@openhands/agent-canvas 1.5.1 → 1.6.1

package/dist/utils/mcp-credential-validation.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-credential-validation.cjs","names":[],"sources":["../../src/utils/mcp-credential-validation.ts"],"sourcesContent":["import { INTEGRATION_CATALOG as MCP_MARKETPLACE } from \"@openhands/extensions/integrations\";\nimport {\n  findCatalogEntryForServer,\n  getMcpMarketplaceCatalog,\n} from \"#/utils/mcp-marketplace-utils\";\nimport type {\n  MCPServerConfig,\n  MCPTestToolCall,\n  MCPTestToolResult,\n} from \"#/types/mcp-server\";\n\n/**\n * Credential validation specs for marketplace MCP servers whose credentials\n * are only exercised on tool invocation (listing tools succeeds with any\n * credentials). The test endpoint runs `toolCall` after listing and reports\n * the outcome verbatim; `interpret` decides whether that outcome proves the\n * credentials are invalid.\n *\n * `toolCall` MUST be read-only — it runs on every \"Test connection\" /\n * pre-save validation.\n */\nexport interface CredentialValidation {\n  toolCall: MCPTestToolCall;\n  /** Returns the provider's error code/message, or null when creds pass. */\n  interpret: (toolResult: MCPTestToolResult) => string | null;\n}\n\n/**\n * Slack error codes that mean the credentials themselves are bad. Anything\n * else (e.g. `missing_scope`) proves the token *authenticated* — a valid\n * token lacking a scope must not be reported as invalid credentials.\n */\nconst SLACK_AUTH_FAILURES = new Set([\n  \"invalid_auth\",\n  \"not_authed\",\n  \"account_inactive\",\n  \"token_revoked\",\n  \"token_expired\",\n]);\n\nconst VALIDATION_BY_ENTRY_ID: Record<string, CredentialValidation> = {\n  slack: {\n    // Read-only: lists at most one channel. The Slack MCP server returns\n    // the raw Slack API JSON ({ok: boolean, error?: string}) as text.\n    toolCall: { name: \"slack_list_channels\", arguments: { limit: 1 } },\n    interpret: (toolResult) => {\n      if (toolResult.is_error) {\n        return toolResult.text || \"tool call failed\";\n      }\n      try {\n        const parsed = JSON.parse(toolResult.text);\n        if (parsed?.ok === false && SLACK_AUTH_FAILURES.has(parsed.error)) {\n          return String(parsed.error);\n        }\n      } catch {\n        // Non-JSON payload — make no claim about the credentials.\n      }\n      return null;\n    },\n  },\n};\n\n/**\n * Look up the credential validation for a server by matching it to its\n * marketplace catalog entry (same matching the MCP page uses for icons).\n * Returns undefined for custom servers — their test behaves as before.\n */\nexport function getCredentialValidationForServer(\n  server: MCPServerConfig,\n): CredentialValidation | undefined {\n  const entry = findCatalogEntryForServer(\n    server,\n    getMcpMarketplaceCatalog(MCP_MARKETPLACE),\n  );\n  return entry ? VALIDATION_BY_ENTRY_ID[entry.id] : undefined;\n}\n"],"mappings":"sKAgCA,IAAM,EAAsB,IAAI,IAAI,CAClC,eACA,aACA,mBACA,gBACA,gBACD,CAAC,CAEI,EAA+D,CACnE,MAAO,CAGL,SAAU,CAAE,KAAM,sBAAuB,UAAW,CAAE,MAAO,EAAG,CAAE,CAClE,UAAY,GAAe,CACzB,GAAI,EAAW,SACb,OAAO,EAAW,MAAQ,mBAE5B,GAAI,CACF,IAAM,EAAS,KAAK,MAAM,EAAW,KAAK,CAC1C,GAAI,GAAQ,KAAO,IAAS,EAAoB,IAAI,EAAO,MAAM,CAC/D,OAAO,OAAO,EAAO,MAAM,MAEvB,EAGR,OAAO,MAEV,CACF,CAOD,SAAgB,EACd,EACkC,CAClC,IAAM,EAAQ,EAAA,0BACZ,EACA,EAAA,yBAAyB,EAAA,QAAgB,CAC1C,CACD,OAAO,EAAQ,EAAuB,EAAM,IAAM,IAAA"}
+{"version":3,"file":"mcp-credential-validation.cjs","names":[],"sources":["../../src/utils/mcp-credential-validation.ts"],"sourcesContent":["import { INTEGRATION_CATALOG as MCP_MARKETPLACE } from \"@openhands/extensions/integrations\";\nimport {\n  findCatalogEntryForServer,\n  getMcpMarketplaceCatalog,\n} from \"#/utils/mcp-marketplace-utils\";\nimport type {\n  MCPServerConfig,\n  MCPTestToolCall,\n  MCPTestToolResult,\n} from \"#/types/mcp-server\";\n\n/**\n * Credential validation specs for marketplace MCP servers whose credentials\n * are only exercised on tool invocation (listing tools succeeds with any\n * credentials). The test endpoint runs `toolCall` after listing and reports\n * the outcome verbatim; `interpret` decides whether that outcome proves the\n * credentials are invalid.\n *\n * `toolCall` MUST be read-only — it runs on every \"Test connection\" /\n * pre-save validation.\n */\nexport interface CredentialValidation {\n  toolCall: MCPTestToolCall;\n  /** Returns the provider's error code/message, or null when creds pass. */\n  interpret: (toolResult: MCPTestToolResult) => string | null;\n}\n\n/**\n * Slack error codes that mean the credentials themselves are bad. Anything\n * else (e.g. `missing_scope`) proves the token *authenticated* — a valid\n * token lacking a scope must not be reported as invalid credentials.\n */\nconst SLACK_AUTH_FAILURES = new Set([\n  \"invalid_auth\",\n  \"not_authed\",\n  \"account_inactive\",\n  \"token_revoked\",\n  \"token_expired\",\n]);\n\n/**\n * Interpreter for hosted HTTP API servers (GitHub, Linear). The service only\n * calls `interpret` when the probe tool was advertised by the server AND\n * invoked, so `is_error` here means the read-only call itself failed — for a\n * \"who am I\" / \"list teams\" probe that is an auth/permission failure.\n */\nconst interpretReadOnlyToolResult = (\n  toolResult: MCPTestToolResult,\n): string | null =>\n  toolResult.is_error ? toolResult.text || \"tool call failed\" : null;\n\nconst VALIDATION_BY_ENTRY_ID: Record<string, CredentialValidation> = {\n  github: {\n    // Official GitHub MCP server (api.githubcopilot.com): read-only\n    // \"get details of the authenticated user\".\n    toolCall: { name: \"get_me\", arguments: {} },\n    interpret: interpretReadOnlyToolResult,\n  },\n  linear: {\n    // Linear hosted MCP (mcp.linear.app): read-only teams listing with no\n    // required arguments.\n    toolCall: { name: \"list_teams\", arguments: {} },\n    interpret: interpretReadOnlyToolResult,\n  },\n  slack: {\n    // Read-only: lists at most one channel. The Slack MCP server returns\n    // the raw Slack API JSON ({ok: boolean, error?: string}) as text.\n    toolCall: { name: \"slack_list_channels\", arguments: { limit: 1 } },\n    interpret: (toolResult) => {\n      if (toolResult.is_error) {\n        return toolResult.text || \"tool call failed\";\n      }\n      try {\n        const parsed = JSON.parse(toolResult.text);\n        if (parsed?.ok === false && SLACK_AUTH_FAILURES.has(parsed.error)) {\n          return String(parsed.error);\n        }\n      } catch {\n        // Non-JSON payload — make no claim about the credentials.\n      }\n      return null;\n    },\n  },\n};\n\n/**\n * Look up the credential validation for a server by matching it to its\n * marketplace catalog entry (same matching the MCP page uses for icons).\n * Returns undefined for custom servers — their test behaves as before.\n */\nexport function getCredentialValidationForServer(\n  server: MCPServerConfig,\n): CredentialValidation | undefined {\n  const entry = findCatalogEntryForServer(\n    server,\n    getMcpMarketplaceCatalog(MCP_MARKETPLACE),\n  );\n  return entry ? VALIDATION_BY_ENTRY_ID[entry.id] : undefined;\n}\n"],"mappings":"sKAgCA,IAAM,EAAsB,IAAI,IAAI,CAClC,eACA,aACA,mBACA,gBACA,gBACD,CAAC,CAQI,EACJ,GAEA,EAAW,SAAW,EAAW,MAAQ,mBAAqB,KAE1D,EAA+D,CACnE,OAAQ,CAGN,SAAU,CAAE,KAAM,SAAU,UAAW,EAAE,CAAE,CAC3C,UAAW,EACZ,CACD,OAAQ,CAGN,SAAU,CAAE,KAAM,aAAc,UAAW,EAAE,CAAE,CAC/C,UAAW,EACZ,CACD,MAAO,CAGL,SAAU,CAAE,KAAM,sBAAuB,UAAW,CAAE,MAAO,EAAG,CAAE,CAClE,UAAY,GAAe,CACzB,GAAI,EAAW,SACb,OAAO,EAAW,MAAQ,mBAE5B,GAAI,CACF,IAAM,EAAS,KAAK,MAAM,EAAW,KAAK,CAC1C,GAAI,GAAQ,KAAO,IAAS,EAAoB,IAAI,EAAO,MAAM,CAC/D,OAAO,OAAO,EAAO,MAAM,MAEvB,EAGR,OAAO,MAEV,CACF,CAOD,SAAgB,EACd,EACkC,CAClC,IAAM,EAAQ,EAAA,0BACZ,EACA,EAAA,yBAAyB,EAAA,QAAgB,CAC1C,CACD,OAAO,EAAQ,EAAuB,EAAM,IAAM,IAAA"}

package/dist/utils/mcp-credential-validation.js

@@ -7,25 +7,41 @@ var r = new Set([
 	"account_inactive",
 	"token_revoked",
 	"token_expired"
-]), i = { slack: {
-	toolCall: {
-		name: "slack_list_channels",
-		arguments: { limit: 1 }
+]), i = (e) => e.is_error ? e.text || "tool call failed" : null, a = {
+	github: {
+		toolCall: {
+			name: "get_me",
+			arguments: {}
+		},
+		interpret: i
 	},
-	interpret: (e) => {
-		if (e.is_error) return e.text || "tool call failed";
-		try {
-			let t = JSON.parse(e.text);
-			if (t?.ok === !1 && r.has(t.error)) return String(t.error);
-		} catch {}
-		return null;
+	linear: {
+		toolCall: {
+			name: "list_teams",
+			arguments: {}
+		},
+		interpret: i
+	},
+	slack: {
+		toolCall: {
+			name: "slack_list_channels",
+			arguments: { limit: 1 }
+		},
+		interpret: (e) => {
+			if (e.is_error) return e.text || "tool call failed";
+			try {
+				let t = JSON.parse(e.text);
+				if (t?.ok === !1 && r.has(t.error)) return String(t.error);
+			} catch {}
+			return null;
+		}
 	}
-} };
-function a(r) {
-	let a = e(r, t(n));
-	return a ? i[a.id] : void 0;
+};
+function o(r) {
+	let i = e(r, t(n));
+	return i ? a[i.id] : void 0;
 }
 //#endregion
-export { a as getCredentialValidationForServer };
+export { o as getCredentialValidationForServer };
 
 //# sourceMappingURL=mcp-credential-validation.js.map

package/dist/utils/mcp-credential-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-credential-validation.js","names":[],"sources":["../../src/utils/mcp-credential-validation.ts"],"sourcesContent":["import { INTEGRATION_CATALOG as MCP_MARKETPLACE } from \"@openhands/extensions/integrations\";\nimport {\n  findCatalogEntryForServer,\n  getMcpMarketplaceCatalog,\n} from \"#/utils/mcp-marketplace-utils\";\nimport type {\n  MCPServerConfig,\n  MCPTestToolCall,\n  MCPTestToolResult,\n} from \"#/types/mcp-server\";\n\n/**\n * Credential validation specs for marketplace MCP servers whose credentials\n * are only exercised on tool invocation (listing tools succeeds with any\n * credentials). The test endpoint runs `toolCall` after listing and reports\n * the outcome verbatim; `interpret` decides whether that outcome proves the\n * credentials are invalid.\n *\n * `toolCall` MUST be read-only — it runs on every \"Test connection\" /\n * pre-save validation.\n */\nexport interface CredentialValidation {\n  toolCall: MCPTestToolCall;\n  /** Returns the provider's error code/message, or null when creds pass. */\n  interpret: (toolResult: MCPTestToolResult) => string | null;\n}\n\n/**\n * Slack error codes that mean the credentials themselves are bad. Anything\n * else (e.g. `missing_scope`) proves the token *authenticated* — a valid\n * token lacking a scope must not be reported as invalid credentials.\n */\nconst SLACK_AUTH_FAILURES = new Set([\n  \"invalid_auth\",\n  \"not_authed\",\n  \"account_inactive\",\n  \"token_revoked\",\n  \"token_expired\",\n]);\n\nconst VALIDATION_BY_ENTRY_ID: Record<string, CredentialValidation> = {\n  slack: {\n    // Read-only: lists at most one channel. The Slack MCP server returns\n    // the raw Slack API JSON ({ok: boolean, error?: string}) as text.\n    toolCall: { name: \"slack_list_channels\", arguments: { limit: 1 } },\n    interpret: (toolResult) => {\n      if (toolResult.is_error) {\n        return toolResult.text || \"tool call failed\";\n      }\n      try {\n        const parsed = JSON.parse(toolResult.text);\n        if (parsed?.ok === false && SLACK_AUTH_FAILURES.has(parsed.error)) {\n          return String(parsed.error);\n        }\n      } catch {\n        // Non-JSON payload — make no claim about the credentials.\n      }\n      return null;\n    },\n  },\n};\n\n/**\n * Look up the credential validation for a server by matching it to its\n * marketplace catalog entry (same matching the MCP page uses for icons).\n * Returns undefined for custom servers — their test behaves as before.\n */\nexport function getCredentialValidationForServer(\n  server: MCPServerConfig,\n): CredentialValidation | undefined {\n  const entry = findCatalogEntryForServer(\n    server,\n    getMcpMarketplaceCatalog(MCP_MARKETPLACE),\n  );\n  return entry ? VALIDATION_BY_ENTRY_ID[entry.id] : undefined;\n}\n"],"mappings":";;;AAgCA,IAAM,IAAsB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACD,CAAC,EAEI,IAA+D,EACnE,OAAO;CAGL,UAAU;EAAE,MAAM;EAAuB,WAAW,EAAE,OAAO,GAAG;EAAE;CAClE,YAAY,MAAe;AACzB,MAAI,EAAW,SACb,QAAO,EAAW,QAAQ;AAE5B,MAAI;GACF,IAAM,IAAS,KAAK,MAAM,EAAW,KAAK;AAC1C,OAAI,GAAQ,OAAO,MAAS,EAAoB,IAAI,EAAO,MAAM,CAC/D,QAAO,OAAO,EAAO,MAAM;UAEvB;AAGR,SAAO;;CAEV,EACF;AAOD,SAAgB,EACd,GACkC;CAClC,IAAM,IAAQ,EACZ,GACA,EAAyB,EAAgB,CAC1C;AACD,QAAO,IAAQ,EAAuB,EAAM,MAAM,KAAA"}
+{"version":3,"file":"mcp-credential-validation.js","names":[],"sources":["../../src/utils/mcp-credential-validation.ts"],"sourcesContent":["import { INTEGRATION_CATALOG as MCP_MARKETPLACE } from \"@openhands/extensions/integrations\";\nimport {\n  findCatalogEntryForServer,\n  getMcpMarketplaceCatalog,\n} from \"#/utils/mcp-marketplace-utils\";\nimport type {\n  MCPServerConfig,\n  MCPTestToolCall,\n  MCPTestToolResult,\n} from \"#/types/mcp-server\";\n\n/**\n * Credential validation specs for marketplace MCP servers whose credentials\n * are only exercised on tool invocation (listing tools succeeds with any\n * credentials). The test endpoint runs `toolCall` after listing and reports\n * the outcome verbatim; `interpret` decides whether that outcome proves the\n * credentials are invalid.\n *\n * `toolCall` MUST be read-only — it runs on every \"Test connection\" /\n * pre-save validation.\n */\nexport interface CredentialValidation {\n  toolCall: MCPTestToolCall;\n  /** Returns the provider's error code/message, or null when creds pass. */\n  interpret: (toolResult: MCPTestToolResult) => string | null;\n}\n\n/**\n * Slack error codes that mean the credentials themselves are bad. Anything\n * else (e.g. `missing_scope`) proves the token *authenticated* — a valid\n * token lacking a scope must not be reported as invalid credentials.\n */\nconst SLACK_AUTH_FAILURES = new Set([\n  \"invalid_auth\",\n  \"not_authed\",\n  \"account_inactive\",\n  \"token_revoked\",\n  \"token_expired\",\n]);\n\n/**\n * Interpreter for hosted HTTP API servers (GitHub, Linear). The service only\n * calls `interpret` when the probe tool was advertised by the server AND\n * invoked, so `is_error` here means the read-only call itself failed — for a\n * \"who am I\" / \"list teams\" probe that is an auth/permission failure.\n */\nconst interpretReadOnlyToolResult = (\n  toolResult: MCPTestToolResult,\n): string | null =>\n  toolResult.is_error ? toolResult.text || \"tool call failed\" : null;\n\nconst VALIDATION_BY_ENTRY_ID: Record<string, CredentialValidation> = {\n  github: {\n    // Official GitHub MCP server (api.githubcopilot.com): read-only\n    // \"get details of the authenticated user\".\n    toolCall: { name: \"get_me\", arguments: {} },\n    interpret: interpretReadOnlyToolResult,\n  },\n  linear: {\n    // Linear hosted MCP (mcp.linear.app): read-only teams listing with no\n    // required arguments.\n    toolCall: { name: \"list_teams\", arguments: {} },\n    interpret: interpretReadOnlyToolResult,\n  },\n  slack: {\n    // Read-only: lists at most one channel. The Slack MCP server returns\n    // the raw Slack API JSON ({ok: boolean, error?: string}) as text.\n    toolCall: { name: \"slack_list_channels\", arguments: { limit: 1 } },\n    interpret: (toolResult) => {\n      if (toolResult.is_error) {\n        return toolResult.text || \"tool call failed\";\n      }\n      try {\n        const parsed = JSON.parse(toolResult.text);\n        if (parsed?.ok === false && SLACK_AUTH_FAILURES.has(parsed.error)) {\n          return String(parsed.error);\n        }\n      } catch {\n        // Non-JSON payload — make no claim about the credentials.\n      }\n      return null;\n    },\n  },\n};\n\n/**\n * Look up the credential validation for a server by matching it to its\n * marketplace catalog entry (same matching the MCP page uses for icons).\n * Returns undefined for custom servers — their test behaves as before.\n */\nexport function getCredentialValidationForServer(\n  server: MCPServerConfig,\n): CredentialValidation | undefined {\n  const entry = findCatalogEntryForServer(\n    server,\n    getMcpMarketplaceCatalog(MCP_MARKETPLACE),\n  );\n  return entry ? VALIDATION_BY_ENTRY_ID[entry.id] : undefined;\n}\n"],"mappings":";;;AAgCA,IAAM,IAAsB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACD,CAAC,EAQI,KACJ,MAEA,EAAW,WAAW,EAAW,QAAQ,qBAAqB,MAE1D,IAA+D;CACnE,QAAQ;EAGN,UAAU;GAAE,MAAM;GAAU,WAAW,EAAE;GAAE;EAC3C,WAAW;EACZ;CACD,QAAQ;EAGN,UAAU;GAAE,MAAM;GAAc,WAAW,EAAE;GAAE;EAC/C,WAAW;EACZ;CACD,OAAO;EAGL,UAAU;GAAE,MAAM;GAAuB,WAAW,EAAE,OAAO,GAAG;GAAE;EAClE,YAAY,MAAe;AACzB,OAAI,EAAW,SACb,QAAO,EAAW,QAAQ;AAE5B,OAAI;IACF,IAAM,IAAS,KAAK,MAAM,EAAW,KAAK;AAC1C,QAAI,GAAQ,OAAO,MAAS,EAAoB,IAAI,EAAO,MAAM,CAC/D,QAAO,OAAO,EAAO,MAAM;WAEvB;AAGR,UAAO;;EAEV;CACF;AAOD,SAAgB,EACd,GACkC;CAClC,IAAM,IAAQ,EACZ,GACA,EAAyB,EAAgB,CAC1C;AACD,QAAO,IAAQ,EAAuB,EAAM,MAAM,KAAA"}

package/dist/utils/mcp-server-health-key.cjs

@@ -0,0 +1,2 @@
+require(`../_virtual/_rolldown/runtime.cjs`);var e=e=>Object.keys(e??{}).sort();function t(t){return t.type===`stdio`?JSON.stringify({type:t.type,name:t.name??``,command:t.command??``,args:t.args??[],envKeys:e(t.env)}):JSON.stringify({type:t.type,name:t.name??``,url:t.url??``,headerKeys:e(t.headers),authStrategy:t.auth?.strategy??``,authHeaderName:t.auth?.strategy===`api_key`?t.auth.header_name??``:``,authHeaderKeys:t.auth?.strategy===`header`?e(t.auth.headers):[]})}exports.getMcpServerHealthKey=t;
+//# sourceMappingURL=mcp-server-health-key.cjs.map

package/dist/utils/mcp-server-health-key.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-health-key.cjs","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes\n * duplicates `github` → `github_1`), which makes the key unique per stored\n * server and stable across list reordering — unlike the positional\n * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":"6CAEA,IAAM,EAAc,GAClB,OAAO,KAAK,GAAU,EAAE,CAAC,CAAC,MAAM,CAgBlC,SAAgB,EAAsB,EAAiC,CAUrE,OATI,EAAO,OAAS,QACX,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,QAAS,EAAO,SAAW,GAC3B,KAAM,EAAO,MAAQ,EAAE,CACvB,QAAS,EAAW,EAAO,IAAI,CAChC,CAAC,CAEG,KAAK,UAAU,CACpB,KAAM,EAAO,KACb,KAAM,EAAO,MAAQ,GACrB,IAAK,EAAO,KAAO,GACnB,WAAY,EAAW,EAAO,QAAQ,CACtC,aAAc,EAAO,MAAM,UAAY,GACvC,eACE,EAAO,MAAM,WAAa,UACrB,EAAO,KAAK,aAAe,GAC5B,GACN,eACE,EAAO,MAAM,WAAa,SAAW,EAAW,EAAO,KAAK,QAAQ,CAAG,EAAE,CAC5E,CAAC"}

package/dist/utils/mcp-server-health-key.d.ts

@@ -0,0 +1,16 @@
+import type { MCPServerConfig } from "#/types/mcp-server";
+/**
+ * Stable identity for a server's health entry.
+ *
+ * Built from the server's structural, non-secret fields. Names are included
+ * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes
+ * duplicates `github` → `github_1`), which makes the key unique per stored
+ * server and stable across list reordering — unlike the positional
+ * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:
+ * the same credential legitimately appears as plaintext at install time,
+ * `**********` in redacted settings, and ciphertext in test requests, so any
+ * of them would make the key flap. A structural edit (URL, command, header
+ * names, auth strategy, ...) therefore produces a new key, orphaning the old
+ * health entry instead of misattributing it.
+ */
+export declare function getMcpServerHealthKey(server: MCPServerConfig): string;

package/dist/utils/mcp-server-health-key.js

@@ -0,0 +1,23 @@
+//#region src/utils/mcp-server-health-key.ts
+var e = (e) => Object.keys(e ?? {}).sort();
+function t(t) {
+	return t.type === "stdio" ? JSON.stringify({
+		type: t.type,
+		name: t.name ?? "",
+		command: t.command ?? "",
+		args: t.args ?? [],
+		envKeys: e(t.env)
+	}) : JSON.stringify({
+		type: t.type,
+		name: t.name ?? "",
+		url: t.url ?? "",
+		headerKeys: e(t.headers),
+		authStrategy: t.auth?.strategy ?? "",
+		authHeaderName: t.auth?.strategy === "api_key" ? t.auth.header_name ?? "" : "",
+		authHeaderKeys: t.auth?.strategy === "header" ? e(t.auth.headers) : []
+	});
+}
+//#endregion
+export { t as getMcpServerHealthKey };
+
+//# sourceMappingURL=mcp-server-health-key.js.map

package/dist/utils/mcp-server-health-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-health-key.js","names":[],"sources":["../../src/utils/mcp-server-health-key.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\n\nconst sortedKeys = (record?: Record<string, string> | null): string[] =>\n  Object.keys(record ?? {}).sort();\n\n/**\n * Stable identity for a server's health entry.\n *\n * Built from the server's structural, non-secret fields. Names are included\n * because persisted configs are keyed by name (`toSdkMcpConfig` suffixes\n * duplicates `github` → `github_1`), which makes the key unique per stored\n * server and stable across list reordering — unlike the positional\n * `sse-0`/`stdio-1` ids from `flattenMcpConfig`. Secret VALUES are excluded:\n * the same credential legitimately appears as plaintext at install time,\n * `**********` in redacted settings, and ciphertext in test requests, so any\n * of them would make the key flap. A structural edit (URL, command, header\n * names, auth strategy, ...) therefore produces a new key, orphaning the old\n * health entry instead of misattributing it.\n */\nexport function getMcpServerHealthKey(server: MCPServerConfig): string {\n  if (server.type === \"stdio\") {\n    return JSON.stringify({\n      type: server.type,\n      name: server.name ?? \"\",\n      command: server.command ?? \"\",\n      args: server.args ?? [],\n      envKeys: sortedKeys(server.env),\n    });\n  }\n  return JSON.stringify({\n    type: server.type,\n    name: server.name ?? \"\",\n    url: server.url ?? \"\",\n    headerKeys: sortedKeys(server.headers),\n    authStrategy: server.auth?.strategy ?? \"\",\n    authHeaderName:\n      server.auth?.strategy === \"api_key\"\n        ? (server.auth.header_name ?? \"\")\n        : \"\",\n    authHeaderKeys:\n      server.auth?.strategy === \"header\" ? sortedKeys(server.auth.headers) : [],\n  });\n}\n"],"mappings":";AAEA,IAAM,KAAc,MAClB,OAAO,KAAK,KAAU,EAAE,CAAC,CAAC,MAAM;AAgBlC,SAAgB,EAAsB,GAAiC;AAUrE,QATI,EAAO,SAAS,UACX,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,SAAS,EAAO,WAAW;EAC3B,MAAM,EAAO,QAAQ,EAAE;EACvB,SAAS,EAAW,EAAO,IAAI;EAChC,CAAC,GAEG,KAAK,UAAU;EACpB,MAAM,EAAO;EACb,MAAM,EAAO,QAAQ;EACrB,KAAK,EAAO,OAAO;EACnB,YAAY,EAAW,EAAO,QAAQ;EACtC,cAAc,EAAO,MAAM,YAAY;EACvC,gBACE,EAAO,MAAM,aAAa,YACrB,EAAO,KAAK,eAAe,KAC5B;EACN,gBACE,EAAO,MAAM,aAAa,WAAW,EAAW,EAAO,KAAK,QAAQ,GAAG,EAAE;EAC5E,CAAC"}

package/dist/utils/mcp-test-error-message.cjs

@@ -0,0 +1,2 @@
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../i18n/declaration.cjs`);function t(t,n,r){switch(n){case`timeout`:return t(e.I18nKey.MCP$TEST_ERROR_TIMEOUT);case`connection`:return t(e.I18nKey.MCP$TEST_ERROR_CONNECTION);case`credentials`:return t(e.I18nKey.MCP$TEST_ERROR_CREDENTIALS,{error:r});default:return t(e.I18nKey.MCP$TEST_ERROR_UNKNOWN,{error:r})}}exports.makeMcpTestErrorMessage=t;
+//# sourceMappingURL=mcp-test-error-message.cjs.map

package/dist/utils/mcp-test-error-message.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-test-error-message.cjs","names":[],"sources":["../../src/utils/mcp-test-error-message.ts"],"sourcesContent":["import type { TFunction } from \"i18next\";\nimport { I18nKey } from \"#/i18n/declaration\";\nimport type { ExtendedMCPTestFailureKind } from \"#/types/mcp-server\";\n\n/**\n * Kind-specific, localized guidance for a failed MCP connection test.\n * `error` is interpolated for the kinds whose message surfaces the provider\n * detail — callers pass display-safe (redacted) text.\n */\nexport function makeMcpTestErrorMessage(\n  t: TFunction<\"openhands\">,\n  errorKind: ExtendedMCPTestFailureKind,\n  error: string,\n): string {\n  switch (errorKind) {\n    case \"timeout\":\n      return t(I18nKey.MCP$TEST_ERROR_TIMEOUT);\n    case \"connection\":\n      return t(I18nKey.MCP$TEST_ERROR_CONNECTION);\n    case \"credentials\":\n      return t(I18nKey.MCP$TEST_ERROR_CREDENTIALS, { error });\n    default:\n      return t(I18nKey.MCP$TEST_ERROR_UNKNOWN, { error });\n  }\n}\n"],"mappings":"wFASA,SAAgB,EACd,EACA,EACA,EACQ,CACR,OAAQ,EAAR,CACE,IAAK,UACH,OAAO,EAAE,EAAA,QAAQ,uBAAuB,CAC1C,IAAK,aACH,OAAO,EAAE,EAAA,QAAQ,0BAA0B,CAC7C,IAAK,cACH,OAAO,EAAE,EAAA,QAAQ,2BAA4B,CAAE,QAAO,CAAC,CACzD,QACE,OAAO,EAAE,EAAA,QAAQ,uBAAwB,CAAE,QAAO,CAAC"}

package/dist/utils/mcp-test-error-message.d.ts

@@ -0,0 +1,8 @@
+import type { TFunction } from "i18next";
+import type { ExtendedMCPTestFailureKind } from "#/types/mcp-server";
+/**
+ * Kind-specific, localized guidance for a failed MCP connection test.
+ * `error` is interpolated for the kinds whose message surfaces the provider
+ * detail — callers pass display-safe (redacted) text.
+ */
+export declare function makeMcpTestErrorMessage(t: TFunction<"openhands">, errorKind: ExtendedMCPTestFailureKind, error: string): string;

package/dist/utils/mcp-test-error-message.js

@@ -0,0 +1,14 @@
+import { I18nKey as e } from "../i18n/declaration.js";
+//#region src/utils/mcp-test-error-message.ts
+function t(t, n, r) {
+	switch (n) {
+		case "timeout": return t(e.MCP$TEST_ERROR_TIMEOUT);
+		case "connection": return t(e.MCP$TEST_ERROR_CONNECTION);
+		case "credentials": return t(e.MCP$TEST_ERROR_CREDENTIALS, { error: r });
+		default: return t(e.MCP$TEST_ERROR_UNKNOWN, { error: r });
+	}
+}
+//#endregion
+export { t as makeMcpTestErrorMessage };
+
+//# sourceMappingURL=mcp-test-error-message.js.map

package/dist/utils/mcp-test-error-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-test-error-message.js","names":[],"sources":["../../src/utils/mcp-test-error-message.ts"],"sourcesContent":["import type { TFunction } from \"i18next\";\nimport { I18nKey } from \"#/i18n/declaration\";\nimport type { ExtendedMCPTestFailureKind } from \"#/types/mcp-server\";\n\n/**\n * Kind-specific, localized guidance for a failed MCP connection test.\n * `error` is interpolated for the kinds whose message surfaces the provider\n * detail — callers pass display-safe (redacted) text.\n */\nexport function makeMcpTestErrorMessage(\n  t: TFunction<\"openhands\">,\n  errorKind: ExtendedMCPTestFailureKind,\n  error: string,\n): string {\n  switch (errorKind) {\n    case \"timeout\":\n      return t(I18nKey.MCP$TEST_ERROR_TIMEOUT);\n    case \"connection\":\n      return t(I18nKey.MCP$TEST_ERROR_CONNECTION);\n    case \"credentials\":\n      return t(I18nKey.MCP$TEST_ERROR_CREDENTIALS, { error });\n    default:\n      return t(I18nKey.MCP$TEST_ERROR_UNKNOWN, { error });\n  }\n}\n"],"mappings":";;AASA,SAAgB,EACd,GACA,GACA,GACQ;AACR,SAAQ,GAAR;EACE,KAAK,UACH,QAAO,EAAE,EAAQ,uBAAuB;EAC1C,KAAK,aACH,QAAO,EAAE,EAAQ,0BAA0B;EAC7C,KAAK,cACH,QAAO,EAAE,EAAQ,4BAA4B,EAAE,UAAO,CAAC;EACzD,QACE,QAAO,EAAE,EAAQ,wBAAwB,EAAE,UAAO,CAAC"}

package/dist/utils/redact-mcp-secrets.cjs

@@ -0,0 +1,2 @@
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`./mcp-config.cjs`);var t=4,n=/token|key|secret|auth/i,r=[/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bxox[a-z](?:-[A-Za-z0-9]+)+/g,/\blin_api_[A-Za-z0-9]{10,}\b/g,/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g],i=/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;function a(e,n){typeof n==`string`&&(n.length<t||n!==`**********`&&e.add(n))}function o(e,t){for(let n of Object.values(t??{}))a(e,n)}function s(e,t){if(t)try{let r=new URL(t);a(e,r.username),a(e,r.password),a(e,decodeURIComponent(r.username)),a(e,decodeURIComponent(r.password)),r.searchParams.forEach((t,r)=>{n.test(r)&&a(e,t)})}catch{}}function c(e,t){if(t)switch(t.strategy){case`api_key`:case`bearer`:a(e,t.value);break;case`basic`:a(e,t.username),a(e,t.password);break;case`header`:o(e,t.headers);break;case`oauth2`:a(e,t.authentication?.client_secret),o(e,t.state?.tokens);break;default:break}}function l(e){let t=new Set;return o(t,e.env),o(t,e.headers),c(t,e.auth),s(t,e.url),[...t].sort((e,t)=>t.length-e.length)}function u(t,...n){if(!t)return t;let a=t;for(let t of n)if(t)for(let n of l(t))a=a.split(n).join(e.REDACTED_MCP_SECRET_VALUE);a=a.replace(i,`Bearer ${e.REDACTED_MCP_SECRET_VALUE}`);for(let t of r)a=a.replace(t,e.REDACTED_MCP_SECRET_VALUE);return a}exports.redactMcpSecrets=u;
+//# sourceMappingURL=redact-mcp-secrets.cjs.map

package/dist/utils/redact-mcp-secrets.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-mcp-secrets.cjs","names":[],"sources":["../../src/utils/redact-mcp-secrets.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { REDACTED_MCP_SECRET_VALUE } from \"#/utils/mcp-config\";\n\n/**\n * Minimum length for a config value to be treated as a redactable secret.\n * Shorter strings are too likely to collide with ordinary words in an\n * error message and would mangle it without hiding anything meaningful.\n */\nconst MIN_SECRET_LENGTH = 4;\n\nconst SECRETLIKE_PARAM_NAME = /token|key|secret|auth/i;\n\n/**\n * Token shapes that may appear in backend error text even when the browser\n * never held the plaintext value (stored secrets round-trip encrypted and\n * are decrypted server-side, so a spawn/connect error can echo them back).\n */\nconst GENERIC_SECRET_PATTERNS: RegExp[] = [\n  // GitHub personal access tokens (classic and fine-grained).\n  /\\bgh[pousr]_[A-Za-z0-9]{16,}\\b/g,\n  /\\bgithub_pat_[A-Za-z0-9_]{20,}\\b/g,\n  // Slack workspace tokens (xoxb-, xoxp-, xoxs-, ...).\n  /\\bxox[a-z](?:-[A-Za-z0-9]+)+/g,\n  // Linear API keys.\n  /\\blin_api_[A-Za-z0-9]{10,}\\b/g,\n  // JWT-shaped values (three base64url segments starting with \"eyJ\").\n  /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}\\b/g,\n];\n\n// \"Bearer <token>\" keeps its prefix so the message stays readable.\nconst BEARER_PATTERN = /\\bBearer\\s+[A-Za-z0-9._~+/=-]{8,}/gi;\n\nfunction addValue(values: Set<string>, value: unknown): void {\n  if (typeof value !== \"string\") return;\n  if (value.length < MIN_SECRET_LENGTH) return;\n  if (value === REDACTED_MCP_SECRET_VALUE) return;\n  values.add(value);\n}\n\nfunction addRecordValues(\n  values: Set<string>,\n  record: Record<string, unknown> | null | undefined,\n): void {\n  for (const value of Object.values(record ?? {})) {\n    addValue(values, value);\n  }\n}\n\nfunction addUrlSecrets(values: Set<string>, rawUrl: string | undefined): void {\n  if (!rawUrl) return;\n  try {\n    const url = new URL(rawUrl);\n    addValue(values, url.username);\n    addValue(values, url.password);\n    addValue(values, decodeURIComponent(url.username));\n    addValue(values, decodeURIComponent(url.password));\n    url.searchParams.forEach((value, name) => {\n      if (SECRETLIKE_PARAM_NAME.test(name)) addValue(values, value);\n    });\n  } catch {\n    // Not a parseable URL — nothing to collect.\n  }\n}\n\nfunction addAuthSecrets(\n  values: Set<string>,\n  auth: MCPServerConfig[\"auth\"],\n): void {\n  if (!auth) return;\n  switch (auth.strategy) {\n    case \"api_key\":\n    case \"bearer\":\n      addValue(values, auth.value);\n      break;\n    case \"basic\":\n      addValue(values, auth.username);\n      addValue(values, auth.password);\n      break;\n    case \"header\":\n      addRecordValues(values, auth.headers);\n      break;\n    case \"oauth2\":\n      addValue(values, auth.authentication?.client_secret);\n      addRecordValues(values, auth.state?.tokens);\n      break;\n    default:\n      break;\n  }\n}\n\n/**\n * Collect every secret VALUE a server config may carry, longest first so\n * replacing a shorter secret can never split a longer one that contains it.\n */\nexport function collectMcpSecretValues(server: MCPServerConfig): string[] {\n  const values = new Set<string>();\n  addRecordValues(values, server.env);\n  addRecordValues(values, server.headers);\n  addAuthSecrets(values, server.auth);\n  addUrlSecrets(values, server.url);\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\n/**\n * Scrub secrets from MCP test/probe error text before it is displayed.\n * Replaces every known secret value from the given server config(s), then\n * applies generic token patterns as a safety net for plaintext the browser\n * never saw (e.g. values decrypted server-side and echoed in an error).\n */\nexport function redactMcpSecrets(\n  text: string,\n  ...servers: (MCPServerConfig | undefined)[]\n): string {\n  if (!text) return text;\n  let redacted = text;\n  for (const server of servers) {\n    if (!server) continue;\n    for (const value of collectMcpSecretValues(server)) {\n      redacted = redacted.split(value).join(REDACTED_MCP_SECRET_VALUE);\n    }\n  }\n  redacted = redacted.replace(\n    BEARER_PATTERN,\n    `Bearer ${REDACTED_MCP_SECRET_VALUE}`,\n  );\n  for (const pattern of GENERIC_SECRET_PATTERNS) {\n    redacted = redacted.replace(pattern, REDACTED_MCP_SECRET_VALUE);\n  }\n  return redacted;\n}\n"],"mappings":"iFAQA,IAAM,EAAoB,EAEpB,EAAwB,yBAOxB,EAAoC,CAExC,kCACA,oCAEA,gCAEA,gCAEA,mEACD,CAGK,EAAiB,sCAEvB,SAAS,EAAS,EAAqB,EAAsB,CACvD,OAAO,GAAU,WACjB,EAAM,OAAS,GACf,IAAA,cACJ,EAAO,IAAI,EAAM,EAGnB,SAAS,EACP,EACA,EACM,CACN,IAAK,IAAM,KAAS,OAAO,OAAO,GAAU,EAAE,CAAC,CAC7C,EAAS,EAAQ,EAAM,CAI3B,SAAS,EAAc,EAAqB,EAAkC,CACvE,KACL,GAAI,CACF,IAAM,EAAM,IAAI,IAAI,EAAO,CAC3B,EAAS,EAAQ,EAAI,SAAS,CAC9B,EAAS,EAAQ,EAAI,SAAS,CAC9B,EAAS,EAAQ,mBAAmB,EAAI,SAAS,CAAC,CAClD,EAAS,EAAQ,mBAAmB,EAAI,SAAS,CAAC,CAClD,EAAI,aAAa,SAAS,EAAO,IAAS,CACpC,EAAsB,KAAK,EAAK,EAAE,EAAS,EAAQ,EAAM,EAC7D,MACI,GAKV,SAAS,EACP,EACA,EACM,CACD,KACL,OAAQ,EAAK,SAAb,CACE,IAAK,UACL,IAAK,SACH,EAAS,EAAQ,EAAK,MAAM,CAC5B,MACF,IAAK,QACH,EAAS,EAAQ,EAAK,SAAS,CAC/B,EAAS,EAAQ,EAAK,SAAS,CAC/B,MACF,IAAK,SACH,EAAgB,EAAQ,EAAK,QAAQ,CACrC,MACF,IAAK,SACH,EAAS,EAAQ,EAAK,gBAAgB,cAAc,CACpD,EAAgB,EAAQ,EAAK,OAAO,OAAO,CAC3C,MACF,QACE,OAQN,SAAgB,EAAuB,EAAmC,CACxE,IAAM,EAAS,IAAI,IAKnB,OAJA,EAAgB,EAAQ,EAAO,IAAI,CACnC,EAAgB,EAAQ,EAAO,QAAQ,CACvC,EAAe,EAAQ,EAAO,KAAK,CACnC,EAAc,EAAQ,EAAO,IAAI,CAC1B,CAAC,GAAG,EAAO,CAAC,MAAM,EAAG,IAAM,EAAE,OAAS,EAAE,OAAO,CASxD,SAAgB,EACd,EACA,GAAG,EACK,CACR,GAAI,CAAC,EAAM,OAAO,EAClB,IAAI,EAAW,EACf,IAAK,IAAM,KAAU,EACd,KACL,IAAK,IAAM,KAAS,EAAuB,EAAO,CAChD,EAAW,EAAS,MAAM,EAAM,CAAC,KAAK,EAAA,0BAA0B,CAGpE,EAAW,EAAS,QAClB,EACA,UAAU,EAAA,4BACX,CACD,IAAK,IAAM,KAAW,EACpB,EAAW,EAAS,QAAQ,EAAS,EAAA,0BAA0B,CAEjE,OAAO"}

package/dist/utils/redact-mcp-secrets.d.ts

@@ -0,0 +1,13 @@
+import type { MCPServerConfig } from "#/types/mcp-server";
+/**
+ * Collect every secret VALUE a server config may carry, longest first so
+ * replacing a shorter secret can never split a longer one that contains it.
+ */
+export declare function collectMcpSecretValues(server: MCPServerConfig): string[];
+/**
+ * Scrub secrets from MCP test/probe error text before it is displayed.
+ * Replaces every known secret value from the given server config(s), then
+ * applies generic token patterns as a safety net for plaintext the browser
+ * never saw (e.g. values decrypted server-side and echoed in an error).
+ */
+export declare function redactMcpSecrets(text: string, ...servers: (MCPServerConfig | undefined)[]): string;

package/dist/utils/redact-mcp-secrets.js

@@ -0,0 +1,57 @@
+import { REDACTED_MCP_SECRET_VALUE as e } from "./mcp-config.js";
+//#region src/utils/redact-mcp-secrets.ts
+var t = 4, n = /token|key|secret|auth/i, r = [
+	/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+	/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+	/\bxox[a-z](?:-[A-Za-z0-9]+)+/g,
+	/\blin_api_[A-Za-z0-9]{10,}\b/g,
+	/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g
+], i = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function a(e, n) {
+	typeof n == "string" && (n.length < t || n !== "**********" && e.add(n));
+}
+function o(e, t) {
+	for (let n of Object.values(t ?? {})) a(e, n);
+}
+function s(e, t) {
+	if (t) try {
+		let r = new URL(t);
+		a(e, r.username), a(e, r.password), a(e, decodeURIComponent(r.username)), a(e, decodeURIComponent(r.password)), r.searchParams.forEach((t, r) => {
+			n.test(r) && a(e, t);
+		});
+	} catch {}
+}
+function c(e, t) {
+	if (t) switch (t.strategy) {
+		case "api_key":
+		case "bearer":
+			a(e, t.value);
+			break;
+		case "basic":
+			a(e, t.username), a(e, t.password);
+			break;
+		case "header":
+			o(e, t.headers);
+			break;
+		case "oauth2":
+			a(e, t.authentication?.client_secret), o(e, t.state?.tokens);
+			break;
+		default: break;
+	}
+}
+function l(e) {
+	let t = /* @__PURE__ */ new Set();
+	return o(t, e.env), o(t, e.headers), c(t, e.auth), s(t, e.url), [...t].sort((e, t) => t.length - e.length);
+}
+function u(t, ...n) {
+	if (!t) return t;
+	let a = t;
+	for (let t of n) if (t) for (let n of l(t)) a = a.split(n).join(e);
+	a = a.replace(i, `Bearer ${e}`);
+	for (let t of r) a = a.replace(t, e);
+	return a;
+}
+//#endregion
+export { u as redactMcpSecrets };
+
+//# sourceMappingURL=redact-mcp-secrets.js.map

package/dist/utils/redact-mcp-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-mcp-secrets.js","names":[],"sources":["../../src/utils/redact-mcp-secrets.ts"],"sourcesContent":["import type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { REDACTED_MCP_SECRET_VALUE } from \"#/utils/mcp-config\";\n\n/**\n * Minimum length for a config value to be treated as a redactable secret.\n * Shorter strings are too likely to collide with ordinary words in an\n * error message and would mangle it without hiding anything meaningful.\n */\nconst MIN_SECRET_LENGTH = 4;\n\nconst SECRETLIKE_PARAM_NAME = /token|key|secret|auth/i;\n\n/**\n * Token shapes that may appear in backend error text even when the browser\n * never held the plaintext value (stored secrets round-trip encrypted and\n * are decrypted server-side, so a spawn/connect error can echo them back).\n */\nconst GENERIC_SECRET_PATTERNS: RegExp[] = [\n  // GitHub personal access tokens (classic and fine-grained).\n  /\\bgh[pousr]_[A-Za-z0-9]{16,}\\b/g,\n  /\\bgithub_pat_[A-Za-z0-9_]{20,}\\b/g,\n  // Slack workspace tokens (xoxb-, xoxp-, xoxs-, ...).\n  /\\bxox[a-z](?:-[A-Za-z0-9]+)+/g,\n  // Linear API keys.\n  /\\blin_api_[A-Za-z0-9]{10,}\\b/g,\n  // JWT-shaped values (three base64url segments starting with \"eyJ\").\n  /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}\\b/g,\n];\n\n// \"Bearer <token>\" keeps its prefix so the message stays readable.\nconst BEARER_PATTERN = /\\bBearer\\s+[A-Za-z0-9._~+/=-]{8,}/gi;\n\nfunction addValue(values: Set<string>, value: unknown): void {\n  if (typeof value !== \"string\") return;\n  if (value.length < MIN_SECRET_LENGTH) return;\n  if (value === REDACTED_MCP_SECRET_VALUE) return;\n  values.add(value);\n}\n\nfunction addRecordValues(\n  values: Set<string>,\n  record: Record<string, unknown> | null | undefined,\n): void {\n  for (const value of Object.values(record ?? {})) {\n    addValue(values, value);\n  }\n}\n\nfunction addUrlSecrets(values: Set<string>, rawUrl: string | undefined): void {\n  if (!rawUrl) return;\n  try {\n    const url = new URL(rawUrl);\n    addValue(values, url.username);\n    addValue(values, url.password);\n    addValue(values, decodeURIComponent(url.username));\n    addValue(values, decodeURIComponent(url.password));\n    url.searchParams.forEach((value, name) => {\n      if (SECRETLIKE_PARAM_NAME.test(name)) addValue(values, value);\n    });\n  } catch {\n    // Not a parseable URL — nothing to collect.\n  }\n}\n\nfunction addAuthSecrets(\n  values: Set<string>,\n  auth: MCPServerConfig[\"auth\"],\n): void {\n  if (!auth) return;\n  switch (auth.strategy) {\n    case \"api_key\":\n    case \"bearer\":\n      addValue(values, auth.value);\n      break;\n    case \"basic\":\n      addValue(values, auth.username);\n      addValue(values, auth.password);\n      break;\n    case \"header\":\n      addRecordValues(values, auth.headers);\n      break;\n    case \"oauth2\":\n      addValue(values, auth.authentication?.client_secret);\n      addRecordValues(values, auth.state?.tokens);\n      break;\n    default:\n      break;\n  }\n}\n\n/**\n * Collect every secret VALUE a server config may carry, longest first so\n * replacing a shorter secret can never split a longer one that contains it.\n */\nexport function collectMcpSecretValues(server: MCPServerConfig): string[] {\n  const values = new Set<string>();\n  addRecordValues(values, server.env);\n  addRecordValues(values, server.headers);\n  addAuthSecrets(values, server.auth);\n  addUrlSecrets(values, server.url);\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\n/**\n * Scrub secrets from MCP test/probe error text before it is displayed.\n * Replaces every known secret value from the given server config(s), then\n * applies generic token patterns as a safety net for plaintext the browser\n * never saw (e.g. values decrypted server-side and echoed in an error).\n */\nexport function redactMcpSecrets(\n  text: string,\n  ...servers: (MCPServerConfig | undefined)[]\n): string {\n  if (!text) return text;\n  let redacted = text;\n  for (const server of servers) {\n    if (!server) continue;\n    for (const value of collectMcpSecretValues(server)) {\n      redacted = redacted.split(value).join(REDACTED_MCP_SECRET_VALUE);\n    }\n  }\n  redacted = redacted.replace(\n    BEARER_PATTERN,\n    `Bearer ${REDACTED_MCP_SECRET_VALUE}`,\n  );\n  for (const pattern of GENERIC_SECRET_PATTERNS) {\n    redacted = redacted.replace(pattern, REDACTED_MCP_SECRET_VALUE);\n  }\n  return redacted;\n}\n"],"mappings":";;AAQA,IAAM,IAAoB,GAEpB,IAAwB,0BAOxB,IAAoC;CAExC;CACA;CAEA;CAEA;CAEA;CACD,EAGK,IAAiB;AAEvB,SAAS,EAAS,GAAqB,GAAsB;AACvD,QAAO,KAAU,aACjB,EAAM,SAAS,KACf,MAAA,gBACJ,EAAO,IAAI,EAAM;;AAGnB,SAAS,EACP,GACA,GACM;AACN,MAAK,IAAM,KAAS,OAAO,OAAO,KAAU,EAAE,CAAC,CAC7C,GAAS,GAAQ,EAAM;;AAI3B,SAAS,EAAc,GAAqB,GAAkC;AACvE,OACL,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,EAAO;AAK3B,EAJA,EAAS,GAAQ,EAAI,SAAS,EAC9B,EAAS,GAAQ,EAAI,SAAS,EAC9B,EAAS,GAAQ,mBAAmB,EAAI,SAAS,CAAC,EAClD,EAAS,GAAQ,mBAAmB,EAAI,SAAS,CAAC,EAClD,EAAI,aAAa,SAAS,GAAO,MAAS;AACxC,GAAI,EAAsB,KAAK,EAAK,IAAE,EAAS,GAAQ,EAAM;IAC7D;SACI;;AAKV,SAAS,EACP,GACA,GACM;AACD,OACL,SAAQ,EAAK,UAAb;EACE,KAAK;EACL,KAAK;AACH,KAAS,GAAQ,EAAK,MAAM;AAC5B;EACF,KAAK;AAEH,GADA,EAAS,GAAQ,EAAK,SAAS,EAC/B,EAAS,GAAQ,EAAK,SAAS;AAC/B;EACF,KAAK;AACH,KAAgB,GAAQ,EAAK,QAAQ;AACrC;EACF,KAAK;AAEH,GADA,EAAS,GAAQ,EAAK,gBAAgB,cAAc,EACpD,EAAgB,GAAQ,EAAK,OAAO,OAAO;AAC3C;EACF,QACE;;;AAQN,SAAgB,EAAuB,GAAmC;CACxE,IAAM,oBAAS,IAAI,KAAa;AAKhC,QAJA,EAAgB,GAAQ,EAAO,IAAI,EACnC,EAAgB,GAAQ,EAAO,QAAQ,EACvC,EAAe,GAAQ,EAAO,KAAK,EACnC,EAAc,GAAQ,EAAO,IAAI,EAC1B,CAAC,GAAG,EAAO,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO;;AASxD,SAAgB,EACd,GACA,GAAG,GACK;AACR,KAAI,CAAC,EAAM,QAAO;CAClB,IAAI,IAAW;AACf,MAAK,IAAM,KAAU,EACd,OACL,MAAK,IAAM,KAAS,EAAuB,EAAO,CAChD,KAAW,EAAS,MAAM,EAAM,CAAC,KAAK,EAA0B;AAGpE,KAAW,EAAS,QAClB,GACA,UAAU,IACX;AACD,MAAK,IAAM,KAAW,EACpB,KAAW,EAAS,QAAQ,GAAS,EAA0B;AAEjE,QAAO"}

package/dist/utils/settings-utils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-utils.cjs","names":[],"sources":["../../src/utils/settings-utils.ts"],"sourcesContent":["import { WebClientFeatureFlags } from \"#/api/option-service/option.types\";\nimport { Settings, SettingsValue } from \"#/types/settings\";\nimport { getProviderId } from \"#/utils/map-provider\";\n\nconst extractBasicFormData = (formData: FormData) => {\n  const providerDisplay = formData.get(\"llm-provider-input\")?.toString();\n  const provider = providerDisplay ? getProviderId(providerDisplay) : undefined;\n  const model = formData.get(\"llm-model-input\")?.toString();\n\n  return {\n    llmModel: provider && model ? `${provider}/${model}` : undefined,\n    llmApiKey: formData.get(\"llm-api-key-input\")?.toString(),\n    agent: formData.get(\"agent\")?.toString(),\n    language: formData.get(\"language\")?.toString(),\n  };\n};\n\nexport const parseMaxBudgetPerTask = (value: string): number | null => {\n  if (!value) {\n    return null;\n  }\n\n  const parsedValue = parseFloat(value);\n  return parsedValue && parsedValue >= 1 && Number.isFinite(parsedValue)\n    ? parsedValue\n    : null;\n};\n\nexport const extractSettings = (\n  formData: FormData,\n): Partial<Settings> & Record<string, unknown> => {\n  const { llmModel, llmApiKey, agent, language } =\n    extractBasicFormData(formData);\n\n  const llm: Record<string, unknown> = {};\n  if (llmModel) llm.model = llmModel;\n  if (llmApiKey !== undefined) llm.api_key = llmApiKey;\n\n  const agentSettings: Record<string, SettingsValue> = {};\n  if (Object.keys(llm).length > 0)\n    agentSettings.llm = llm as Record<string, SettingsValue>;\n  if (agent) agentSettings.agent = agent;\n\n  return {\n    ...(Object.keys(agentSettings).length > 0\n      ? { agent_settings_diff: agentSettings }\n      : {}),\n    ...(language ? { language } : {}),\n  };\n};\n\nexport function isSettingsPageHidden(\n  path: string,\n  featureFlags: WebClientFeatureFlags | undefined,\n): boolean {\n  if (featureFlags?.hide_llm_settings && path === \"/settings/llm\") return true;\n  return false;\n}\n\nexport function getFirstAvailablePath(\n  featureFlags: WebClientFeatureFlags | undefined,\n): string | null {\n  // ``/settings/agents`` (the Agent Profile library — the \"Agent\" page) always\n  // wins: it is where the agent is defined (OpenHands / ACP, via the active\n  // profile) and is always available regardless of feature flags. Landing here\n  // keeps routing simple — ACP users no longer have to bounce through\n  // ``/settings/llm`` (which is disabled for them), and OpenHands users are one\n  // nav-click away from the LLM page.\n  const fallbackOrder = [\n    { path: \"/settings/agents\", hidden: false },\n    { path: \"/settings/llm\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings/app\", hidden: false },\n    { path: \"/settings/secrets\", hidden: false },\n  ];\n\n  const firstAvailable = fallbackOrder.find((item) => !item.hidden);\n  return firstAvailable?.path ?? null;\n}\n"],"mappings":"mFAIA,IAAM,EAAwB,GAAuB,CACnD,IAAM,EAAkB,EAAS,IAAI,qBAAqB,EAAE,UAAU,CAChE,EAAW,EAAkB,EAAA,cAAc,EAAgB,CAAG,IAAA,GAC9D,EAAQ,EAAS,IAAI,kBAAkB,EAAE,UAAU,CAEzD,MAAO,CACL,SAAU,GAAY,EAAQ,GAAG,EAAS,GAAG,IAAU,IAAA,GACvD,UAAW,EAAS,IAAI,oBAAoB,EAAE,UAAU,CACxD,MAAO,EAAS,IAAI,QAAQ,EAAE,UAAU,CACxC,SAAU,EAAS,IAAI,WAAW,EAAE,UAAU,CAC/C,EAcU,EACX,GACgD,CAChD,GAAM,CAAE,WAAU,YAAW,QAAO,YAClC,EAAqB,EAAS,CAE1B,EAA+B,EAAE,CACnC,IAAU,EAAI,MAAQ,GACtB,IAAc,IAAA,KAAW,EAAI,QAAU,GAE3C,IAAM,EAA+C,EAAE,CAKvD,OAJI,OAAO,KAAK,EAAI,CAAC,OAAS,IAC5B,EAAc,IAAM,GAClB,IAAO,EAAc,MAAQ,GAE1B,CACL,GAAI,OAAO,KAAK,EAAc,CAAC,OAAS,EACpC,CAAE,oBAAqB,EAAe,CACtC,EAAE,CACN,GAAI,EAAW,CAAE,WAAU,CAAG,EAAE,CACjC,EAGH,SAAgB,EACd,EACA,EACS,CAET,MADA,GAAI,GAAc,mBAAqB,IAAS"}
+{"version":3,"file":"settings-utils.cjs","names":[],"sources":["../../src/utils/settings-utils.ts"],"sourcesContent":["import { WebClientFeatureFlags } from \"#/api/option-service/option.types\";\nimport { Settings, SettingsValue } from \"#/types/settings\";\nimport { getProviderId } from \"#/utils/map-provider\";\n\nconst extractBasicFormData = (formData: FormData) => {\n  const providerDisplay = formData.get(\"llm-provider-input\")?.toString();\n  const provider = providerDisplay ? getProviderId(providerDisplay) : undefined;\n  const model = formData.get(\"llm-model-input\")?.toString();\n\n  return {\n    llmModel: provider && model ? `${provider}/${model}` : undefined,\n    llmApiKey: formData.get(\"llm-api-key-input\")?.toString(),\n    agent: formData.get(\"agent\")?.toString(),\n    language: formData.get(\"language\")?.toString(),\n  };\n};\n\nexport const parseMaxBudgetPerTask = (value: string): number | null => {\n  if (!value) {\n    return null;\n  }\n\n  const parsedValue = parseFloat(value);\n  return parsedValue && parsedValue >= 1 && Number.isFinite(parsedValue)\n    ? parsedValue\n    : null;\n};\n\nexport const extractSettings = (\n  formData: FormData,\n): Partial<Settings> & Record<string, unknown> => {\n  const { llmModel, llmApiKey, agent, language } =\n    extractBasicFormData(formData);\n\n  const llm: Record<string, unknown> = {};\n  if (llmModel) llm.model = llmModel;\n  if (llmApiKey !== undefined) llm.api_key = llmApiKey;\n\n  const agentSettings: Record<string, SettingsValue> = {};\n  if (Object.keys(llm).length > 0)\n    agentSettings.llm = llm as Record<string, SettingsValue>;\n  if (agent) agentSettings.agent = agent;\n\n  return {\n    ...(Object.keys(agentSettings).length > 0\n      ? { agent_settings_diff: agentSettings }\n      : {}),\n    ...(language ? { language } : {}),\n  };\n};\n\nexport function isSettingsPageHidden(\n  path: string,\n  featureFlags: WebClientFeatureFlags | undefined,\n): boolean {\n  if (featureFlags?.hide_llm_settings && path === \"/settings/llm\") return true;\n  return false;\n}\n\nexport function getFirstAvailablePath(\n  featureFlags: WebClientFeatureFlags | undefined,\n): string | null {\n  // ``/settings/agents`` (the Agent Profile library — the \"Agent\" page) always\n  // wins: it is where the agent is defined (OpenHands / ACP, via the active\n  // profile) and is always available regardless of feature flags. Landing here\n  // keeps routing simple — every user lands where the agent is chosen, and\n  // the LLM page is one nav-click away.\n  const fallbackOrder = [\n    { path: \"/settings/agents\", hidden: false },\n    { path: \"/settings/llm\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings/app\", hidden: false },\n    { path: \"/settings/secrets\", hidden: false },\n  ];\n\n  const firstAvailable = fallbackOrder.find((item) => !item.hidden);\n  return firstAvailable?.path ?? null;\n}\n"],"mappings":"mFAIA,IAAM,EAAwB,GAAuB,CACnD,IAAM,EAAkB,EAAS,IAAI,qBAAqB,EAAE,UAAU,CAChE,EAAW,EAAkB,EAAA,cAAc,EAAgB,CAAG,IAAA,GAC9D,EAAQ,EAAS,IAAI,kBAAkB,EAAE,UAAU,CAEzD,MAAO,CACL,SAAU,GAAY,EAAQ,GAAG,EAAS,GAAG,IAAU,IAAA,GACvD,UAAW,EAAS,IAAI,oBAAoB,EAAE,UAAU,CACxD,MAAO,EAAS,IAAI,QAAQ,EAAE,UAAU,CACxC,SAAU,EAAS,IAAI,WAAW,EAAE,UAAU,CAC/C,EAcU,EACX,GACgD,CAChD,GAAM,CAAE,WAAU,YAAW,QAAO,YAClC,EAAqB,EAAS,CAE1B,EAA+B,EAAE,CACnC,IAAU,EAAI,MAAQ,GACtB,IAAc,IAAA,KAAW,EAAI,QAAU,GAE3C,IAAM,EAA+C,EAAE,CAKvD,OAJI,OAAO,KAAK,EAAI,CAAC,OAAS,IAC5B,EAAc,IAAM,GAClB,IAAO,EAAc,MAAQ,GAE1B,CACL,GAAI,OAAO,KAAK,EAAc,CAAC,OAAS,EACpC,CAAE,oBAAqB,EAAe,CACtC,EAAE,CACN,GAAI,EAAW,CAAE,WAAU,CAAG,EAAE,CACjC,EAGH,SAAgB,EACd,EACA,EACS,CAET,MADA,GAAI,GAAc,mBAAqB,IAAS"}

package/dist/utils/settings-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-utils.js","names":[],"sources":["../../src/utils/settings-utils.ts"],"sourcesContent":["import { WebClientFeatureFlags } from \"#/api/option-service/option.types\";\nimport { Settings, SettingsValue } from \"#/types/settings\";\nimport { getProviderId } from \"#/utils/map-provider\";\n\nconst extractBasicFormData = (formData: FormData) => {\n  const providerDisplay = formData.get(\"llm-provider-input\")?.toString();\n  const provider = providerDisplay ? getProviderId(providerDisplay) : undefined;\n  const model = formData.get(\"llm-model-input\")?.toString();\n\n  return {\n    llmModel: provider && model ? `${provider}/${model}` : undefined,\n    llmApiKey: formData.get(\"llm-api-key-input\")?.toString(),\n    agent: formData.get(\"agent\")?.toString(),\n    language: formData.get(\"language\")?.toString(),\n  };\n};\n\nexport const parseMaxBudgetPerTask = (value: string): number | null => {\n  if (!value) {\n    return null;\n  }\n\n  const parsedValue = parseFloat(value);\n  return parsedValue && parsedValue >= 1 && Number.isFinite(parsedValue)\n    ? parsedValue\n    : null;\n};\n\nexport const extractSettings = (\n  formData: FormData,\n): Partial<Settings> & Record<string, unknown> => {\n  const { llmModel, llmApiKey, agent, language } =\n    extractBasicFormData(formData);\n\n  const llm: Record<string, unknown> = {};\n  if (llmModel) llm.model = llmModel;\n  if (llmApiKey !== undefined) llm.api_key = llmApiKey;\n\n  const agentSettings: Record<string, SettingsValue> = {};\n  if (Object.keys(llm).length > 0)\n    agentSettings.llm = llm as Record<string, SettingsValue>;\n  if (agent) agentSettings.agent = agent;\n\n  return {\n    ...(Object.keys(agentSettings).length > 0\n      ? { agent_settings_diff: agentSettings }\n      : {}),\n    ...(language ? { language } : {}),\n  };\n};\n\nexport function isSettingsPageHidden(\n  path: string,\n  featureFlags: WebClientFeatureFlags | undefined,\n): boolean {\n  if (featureFlags?.hide_llm_settings && path === \"/settings/llm\") return true;\n  return false;\n}\n\nexport function getFirstAvailablePath(\n  featureFlags: WebClientFeatureFlags | undefined,\n): string | null {\n  // ``/settings/agents`` (the Agent Profile library — the \"Agent\" page) always\n  // wins: it is where the agent is defined (OpenHands / ACP, via the active\n  // profile) and is always available regardless of feature flags. Landing here\n  // keeps routing simple — ACP users no longer have to bounce through\n  // ``/settings/llm`` (which is disabled for them), and OpenHands users are one\n  // nav-click away from the LLM page.\n  const fallbackOrder = [\n    { path: \"/settings/agents\", hidden: false },\n    { path: \"/settings/llm\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings/app\", hidden: false },\n    { path: \"/settings/secrets\", hidden: false },\n  ];\n\n  const firstAvailable = fallbackOrder.find((item) => !item.hidden);\n  return firstAvailable?.path ?? null;\n}\n"],"mappings":";;AAIA,IAAM,KAAwB,MAAuB;CACnD,IAAM,IAAkB,EAAS,IAAI,qBAAqB,EAAE,UAAU,EAChE,IAAW,IAAkB,EAAc,EAAgB,GAAG,KAAA,GAC9D,IAAQ,EAAS,IAAI,kBAAkB,EAAE,UAAU;AAEzD,QAAO;EACL,UAAU,KAAY,IAAQ,GAAG,EAAS,GAAG,MAAU,KAAA;EACvD,WAAW,EAAS,IAAI,oBAAoB,EAAE,UAAU;EACxD,OAAO,EAAS,IAAI,QAAQ,EAAE,UAAU;EACxC,UAAU,EAAS,IAAI,WAAW,EAAE,UAAU;EAC/C;GAcU,KACX,MACgD;CAChD,IAAM,EAAE,aAAU,cAAW,UAAO,gBAClC,EAAqB,EAAS,EAE1B,IAA+B,EAAE;AAEvC,CADI,MAAU,EAAI,QAAQ,IACtB,MAAc,KAAA,MAAW,EAAI,UAAU;CAE3C,IAAM,IAA+C,EAAE;AAKvD,QAJI,OAAO,KAAK,EAAI,CAAC,SAAS,MAC5B,EAAc,MAAM,IAClB,MAAO,EAAc,QAAQ,IAE1B;EACL,GAAI,OAAO,KAAK,EAAc,CAAC,SAAS,IACpC,EAAE,qBAAqB,GAAe,GACtC,EAAE;EACN,GAAI,IAAW,EAAE,aAAU,GAAG,EAAE;EACjC;;AAGH,SAAgB,EACd,GACA,GACS;AAET,QADA,GAAI,GAAc,qBAAqB,MAAS"}
+{"version":3,"file":"settings-utils.js","names":[],"sources":["../../src/utils/settings-utils.ts"],"sourcesContent":["import { WebClientFeatureFlags } from \"#/api/option-service/option.types\";\nimport { Settings, SettingsValue } from \"#/types/settings\";\nimport { getProviderId } from \"#/utils/map-provider\";\n\nconst extractBasicFormData = (formData: FormData) => {\n  const providerDisplay = formData.get(\"llm-provider-input\")?.toString();\n  const provider = providerDisplay ? getProviderId(providerDisplay) : undefined;\n  const model = formData.get(\"llm-model-input\")?.toString();\n\n  return {\n    llmModel: provider && model ? `${provider}/${model}` : undefined,\n    llmApiKey: formData.get(\"llm-api-key-input\")?.toString(),\n    agent: formData.get(\"agent\")?.toString(),\n    language: formData.get(\"language\")?.toString(),\n  };\n};\n\nexport const parseMaxBudgetPerTask = (value: string): number | null => {\n  if (!value) {\n    return null;\n  }\n\n  const parsedValue = parseFloat(value);\n  return parsedValue && parsedValue >= 1 && Number.isFinite(parsedValue)\n    ? parsedValue\n    : null;\n};\n\nexport const extractSettings = (\n  formData: FormData,\n): Partial<Settings> & Record<string, unknown> => {\n  const { llmModel, llmApiKey, agent, language } =\n    extractBasicFormData(formData);\n\n  const llm: Record<string, unknown> = {};\n  if (llmModel) llm.model = llmModel;\n  if (llmApiKey !== undefined) llm.api_key = llmApiKey;\n\n  const agentSettings: Record<string, SettingsValue> = {};\n  if (Object.keys(llm).length > 0)\n    agentSettings.llm = llm as Record<string, SettingsValue>;\n  if (agent) agentSettings.agent = agent;\n\n  return {\n    ...(Object.keys(agentSettings).length > 0\n      ? { agent_settings_diff: agentSettings }\n      : {}),\n    ...(language ? { language } : {}),\n  };\n};\n\nexport function isSettingsPageHidden(\n  path: string,\n  featureFlags: WebClientFeatureFlags | undefined,\n): boolean {\n  if (featureFlags?.hide_llm_settings && path === \"/settings/llm\") return true;\n  return false;\n}\n\nexport function getFirstAvailablePath(\n  featureFlags: WebClientFeatureFlags | undefined,\n): string | null {\n  // ``/settings/agents`` (the Agent Profile library — the \"Agent\" page) always\n  // wins: it is where the agent is defined (OpenHands / ACP, via the active\n  // profile) and is always available regardless of feature flags. Landing here\n  // keeps routing simple — every user lands where the agent is chosen, and\n  // the LLM page is one nav-click away.\n  const fallbackOrder = [\n    { path: \"/settings/agents\", hidden: false },\n    { path: \"/settings/llm\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings\", hidden: !!featureFlags?.hide_llm_settings },\n    { path: \"/settings/app\", hidden: false },\n    { path: \"/settings/secrets\", hidden: false },\n  ];\n\n  const firstAvailable = fallbackOrder.find((item) => !item.hidden);\n  return firstAvailable?.path ?? null;\n}\n"],"mappings":";;AAIA,IAAM,KAAwB,MAAuB;CACnD,IAAM,IAAkB,EAAS,IAAI,qBAAqB,EAAE,UAAU,EAChE,IAAW,IAAkB,EAAc,EAAgB,GAAG,KAAA,GAC9D,IAAQ,EAAS,IAAI,kBAAkB,EAAE,UAAU;AAEzD,QAAO;EACL,UAAU,KAAY,IAAQ,GAAG,EAAS,GAAG,MAAU,KAAA;EACvD,WAAW,EAAS,IAAI,oBAAoB,EAAE,UAAU;EACxD,OAAO,EAAS,IAAI,QAAQ,EAAE,UAAU;EACxC,UAAU,EAAS,IAAI,WAAW,EAAE,UAAU;EAC/C;GAcU,KACX,MACgD;CAChD,IAAM,EAAE,aAAU,cAAW,UAAO,gBAClC,EAAqB,EAAS,EAE1B,IAA+B,EAAE;AAEvC,CADI,MAAU,EAAI,QAAQ,IACtB,MAAc,KAAA,MAAW,EAAI,UAAU;CAE3C,IAAM,IAA+C,EAAE;AAKvD,QAJI,OAAO,KAAK,EAAI,CAAC,SAAS,MAC5B,EAAc,MAAM,IAClB,MAAO,EAAc,QAAQ,IAE1B;EACL,GAAI,OAAO,KAAK,EAAc,CAAC,SAAS,IACpC,EAAE,qBAAqB,GAAe,GACtC,EAAE;EACN,GAAI,IAAW,EAAE,aAAU,GAAG,EAAE;EACjC;;AAGH,SAAgB,EACd,GACA,GACS;AAET,QADA,GAAI,GAAc,qBAAqB,MAAS"}

package/dist/utils/skill-install-events.cjs

@@ -0,0 +1,3 @@
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../types/agent-server/type-guards.cjs`);var t=/^✅ Successfully installed '([^']+)' to (.+)$/m;function n(n){let r=new Map;for(let i of n){if(!e.isExecuteBashObservationEvent(i))continue;let n=i.observation.content.filter(e=>e.type===`text`).map(e=>e.text).join(`
+`).match(t);if(!n)continue;let a=n[1],o=n[2].replace(/\\/g,`/`).replace(/\/+$/,``),s=`/.agents/skills/${a}`;if(!o.endsWith(s))continue;let c=o.slice(0,-s.length);if(!c)continue;let l=`${c}::${a}`;r.delete(l),r.set(l,{eventId:i.id,skillName:a,workspacePath:c})}return[...r.values()]}exports.detectSkillInstalls=n;
+//# sourceMappingURL=skill-install-events.cjs.map

package/dist/utils/skill-install-events.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-install-events.cjs","names":[],"sources":["../../src/utils/skill-install-events.ts"],"sourcesContent":["import { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { isExecuteBashObservationEvent } from \"#/types/agent-server/type-guards\";\n\nexport interface DetectedSkillInstall {\n  /** Id of the bash observation event carrying the success marker. */\n  eventId: string;\n  skillName: string;\n  /** Workspace root the skill was installed into (forward slashes). */\n  workspacePath: string;\n}\n\n/**\n * Success marker printed by the bundled add-skill skill's fetch_skill.py:\n *   ✅ Successfully installed '<name>' to <workspace>/.agents/skills/<name>\n * Failures exit 1 and never print this line. Matched on output alone —\n * `command` can be \"\" and `exit_code` can be -1 on soft-timeout\n * continuation observations that still carry the full output.\n */\nconst INSTALL_SUCCESS_PATTERN =\n  /^✅ Successfully installed '([^']+)' to (.+)$/m;\n\n/**\n * Skills the agent installed during this conversation via the add-skill\n * flow. The SDK loads skills once at conversation start, so these are on\n * disk but inert until a new conversation starts in `workspacePath`.\n * Deduped per workspace+skill; a re-install (--force) keeps the latest\n * event id and moves the entry to the end.\n */\nexport function detectSkillInstalls(\n  events: OpenHandsEvent[],\n): DetectedSkillInstall[] {\n  const byKey = new Map<string, DetectedSkillInstall>();\n\n  for (const event of events) {\n    if (!isExecuteBashObservationEvent(event)) continue;\n\n    const text = event.observation.content\n      .filter((c) => c.type === \"text\")\n      .map((c) => c.text)\n      .join(\"\\n\");\n    const match = text.match(INSTALL_SUCCESS_PATTERN);\n    if (!match) continue;\n\n    const skillName = match[1];\n    const dest = match[2].replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n    const suffix = `/.agents/skills/${skillName}`;\n    if (!dest.endsWith(suffix)) continue;\n    const workspacePath = dest.slice(0, -suffix.length);\n    if (!workspacePath) continue;\n\n    const key = `${workspacePath}::${skillName}`;\n    byKey.delete(key);\n    byKey.set(key, { eventId: event.id, skillName, workspacePath });\n  }\n\n  return [...byKey.values()];\n}\n"],"mappings":"sGAkBA,IAAM,EACJ,gDASF,SAAgB,EACd,EACwB,CACxB,IAAM,EAAQ,IAAI,IAElB,IAAK,IAAM,KAAS,EAAQ,CAC1B,GAAI,CAAC,EAAA,8BAA8B,EAAM,CAAE,SAM3C,IAAM,EAJO,EAAM,YAAY,QAC5B,OAAQ,GAAM,EAAE,OAAS,OAAO,CAChC,IAAK,GAAM,EAAE,KAAK,CAClB,KAAK;EACM,CAAK,MAAM,EAAwB,CACjD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAClB,EAAO,EAAM,GAAG,QAAQ,MAAO,IAAI,CAAC,QAAQ,OAAQ,GAAG,CACvD,EAAS,mBAAmB,IAClC,GAAI,CAAC,EAAK,SAAS,EAAO,CAAE,SAC5B,IAAM,EAAgB,EAAK,MAAM,EAAG,CAAC,EAAO,OAAO,CACnD,GAAI,CAAC,EAAe,SAEpB,IAAM,EAAM,GAAG,EAAc,IAAI,IACjC,EAAM,OAAO,EAAI,CACjB,EAAM,IAAI,EAAK,CAAE,QAAS,EAAM,GAAI,YAAW,gBAAe,CAAC,CAGjE,MAAO,CAAC,GAAG,EAAM,QAAQ,CAAC"}

package/dist/utils/skill-install-events.d.ts

@@ -0,0 +1,16 @@
+import { OpenHandsEvent } from "#/types/agent-server/core";
+export interface DetectedSkillInstall {
+    /** Id of the bash observation event carrying the success marker. */
+    eventId: string;
+    skillName: string;
+    /** Workspace root the skill was installed into (forward slashes). */
+    workspacePath: string;
+}
+/**
+ * Skills the agent installed during this conversation via the add-skill
+ * flow. The SDK loads skills once at conversation start, so these are on
+ * disk but inert until a new conversation starts in `workspacePath`.
+ * Deduped per workspace+skill; a re-install (--force) keeps the latest
+ * event id and moves the entry to the end.
+ */
+export declare function detectSkillInstalls(events: OpenHandsEvent[]): DetectedSkillInstall[];

package/dist/utils/skill-install-events.js

@@ -0,0 +1,26 @@
+import { isExecuteBashObservationEvent as e } from "../types/agent-server/type-guards.js";
+//#region src/utils/skill-install-events.ts
+var t = /^✅ Successfully installed '([^']+)' to (.+)$/m;
+function n(n) {
+	let r = /* @__PURE__ */ new Map();
+	for (let i of n) {
+		if (!e(i)) continue;
+		let n = i.observation.content.filter((e) => e.type === "text").map((e) => e.text).join("\n").match(t);
+		if (!n) continue;
+		let a = n[1], o = n[2].replace(/\\/g, "/").replace(/\/+$/, ""), s = `/.agents/skills/${a}`;
+		if (!o.endsWith(s)) continue;
+		let c = o.slice(0, -s.length);
+		if (!c) continue;
+		let l = `${c}::${a}`;
+		r.delete(l), r.set(l, {
+			eventId: i.id,
+			skillName: a,
+			workspacePath: c
+		});
+	}
+	return [...r.values()];
+}
+//#endregion
+export { n as detectSkillInstalls };
+
+//# sourceMappingURL=skill-install-events.js.map

package/dist/utils/skill-install-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-install-events.js","names":[],"sources":["../../src/utils/skill-install-events.ts"],"sourcesContent":["import { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { isExecuteBashObservationEvent } from \"#/types/agent-server/type-guards\";\n\nexport interface DetectedSkillInstall {\n  /** Id of the bash observation event carrying the success marker. */\n  eventId: string;\n  skillName: string;\n  /** Workspace root the skill was installed into (forward slashes). */\n  workspacePath: string;\n}\n\n/**\n * Success marker printed by the bundled add-skill skill's fetch_skill.py:\n *   ✅ Successfully installed '<name>' to <workspace>/.agents/skills/<name>\n * Failures exit 1 and never print this line. Matched on output alone —\n * `command` can be \"\" and `exit_code` can be -1 on soft-timeout\n * continuation observations that still carry the full output.\n */\nconst INSTALL_SUCCESS_PATTERN =\n  /^✅ Successfully installed '([^']+)' to (.+)$/m;\n\n/**\n * Skills the agent installed during this conversation via the add-skill\n * flow. The SDK loads skills once at conversation start, so these are on\n * disk but inert until a new conversation starts in `workspacePath`.\n * Deduped per workspace+skill; a re-install (--force) keeps the latest\n * event id and moves the entry to the end.\n */\nexport function detectSkillInstalls(\n  events: OpenHandsEvent[],\n): DetectedSkillInstall[] {\n  const byKey = new Map<string, DetectedSkillInstall>();\n\n  for (const event of events) {\n    if (!isExecuteBashObservationEvent(event)) continue;\n\n    const text = event.observation.content\n      .filter((c) => c.type === \"text\")\n      .map((c) => c.text)\n      .join(\"\\n\");\n    const match = text.match(INSTALL_SUCCESS_PATTERN);\n    if (!match) continue;\n\n    const skillName = match[1];\n    const dest = match[2].replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n    const suffix = `/.agents/skills/${skillName}`;\n    if (!dest.endsWith(suffix)) continue;\n    const workspacePath = dest.slice(0, -suffix.length);\n    if (!workspacePath) continue;\n\n    const key = `${workspacePath}::${skillName}`;\n    byKey.delete(key);\n    byKey.set(key, { eventId: event.id, skillName, workspacePath });\n  }\n\n  return [...byKey.values()];\n}\n"],"mappings":";;AAkBA,IAAM,IACJ;AASF,SAAgB,EACd,GACwB;CACxB,IAAM,oBAAQ,IAAI,KAAmC;AAErD,MAAK,IAAM,KAAS,GAAQ;AAC1B,MAAI,CAAC,EAA8B,EAAM,CAAE;EAM3C,IAAM,IAJO,EAAM,YAAY,QAC5B,QAAQ,MAAM,EAAE,SAAS,OAAO,CAChC,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,KACM,CAAK,MAAM,EAAwB;AACjD,MAAI,CAAC,EAAO;EAEZ,IAAM,IAAY,EAAM,IAClB,IAAO,EAAM,GAAG,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG,EACvD,IAAS,mBAAmB;AAClC,MAAI,CAAC,EAAK,SAAS,EAAO,CAAE;EAC5B,IAAM,IAAgB,EAAK,MAAM,GAAG,CAAC,EAAO,OAAO;AACnD,MAAI,CAAC,EAAe;EAEpB,IAAM,IAAM,GAAG,EAAc,IAAI;AAEjC,EADA,EAAM,OAAO,EAAI,EACjB,EAAM,IAAI,GAAK;GAAE,SAAS,EAAM;GAAI;GAAW;GAAe,CAAC;;AAGjE,QAAO,CAAC,GAAG,EAAM,QAAQ,CAAC"}

package/dist/utils/title-llm-profile.cjs

@@ -0,0 +1,2 @@
+require(`../_virtual/_rolldown/runtime.cjs`);function e(e,t){if(!t)return;let n=new Set(t.profiles.map(e=>e.name));if(e&&n.has(e))return e;if(t.active_profile&&n.has(t.active_profile))return t.active_profile}exports.resolveTitleLlmProfile=e;
+//# sourceMappingURL=title-llm-profile.cjs.map

package/dist/utils/title-llm-profile.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"title-llm-profile.cjs","names":[],"sources":["../../src/utils/title-llm-profile.ts"],"sourcesContent":["import type { ProfileListResponse } from \"#/api/profiles-service/profiles-service.api\";\n\nexport function resolveTitleLlmProfile(\n  preference: string | null | undefined,\n  profiles: ProfileListResponse | undefined,\n): string | undefined {\n  if (!profiles) return undefined;\n\n  const availableProfiles = new Set(\n    profiles.profiles.map((profile) => profile.name),\n  );\n  if (preference && availableProfiles.has(preference)) {\n    return preference;\n  }\n  if (\n    profiles.active_profile &&\n    availableProfiles.has(profiles.active_profile)\n  ) {\n    return profiles.active_profile;\n  }\n  return undefined;\n}\n"],"mappings":"6CAEA,SAAgB,EACd,EACA,EACoB,CACpB,GAAI,CAAC,EAAU,OAEf,IAAM,EAAoB,IAAI,IAC5B,EAAS,SAAS,IAAK,GAAY,EAAQ,KAAK,CACjD,CACD,GAAI,GAAc,EAAkB,IAAI,EAAW,CACjD,OAAO,EAET,GACE,EAAS,gBACT,EAAkB,IAAI,EAAS,eAAe,CAE9C,OAAO,EAAS"}

package/dist/utils/title-llm-profile.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileListResponse } from "#/api/profiles-service/profiles-service.api";
+export declare function resolveTitleLlmProfile(preference: string | null | undefined, profiles: ProfileListResponse | undefined): string | undefined;

package/dist/utils/title-llm-profile.js

@@ -0,0 +1,11 @@
+//#region src/utils/title-llm-profile.ts
+function e(e, t) {
+	if (!t) return;
+	let n = new Set(t.profiles.map((e) => e.name));
+	if (e && n.has(e)) return e;
+	if (t.active_profile && n.has(t.active_profile)) return t.active_profile;
+}
+//#endregion
+export { e as resolveTitleLlmProfile };
+
+//# sourceMappingURL=title-llm-profile.js.map

package/dist/utils/title-llm-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"title-llm-profile.js","names":[],"sources":["../../src/utils/title-llm-profile.ts"],"sourcesContent":["import type { ProfileListResponse } from \"#/api/profiles-service/profiles-service.api\";\n\nexport function resolveTitleLlmProfile(\n  preference: string | null | undefined,\n  profiles: ProfileListResponse | undefined,\n): string | undefined {\n  if (!profiles) return undefined;\n\n  const availableProfiles = new Set(\n    profiles.profiles.map((profile) => profile.name),\n  );\n  if (preference && availableProfiles.has(preference)) {\n    return preference;\n  }\n  if (\n    profiles.active_profile &&\n    availableProfiles.has(profiles.active_profile)\n  ) {\n    return profiles.active_profile;\n  }\n  return undefined;\n}\n"],"mappings":";AAEA,SAAgB,EACd,GACA,GACoB;AACpB,KAAI,CAAC,EAAU;CAEf,IAAM,IAAoB,IAAI,IAC5B,EAAS,SAAS,KAAK,MAAY,EAAQ,KAAK,CACjD;AACD,KAAI,KAAc,EAAkB,IAAI,EAAW,CACjD,QAAO;AAET,KACE,EAAS,kBACT,EAAkB,IAAI,EAAS,eAAe,CAE9C,QAAO,EAAS"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openhands/agent-canvas",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "description": "Agent Canvas UI for OpenHands - run AI coding agents with a visual interface",
   "license": "MIT",
   "private": false,
@@ -23,7 +23,7 @@
     "@heroui/react": "2.8.10",
     "@microlink/react-json-view": "1.31.20",
     "@monaco-editor/react": "4.7.0",
-    "@openhands/extensions": "0.9.0",
+    "@openhands/extensions": "0.11.0",
     "@openhands/typescript-client": "1.34.0",
     "@react-router/node": "7.17.0",
     "@react-router/serve": "7.17.0",
@@ -100,7 +100,12 @@
     "build:app": "npm run make-i18n && react-router build",
     "build:lib": "npm run make-i18n && react-router typegen && cross-env BUILD_LIB=true vite build && tsc -p tsconfig.lib.json",
     "build:docker": "node scripts/docker-build.mjs",
-    "example:acp-docker:env": "node scripts/gen-acp-docker-env.mjs"
+    "example:acp-docker:env": "node scripts/gen-acp-docker-env.mjs",
+    "desktop": "npm run build:app && electron electron/main.mjs",
+    "build:desktop": "npm run build:app && node scripts/download-uv.mjs && node scripts/download-node.mjs && electron-builder --config electron-builder.config.mjs",
+    "build:desktop:universal": "npm run build:app && node scripts/download-uv.mjs && node scripts/download-node.mjs && cross-env ELECTRON_ARCH=universal electron-builder --config electron-builder.config.mjs",
+    "download-uv": "node scripts/download-uv.mjs",
+    "download-node": "node scripts/download-node.mjs"
   },
   "lint-staged": {
     "src/**/*.{ts,tsx,js}": [
@@ -136,6 +141,8 @@
     "@vercel/react-router": "1.3.0",
     "@vitest/coverage-v8": "4.1.5",
     "cross-env": "10.1.0",
+    "electron": "42.3.2",
+    "electron-builder": "26.8.1",
     "eslint": "9.39.4",
     "eslint-config-prettier": "10.1.8",
     "eslint-import-resolver-typescript": "4.4.4",

package/scripts/check-sdk-version-sync.mjs

@@ -19,7 +19,7 @@
  *
  * Usage:
  *   node scripts/check-sdk-version-sync.mjs
- *   EXPECTED_SDK_VERSION=1.36.1 node scripts/check-sdk-version-sync.mjs
+ *   EXPECTED_SDK_VERSION=1.37.0 node scripts/check-sdk-version-sync.mjs
  *   node scripts/check-sdk-version-sync.mjs --check-pypi
  *
  * Environment variables:
@@ -78,7 +78,7 @@ Triggering from other repos:
     -H "Authorization: token \$GITHUB_TOKEN" \\
     -H "Accept: application/vnd.github.v3+json" \\
     https://api.github.com/repos/OpenHands/agent-canvas/dispatches \\
-    -d '{"event_type": "sdk-version-check", "client_payload": {"version": "1.36.1"}}'
+    -d '{"event_type": "sdk-version-check", "client_payload": {"version": "1.37.0"}}'
 `);
   process.exit(0);
 }
@@ -260,9 +260,9 @@ async function fetchPyPIDependencies(packageName, version) {
  * Parse PyPI requires_dist array and extract SDK package versions
  *
  * PyPI returns dependencies in PEP 508 format like:
- *   "openhands-sdk>=1.36.1,<2.0.0"
- *   "openhands-tools==1.36.1"
- *   "openhands-workspace (>=1.36.1)"
+ *   "openhands-sdk>=1.37.0,<2.0.0"
+ *   "openhands-tools==1.37.0"
+ *   "openhands-workspace (>=1.37.0)"
  */
 function parseSdkVersionsFromRequiresDist(requiresDist) {
   const versions = {};
@@ -276,7 +276,7 @@ function parseSdkVersionsFromRequiresDist(requiresDist) {
       }
 
       // Extract the version number - look for patterns like:
-      // ">=1.36.1", "==1.36.1", "(>=1.36.1)", "~=1.36.1"
+      // ">=1.37.0", "==1.37.0", "(>=1.37.0)", "~=1.37.0"
       // After the package name and before any comma or closing paren
       const versionPattern = /[><=~!]+\s*([0-9]+(?:\.[0-9]+)*)/;
       const match = dep.match(versionPattern);

package/scripts/check-translation-completeness.cjs

@@ -34,6 +34,7 @@ const IDENTICAL_VALUE_ALLOWLIST = new Set([
   'SCHEMA$VERIFICATION$SECURITY_ANALYZER$CHOICE$LLM',
   'SETTINGS$AGENT_SERVER_URL_PLACEHOLDER',
   'SETTINGS$AGENT_TYPE_OPENHANDS',
+  'SETTINGS$APP_UPDATE_CARD_TITLE',
   'SETTINGS$AZURE_DEVOPS',
   'SETTINGS$CLOUD_SETTINGS_LINK',
   'SETTINGS$GITHUB',
@@ -51,6 +52,7 @@ const IDENTICAL_VALUE_ALLOWLIST = new Set([
   'SETTINGS$SKILLS_PILLS_MORE',
   'SETTINGS$SKILLS_VERSION',
   'SETTINGS$SLACK',
+  'SETTINGS$TITLE_GENERATION_PROFILE_OPTION',
   'VSCODE$TITLE',
   'WORKSPACE$JUPYTER_TAB_LABEL',
 ]);