error_kind: "timeout"
 			};
 		} finally {
-			r.close();
+			o.close();
 		}
 	}
 	static async startOAuthWithClient(e, t) {
-		let n = await l(t);
+		let { request: n } = await u(t);
 		return e.startOAuth(n);
 	}
 	static async getOAuthStatusWithClient(e, t) {
@@ -155,6 +175,6 @@ var p = (e) => new Promise((t) => {
 	}
 };
 //#endregion
-export { m as default };
+export { _ as default };
 
 //# sourceMappingURL=mcp-service.api.js.map

package/dist/api/mcp-service/mcp-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { MCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport { getCredentialValidationForServer } from \"#/utils/mcp-credential-validation\";\nimport type { MCPAuthCredential } from \"#/types/mcp-auth\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\ntype MCPTestServer = {\n  transport?: \"stdio\" | \"http\" | \"sse\";\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  auth?: MCPAuthCredential;\n};\n\ninterface ExtendedMCPTestRequest {\n  server: MCPTestServer;\n  name?: string;\n  timeout?: number;\n  tool_call?: {\n    name: string;\n    arguments: Record<string, unknown>;\n  };\n}\n\nfunction toMcpServer(server: MCPServerConfig): MCPTestServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(\n  server: MCPServerConfig,\n): Promise<ExtendedMCPTestRequest> {\n  const validation = getCredentialValidationForServer(server);\n  const serverSpec = toMcpServer(\n    await substituteRedactedMcpCredentials(server),\n  );\n  const timeout = getMcpTestTimeout(server);\n  return {\n    server: serverSpec,\n    ...(server.name ? { name: server.name } : {}),\n    ...(timeout !== undefined ? { timeout } : {}),\n    ...(validation ? { tool_call: validation.toolCall } : {}),\n  };\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const request = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      if (result.ok && validation && result.tool_result) {\n        const credentialError = validation.interpret(result.tool_result);\n        if (credentialError) {\n          return {\n            ok: false,\n            error: credentialError,\n            error_kind: \"credentials\",\n          };\n        }\n      }\n      return result;\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return {\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        };\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return oauthStatusToTestResponse(status);\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return oauthStatusToTestResponse(status);\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const request = await buildMcpTestRequest(server);\n    return client.startOAuth(request as MCPTestRequest);\n  }\n\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return client.getOAuthStatus(jobId);\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return client.submitOAuthCallback(jobId, { callback_url: callbackUrl });\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;;;;AAiBA,IAAM,IAAiC;AAsBvC,SAAS,EAAY,GAAwC;AAU3D,QATI,EAAO,SAAS,UACX;EACL,WAAW;EACX,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,MAAM;EAChD,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,IAAI,CAAC,SAAS,KAAK,EAAE,KAAK,EAAO,KAAK;EAC5D,GAEI;EACL,WAAW,EAAO,SAAS,QAAQ,QAAQ;EAC3C,KAAK,EAAO;EACZ,GAAI,EAAO,WACT,OAAO,KAAK,EAAO,QAAQ,CAAC,SAAS,KAAK,EAAE,SAAS,EAAO,SAAS;EACvE,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;EAC7C;;AAGH,SAAS,EAAkB,GAA6C;AAEtE,QADI,EAAO,MAAM,aAAa,WACvB,IADwC,EAAO;;AAIxD,eAAe,EACb,GACiC;CACjC,IAAM,IAAa,EAAiC,EAAO,EACrD,IAAa,EACjB,MAAM,EAAiC,EAAO,CAC/C,EACK,IAAU,EAAkB,EAAO;AACzC,QAAO;EACL,QAAQ;EACR,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;EAC5C,GAAI,MAAY,KAAA,IAA0B,EAAE,GAAhB,EAAE,YAAS;EACvC,GAAI,IAAa,EAAE,WAAW,EAAW,UAAU,GAAG,EAAE;EACzD;;AAGH,SAAS,IAAwD;AAE/D,KADe,GAAkB,CAAC,QACvB,SAAS,SAAS;EAC3B,IAAM,EAAE,SAAM,cAAW,GAA6B;AACtD,SAAO;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG;;CAGhD,IAAM,IAAe,GAAuB,CAAC,MAC1C,MAAY,EAAQ,SAAS,WAAW,EAAQ,KAClD;AACD,KAAI,EACF,QAAO;EACL,MAAM,EAAa,KAAK,QAAQ,QAAQ,GAAG;EAC3C,GAAI,EAAa,SAAS,EAAE,QAAQ,EAAa,QAAQ,GAAG,EAAE;EAC/D;AAEH,OAAU,MAAM,0DAA0D;;AAG5E,SAAS,IAAkC;CACzC,IAAM,EAAE,SAAM,cAAW,GAAoB;AAC7C,QAAO,IAAI,EAAU;EACnB;EACA,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;EAC5B,SAAS,IAAiC,MAAO;EAClD,CAAC;;AAGJ,SAAS,EACP,GACyB;AAazB,QAZI,EAAO,WAAW,cACb;EACL,IAAI;EACJ,OAAO,EAAO,SAAS,EAAE;EACzB,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,aACrB;EACD,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,aACrB;EACF,GAEI;EACL,IAAI;EACJ,OAAO,EAAO,SAAS;EACvB,YAAY,EAAO,cAAc;EAClC;;AAGH,IAAM,KAAS,MACb,IAAI,SAAe,MAAY;AAC7B,QAAO,WAAW,GAAS,EAAG;EAC9B,EAEE,IAAN,MAAM,EAAW;CACf,aAAa,WACX,GACkC;AAWlC,MAAI,GAAkB,CAAC,QAAQ,SAAS,QACtC,QAAO;GAAE,IAAI;GAAM,OAAO,EAAE;GAAE;EAEhC,IAAM,IAAa,EAAiC,EAAO,EACrD,EAAE,SAAM,cAAW,GAA6B,EAChD,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG,CAAC;AACrE,MAAI;GACF,IAAM,IAAU,MAAM,EAAoB,EAAO,EAC3C,IAAU,MAAM,EAAO,WAC3B,EACD;AACD,OAAI,EAAO,MAAM,KAAc,EAAO,aAAa;IACjD,IAAM,IAAkB,EAAW,UAAU,EAAO,YAAY;AAChE,QAAI,EACF,QAAO;KACL,IAAI;KACJ,OAAO;KACP,YAAY;KACb;;AAGL,UAAO;YACC;AACR,KAAO,OAAO;;;CAIlB,aAAa,WACX,GACgC;EAChC,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,qBAAqB,GAAQ,EAAO;YACpD;AACR,KAAO,OAAO;;;CAIlB,aAAa,eAAe,GAAgD;EAC1E,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,yBAAyB,GAAQ,EAAM;YACvD;AACR,KAAO,OAAO;;;CAIlB,aAAa,oBACX,GACA,GACiC;EACjC,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,8BACtB,GACA,GACA,EACD;YACO;AACR,KAAO,OAAO;;;CAIlB,aAAa,eACX,GACkC;EAClC,IAAM,IAAQ,OAAO,KAAK,eAAe,SAAS,EAC5C,IAAS,GAAsB;AACrC,MAAI;GACF,IAAM,IAAQ,MAAM,EAAW,qBAAqB,GAAQ,EAAO;AACnE,OAAI,CAAC,EAAM,MAAM,CAAC,EAAM,UAAU,CAAC,EAAM,kBAEvC,QADA,GAAO,OAAO,EACP;IACL,IAAI;IACJ,OAAO,EAAM,SAAS;IACtB,YAAY,EAAM,cAAc;IACjC;GAGH,IAAI,IAAS,MAAM,EAAW,yBAC5B,GACA,EAAM,OACP;AACD,QAAK,IAAI,IAAU,GAAG,IAAU,IAAI,KAAW,GAAG;AAChD,QAAI,EAAO,WAAW,eAAe,EAAO,WAAW,SAErD,QADA,GAAO,OAAO,EACP,EAA0B,EAAO;AAE1C,QAAI,EAAO,eAAgB;AAE3B,IADA,MAAM,EAAM,IAAI,EAChB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,OACP;;AAGH,GAAI,MACF,EAAM,SAAS,OAAO,EAAM;AAG9B,QACE,IAAI,IAAU,GACd,IAAU,GACV,KAAW,EAOX,KALA,MAAM,EAAM,IAAK,EACjB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,OACP,EACG,EAAO,WAAW,eAAe,EAAO,WAAW,SAErD,QADA,GAAO,OAAO,EACP,EAA0B,EAAO;AAI5C,UAAO;IACL,IAAI;IACJ,OAAO;IACP,YAAY;IACb;YACO;AACR,KAAO,OAAO;;;CAIlB,aAAqB,qBACnB,GACA,GACgC;EAChC,IAAM,IAAU,MAAM,EAAoB,EAAO;AACjD,SAAO,EAAO,WAAW,EAA0B;;CAGrD,aAAqB,yBACnB,GACA,GACiC;AACjC,SAAO,EAAO,eAAe,EAAM;;CAGrC,aAAqB,8BACnB,GACA,GACA,GACiC;AACjC,SAAO,EAAO,oBAAoB,GAAO,EAAE,cAAc,GAAa,CAAC"}
+{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { MCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n  getCredentialValidationForServer,\n  type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type { MCPAuthCredential } from \"#/types/mcp-auth\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\ntype MCPTestServer = {\n  transport?: \"stdio\" | \"http\" | \"sse\";\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  auth?: MCPAuthCredential;\n};\n\ninterface ExtendedMCPTestRequest {\n  server: MCPTestServer;\n  name?: string;\n  timeout?: number;\n  tool_call?: {\n    name: string;\n    arguments: Record<string, unknown>;\n  };\n}\n\nfunction toMcpServer(server: MCPServerConfig): MCPTestServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n  request: ExtendedMCPTestRequest;\n  substituted: MCPServerConfig;\n}> {\n  const validation = getCredentialValidationForServer(server);\n  const substituted = await substituteRedactedMcpCredentials(server);\n  const serverSpec = toMcpServer(substituted);\n  const timeout = getMcpTestTimeout(server);\n  return {\n    request: {\n      server: serverSpec,\n      ...(server.name ? { name: server.name } : {}),\n      ...(timeout !== undefined ? { timeout } : {}),\n      ...(validation ? { tool_call: validation.toolCall } : {}),\n    },\n    substituted,\n  };\n}\n\nfunction redactMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  if (!result.ok) {\n    return {\n      ...result,\n      error: redactMcpSecrets(result.error, ...redactionSources),\n    };\n  }\n  if (result.tool_result) {\n    return {\n      ...result,\n      tool_result: {\n        ...result.tool_result,\n        text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n      },\n    };\n  }\n  return result;\n}\n\n/**\n * Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n */\nfunction finalizeMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  validation: CredentialValidation | undefined,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  const redacted = redactMcpTestResponse(result, redactionSources);\n  if (\n    redacted.ok &&\n    validation &&\n    redacted.tool_result &&\n    redacted.tools.includes(validation.toolCall.name)\n  ) {\n    const credentialError = validation.interpret(redacted.tool_result);\n    if (credentialError) {\n      return {\n        ok: false,\n        error: credentialError,\n        error_kind: \"credentials\",\n      };\n    }\n  }\n  return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const { request, substituted } = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      // Redact against both config forms: `server` may hold fresh plaintext\n      // input, `substituted` the stored (encrypted) round-trip values.\n      return finalizeMcpTestResponse(result, validation, [substituted, server]);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const validation = getCredentialValidationForServer(server);\n    const finalize = (result: ExtendedMCPTestResponse) =>\n      finalizeMcpTestResponse(result, validation, [server]);\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return finalize({\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        });\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const { request } = await buildMcpTestRequest(server);\n    return client.startOAuth(request as MCPTestRequest);\n  }\n\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return client.getOAuthStatus(jobId);\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return client.submitOAuthCallback(jobId, { callback_url: callbackUrl });\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;;;;;AAqBA,IAAM,IAAiC;AAsBvC,SAAS,EAAY,GAAwC;AAU3D,QATI,EAAO,SAAS,UACX;EACL,WAAW;EACX,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,MAAM;EAChD,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,IAAI,CAAC,SAAS,KAAK,EAAE,KAAK,EAAO,KAAK;EAC5D,GAEI;EACL,WAAW,EAAO,SAAS,QAAQ,QAAQ;EAC3C,KAAK,EAAO;EACZ,GAAI,EAAO,WACT,OAAO,KAAK,EAAO,QAAQ,CAAC,SAAS,KAAK,EAAE,SAAS,EAAO,SAAS;EACvE,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;EAC7C;;AAGH,SAAS,EAAkB,GAA6C;AAEtE,QADI,EAAO,MAAM,aAAa,WACvB,IADwC,EAAO;;AAIxD,eAAe,EAAoB,GAGhC;CACD,IAAM,IAAa,EAAiC,EAAO,EACrD,IAAc,MAAM,EAAiC,EAAO,EAC5D,IAAa,EAAY,EAAY,EACrC,IAAU,EAAkB,EAAO;AACzC,QAAO;EACL,SAAS;GACP,QAAQ;GACR,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;GAC5C,GAAI,MAAY,KAAA,IAA0B,EAAE,GAAhB,EAAE,YAAS;GACvC,GAAI,IAAa,EAAE,WAAW,EAAW,UAAU,GAAG,EAAE;GACzD;EACD;EACD;;AAGH,SAAS,EACP,GACA,GACyB;AAgBzB,QAfK,EAAO,KAMR,EAAO,cACF;EACL,GAAG;EACH,aAAa;GACX,GAAG,EAAO;GACV,MAAM,EAAiB,EAAO,YAAY,MAAM,GAAG,EAAiB;GACrE;EACF,GAEI,IAdE;EACL,GAAG;EACH,OAAO,EAAiB,EAAO,OAAO,GAAG,EAAiB;EAC3D;;AAwBL,SAAS,EACP,GACA,GACA,GACyB;CACzB,IAAM,IAAW,EAAsB,GAAQ,EAAiB;AAChE,KACE,EAAS,MACT,KACA,EAAS,eACT,EAAS,MAAM,SAAS,EAAW,SAAS,KAAK,EACjD;EACA,IAAM,IAAkB,EAAW,UAAU,EAAS,YAAY;AAClE,MAAI,EACF,QAAO;GACL,IAAI;GACJ,OAAO;GACP,YAAY;GACb;;AAGL,QAAO;;AAGT,SAAS,IAAwD;AAE/D,KADe,GAAkB,CAAC,QACvB,SAAS,SAAS;EAC3B,IAAM,EAAE,SAAM,cAAW,GAA6B;AACtD,SAAO;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG;;CAGhD,IAAM,IAAe,GAAuB,CAAC,MAC1C,MAAY,EAAQ,SAAS,WAAW,EAAQ,KAClD;AACD,KAAI,EACF,QAAO;EACL,MAAM,EAAa,KAAK,QAAQ,QAAQ,GAAG;EAC3C,GAAI,EAAa,SAAS,EAAE,QAAQ,EAAa,QAAQ,GAAG,EAAE;EAC/D;AAEH,OAAU,MAAM,0DAA0D;;AAG5E,SAAS,IAAkC;CACzC,IAAM,EAAE,SAAM,cAAW,GAAoB;AAC7C,QAAO,IAAI,EAAU;EACnB;EACA,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;EAC5B,SAAS,IAAiC,MAAO;EAClD,CAAC;;AAGJ,SAAS,EACP,GACyB;AAazB,QAZI,EAAO,WAAW,cACb;EACL,IAAI;EACJ,OAAO,EAAO,SAAS,EAAE;EACzB,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,aACrB;EACD,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,aACrB;EACF,GAEI;EACL,IAAI;EACJ,OAAO,EAAO,SAAS;EACvB,YAAY,EAAO,cAAc;EAClC;;AAGH,IAAM,KAAS,MACb,IAAI,SAAe,MAAY;AAC7B,QAAO,WAAW,GAAS,EAAG;EAC9B,EAEE,IAAN,MAAM,EAAW;CACf,aAAa,WACX,GACkC;AAWlC,MAAI,GAAkB,CAAC,QAAQ,SAAS,QACtC,QAAO;GAAE,IAAI;GAAM,OAAO,EAAE;GAAE;EAEhC,IAAM,IAAa,EAAiC,EAAO,EACrD,EAAE,SAAM,cAAW,GAA6B,EAChD,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG,CAAC;AACrE,MAAI;GACF,IAAM,EAAE,YAAS,mBAAgB,MAAM,EAAoB,EAAO;AAMlE,UAAO,EAAwB,MALT,EAAO,WAC3B,EACD,EAGsC,GAAY,CAAC,GAAa,EAAO,CAAC;YACjE;AACR,KAAO,OAAO;;;CAIlB,aAAa,WACX,GACgC;EAChC,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,qBAAqB,GAAQ,EAAO;YACpD;AACR,KAAO,OAAO;;;CAIlB,aAAa,eAAe,GAAgD;EAC1E,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,yBAAyB,GAAQ,EAAM;YACvD;AACR,KAAO,OAAO;;;CAIlB,aAAa,oBACX,GACA,GACiC;EACjC,IAAM,IAAS,GAAsB;AACrC,MAAI;AACF,UAAO,MAAM,EAAW,8BACtB,GACA,GACA,EACD;YACO;AACR,KAAO,OAAO;;;CAIlB,aAAa,eACX,GACkC;EAClC,IAAM,IAAa,EAAiC,EAAO,EACrD,KAAY,MAChB,EAAwB,GAAQ,GAAY,CAAC,EAAO,CAAC,EACjD,IAAQ,OAAO,KAAK,eAAe,SAAS,EAC5C,IAAS,GAAsB;AACrC,MAAI;GACF,IAAM,IAAQ,MAAM,EAAW,qBAAqB,GAAQ,EAAO;AACnE,OAAI,CAAC,EAAM,MAAM,CAAC,EAAM,UAAU,CAAC,EAAM,kBAEvC,QADA,GAAO,OAAO,EACP,EAAS;IACd,IAAI;IACJ,OAAO,EAAM,SAAS;IACtB,YAAY,EAAM,cAAc;IACjC,CAAC;GAGJ,IAAI,IAAS,MAAM,EAAW,yBAC5B,GACA,EAAM,OACP;AACD,QAAK,IAAI,IAAU,GAAG,IAAU,IAAI,KAAW,GAAG;AAChD,QAAI,EAAO,WAAW,eAAe,EAAO,WAAW,SAErD,QADA,GAAO,OAAO,EACP,EAAS,EAA0B,EAAO,CAAC;AAEpD,QAAI,EAAO,eAAgB;AAE3B,IADA,MAAM,EAAM,IAAI,EAChB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,OACP;;AAGH,GAAI,MACF,EAAM,SAAS,OAAO,EAAM;AAG9B,QACE,IAAI,IAAU,GACd,IAAU,GACV,KAAW,EAOX,KALA,MAAM,EAAM,IAAK,EACjB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,OACP,EACG,EAAO,WAAW,eAAe,EAAO,WAAW,SAErD,QADA,GAAO,OAAO,EACP,EAAS,EAA0B,EAAO,CAAC;AAItD,UAAO;IACL,IAAI;IACJ,OAAO;IACP,YAAY;IACb;YACO;AACR,KAAO,OAAO;;;CAIlB,aAAqB,qBACnB,GACA,GACgC;EAChC,IAAM,EAAE,eAAY,MAAM,EAAoB,EAAO;AACrD,SAAO,EAAO,WAAW,EAA0B;;CAGrD,aAAqB,yBACnB,GACA,GACiC;AACjC,SAAO,EAAO,eAAe,EAAM;;CAGrC,aAAqB,8BACnB,GACA,GACA,GACiC;AACjC,SAAO,EAAO,oBAAoB,GAAO,EAAE,cAAc,GAAa,CAAC"}

package/dist/api/plugins-management-service.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugins-management-service.cjs","names":[],"sources":["../../src/api/plugins-management-service.ts"],"sourcesContent":["import { PluginsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\n\n/**\n * An installed plugin, as returned by the agent-server management router\n * (`GET /api/plugins/installed`). Matches the typescript-client\n * `InstalledPluginInfo`.\n */\nexport interface InstalledPluginInfo {\n  name: string;\n  version: string;\n  description: string | null;\n  enabled: boolean;\n  source: string;\n  resolved_ref?: string | null;\n  repo_path?: string | null;\n  installed_at: string;\n  install_path: string;\n}\n\n/** Coordinates for installing a plugin from a git source or local path. */\nexport interface InstallPluginRequest {\n  source: string;\n  ref?: string | null;\n  repo_path?: string | null;\n  force?: boolean;\n}\n\n/**\n * The slice of the typescript-client `PluginsClient` this service drives. The\n * installed `@openhands/typescript-client` package does not yet export these\n * management methods (they ship in typescript-client PRs #222/#223); narrowing\n * to this local interface keeps `vitest` (types stripped) and `eslint` green\n * until the client is republished, at which point the cast below can be dropped.\n */\ninterface PluginsManagementClient {\n  listInstalledPlugins(): Promise<{ plugins: InstalledPluginInfo[] }>;\n  installPlugin(request: InstallPluginRequest): Promise<InstalledPluginInfo>;\n  setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }>;\n  uninstallPlugin(name: string): Promise<{ message: string }>;\n  refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }>;\n}\n\nfunction isCloudBackend(): boolean {\n  return getActiveBackend().backend.kind === \"cloud\";\n}\n\nfunction getManagementClient(): PluginsManagementClient {\n  return new PluginsClient(\n    getAgentServerClientOptions(),\n  ) as unknown as PluginsManagementClient;\n}\n\n/**\n * Front-end management layer for installed plugins: list / install / enable /\n * disable / uninstall / refresh. Kept separate from the read-only catalog\n * service (`plugins-service.ts`), exactly as skills separate the marketplace\n * catalog from install actions.\n *\n * Local backend only for now (per Appendix C Q5): installed plugins live on the\n * local agent-server's `~/.openhands/plugins/installed/`. A cloud backend has no\n * per-user installed store yet, so reads return an empty list and mutating\n * actions throw (the UI also disables them on cloud).\n */\nclass PluginsManagementService {\n  static async listInstalledPlugins(): Promise<InstalledPluginInfo[]> {\n    if (isCloudBackend()) {\n      return [];\n    }\n\n    try {\n      const response = await getManagementClient().listInstalledPlugins();\n      return response.plugins ?? [];\n    } catch {\n      // Agent-server may predate the plugins router or be unreachable; surface\n      // an empty list rather than throwing (mirrors the catalog service).\n      return [];\n    }\n  }\n\n  static async installPlugin(\n    request: InstallPluginRequest,\n  ): Promise<InstalledPluginInfo> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Installing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().installPlugin(request);\n  }\n\n  static async setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Enabling and disabling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().setPluginEnabled(name, enabled);\n  }\n\n  static async uninstallPlugin(name: string): Promise<{ message: string }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Uninstalling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().uninstallPlugin(name);\n  }\n\n  static async refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Refreshing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().refreshPlugin(name);\n  }\n}\n\nexport default PluginsManagementService;\n"],"mappings":"2TAiDA,SAAS,GAA0B,CACjC,OAAO,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAG7C,SAAS,GAA+C,CACtD,OAAO,IAAI,EAAA,cACT,EAAA,6BAA6B,CAC9B,CAcH,IAAM,EAAN,KAA+B,CAC7B,aAAa,sBAAuD,CAClE,GAAI,GAAgB,CAClB,MAAO,EAAE,CAGX,GAAI,CAEF,OAAO,MADgB,GAAqB,CAAC,sBAAsB,EACnD,SAAW,EAAE,MACvB,CAGN,MAAO,EAAE,EAIb,aAAa,cACX,EAC8B,CAC9B,GAAI,GAAgB,CAClB,MAAU,MACR,2DACD,CAEH,OAAO,GAAqB,CAAC,cAAc,EAAQ,CAGrD,aAAa,iBACX,EACA,EAC6C,CAC7C,GAAI,GAAgB,CAClB,MAAU,MACR,uEACD,CAEH,OAAO,GAAqB,CAAC,iBAAiB,EAAM,EAAQ,CAG9D,aAAa,gBAAgB,EAA4C,CACvE,GAAI,GAAgB,CAClB,MAAU,MACR,6DACD,CAEH,OAAO,GAAqB,CAAC,gBAAgB,EAAK,CAGpD,aAAa,cACX,EAC2D,CAC3D,GAAI,GAAgB,CAClB,MAAU,MACR,2DACD,CAEH,OAAO,GAAqB,CAAC,cAAc,EAAK"}
+{"version":3,"file":"plugins-management-service.cjs","names":[],"sources":["../../src/api/plugins-management-service.ts"],"sourcesContent":["import { PluginsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport type { PluginBundledSkill } from \"./plugins-service\";\n\n/**\n * An installed plugin, as returned by the agent-server management router\n * (`GET /api/plugins/installed`). Matches the typescript-client\n * `InstalledPluginInfo`. The contents fields (`skills`, `files`, relative to\n * `install_path`) are absent on older agent-servers and null when the\n * installed plugin directory failed to load.\n */\nexport interface InstalledPluginInfo {\n  name: string;\n  version: string;\n  description: string | null;\n  enabled: boolean;\n  source: string;\n  resolved_ref?: string | null;\n  repo_path?: string | null;\n  installed_at: string;\n  install_path: string;\n  skills?: PluginBundledSkill[] | null;\n  files?: string[] | null;\n}\n\n/** Coordinates for installing a plugin from a git source or local path. */\nexport interface InstallPluginRequest {\n  source: string;\n  ref?: string | null;\n  repo_path?: string | null;\n  force?: boolean;\n}\n\n/**\n * The slice of the typescript-client `PluginsClient` this service drives. The\n * installed `@openhands/typescript-client` package does not yet export these\n * management methods (they ship in typescript-client PRs #222/#223); narrowing\n * to this local interface keeps `vitest` (types stripped) and `eslint` green\n * until the client is republished, at which point the cast below can be dropped.\n */\ninterface PluginsManagementClient {\n  listInstalledPlugins(): Promise<{ plugins: InstalledPluginInfo[] }>;\n  installPlugin(request: InstallPluginRequest): Promise<InstalledPluginInfo>;\n  setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }>;\n  uninstallPlugin(name: string): Promise<{ message: string }>;\n  refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }>;\n}\n\nfunction isCloudBackend(): boolean {\n  return getActiveBackend().backend.kind === \"cloud\";\n}\n\nfunction getManagementClient(): PluginsManagementClient {\n  return new PluginsClient(\n    getAgentServerClientOptions(),\n  ) as unknown as PluginsManagementClient;\n}\n\n/**\n * Front-end management layer for installed plugins: list / install / enable /\n * disable / uninstall / refresh. Kept separate from the read-only catalog\n * service (`plugins-service.ts`), exactly as skills separate the marketplace\n * catalog from install actions.\n *\n * Local backend only for now (per Appendix C Q5): installed plugins live on the\n * local agent-server's `~/.openhands/plugins/installed/`. A cloud backend has no\n * per-user installed store yet, so reads return an empty list and mutating\n * actions throw (the UI also disables them on cloud).\n */\nclass PluginsManagementService {\n  static async listInstalledPlugins(): Promise<InstalledPluginInfo[]> {\n    if (isCloudBackend()) {\n      return [];\n    }\n\n    try {\n      const response = await getManagementClient().listInstalledPlugins();\n      return response.plugins ?? [];\n    } catch {\n      // Agent-server may predate the plugins router or be unreachable; surface\n      // an empty list rather than throwing (mirrors the catalog service).\n      return [];\n    }\n  }\n\n  static async installPlugin(\n    request: InstallPluginRequest,\n  ): Promise<InstalledPluginInfo> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Installing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().installPlugin(request);\n  }\n\n  static async setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Enabling and disabling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().setPluginEnabled(name, enabled);\n  }\n\n  static async uninstallPlugin(name: string): Promise<{ message: string }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Uninstalling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().uninstallPlugin(name);\n  }\n\n  static async refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Refreshing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().refreshPlugin(name);\n  }\n}\n\nexport default PluginsManagementService;\n"],"mappings":"2TAsDA,SAAS,GAA0B,CACjC,OAAO,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAG7C,SAAS,GAA+C,CACtD,OAAO,IAAI,EAAA,cACT,EAAA,6BAA6B,CAC9B,CAcH,IAAM,EAAN,KAA+B,CAC7B,aAAa,sBAAuD,CAClE,GAAI,GAAgB,CAClB,MAAO,EAAE,CAGX,GAAI,CAEF,OAAO,MADgB,GAAqB,CAAC,sBAAsB,EACnD,SAAW,EAAE,MACvB,CAGN,MAAO,EAAE,EAIb,aAAa,cACX,EAC8B,CAC9B,GAAI,GAAgB,CAClB,MAAU,MACR,2DACD,CAEH,OAAO,GAAqB,CAAC,cAAc,EAAQ,CAGrD,aAAa,iBACX,EACA,EAC6C,CAC7C,GAAI,GAAgB,CAClB,MAAU,MACR,uEACD,CAEH,OAAO,GAAqB,CAAC,iBAAiB,EAAM,EAAQ,CAG9D,aAAa,gBAAgB,EAA4C,CACvE,GAAI,GAAgB,CAClB,MAAU,MACR,6DACD,CAEH,OAAO,GAAqB,CAAC,gBAAgB,EAAK,CAGpD,aAAa,cACX,EAC2D,CAC3D,GAAI,GAAgB,CAClB,MAAU,MACR,2DACD,CAEH,OAAO,GAAqB,CAAC,cAAc,EAAK"}

package/dist/api/plugins-management-service.d.ts

@@ -1,7 +1,10 @@
+import type { PluginBundledSkill } from "./plugins-service";
 /**
  * An installed plugin, as returned by the agent-server management router
  * (`GET /api/plugins/installed`). Matches the typescript-client
- * `InstalledPluginInfo`.
+ * `InstalledPluginInfo`. The contents fields (`skills`, `files`, relative to
+ * `install_path`) are absent on older agent-servers and null when the
+ * installed plugin directory failed to load.
  */
 export interface InstalledPluginInfo {
     name: string;
@@ -13,6 +16,8 @@ export interface InstalledPluginInfo {
     repo_path?: string | null;
     installed_at: string;
     install_path: string;
+    skills?: PluginBundledSkill[] | null;
+    files?: string[] | null;
 }
 /** Coordinates for installing a plugin from a git source or local path. */
 export interface InstallPluginRequest {

package/dist/api/plugins-management-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugins-management-service.js","names":[],"sources":["../../src/api/plugins-management-service.ts"],"sourcesContent":["import { PluginsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\n\n/**\n * An installed plugin, as returned by the agent-server management router\n * (`GET /api/plugins/installed`). Matches the typescript-client\n * `InstalledPluginInfo`.\n */\nexport interface InstalledPluginInfo {\n  name: string;\n  version: string;\n  description: string | null;\n  enabled: boolean;\n  source: string;\n  resolved_ref?: string | null;\n  repo_path?: string | null;\n  installed_at: string;\n  install_path: string;\n}\n\n/** Coordinates for installing a plugin from a git source or local path. */\nexport interface InstallPluginRequest {\n  source: string;\n  ref?: string | null;\n  repo_path?: string | null;\n  force?: boolean;\n}\n\n/**\n * The slice of the typescript-client `PluginsClient` this service drives. The\n * installed `@openhands/typescript-client` package does not yet export these\n * management methods (they ship in typescript-client PRs #222/#223); narrowing\n * to this local interface keeps `vitest` (types stripped) and `eslint` green\n * until the client is republished, at which point the cast below can be dropped.\n */\ninterface PluginsManagementClient {\n  listInstalledPlugins(): Promise<{ plugins: InstalledPluginInfo[] }>;\n  installPlugin(request: InstallPluginRequest): Promise<InstalledPluginInfo>;\n  setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }>;\n  uninstallPlugin(name: string): Promise<{ message: string }>;\n  refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }>;\n}\n\nfunction isCloudBackend(): boolean {\n  return getActiveBackend().backend.kind === \"cloud\";\n}\n\nfunction getManagementClient(): PluginsManagementClient {\n  return new PluginsClient(\n    getAgentServerClientOptions(),\n  ) as unknown as PluginsManagementClient;\n}\n\n/**\n * Front-end management layer for installed plugins: list / install / enable /\n * disable / uninstall / refresh. Kept separate from the read-only catalog\n * service (`plugins-service.ts`), exactly as skills separate the marketplace\n * catalog from install actions.\n *\n * Local backend only for now (per Appendix C Q5): installed plugins live on the\n * local agent-server's `~/.openhands/plugins/installed/`. A cloud backend has no\n * per-user installed store yet, so reads return an empty list and mutating\n * actions throw (the UI also disables them on cloud).\n */\nclass PluginsManagementService {\n  static async listInstalledPlugins(): Promise<InstalledPluginInfo[]> {\n    if (isCloudBackend()) {\n      return [];\n    }\n\n    try {\n      const response = await getManagementClient().listInstalledPlugins();\n      return response.plugins ?? [];\n    } catch {\n      // Agent-server may predate the plugins router or be unreachable; surface\n      // an empty list rather than throwing (mirrors the catalog service).\n      return [];\n    }\n  }\n\n  static async installPlugin(\n    request: InstallPluginRequest,\n  ): Promise<InstalledPluginInfo> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Installing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().installPlugin(request);\n  }\n\n  static async setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Enabling and disabling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().setPluginEnabled(name, enabled);\n  }\n\n  static async uninstallPlugin(name: string): Promise<{ message: string }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Uninstalling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().uninstallPlugin(name);\n  }\n\n  static async refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Refreshing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().refreshPlugin(name);\n  }\n}\n\nexport default PluginsManagementService;\n"],"mappings":";;;;;AAiDA,SAAS,IAA0B;AACjC,QAAO,GAAkB,CAAC,QAAQ,SAAS;;AAG7C,SAAS,IAA+C;AACtD,QAAO,IAAI,EACT,GAA6B,CAC9B;;AAcH,IAAM,IAAN,MAA+B;CAC7B,aAAa,uBAAuD;AAClE,MAAI,GAAgB,CAClB,QAAO,EAAE;AAGX,MAAI;AAEF,WAAO,MADgB,GAAqB,CAAC,sBAAsB,EACnD,WAAW,EAAE;UACvB;AAGN,UAAO,EAAE;;;CAIb,aAAa,cACX,GAC8B;AAC9B,MAAI,GAAgB,CAClB,OAAU,MACR,2DACD;AAEH,SAAO,GAAqB,CAAC,cAAc,EAAQ;;CAGrD,aAAa,iBACX,GACA,GAC6C;AAC7C,MAAI,GAAgB,CAClB,OAAU,MACR,uEACD;AAEH,SAAO,GAAqB,CAAC,iBAAiB,GAAM,EAAQ;;CAG9D,aAAa,gBAAgB,GAA4C;AACvE,MAAI,GAAgB,CAClB,OAAU,MACR,6DACD;AAEH,SAAO,GAAqB,CAAC,gBAAgB,EAAK;;CAGpD,aAAa,cACX,GAC2D;AAC3D,MAAI,GAAgB,CAClB,OAAU,MACR,2DACD;AAEH,SAAO,GAAqB,CAAC,cAAc,EAAK"}
+{"version":3,"file":"plugins-management-service.js","names":[],"sources":["../../src/api/plugins-management-service.ts"],"sourcesContent":["import { PluginsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport type { PluginBundledSkill } from \"./plugins-service\";\n\n/**\n * An installed plugin, as returned by the agent-server management router\n * (`GET /api/plugins/installed`). Matches the typescript-client\n * `InstalledPluginInfo`. The contents fields (`skills`, `files`, relative to\n * `install_path`) are absent on older agent-servers and null when the\n * installed plugin directory failed to load.\n */\nexport interface InstalledPluginInfo {\n  name: string;\n  version: string;\n  description: string | null;\n  enabled: boolean;\n  source: string;\n  resolved_ref?: string | null;\n  repo_path?: string | null;\n  installed_at: string;\n  install_path: string;\n  skills?: PluginBundledSkill[] | null;\n  files?: string[] | null;\n}\n\n/** Coordinates for installing a plugin from a git source or local path. */\nexport interface InstallPluginRequest {\n  source: string;\n  ref?: string | null;\n  repo_path?: string | null;\n  force?: boolean;\n}\n\n/**\n * The slice of the typescript-client `PluginsClient` this service drives. The\n * installed `@openhands/typescript-client` package does not yet export these\n * management methods (they ship in typescript-client PRs #222/#223); narrowing\n * to this local interface keeps `vitest` (types stripped) and `eslint` green\n * until the client is republished, at which point the cast below can be dropped.\n */\ninterface PluginsManagementClient {\n  listInstalledPlugins(): Promise<{ plugins: InstalledPluginInfo[] }>;\n  installPlugin(request: InstallPluginRequest): Promise<InstalledPluginInfo>;\n  setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }>;\n  uninstallPlugin(name: string): Promise<{ message: string }>;\n  refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }>;\n}\n\nfunction isCloudBackend(): boolean {\n  return getActiveBackend().backend.kind === \"cloud\";\n}\n\nfunction getManagementClient(): PluginsManagementClient {\n  return new PluginsClient(\n    getAgentServerClientOptions(),\n  ) as unknown as PluginsManagementClient;\n}\n\n/**\n * Front-end management layer for installed plugins: list / install / enable /\n * disable / uninstall / refresh. Kept separate from the read-only catalog\n * service (`plugins-service.ts`), exactly as skills separate the marketplace\n * catalog from install actions.\n *\n * Local backend only for now (per Appendix C Q5): installed plugins live on the\n * local agent-server's `~/.openhands/plugins/installed/`. A cloud backend has no\n * per-user installed store yet, so reads return an empty list and mutating\n * actions throw (the UI also disables them on cloud).\n */\nclass PluginsManagementService {\n  static async listInstalledPlugins(): Promise<InstalledPluginInfo[]> {\n    if (isCloudBackend()) {\n      return [];\n    }\n\n    try {\n      const response = await getManagementClient().listInstalledPlugins();\n      return response.plugins ?? [];\n    } catch {\n      // Agent-server may predate the plugins router or be unreachable; surface\n      // an empty list rather than throwing (mirrors the catalog service).\n      return [];\n    }\n  }\n\n  static async installPlugin(\n    request: InstallPluginRequest,\n  ): Promise<InstalledPluginInfo> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Installing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().installPlugin(request);\n  }\n\n  static async setPluginEnabled(\n    name: string,\n    enabled: boolean,\n  ): Promise<{ name: string; enabled: boolean }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Enabling and disabling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().setPluginEnabled(name, enabled);\n  }\n\n  static async uninstallPlugin(name: string): Promise<{ message: string }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Uninstalling plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().uninstallPlugin(name);\n  }\n\n  static async refreshPlugin(\n    name: string,\n  ): Promise<{ message: string; plugin: InstalledPluginInfo }> {\n    if (isCloudBackend()) {\n      throw new Error(\n        \"Refreshing plugins is only available on a local backend.\",\n      );\n    }\n    return getManagementClient().refreshPlugin(name);\n  }\n}\n\nexport default PluginsManagementService;\n"],"mappings":";;;;;AAsDA,SAAS,IAA0B;AACjC,QAAO,GAAkB,CAAC,QAAQ,SAAS;;AAG7C,SAAS,IAA+C;AACtD,QAAO,IAAI,EACT,GAA6B,CAC9B;;AAcH,IAAM,IAAN,MAA+B;CAC7B,aAAa,uBAAuD;AAClE,MAAI,GAAgB,CAClB,QAAO,EAAE;AAGX,MAAI;AAEF,WAAO,MADgB,GAAqB,CAAC,sBAAsB,EACnD,WAAW,EAAE;UACvB;AAGN,UAAO,EAAE;;;CAIb,aAAa,cACX,GAC8B;AAC9B,MAAI,GAAgB,CAClB,OAAU,MACR,2DACD;AAEH,SAAO,GAAqB,CAAC,cAAc,EAAQ;;CAGrD,aAAa,iBACX,GACA,GAC6C;AAC7C,MAAI,GAAgB,CAClB,OAAU,MACR,uEACD;AAEH,SAAO,GAAqB,CAAC,iBAAiB,GAAM,EAAQ;;CAG9D,aAAa,gBAAgB,GAA4C;AACvE,MAAI,GAAgB,CAClB,OAAU,MACR,6DACD;AAEH,SAAO,GAAqB,CAAC,gBAAgB,EAAK;;CAGpD,aAAa,cACX,GAC2D;AAC3D,MAAI,GAAgB,CAClB,OAAU,MACR,2DACD;AAEH,SAAO,GAAqB,CAAC,cAAc,EAAK"}

package/dist/api/plugins-service.d.ts

@@ -1,7 +1,14 @@
+/** Summary of a skill bundled in a plugin (agent-server `PluginSkillSummary`). */
+export interface PluginBundledSkill {
+    name: string;
+    description?: string | null;
+}
 /**
  * A plugin in the dynamic marketplace catalog, with attachable coordinates and
  * install state. Matches the agent-server `MarketplacePluginInfo` / the
- * typescript-client `MarketplacePlugin`.
+ * typescript-client `MarketplacePlugin`. The contents fields (`path`, `skills`,
+ * `files`) are populated when the entry resolves to a directory in the
+ * server's local marketplace clone, and are absent on older agent-servers.
  */
 export interface MarketplacePlugin {
     name: string;
@@ -10,18 +17,30 @@ export interface MarketplacePlugin {
     ref?: string | null;
     repo_path?: string | null;
     installed: boolean;
+    path?: string | null;
+    skills?: PluginBundledSkill[] | null;
+    files?: string[] | null;
 }
 /**
  * A locally-discovered ("ambient") plugin reported by the agent-server — one
  * found in the user's local plugin directories (e.g. `~/.agents/plugins`).
  * These auto-load into conversations and are not managed via install/uninstall,
  * so the Plugins page renders them as a read-only "Local" group. Matches the
- * typescript-client `PluginInfo`.
+ * typescript-client `PluginInfo`; the contents fields are absent on older
+ * agent-servers.
  */
 export interface LocalPlugin {
     name: string;
     version: string;
     description: string;
+    path?: string;
+    skills?: PluginBundledSkill[];
+    files?: string[];
+}
+/** Content of a single plugin file fetched for the detail-modal viewer. */
+export interface PluginFileContent {
+    kind: "text" | "binary";
+    text: string | null;
 }
 declare class PluginsService {
     /**
@@ -45,5 +64,14 @@ declare class PluginsService {
      * catalog) rather than throwing.
      */
     static getLocalPlugins(): Promise<LocalPlugin[]>;
+    /**
+     * Fetch one plugin file's content for the detail-modal viewer. `basePath` is
+     * the plugin directory reported by the agent-server (`path`/`install_path`)
+     * and `relativePath` a POSIX path from the plugin's `files` listing.
+     *
+     * Local backend only — plugin files live on the local agent-server's disk.
+     * Errors propagate so the caller can render a load-error state.
+     */
+    static getPluginFileContent(basePath: string, relativePath: string): Promise<PluginFileContent>;
 }
 export default PluginsService;

package/dist/api/secrets-service.cjs

@@ -1,2 +1,2 @@
-require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./agent-server-compatibility.cjs`),i=require(`./cloud/secrets-service.api.cjs`);async function a(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var o=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await a(()=>i.fetchCloudSecrets()):(await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(r,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.createCloudSecret(r,o,s));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:r,value:o,description:s}))}static async updateSecret(e,n,r){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.updateCloudSecret(e,n,r));return}await this.createSecret(e,n,r)}static async deleteSecret(o){try{if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.deleteCloudSecret(o));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(o))}catch(e){if(r.isSdkHttpStatusError(e,404)||e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=o;
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./agent-server-compatibility.cjs`),i=require(`./cloud/secrets-service.api.cjs`);async function a(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var o=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await a(()=>i.fetchCloudSecrets()):(await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(r,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.createCloudSecret(r,o,s));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:r,value:o,description:s}))}static async updateSecret(r,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.updateCloudSecret(r,o,s));return}let c=new e.SettingsClient(n.getAgentServerClientOptions()),l=await a(()=>c.getSecret(r));await a(()=>c.upsertSecret({name:o,value:l,description:s})),o!==r&&await this.deleteSecret(r)}static async deleteSecret(o){try{if(t.getActiveBackend().backend.kind===`cloud`){await a(()=>i.deleteCloudSecret(o));return}await a(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(o))}catch(e){if(r.isSdkHttpStatusError(e,404)||e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=o;
 //# sourceMappingURL=secrets-service.cjs.map

package/dist/api/secrets-service.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { isSdkHttpStatusError } from \"./agent-server-compatibility\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion.\n      // Both the SDK's HttpError (status on the error itself) and\n      // axios-style errors (status under `response`) count.\n      if (\n        isSdkHttpStatusError(error, 404) ||\n        (error &&\n          typeof error === \"object\" &&\n          \"response\" in error &&\n          (error as { response?: { status?: number } }).response?.status ===\n            404)\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"uZAeA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAI/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAGF,MAAM,KAAK,aAAa,EAAM,EAAO,EAAY,CAUnD,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAId,GACE,EAAA,qBAAqB,EAAO,IAAI,EAC/B,GACC,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SACtD,IAEJ,OAEF,MAAM"}
+{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { isSdkHttpStatusError } from \"./agent-server-compatibility\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's name and/or description while preserving its value.\n   * The agent-server only exposes an upsert endpoint, so we fetch the\n   * existing value and re-upsert it under the updated name/description.\n   *\n   * @param secretToEdit - Existing secret name\n   * @param name - New (or same) secret name\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    secretToEdit: string,\n    name: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => updateCloudSecret(secretToEdit, name, description));\n      return;\n    }\n\n    const client = new SettingsClient(getAgentServerClientOptions());\n    const value = await withRetry(() => client.getSecret(secretToEdit));\n\n    await withRetry(() =>\n      client.upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n\n    if (name !== secretToEdit) {\n      await this.deleteSecret(secretToEdit);\n    }\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion.\n      // Both the SDK's HttpError (status on the error itself) and\n      // axios-style errors (status under `response`) count.\n      if (\n        isSdkHttpStatusError(error, 404) ||\n        (error &&\n          typeof error === \"object\" &&\n          \"response\" in error &&\n          (error as { response?: { status?: number } }).response?.status ===\n            404)\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"uZAeA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAc,EAAM,EAAY,CAAC,CACzE,OAGF,IAAM,EAAS,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAC1D,EAAQ,MAAM,MAAgB,EAAO,UAAU,EAAa,CAAC,CAEnE,MAAM,MACJ,EAAO,aAAa,CAClB,OACA,QACA,cACD,CAAC,CACH,CAEG,IAAS,GACX,MAAM,KAAK,aAAa,EAAa,CAWzC,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAId,GACE,EAAA,qBAAqB,EAAO,IAAI,EAC/B,GACC,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SACtD,IAEJ,OAEF,MAAM"}

package/dist/api/secrets-service.d.ts

@@ -19,16 +19,16 @@ export declare class SecretsService {
      */
     static createSecret(name: string, value: string, description?: string): Promise<void>;
     /**
-     * Update a secret's value and/or description.
-     * Uses the same upsert endpoint as createSecret since agent-server
-     * doesn't have a separate update endpoint.
+     * Update a secret's name and/or description while preserving its value.
+     * The agent-server only exposes an upsert endpoint, so we fetch the
+     * existing value and re-upsert it under the updated name/description.
      *
-     * @param name - Secret name (used as identifier)
-     * @param value - New secret value
+     * @param secretToEdit - Existing secret name
+     * @param name - New (or same) secret name
      * @param description - Optional new description
      * @throws Error if the API call fails after retries
      */
-    static updateSecret(name: string, value: string, description?: string): Promise<void>;
+    static updateSecret(secretToEdit: string, name: string, description?: string): Promise<void>;
     /**
      * Delete a custom secret by name.
      * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}

package/dist/api/secrets-service.js

@@ -39,12 +39,17 @@ var l = class {
 			description: o
 		}));
 	}
-	static async updateSecret(e, n, r) {
+	static async updateSecret(r, i, a) {
 		if (t().backend.kind === "cloud") {
-			await c(() => s(e, n, r));
+			await c(() => s(r, i, a));
 			return;
 		}
-		await this.createSecret(e, n, r);
+		let o = new e(n()), l = await c(() => o.getSecret(r));
+		await c(() => o.upsertSecret({
+			name: i,
+			value: l,
+			description: a
+		})), i !== r && await this.deleteSecret(r);
 	}
 	static async deleteSecret(i) {
 		try {

package/dist/api/secrets-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-service.js","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { isSdkHttpStatusError } from \"./agent-server-compatibility\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion.\n      // Both the SDK's HttpError (status on the error itself) and\n      // axios-style errors (status under `response`) count.\n      if (\n        isSdkHttpStatusError(error, 404) ||\n        (error &&\n          typeof error === \"object\" &&\n          \"response\" in error &&\n          (error as { response?: { status?: number } }).response?.status ===\n            404)\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;;;;AAeA,eAAe,EACb,GACA,IAAqB,GACrB,IAAsB,KACV;AACZ,MAAK,IAAI,IAAU,GAAG,IAAU,GAAY,KAAW,EACrD,KAAI;AACF,SAAO,MAAM,GAAI;UACV,GAAO;AACd,MAAI,KAAW,IAAa,EAC1B,OAAM;EAGR,IAAM,IAAQ,IAAc,KAAK;AAEjC,QAAM,IAAI,SAAe,MAAY;AACnC,cAAW,GAAS,EAAM;IAC1B;;AAIN,OAAU,MAAM,2BAA2B;;AAG7C,IAAa,IAAb,MAA4B;CAQ1B,aAAa,aAAkD;AAC7D,MAAI;AAOF,UANI,GAAkB,CAAC,QAAQ,SAAS,UAC/B,MAAM,QAAgB,GAAmB,CAAC,IAK5C,MAHgB,QACrB,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,KAAK,OAAO;IAClC,MAAM,EAAE;IACR,aAAa,EAAE;IAChB,EAAE;WACI,GAAO;AAEd,UADA,QAAQ,MAAM,0CAA0C,EAAM,EACvD,EAAE;;;CAab,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAEF,QAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa;GAC7D;GACA;GACA;GACD,CAAC,CACH;;CAaH,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAI/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAGF,QAAM,KAAK,aAAa,GAAM,GAAO,EAAY;;CAUnD,aAAa,aAAa,GAA6B;AACrD,MAAI;AACF,OAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,UAAM,QAAgB,EAAkB,EAAK,CAAC;AAC9C;;AAEF,SAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,EAAK,CACrE;WACM,GAAO;AAId,OACE,EAAqB,GAAO,IAAI,IAC/B,KACC,OAAO,KAAU,YACjB,cAAc,KACb,EAA6C,UAAU,WACtD,IAEJ;AAEF,SAAM"}
+{"version":3,"file":"secrets-service.js","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { isSdkHttpStatusError } from \"./agent-server-compatibility\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's name and/or description while preserving its value.\n   * The agent-server only exposes an upsert endpoint, so we fetch the\n   * existing value and re-upsert it under the updated name/description.\n   *\n   * @param secretToEdit - Existing secret name\n   * @param name - New (or same) secret name\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    secretToEdit: string,\n    name: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => updateCloudSecret(secretToEdit, name, description));\n      return;\n    }\n\n    const client = new SettingsClient(getAgentServerClientOptions());\n    const value = await withRetry(() => client.getSecret(secretToEdit));\n\n    await withRetry(() =>\n      client.upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n\n    if (name !== secretToEdit) {\n      await this.deleteSecret(secretToEdit);\n    }\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion.\n      // Both the SDK's HttpError (status on the error itself) and\n      // axios-style errors (status under `response`) count.\n      if (\n        isSdkHttpStatusError(error, 404) ||\n        (error &&\n          typeof error === \"object\" &&\n          \"response\" in error &&\n          (error as { response?: { status?: number } }).response?.status ===\n            404)\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;;;;AAeA,eAAe,EACb,GACA,IAAqB,GACrB,IAAsB,KACV;AACZ,MAAK,IAAI,IAAU,GAAG,IAAU,GAAY,KAAW,EACrD,KAAI;AACF,SAAO,MAAM,GAAI;UACV,GAAO;AACd,MAAI,KAAW,IAAa,EAC1B,OAAM;EAGR,IAAM,IAAQ,IAAc,KAAK;AAEjC,QAAM,IAAI,SAAe,MAAY;AACnC,cAAW,GAAS,EAAM;IAC1B;;AAIN,OAAU,MAAM,2BAA2B;;AAG7C,IAAa,IAAb,MAA4B;CAQ1B,aAAa,aAAkD;AAC7D,MAAI;AAOF,UANI,GAAkB,CAAC,QAAQ,SAAS,UAC/B,MAAM,QAAgB,GAAmB,CAAC,IAK5C,MAHgB,QACrB,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,KAAK,OAAO;IAClC,MAAM,EAAE;IACR,aAAa,EAAE;IAChB,EAAE;WACI,GAAO;AAEd,UADA,QAAQ,MAAM,0CAA0C,EAAM,EACvD,EAAE;;;CAab,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAEF,QAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa;GAC7D;GACA;GACA;GACD,CAAC,CACH;;CAaH,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,SAAM,QAAgB,EAAkB,GAAc,GAAM,EAAY,CAAC;AACzE;;EAGF,IAAM,IAAS,IAAI,EAAe,GAA6B,CAAC,EAC1D,IAAQ,MAAM,QAAgB,EAAO,UAAU,EAAa,CAAC;AAUnE,EARA,MAAM,QACJ,EAAO,aAAa;GAClB;GACA;GACA;GACD,CAAC,CACH,EAEG,MAAS,KACX,MAAM,KAAK,aAAa,EAAa;;CAWzC,aAAa,aAAa,GAA6B;AACrD,MAAI;AACF,OAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,UAAM,QAAgB,EAAkB,EAAK,CAAC;AAC9C;;AAEF,SAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,EAAK,CACrE;WACM,GAAO;AAId,OACE,EAAqB,GAAO,IAAI,IAC/B,KACC,OAAO,KAAU,YACjB,cAAc,KACb,EAA6C,UAAU,WACtD,IAEJ;AAEF,SAAM"}

package/dist/api/settings-service/settings-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../../utils/mcp-config.cjs`),a=require(`../cloud/settings-service.api.cjs`);var o=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`disabled_skills`],s=new Set(o),c=e=>s.has(e),l=e=>{let t={},n={};for(let[r,i]of Object.entries(e))c(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},u=e=>JSON.parse(JSON.stringify(e)),d=(e,t)=>({...e??{},...t??{}});async function f(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var p={redacted:null,encrypted:null,timestamp:0},m=300*1e3,h=()=>Date.now()-p.timestamp<m,g=()=>{p={redacted:null,encrypted:null,timestamp:0}},_=e=>!!e&&typeof e==`object`&&!Array.isArray(e),v=(e,t)=>`Basic ${btoa(`${e}:${t}`)}`,y=e=>{switch(e.strategy){case`none`:return{};case`api_key`:{if(typeof e.value!=`string`||!e.value)return null;let t=typeof e.header_name==`string`&&e.header_name?e.header_name:`Authorization`,n=t===`Authorization`?`Bearer ${e.value}`:e.value;return{[t]:n}}case`bearer`:return typeof e.value!=`string`||!e.value?null:{Authorization:`Bearer ${e.value}`};case`basic`:return typeof e.username!=`string`||typeof e.password!=`string`?null:{Authorization:v(e.username,e.password)};case`header`:return i.stringRecord(e.headers)??{};case`oauth2`:{let t=_(e.state)?e.state.tokens:void 0;return!_(t)||typeof t.access_token!=`string`?null:{Authorization:`Bearer ${t.access_token}`}}default:return null}},b=e=>{if(!_(e))return e;let t=_(e.mcpServers),n=t?e.mcpServers:e,r=Object.fromEntries(Object.entries(n).map(([e,t])=>{if(!_(t)||!_(t.auth))return[e,t];let n=y(t.auth);if(n===null)return[e,t];let r={...t},a={...i.stringRecord(t.headers)??{},...n};return delete r.auth,Object.keys(a).length>0?r.headers=a:delete r.headers,[e,r]}));return t?{...e,mcpServers:r}:r},x=e=>{let t=i.getSdkMcpServerMap(e);return t?Object.values(t).some(e=>i.hasRedactedMcpSecretLeaf(_(e)?e.auth:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.headers:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.env:void 0)):!1},S=(e,t)=>{let n=i.getSdkMcpServerMap(e),r=i.getSdkMcpServerMap(t);return!n||!r?!1:Object.keys(n).some(e=>!(e in r))},C=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of o){let r=n[e];r!==void 0&&(t[e]=r)}return t},w=e=>{let t=d(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=d(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...u(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},T=class r{static async fetchSettingsFromApi(t){return f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return w(await f(()=>a.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),w({})}if(h()&&p.redacted)return w(C(p.redacted));try{let e=await this.fetchSettingsFromApi();return p.redacted=e,p.timestamp=Date.now(),w(C(e))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),w({})}}static async getSettingsForConversation(){if(h()&&p.encrypted)return{agentSettings:p.encrypted.agent_settings,conversationSettings:p.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return p.encrypted=e,p.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(i){let{extracted:o,rest:s}=l(i),c=Object.keys(o).length>0,u={},d=s.agent_settings_diff;d&&Object.keys(d).length>0&&(u.agent_settings_diff=d);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),c&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,h=u.agent_settings_diff,_=!!h&&`mcp_config`in h&&h.mcp_config!==null,v;if(_)try{v=m?(await a.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}let y=m&&_&&x(v)&&!S(v,h?.mcp_config),C=_&&!y;if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||c))return!0;C&&await f(()=>a.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff={...u.agent_settings_diff},`mcp_config`in e.agent_settings_diff&&(e.agent_settings_diff.mcp_config=b(e.agent_settings_diff.mcp_config))),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),c&&(e.app_preferences=o);try{await f(()=>a.saveCloudSettings(e))}catch(e){if(C&&v)try{await a.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;C&&await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(C&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return g(),!0}static invalidateCache(){g()}};exports.default=T;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../../utils/mcp-config.cjs`),a=require(`../cloud/settings-service.api.cjs`);var o=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`title_llm_profile`,`disabled_skills`],s=new Set(o),c=e=>s.has(e),l=e=>{let t={},n={};for(let[r,i]of Object.entries(e))c(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},u=e=>JSON.parse(JSON.stringify(e)),d=(e,t)=>({...e??{},...t??{}});async function f(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var p={redacted:null,encrypted:null,timestamp:0},m=300*1e3,h=()=>Date.now()-p.timestamp<m,g=()=>{p={redacted:null,encrypted:null,timestamp:0}},_=e=>!!e&&typeof e==`object`&&!Array.isArray(e),v=(e,t)=>`Basic ${btoa(`${e}:${t}`)}`,y=e=>{switch(e.strategy){case`none`:return{};case`api_key`:{if(typeof e.value!=`string`||!e.value)return null;let t=typeof e.header_name==`string`&&e.header_name?e.header_name:`Authorization`,n=t===`Authorization`?`Bearer ${e.value}`:e.value;return{[t]:n}}case`bearer`:return typeof e.value!=`string`||!e.value?null:{Authorization:`Bearer ${e.value}`};case`basic`:return typeof e.username!=`string`||typeof e.password!=`string`?null:{Authorization:v(e.username,e.password)};case`header`:return i.stringRecord(e.headers)??{};case`oauth2`:{let t=_(e.state)?e.state.tokens:void 0;return!_(t)||typeof t.access_token!=`string`?null:{Authorization:`Bearer ${t.access_token}`}}default:return null}},b=e=>{if(!_(e))return e;let t=_(e.mcpServers),n=t?e.mcpServers:e,r=Object.fromEntries(Object.entries(n).map(([e,t])=>{if(!_(t)||!_(t.auth))return[e,t];let n=y(t.auth);if(n===null)return[e,t];let r={...t},a={...i.stringRecord(t.headers)??{},...n};return delete r.auth,Object.keys(a).length>0?r.headers=a:delete r.headers,[e,r]}));return t?{...e,mcpServers:r}:r},x=e=>{let t=i.getSdkMcpServerMap(e);return t?Object.values(t).some(e=>i.hasRedactedMcpSecretLeaf(_(e)?e.auth:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.headers:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.env:void 0)):!1},S=(e,t)=>{let n=i.getSdkMcpServerMap(e),r=i.getSdkMcpServerMap(t);return!n||!r?!1:Object.keys(n).some(e=>!(e in r))},C=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of o){let r=n[e];r!==void 0&&(t[e]=r)}return t},w=e=>{let t=d(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=d(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...u(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},T=class r{static async fetchSettingsFromApi(t){return f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return w(await f(()=>a.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),w({})}if(h()&&p.redacted)return w(C(p.redacted));try{let e=await this.fetchSettingsFromApi();return p.redacted=e,p.timestamp=Date.now(),w(C(e))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),w({})}}static async getSettingsForConversation(){if(h()&&p.encrypted)return{agentSettings:p.encrypted.agent_settings,conversationSettings:p.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return p.encrypted=e,p.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(i){let{extracted:o,rest:s}=l(i),c=Object.keys(o).length>0,u={},d=s.agent_settings_diff;d&&Object.keys(d).length>0&&(u.agent_settings_diff=d);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),c&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,h=u.agent_settings_diff,_=!!h&&`mcp_config`in h&&h.mcp_config!==null,v;if(_)try{v=m?(await a.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}let y=m&&_&&x(v)&&!S(v,h?.mcp_config),C=_&&!y;if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||c))return!0;C&&await f(()=>a.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff={...u.agent_settings_diff},`mcp_config`in e.agent_settings_diff&&(e.agent_settings_diff.mcp_config=b(e.agent_settings_diff.mcp_config))),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),c&&(e.app_preferences=o);try{await f(()=>a.saveCloudSettings(e))}catch(e){if(C&&v)try{await a.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;C&&await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(C&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return g(),!0}static invalidateCache(){g()}};exports.default=T;
 //# sourceMappingURL=settings-service.api.cjs.map