npm - @openhands/agent-canvas - Versions diffs - 1.8.0 → 1.10.0 - Mend

@openhands/agent-canvas 1.8.0 → 1.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1282) hide show

package/dist/api/backend-registry/active-store.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"active-store.js","names":[],"sources":["../../../src/api/backend-registry/active-store.ts"],"sourcesContent":["import { getBackendHealthEntry } from \"./health-store\";\nimport {\n readStoredActiveBackend,\n readStoredBackends,\n writeStoredActiveBackend,\n writeStoredBackends,\n} from \"./storage\";\nimport type { Backend, BackendSelection, ResolvedActiveBackend } from \"./types\";\n\ntype Listener = () => void;\n\ninterface Snapshot {\n backends: Backend[];\n selection: BackendSelection \| null;\n active: ResolvedActiveBackend;\n}\n\nexport const NO_BACKEND_ID = \"no-backend\";\n\n/*\n Sentinel returned when the registry has no usable backend. It must never be\n * persisted, and callers must check `isNoBackend()` before interpreting fields\n * like `kind`, `host`, or `apiKey`.\n /\nexport const NO_BACKEND: Backend = {\n id: NO_BACKEND_ID,\n name: \"No Backend Available\",\n host: \"\",\n apiKey: \"\",\n kind: \"local\",\n};\n\nexport function isNoBackend(backend: Backend): boolean {\n return backend.id === NO_BACKEND_ID;\n}\n\n/\n Choose an active backend when there is no valid explicit selection (fresh\n * start, or the selected backend was removed). Most of the GUI speaks the\n * local agent-server protocol, so a cloud or dead-local backend at index 0\n * would leave `getEffectiveLocalBackend()` null and make every local-protocol\n * call throw \"No backend is configured\" even when a healthy local backend is\n * registered further down the list. Consult the synchronous, persisted health\n * store and prefer a healthy local backend; fall back to any local backend so\n * the effective-local resolver still resolves, then to the prior deterministic\n * `backends[0]` behavior for the registry-has-no-local case.\n /\nfunction pickFallbackBackend(backends: Backend[]): Backend {\n const healthyLocalBackend = backends.find(\n (backend) =>\n backend.kind === \"local\" &&\n getBackendHealthEntry(backend.id)?.disabled !== true,\n );\n if (healthyLocalBackend) return healthyLocalBackend;\n\n const localBackend = backends.find((backend) => backend.kind === \"local\");\n return localBackend ?? backends[0] ?? NO_BACKEND;\n}\n\nfunction computeSnapshot(\n backends: Backend[],\n selection: BackendSelection \| null,\n): Snapshot {\n let activeBackend: Backend \| null = null;\n let activeOrgId: string \| null = null;\n\n if (selection) {\n const found = backends.find((b) => b.id === selection.backendId);\n if (found) {\n activeBackend = found;\n activeOrgId = selection.orgId ?? null;\n }\n // If the selection points at a removed backend, fall through to\n // the unselected case below; we also drop the orgId since it only\n // makes sense in the context of a specific cloud backend.\n }\n\n // @spec BM-003 — Fallback on active backend removal\n if (!activeBackend) {\n activeBackend = pickFallbackBackend(backends);\n activeOrgId = null;\n }\n\n return {\n backends,\n selection,\n active: { backend: activeBackend, orgId: activeOrgId },\n };\n}\n\nlet snapshot: Snapshot = computeSnapshot(\n ~~readStoredBackends()~~,\n ~~readStoredActiveBackend~~(),\n);\n\nconst listeners = new Set<Listener>();\n\nfunction notify(): void {\n listeners.forEach((listener) => listener());\n}\n\nexport function getActiveBackend(): ResolvedActiveBackend {\n return snapshot.active;\n}\n\n/\n Pick the backend to use for local agent-server protocol calls.\n \n Most of the GUI's services (settings reads/writes, conversation CRUD,\n * skills/MCP/secrets, etc.) speak the local agent-server's protocol —\n * they would fail against a cloud host. Only the active backend is eligible:\n * a cloud selection must not borrow another registered local backend.\n /\nexport function getEffectiveLocalBackend(): Backend \| null {\n const active = snapshot.active.backend;\n if (active.kind === \"local\" && !isNoBackend(active)) return active;\n return null;\n}\n\nexport function getRegisteredBackends(): Backend[] {\n return snapshot.backends;\n}\n\nexport function getActiveSelection(): BackendSelection \| null {\n return snapshot.selection;\n}\n\nexport function getSnapshot(): Snapshot {\n return snapshot;\n}\n\nexport function setActiveSelection(selection: BackendSelection \| null): void {\n writeStoredActiveBackend(selection);\n snapshot = computeSnapshot(snapshot.backends, selection);\n notify();\n}\n\nexport function setRegisteredBackends(backends: Backend[]): void {\n writeStoredBackends(backends);\n\n let nextSelection = snapshot.selection;\n if (\n nextSelection &&\n !backends.some((b) => b.id === nextSelection!.backendId)\n ) {\n nextSelection = null;\n writeStoredActiveBackend(null);\n }\n\n snapshot = computeSnapshot(backends, nextSelection);\n notify();\n}\n\nexport function subscribeActiveBackend(listener: Listener): () => void {\n listeners.add(listener);\n return () => {\n listeners.delete(listener);\n };\n}\n\n/* Test-only: re-read storage and clear listeners. */\n\nexport function __resetActiveStoreForTests(): void {\n snapshot = computeSnapshot(~~readStoredBackends()~~, ~~readStoredActiveBackend~~());\n listeners.clear();\n}\n"],"mappings":"~~;;;AAiBA~~,IAAa,IAAgB,cAOhB,IAAsB;CACjC,IAAI;CACJ,MAAM;CACN,MAAM;CACN,QAAQ;CACR,MAAM;AACR;AAEA,SAAgB,EAAY,GAA2B;CACrD,OAAO,EAAQ,OAAO;AACxB;AAaA,SAAS,EAAoB,GAA8B;CASzD,OAR4B,EAAS,MAClC,MACC,EAAQ,SAAS,WACjB,EAAsB,EAAQ,EAAE,GAAG,aAAa,EAEhD,MAEiB,EAAS,MAAM,MAAY,EAAQ,SAAS,OAC1D,KAAgB,EAAS,MAAM;AACxC;AAEA,SAAS,EACP,GACA,GACU;CACV,IAAI,IAAgC,MAChC,IAA6B;CAEjC,IAAI,GAAW;EACb,IAAM,IAAQ,EAAS,MAAM,MAAM,EAAE,OAAO,EAAU,SAAS;EAC/D,AAAI,MACF,IAAgB,GAChB,IAAc,EAAU,SAAS;CAKrC;CAQA,OALK,MACH,IAAgB,EAAoB,CAAQ,GAC5C,IAAc,OAGT;EACL;EACA;EACA,QAAQ;GAAE,SAAS;GAAe,OAAO;EAAY;CACvD;AACF;AAEA,~~IAAI~~,IAAqB,EACvB,~~EAAmB~~,~~GACnB~~,~~EAAwB~~,~~CAC1B~~,GAEM,oBAAY,IAAI,IAAc;AAEpC,SAAS,IAAe;CACtB,EAAU,SAAS,MAAa,EAAS,CAAC;AAC5C;AAEA,SAAgB,IAA0C;CACxD,OAAO,EAAS;AAClB;AAUA,SAAgB,IAA2C;CACzD,IAAM,IAAS,EAAS,OAAO;CAE/B,OADI,EAAO,SAAS,WAAW,CAAC,EAAY,CAAM,IAAU,IACrD;AACT;AAEA,SAAgB,IAAmC;CACjD,OAAO,EAAS;AAClB;AAEA,SAAgB,IAA8C;CAC5D,OAAO,EAAS;AAClB;AAEA,SAAgB,IAAwB;CACtC,OAAO;AACT;AAEA,SAAgB,EAAmB,GAA0C;CAG3E,AAFA,EAAyB,CAAS,GAClC,IAAW,EAAgB,EAAS,UAAU,CAAS,GACvD,EAAO;AACT;AAEA,SAAgB,EAAsB,GAA2B;CAC/D,EAAoB,CAAQ;CAE5B,IAAI,IAAgB,EAAS;CAU7B,AARE,KACA,CAAC,EAAS,MAAM,MAAM,EAAE,OAAO,EAAe,SAAS,MAEvD,IAAgB,MAChB,EAAyB,IAAI,IAG/B,IAAW,EAAgB,GAAU,CAAa,GAClD,EAAO;AACT;AAEA,SAAgB,EAAuB,GAAgC;CAErE,OADA,EAAU,IAAI,CAAQ,SACT;EACX,EAAU,OAAO,CAAQ;CAC3B;AACF"}
1	+ {"version":3,"file":"active-store.js","names":[],"sources":["../../../src/api/backend-registry/active-store.ts"],"sourcesContent":["import { getBackendHealthEntry } from \"./health-store\";\nimport {\n readStoredActiveBackend,\n readStoredBackends,\n writeStoredActiveBackend,\n writeStoredBackends,\n} from \"./storage\";\nimport type { Backend, BackendSelection, ResolvedActiveBackend } from \"./types\";\nimport {\n currentLocationSearch,\n readBackendSelectionFromUrl,\n} from \"./url-selection\";\n\ntype Listener = () => void;\n\ninterface Snapshot {\n backends: Backend[];\n selection: BackendSelection \| null;\n active: ResolvedActiveBackend;\n}\n\nexport const NO_BACKEND_ID = \"no-backend\";\n\n/*\n Sentinel returned when the registry has no usable backend. It must never be\n * persisted, and callers must check `isNoBackend()` before interpreting fields\n * like `kind`, `host`, or `apiKey`.\n /\nexport const NO_BACKEND: Backend = {\n id: NO_BACKEND_ID,\n name: \"No Backend Available\",\n host: \"\",\n apiKey: \"\",\n kind: \"local\",\n};\n\nexport function isNoBackend(backend: Backend): boolean {\n return backend.id === NO_BACKEND_ID;\n}\n\n/\n Choose an active backend when there is no valid explicit selection (fresh\n * start, or the selected backend was removed). Most of the GUI speaks the\n * local agent-server protocol, so a cloud or dead-local backend at index 0\n * would leave `getEffectiveLocalBackend()` null and make every local-protocol\n * call throw \"No backend is configured\" even when a healthy local backend is\n * registered further down the list. Consult the synchronous, persisted health\n * store and prefer a healthy local backend; fall back to any local backend so\n * the effective-local resolver still resolves, then to the prior deterministic\n * `backends[0]` behavior for the registry-has-no-local case.\n /\nfunction pickFallbackBackend(backends: Backend[]): Backend {\n const healthyLocalBackend = backends.find(\n (backend) =>\n backend.kind === \"local\" &&\n getBackendHealthEntry(backend.id)?.disabled !== true,\n );\n if (healthyLocalBackend) return healthyLocalBackend;\n\n const localBackend = backends.find((backend) => backend.kind === \"local\");\n return localBackend ?? backends[0] ?? NO_BACKEND;\n}\n\nfunction computeSnapshot(\n backends: Backend[],\n selection: BackendSelection \| null,\n): Snapshot {\n let activeBackend: Backend \| null = null;\n let activeOrgId: string \| null = null;\n\n if (selection) {\n const found = backends.find((b) => b.id === selection.backendId);\n if (found) {\n activeBackend = found;\n activeOrgId = selection.orgId ?? null;\n }\n // If the selection points at a removed backend, fall through to\n // the unselected case below; we also drop the orgId since it only\n // makes sense in the context of a specific cloud backend.\n }\n\n // @spec BM-003 — Fallback on active backend removal\n if (!activeBackend) {\n activeBackend = pickFallbackBackend(backends);\n activeOrgId = null;\n }\n\n return {\n backends,\n selection,\n active: { backend: activeBackend, orgId: activeOrgId },\n };\n}\n\n/\n Resolve the selection this tab boots with. A backend pinned in the URL wins\n * over stored state so a link opened in a new tab (cmd/ctrl-click, middle\n * click, \"Open in new tab\") lands on the backend that owns the linked\n * conversation, even when the new tab starts with an empty `sessionStorage`\n * and would otherwise adopt the `localStorage` fallback. The honoured\n * selection is persisted so later in-tab navigation — which drops the query\n * parameters — keeps the same backend.\n /\nfunction readInitialSelection(backends: Backend[]): BackendSelection \| null {\n const fromUrl = readBackendSelectionFromUrl(\n backends,\n currentLocationSearch(),\n );\n if (fromUrl) {\n writeStoredActiveBackend(fromUrl);\n return fromUrl;\n }\n return readStoredActiveBackend();\n}\n\nconst initialBackends = readStoredBackends();\nlet snapshot: Snapshot = computeSnapshot(\n initialBackends,\n readInitialSelection(initialBackends),\n);\n\nconst listeners = new Set<Listener>();\n\nfunction notify(): void {\n listeners.forEach((listener) => listener());\n}\n\nexport function getActiveBackend(): ResolvedActiveBackend {\n return snapshot.active;\n}\n\n/\n Pick the backend to use for local agent-server protocol calls.\n \n Most of the GUI's services (settings reads/writes, conversation CRUD,\n * skills/MCP/secrets, etc.) speak the local agent-server's protocol —\n * they would fail against a cloud host. Only the active backend is eligible:\n * a cloud selection must not borrow another registered local backend.\n /\nexport function getEffectiveLocalBackend(): Backend \| null {\n const active = snapshot.active.backend;\n if (active.kind === \"local\" && !isNoBackend(active)) return active;\n return null;\n}\n\nexport function getRegisteredBackends(): Backend[] {\n return snapshot.backends;\n}\n\nexport function getActiveSelection(): BackendSelection \| null {\n return snapshot.selection;\n}\n\nexport function getSnapshot(): Snapshot {\n return snapshot;\n}\n\nexport function setActiveSelection(selection: BackendSelection \| null): void {\n writeStoredActiveBackend(selection);\n snapshot = computeSnapshot(snapshot.backends, selection);\n notify();\n}\n\nexport function setRegisteredBackends(backends: Backend[]): void {\n writeStoredBackends(backends);\n\n let nextSelection = snapshot.selection;\n if (\n nextSelection &&\n !backends.some((b) => b.id === nextSelection!.backendId)\n ) {\n nextSelection = null;\n writeStoredActiveBackend(null);\n }\n\n snapshot = computeSnapshot(backends, nextSelection);\n notify();\n}\n\nexport function subscribeActiveBackend(listener: Listener): () => void {\n listeners.add(listener);\n return () => {\n listeners.delete(listener);\n };\n}\n\n/* Test-only: re-read storage and clear listeners. */\n\nexport function __resetActiveStoreForTests(): void {\n const backends = readStoredBackends();\n snapshot = computeSnapshot(backends, readInitialSelection(backends));\n listeners.clear();\n}\n"],"mappings":";;;;AAqBA,IAAa,IAAgB,cAOhB,IAAsB;CACjC,IAAI;CACJ,MAAM;CACN,MAAM;CACN,QAAQ;CACR,MAAM;AACR;AAEA,SAAgB,EAAY,GAA2B;CACrD,OAAO,EAAQ,OAAO;AACxB;AAaA,SAAS,EAAoB,GAA8B;CASzD,OAR4B,EAAS,MAClC,MACC,EAAQ,SAAS,WACjB,EAAsB,EAAQ,EAAE,GAAG,aAAa,EAEhD,MAEiB,EAAS,MAAM,MAAY,EAAQ,SAAS,OAC1D,KAAgB,EAAS,MAAM;AACxC;AAEA,SAAS,EACP,GACA,GACU;CACV,IAAI,IAAgC,MAChC,IAA6B;CAEjC,IAAI,GAAW;EACb,IAAM,IAAQ,EAAS,MAAM,MAAM,EAAE,OAAO,EAAU,SAAS;EAC/D,AAAI,MACF,IAAgB,GAChB,IAAc,EAAU,SAAS;CAKrC;CAQA,OALK,MACH,IAAgB,EAAoB,CAAQ,GAC5C,IAAc,OAGT;EACL;EACA;EACA,QAAQ;GAAE,SAAS;GAAe,OAAO;EAAY;CACvD;AACF;AAWA,SAAS,EAAqB,GAA8C;CAC1E,IAAM,IAAU,EACd,GACA,EAAsB,CACxB;CAKA,OAJI,KACF,EAAyB,CAAO,GACzB,KAEF,EAAwB;AACjC;AAEA,IAAM,IAAkB,EAAmB,GACvC,IAAqB,EACvB,GACA,EAAqB,CAAe,CACtC,GAEM,oBAAY,IAAI,IAAc;AAEpC,SAAS,IAAe;CACtB,EAAU,SAAS,MAAa,EAAS,CAAC;AAC5C;AAEA,SAAgB,IAA0C;CACxD,OAAO,EAAS;AAClB;AAUA,SAAgB,IAA2C;CACzD,IAAM,IAAS,EAAS,OAAO;CAE/B,OADI,EAAO,SAAS,WAAW,CAAC,EAAY,CAAM,IAAU,IACrD;AACT;AAEA,SAAgB,IAAmC;CACjD,OAAO,EAAS;AAClB;AAEA,SAAgB,IAA8C;CAC5D,OAAO,EAAS;AAClB;AAEA,SAAgB,IAAwB;CACtC,OAAO;AACT;AAEA,SAAgB,EAAmB,GAA0C;CAG3E,AAFA,EAAyB,CAAS,GAClC,IAAW,EAAgB,EAAS,UAAU,CAAS,GACvD,EAAO;AACT;AAEA,SAAgB,EAAsB,GAA2B;CAC/D,EAAoB,CAAQ;CAE5B,IAAI,IAAgB,EAAS;CAU7B,AARE,KACA,CAAC,EAAS,MAAM,MAAM,EAAE,OAAO,EAAe,SAAS,MAEvD,IAAgB,MAChB,EAAyB,IAAI,IAG/B,IAAW,EAAgB,GAAU,CAAa,GAClD,EAAO;AACT;AAEA,SAAgB,EAAuB,GAAgC;CAErE,OADA,EAAU,IAAI,CAAQ,SACT;EACX,EAAU,OAAO,CAAQ;CAC3B;AACF"}

package/dist/api/backend-registry/url-selection.cjs ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ require("../../_virtual/_rolldown/runtime.cjs");var e=`backend`;function t(t,n){let{backend:r,orgId:i}=n;if(!r.id)return t;let[a,o=``]=t.split(`?`),s=new URLSearchParams(o);return s.set(e,r.id),i&&s.set(`org`,i),`${a}?${s.toString()}`}function n(t,n){if(!n)return null;let r;try{r=new URLSearchParams(n)}catch{return null}let i=r.get(e);return!i\|\|!t.some(e=>e.id===i)?null:{backendId:i,orgId:r.get(`org`)\|\|null}}function r(){return typeof window>`u`?``:window.location.search}exports.currentLocationSearch=r,exports.readBackendSelectionFromUrl=n,exports.withBackendSelectionParams=t;
2	+ //# sourceMappingURL=url-selection.cjs.map

package/dist/api/backend-registry/url-selection.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"url-selection.cjs","names":[],"sources":["../../../src/api/backend-registry/url-selection.ts"],"sourcesContent":["import type { Backend, BackendSelection, ResolvedActiveBackend } from \"./types\";\n\n/**\n * Query parameters that pin a link to the backend (and cloud org) that owns\n * the linked resource.\n *\n * The active backend is tab-scoped: `readStoredActiveBackend()` prefers\n * `sessionStorage` and only falls back to `localStorage`. A tab opened with\n * cmd/ctrl-click or middle-click does not reliably inherit the opener's\n * `sessionStorage`, so it can boot from the `localStorage` fallback — which\n * holds whichever backend was selected *last in any tab*, not the one the\n * sidebar we were just looking at belongs to. The new tab then resolves the\n * conversation id against the wrong backend and shows \"conversation not\n * found\". Carrying the identity in the URL makes the link self-describing so\n * the new tab pins to the right backend regardless of what storage holds.\n */\nexport const BACKEND_QUERY_PARAM = \"backend\";\nexport const ORG_QUERY_PARAM = \"org\";\n\n/**\n * Append the active backend identity to an in-app path so opening it in a new\n * browsing context resolves against the same backend.\n */\nexport function withBackendSelectionParams(\n path: string,\n active: ResolvedActiveBackend,\n): string {\n const { backend, orgId } = active;\n if (!backend.id) return path;\n\n const [pathname, existingSearch = \"\"] = path.split(\"?\");\n const params = new URLSearchParams(existingSearch);\n params.set(BACKEND_QUERY_PARAM, backend.id);\n if (orgId) params.set(ORG_QUERY_PARAM, orgId);\n\n return `${pathname}?${params.toString()}`;\n}\n\n/**\n * Read a backend selection off the current URL, keeping it only when it names\n * a registered backend. An unknown id (a link from another machine, or a\n * backend that has since been removed) is ignored so the caller falls back to\n * the stored selection.\n */\nexport function readBackendSelectionFromUrl(\n backends: Backend[],\n search: string,\n): BackendSelection | null {\n if (!search) return null;\n\n let params: URLSearchParams;\n try {\n params = new URLSearchParams(search);\n } catch {\n return null;\n }\n\n const backendId = params.get(BACKEND_QUERY_PARAM);\n if (!backendId) return null;\n if (!backends.some((backend) => backend.id === backendId)) return null;\n\n const orgId = params.get(ORG_QUERY_PARAM);\n return { backendId, orgId: orgId || null };\n}\n\n/** The current tab's query string, or \"\" outside a browser. */\nexport function currentLocationSearch(): string {\n if (typeof window === \"undefined\") return \"\";\n return window.location.search;\n}\n"],"mappings":"gDAgBA,IAAa,EAAsB,UAOnC,SAAgB,EACd,EACA,EACQ,CACR,GAAM,CAAE,UAAS,SAAU,EAC3B,GAAI,CAAC,EAAQ,GAAI,OAAO,EAExB,GAAM,CAAC,EAAU,EAAiB,IAAM,EAAK,MAAM,GAAG,EAChD,EAAS,IAAI,gBAAgB,CAAc,EAIjD,OAHA,EAAO,IAAI,EAAqB,EAAQ,EAAE,EACtC,GAAO,EAAO,IAAA,MAAqB,CAAK,EAErC,GAAG,EAAS,GAAG,EAAO,SAAS,GACxC,CAQA,SAAgB,EACd,EACA,EACyB,CACzB,GAAI,CAAC,EAAQ,OAAO,KAEpB,IAAI,EACJ,GAAI,CACF,EAAS,IAAI,gBAAgB,CAAM,CACrC,MAAQ,CACN,OAAO,IACT,CAEA,IAAM,EAAY,EAAO,IAAI,CAAmB,EAKhD,MAJI,CAAC,GACD,CAAC,EAAS,KAAM,GAAY,EAAQ,KAAO,CAAS,EAAU,KAG3D,CAAE,YAAW,MADN,EAAO,IAAA,KACM,GAAS,IAAK,CAC3C,CAGA,SAAgB,GAAgC,CAE9C,OADI,OAAO,OAAW,IAAoB,GACnC,OAAO,SAAS,MACzB"}

package/dist/api/backend-registry/url-selection.d.ts ADDED Viewed

@@ -0,0 +1,31 @@
+import type { Backend, BackendSelection, ResolvedActiveBackend } from "./types";
+/**
+ * Query parameters that pin a link to the backend (and cloud org) that owns
+ * the linked resource.
+ *
+ * The active backend is tab-scoped: `readStoredActiveBackend()` prefers
+ * `sessionStorage` and only falls back to `localStorage`. A tab opened with
+ * cmd/ctrl-click or middle-click does not reliably inherit the opener's
+ * `sessionStorage`, so it can boot from the `localStorage` fallback — which
+ * holds whichever backend was selected *last in any tab*, not the one the
+ * sidebar we were just looking at belongs to. The new tab then resolves the
+ * conversation id against the wrong backend and shows "conversation not
+ * found". Carrying the identity in the URL makes the link self-describing so
+ * the new tab pins to the right backend regardless of what storage holds.
+ */
+export declare const BACKEND_QUERY_PARAM = "backend";
+export declare const ORG_QUERY_PARAM = "org";
+/**
+ * Append the active backend identity to an in-app path so opening it in a new
+ * browsing context resolves against the same backend.
+ */
+export declare function withBackendSelectionParams(path: string, active: ResolvedActiveBackend): string;
+/**
+ * Read a backend selection off the current URL, keeping it only when it names
+ * a registered backend. An unknown id (a link from another machine, or a
+ * backend that has since been removed) is ignored so the caller falls back to
+ * the stored selection.
+ */
+export declare function readBackendSelectionFromUrl(backends: Backend[], search: string): BackendSelection | null;
+/** The current tab's query string, or "" outside a browser. */
+export declare function currentLocationSearch(): string;

package/dist/api/backend-registry/url-selection.js ADDED Viewed

@@ -0,0 +1,29 @@
+//#region src/api/backend-registry/url-selection.ts
+var e = "backend";
+function t(t, n) {
+	let { backend: r, orgId: i } = n;
+	if (!r.id) return t;
+	let [a, o = ""] = t.split("?"), s = new URLSearchParams(o);
+	return s.set(e, r.id), i && s.set("org", i), `${a}?${s.toString()}`;
+}
+function n(t, n) {
+	if (!n) return null;
+	let r;
+	try {
+		r = new URLSearchParams(n);
+	} catch {
+		return null;
+	}
+	let i = r.get(e);
+	return !i || !t.some((e) => e.id === i) ? null : {
+		backendId: i,
+		orgId: r.get("org") || null
+	};
+}
+function r() {
+	return typeof window > "u" ? "" : window.location.search;
+}
+//#endregion
+export { r as currentLocationSearch, n as readBackendSelectionFromUrl, t as withBackendSelectionParams };
+//# sourceMappingURL=url-selection.js.map

package/dist/api/backend-registry/url-selection.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"url-selection.js","names":[],"sources":["../../../src/api/backend-registry/url-selection.ts"],"sourcesContent":["import type { Backend, BackendSelection, ResolvedActiveBackend } from \"./types\";\n\n/**\n * Query parameters that pin a link to the backend (and cloud org) that owns\n * the linked resource.\n *\n * The active backend is tab-scoped: `readStoredActiveBackend()` prefers\n * `sessionStorage` and only falls back to `localStorage`. A tab opened with\n * cmd/ctrl-click or middle-click does not reliably inherit the opener's\n * `sessionStorage`, so it can boot from the `localStorage` fallback — which\n * holds whichever backend was selected *last in any tab*, not the one the\n * sidebar we were just looking at belongs to. The new tab then resolves the\n * conversation id against the wrong backend and shows \"conversation not\n * found\". Carrying the identity in the URL makes the link self-describing so\n * the new tab pins to the right backend regardless of what storage holds.\n */\nexport const BACKEND_QUERY_PARAM = \"backend\";\nexport const ORG_QUERY_PARAM = \"org\";\n\n/**\n * Append the active backend identity to an in-app path so opening it in a new\n * browsing context resolves against the same backend.\n */\nexport function withBackendSelectionParams(\n path: string,\n active: ResolvedActiveBackend,\n): string {\n const { backend, orgId } = active;\n if (!backend.id) return path;\n\n const [pathname, existingSearch = \"\"] = path.split(\"?\");\n const params = new URLSearchParams(existingSearch);\n params.set(BACKEND_QUERY_PARAM, backend.id);\n if (orgId) params.set(ORG_QUERY_PARAM, orgId);\n\n return `${pathname}?${params.toString()}`;\n}\n\n/**\n * Read a backend selection off the current URL, keeping it only when it names\n * a registered backend. An unknown id (a link from another machine, or a\n * backend that has since been removed) is ignored so the caller falls back to\n * the stored selection.\n */\nexport function readBackendSelectionFromUrl(\n backends: Backend[],\n search: string,\n): BackendSelection | null {\n if (!search) return null;\n\n let params: URLSearchParams;\n try {\n params = new URLSearchParams(search);\n } catch {\n return null;\n }\n\n const backendId = params.get(BACKEND_QUERY_PARAM);\n if (!backendId) return null;\n if (!backends.some((backend) => backend.id === backendId)) return null;\n\n const orgId = params.get(ORG_QUERY_PARAM);\n return { backendId, orgId: orgId || null };\n}\n\n/** The current tab's query string, or \"\" outside a browser. */\nexport function currentLocationSearch(): string {\n if (typeof window === \"undefined\") return \"\";\n return window.location.search;\n}\n"],"mappings":";AAgBA,IAAa,IAAsB;AAOnC,SAAgB,EACd,GACA,GACQ;CACR,IAAM,EAAE,YAAS,aAAU;CAC3B,IAAI,CAAC,EAAQ,IAAI,OAAO;CAExB,IAAM,CAAC,GAAU,IAAiB,MAAM,EAAK,MAAM,GAAG,GAChD,IAAS,IAAI,gBAAgB,CAAc;CAIjD,OAHA,EAAO,IAAI,GAAqB,EAAQ,EAAE,GACtC,KAAO,EAAO,IAAA,OAAqB,CAAK,GAErC,GAAG,EAAS,GAAG,EAAO,SAAS;AACxC;AAQA,SAAgB,EACd,GACA,GACyB;CACzB,IAAI,CAAC,GAAQ,OAAO;CAEpB,IAAI;CACJ,IAAI;EACF,IAAS,IAAI,gBAAgB,CAAM;CACrC,QAAQ;EACN,OAAO;CACT;CAEA,IAAM,IAAY,EAAO,IAAI,CAAmB;CAKhD,OAJI,CAAC,KACD,CAAC,EAAS,MAAM,MAAY,EAAQ,OAAO,CAAS,IAAU,OAG3D;EAAE;EAAW,OADN,EAAO,IAAA,KACM,KAAS;CAAK;AAC3C;AAGA,SAAgB,IAAgC;CAE9C,OADI,OAAO,SAAW,MAAoB,KACnC,OAAO,SAAS;AACzB"}

package/dist/api/mcp-service/mcp-redacted-credentials.cjs CHANGED Viewed

@@ -1,2 +1,2 @@
-require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../utils/mcp-config.cjs"),t=require("../settings-service/settings-service.api.cjs"),n=require("../../types/mcp-auth.cjs");var r=e=>!!e&&typeof e==`object`&&!Array.isArray(e),i=e=>{if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0},a=e=>!!e&&Object.values(e).some(e=>e===`**********`),o=(e,t)=>e===`sse`?t===`sse`:e===`shttp`?t===void 0||t===`http`||t===`shttp`||t===`streamable-http`:!1,s=e=>{if(!e)return;let t=/^stdio-(\d+)$/.exec(e);return t?Number.parseInt(t[1],10):void 0},c=(e,t)=>{let n=s(e);if(n!==void 0)return Object.entries(t).filter(([,e])=>!e.url)[n]?.[1]},l=(e,t)=>e.type===`stdio`?c(e.id,t)??(e.name?t[e.name]:void 0):e.name&&t[e.name]?t[e.name]:Object.values(t).find(t=>t.url===e.url&&o(e.type,t.transport));async function u(e){let n=(await t.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(r(n))return l(e,n)}async function d(t){let r=t.type===`stdio`&&a(t.env),o=(t.type===`sse`||t.type===`shttp`)&&e.hasRedactedMcpSecretLeaf(t.auth);if(!r&&!o)return t;try{let e=await u(t);if(!e)return t;if(r){let n=i(e.env)??{},r=Object.fromEntries(Object.entries(t.env??{}).map(([e,t])=>[e,t===`**********`&&typeof n[e]==`string`?n[e]:t]));return{...t,env:r}}return o&&n.isMcpAuthCredential(e.auth)?{...t,auth:e.auth}:t}catch{return t}}exports.substituteRedactedMcpCredentials=d;
+require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../types/mcp-auth.cjs"),t=require("../../utils/mcp-config.cjs"),n=require("../settings-service/settings-service.api.cjs");var r=e=>!!e&&typeof e==`object`&&!Array.isArray(e),i=e=>{if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0},a=e=>!!e&&Object.values(e).some(e=>e===`**********`);function o(e,t){if(!r(e))return e;let n=r(t)?t:{},i={...e};for(let[t,a]of Object.entries(e))if(a===`**********`){let e=n[t];typeof e==`string`&&e!==`**********`&&(i[t]=e)}else r(a)&&(i[t]=o(a,n[t]));return i}var s=(e,t)=>t[e.id];async function c(e){let t=(await n.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(r(t))return s(e,t)}async function l(n){let r=n.type===`stdio`&&a(n.env),s=(n.type===`sse`||n.type===`shttp`)&&t.hasRedactedMcpSecretLeaf(n.auth),l=(n.type===`sse`||n.type===`shttp`)&&a(n.headers);if(!r&&!s&&!l)return n;try{let t=await c(n);if(!t)return n;if(r){let e=i(t.env)??{},r=Object.fromEntries(Object.entries(n.env??{}).map(([t,n])=>[t,n===`**********`&&typeof e[t]==`string`?e[t]:n]));return{...n,env:r}}let a={...n};if(s&&e.isMcpAuthCredential(t.auth)&&(a.auth=o(n.auth,t.auth)),l){let e=i(t.headers)??{};a.headers=Object.fromEntries(Object.entries(n.headers??{}).map(([t,n])=>[t,n===`**********`&&typeof e[t]==`string`?e[t]:n]))}return a}catch{return n}}exports.substituteRedactedMcpCredentials=l;
 //# sourceMappingURL=mcp-redacted-credentials.cjs.map

package/dist/api/mcp-service/mcp-redacted-credentials.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n hasRedactedMcpSecretLeaf,\n REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n url?: unknown;\n transport?: unknown;\n env?: unknown;\n auth?: unknown;\n headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> \| undefined => {\n if (!isRecord(value)) return undefined;\n const entries = Object.entries(value).filter(\n (entry): entry is [string, string] => typeof entry[1] === \"string\",\n );\n return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> \| undefined) =>\n !!values &&\n Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\~~nconst remoteTransportMatches = (\~~n ~~type: MCPServerConfig[\"type\"],\~~n ~~transport:~~ ~~unknown,\n)~~ => ~~{\n if~~ ~~(type~~ ~~===~~ ~~\"sse\")~~ ~~return~~ ~~transport~~ ~~===~~ \~~"sse\";\~~n if ~~(type~~ === \"shttp\") {\n return (\n transport === undefined \|\|\n transport === \"http\" \|\|\n transport === \"shttp\" \|\|\n transport === \"streamable-http\"\n );\n }\n return false;\n};\n\n// The editor assigns each stdio server an id of the form ``~~stdio-<i>`` matching\n// its position in~~ ``~~parseMcpConfig``'s~~ ~~stdio~~ ~~array.~~ ~~That~~ ~~position~~ ~~is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries~~ (~~those\n// without a ``url``~~) ~~in ``Object~~.~~entries``~~ ~~order, identical for the redacted~~\n// ~~and~~ ~~encrypted~~ ~~settings.~~ ~~Resolve~~ ~~the~~ ~~original~~ ~~stored~~ ~~entry~~ by ~~position~~ so a\n// ~~renamed~~ ~~stdio~~ ~~server~~ ~~still~~ ~~finds~~ ~~its~~ ~~stored~~ ~~encrypted~~ ~~env, instead of\n// looking~~ it up by ~~the new (no-longer-matching) display name~~.\~~nconst~~ ~~stdioIndexFromId~~ = (id: ~~string~~ \| ~~undefined~~): ~~number~~ ~~\| undefined =>~~ {\n if (!id) return ~~undefined~~;\n const ~~match~~ = ~~/^stdio-~~(~~\\d+~~)~~$/.exec(id);\n return~~ ~~match~~ ? ~~Number.parseInt(match[1],~~ ~~10)~~ : ~~undefined;\n~~};\n~~\nconst~~ ~~findStoredStdioByIndex = (\n id~~: string \| ~~undefined,\n storedServers:~~ ~~StoredMcpConfig,\n): StoredMcpServer \| undefined =>~~ {~~\n const~~ ~~index~~ ~~= stdioIndexFromId(id)~~;\n if (~~index~~ ~~===~~ ~~undefined)~~ ~~return~~ ~~undefined;\n const stdioEntries =~~ Object.entries(~~storedServers~~)~~.filter(~~\n ([, ~~stored]~~) ~~=> !stored.url,\~~n ~~);\n return~~ ~~stdioEntries~~[~~index~~]~~?.[1]~~;\n~~};\n\nconst~~ ~~findStoredServer =~~ (\n ~~server:~~ ~~MCPServerConfig,\n storedServers:~~ ~~StoredMcpConfig,\n): StoredMcpServer \| undefined => {\n if (server.type~~ === \"~~stdio~~\") {\n // ~~Prefer~~ ~~the positional id: a rename changes the display name (the stored~~\n ~~// dict key~~), ~~and a rename onto an existing name would otherwise restore the~~\n // ~~wrong~~ ~~server's secrets. Fall back to a name match only when no id-based~~\n // ~~position~~ is ~~available~~ (~~e.g. configs built without an editor-assigned id~~)~~.\n return~~ (\n ~~findStoredStdioByIndex(server.id,~~ ~~storedServers)~~ ~~??\n~~ (~~server.name~~ ~~? storedServers~~[~~server.name~~] ~~: undefined~~)\n ~~);\~~n }\n\n if ~~(server.name~~ && ~~storedServers[server.name]) {\n return storedServers[server.name]~~;\n }\n\n ~~return~~ ~~Object.values(~~storedServers~~).find(\~~n ~~(stored~~) ~~=>\n stored.url~~ ~~===~~ ~~server.url~~ ~~&&\n remoteTransportMatches(~~server.~~type, stored.transport),\n )~~;\n~~};\n~~\nasync function fetchEncryptedStoredServer(\n server: MCPServerConfig,\n): Promise<StoredMcpServer \| undefined> {\n const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n const mcpConfig = response.agent_settings?.mcp_config;\n if (!isRecord(mcpConfig)) {\n return undefined;\n }\n return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/*\n The MCP editor sees redacted settings (`*********`). When the user leaves\n a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so ~~tests~~ ~~and~~ ~~saves~~ ~~round-trip~~ the real\n * credential without exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n const redactedStdioEnv =\n server.type === \"stdio\" && hasRedactedValue(server.env);\n const redactedRemoteAuth =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedMcpSecretLeaf(server.auth);\n\n if (!redactedStdioEnv && !redactedRemoteAuth) {\n return server;\n }\n\n try {\n const stored = await fetchEncryptedStoredServer(server);\n if (!stored) return server;\n\n if (redactedStdioEnv) {\n const storedEnv = stringRecord(stored.env) ?? {};\n const env = Object.fromEntries(\n Object.entries(server.env ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedEnv[key] === \"string\"\n ? storedEnv[key]\n : value,\n ]),\n );\n return { ...server, env };\n }\n\n if ~~(!redactedRemoteAuth)~~ ~~return~~ server;\n if (isMcpAuthCredential(stored.auth)) {\n ~~return~~ { ~~...~~server, auth: stored.~~auth~~ };\n }\n return ~~server~~;\n } catch {\n return server;\n }\n}\n"],"mappings":"8LAkBA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,EAExD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,EAEM,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,CAAM,EAAE,KAAM,GAAU,IAAA,YAAmC,~~EAErE~~,~~GACJ~~,~~EACA~~,~~IAEI~~,~~IAAS,MAAc,IAAc,MACrC,IAAS,QAET,IAAc,IAAA,IACd,IAAc,QACd,IAAc,SACd,IAAc,kBAGX,GAUH,~~EAAoB,~~GAA+C~~,~~CACvE,~~GAAI,CAAC,~~EAAI~~,~~OACT~~,~~IAAM~~,~~EAAQ,gBAAgB,KAAK,CAAE,EACrC,~~OAAO,~~EAAQ~~,~~OAAO~~,~~SAAS~~,~~EAAM~~,~~GAAI~~,~~EAAE,~~EAAI,~~IAAA~~,~~EACjD~~,~~EAEM~~,~~GACJ~~,~~EACA~~,~~IACgC~~,~~CAChC~~,~~IAAM~~,~~EAAQ~~,~~EAAiB~~,~~CAAE~~,~~EAC7B~~,~~OAAU~~,~~IAAA,GAId,OAHqB,~~OAAO,QAAQ,~~CAAa~~,~~EAAE~~,~~QAChD~~,~~EAAG~~,~~KAAY~~,~~CAAC~~,~~EAAO~~,~~GAEnB~~,EAAa,~~KAAS,EAC~~/B,~~EAEM~~,~~GACJ~~,~~EACA~~,~~IAEI~~,~~EAAO~~,~~OAAS,QAMhB,EAAuB,~~EAAO,~~GAAI~~,~~CAAa~~,~~IAC9C~~,~~EAAO~~,~~KAAO~~,~~EAAc~~,EAAO,~~MAAQ~~,~~IAAA~~,~~IAI5C,~~EAAO,~~MAAQ~~,~~EAAc~~,~~EAAO~~,~~MAC/B,EAAc,EAAO,MAGvB,~~OAAO,~~OAAO~~,~~CAAa~~,~~EAAE~~,~~KACjC~~,~~GACC~~,~~EAAO~~,~~MAAQ~~,EAAO,~~KACtB~~,~~EAAuB,EAAO,KAAM,EAAO,SAAS,CACxD,EAGF,~~eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,WAAW,GAC5C,gBAAgB,WACtC,KAAS,CAAS,EAGvB,OAAO,EAAiB,EAAQ,CAA4B,CAC9D,~~CAQA~~,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,GAAG,EAClD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAA,yBAAyB,EAAO,IAAI,~~EAEtC~~,GAAI,CAAC,GAAoB,CAAC,~~EACxB~~,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,CAAM,EACtD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,GAAG,GAAK,CAAC,EACzC,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,CACN,CAAC,CACH,EACA,MAAO,CAAE,GAAG,EAAQ,KAAI,CAC1B,~~CAMA~~,~~OAJK~~,~~GACD~~,EAAA,oBAAoB,EAAO,IAAI,~~EAC1B~~,~~CAAE~~,~~GAAG~~,~~EAAQ~~,KAAM,EAAO,~~IAAK~~,~~EAEjC~~,CACT,MAAQ,CACN,OAAO,CACT,CACF"}
1	+ {"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n hasRedactedMcpSecretLeaf,\n REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n url?: unknown;\n transport?: unknown;\n env?: unknown;\n auth?: unknown;\n headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> \| undefined => {\n if (!isRecord(value)) return undefined;\n const entries = Object.entries(value).filter(\n (entry): entry is [string, string] => typeof entry[1] === \"string\",\n );\n return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> \| undefined) =>\n !!values &&\n Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\n/*\n Recursively replace only the redacted display placeholders inside\n * ``submitted`` with the corresponding stored (encrypted) leaf. Fresh\n * non-redacted edits and untouched structure are preserved verbatim, so a\n * probe request exercises the server exactly as it will be persisted.\n /\nfunction substituteRedactedLeaves<T>(submitted: T, stored: unknown): T {\n if (!isRecord(submitted)) return submitted;\n\n const storedRecord = isRecord(stored) ? stored : {};\n const merged: Record<string, unknown> = { ...submitted };\n for (const [key, value] of Object.entries(submitted)) {\n if (value === REDACTED_MCP_SECRET_VALUE) {\n const storedValue = storedRecord[key];\n if (\n typeof storedValue === \"string\" &&\n storedValue !== REDACTED_MCP_SECRET_VALUE\n ) {\n merged[key] = storedValue;\n }\n } else if (isRecord(value)) {\n merged[key] = substituteRedactedLeaves(value, storedRecord[key]);\n }\n }\n return merged as T;\n}\n\nconst findStoredServer = (\n server: MCPServerConfig,\n storedServers: StoredMcpConfig,\n): StoredMcpServer \| undefined => storedServers[server.id];\n\nasync function fetchEncryptedStoredServer(\n server: MCPServerConfig,\n): Promise<StoredMcpServer \| undefined> {\n const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n const mcpConfig = response.agent_settings?.mcp_config;\n if (!isRecord(mcpConfig)) {\n return undefined;\n }\n return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/\n The MCP editor sees redacted settings (`*********`). When the user leaves\n a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so a connectivity test can exercise the real\n * credential without exposing plaintext in the browser. Persistence never\n * calls this helper; sparse settings patches omit unchanged secrets.\n */\nexport async function substituteRedactedMcpCredentials(\n server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n const redactedStdioEnv =\n server.type === \"stdio\" && hasRedactedValue(server.env);\n const redactedRemoteAuth =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedMcpSecretLeaf(server.auth);\n const redactedRemoteHeaders =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedValue(server.headers);\n\n if (!redactedStdioEnv && !redactedRemoteAuth && !redactedRemoteHeaders) {\n return server;\n }\n\n try {\n const stored = await fetchEncryptedStoredServer(server);\n if (!stored) return server;\n\n if (redactedStdioEnv) {\n const storedEnv = stringRecord(stored.env) ?? {};\n const env = Object.fromEntries(\n Object.entries(server.env ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedEnv[key] === \"string\"\n ? storedEnv[key]\n : value,\n ]),\n );\n return { ...server, env };\n }\n\n const nextServer = { ...server };\n if (redactedRemoteAuth && isMcpAuthCredential(stored.auth)) {\n nextServer.auth = substituteRedactedLeaves(server.auth, stored.auth);\n }\n if (redactedRemoteHeaders) {\n const storedHeaders = stringRecord(stored.headers) ?? {};\n nextServer.headers = Object.fromEntries(\n Object.entries(server.headers ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedHeaders[key] === \"string\"\n ? storedHeaders[key]\n : value,\n ]),\n );\n }\n return nextServer;\n } catch {\n return server;\n }\n}\n"],"mappings":"8LAkBA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,EAExD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,EAEM,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,CAAM,EAAE,KAAM,GAAU,IAAA,YAAmC,EAQ3E,SAAS,EAA4B,EAAc,EAAoB,CACrE,GAAI,CAAC,EAAS,CAAS,EAAG,OAAO,EAEjC,IAAM,EAAe,EAAS,CAAM,EAAI,EAAS,CAAC,EAC5C,EAAkC,CAAE,GAAG,CAAU,EACvD,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAS,EACjD,GAAI,IAAA,aAAqC,CACvC,IAAM,EAAc,EAAa,GAE/B,OAAO,GAAgB,UACvB,IAAA,eAEA,EAAO,GAAO,EAElB,MAAW,EAAS,CAAK,IACvB,EAAO,GAAO,EAAyB,EAAO,EAAa,EAAI,GAGnE,OAAO,CACT,CAEA,IAAM,GACJ,EACA,IACgC,EAAc,EAAO,IAEvD,eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,WAAW,GAC5C,gBAAgB,WACtC,KAAS,CAAS,EAGvB,OAAO,EAAiB,EAAQ,CAA4B,CAC9D,CASA,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,GAAG,EAClD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAA,yBAAyB,EAAO,IAAI,EAChC,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAiB,EAAO,OAAO,EAEjC,GAAI,CAAC,GAAoB,CAAC,GAAsB,CAAC,EAC/C,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,CAAM,EACtD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,GAAG,GAAK,CAAC,EACzC,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,CACN,CAAC,CACH,EACA,MAAO,CAAE,GAAG,EAAQ,KAAI,CAC1B,CAEA,IAAM,EAAa,CAAE,GAAG,CAAO,EAI/B,GAHI,GAAsB,EAAA,oBAAoB,EAAO,IAAI,IACvD,EAAW,KAAO,EAAyB,EAAO,KAAM,EAAO,IAAI,GAEjE,EAAuB,CACzB,IAAM,EAAgB,EAAa,EAAO,OAAO,GAAK,CAAC,EACvD,EAAW,QAAU,OAAO,YAC1B,OAAO,QAAQ,EAAO,SAAW,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACzD,EACA,IAAA,cACA,OAAO,EAAc,IAAS,SAC1B,EAAc,GACd,CACN,CAAC,CACH,CACF,CACA,OAAO,CACT,MAAQ,CACN,OAAO,CACT,CACF"}

package/dist/api/mcp-service/mcp-redacted-credentials.d.ts CHANGED Viewed

@@ -2,7 +2,8 @@ import type { MCPServerConfig } from "#/types/mcp-server";
 /**
  * The MCP editor sees redacted settings (`**********`). When the user leaves
  * a secret unchanged, replace that placeholder with the stored encrypted
- * env/header/OAuth state value so tests and saves round-trip the real
- * credential without exposing plaintext in the browser.
+ * env/header/OAuth state value so a connectivity test can exercise the real
+ * credential without exposing plaintext in the browser. Persistence never
+ * calls this helper; sparse settings patches omit unchanged secrets.
  */
 export declare function substituteRedactedMcpCredentials(server: MCPServerConfig): Promise<MCPServerConfig>;

package/dist/api/mcp-service/mcp-redacted-credentials.js CHANGED Viewed

@@ -1,45 +1,50 @@
-import { hasRedactedMcpSecretLeaf as e } from "../../utils/mcp-config.js";
-import t from "../settings-service/settings-service.api.js";
-import { isMcpAuthCredential as n } from "../../types/mcp-auth.js";
+import { isMcpAuthCredential as e } from "../../types/mcp-auth.js";
+import { hasRedactedMcpSecretLeaf as t } from "../../utils/mcp-config.js";
+import n from "../settings-service/settings-service.api.js";
 //#region src/api/mcp-service/mcp-redacted-credentials.ts
 var r = (e) => !!e && typeof e == "object" && !Array.isArray(e), i = (e) => {
 	if (!r(e)) return;
 	let t = Object.entries(e).filter((e) => typeof e[1] == "string");
 	return t.length > 0 ? Object.fromEntries(t) : void 0;
-}, a = (e) => !!e && Object.values(e).some((e) => e === "**********"), o = (e, t) => e === "sse" ? t === "sse" : e === "shttp" ? t === void 0 || t === "http" || t === "shttp" || t === "streamable-http" : !1, s = (e) => {
-	if (!e) return;
-	let t = /^stdio-(\d+)$/.exec(e);
-	return t ? Number.parseInt(t[1], 10) : void 0;
-}, c = (e, t) => {
-	let n = s(e);
-	if (n !== void 0) return Object.entries(t).filter(([, e]) => !e.url)[n]?.[1];
-}, l = (e, t) => e.type === "stdio" ? c(e.id, t) ?? (e.name ? t[e.name] : void 0) : e.name && t[e.name] ? t[e.name] : Object.values(t).find((t) => t.url === e.url && o(e.type, t.transport));
-async function u(e) {
-	let n = (await t.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
-	if (r(n)) return l(e, n);
+}, a = (e) => !!e && Object.values(e).some((e) => e === "**********");
+function o(e, t) {
+	if (!r(e)) return e;
+	let n = r(t) ? t : {}, i = { ...e };
+	for (let [t, a] of Object.entries(e)) if (a === "**********") {
+		let e = n[t];
+		typeof e == "string" && e !== "**********" && (i[t] = e);
+	} else r(a) && (i[t] = o(a, n[t]));
+	return i;
 }
-async function d(t) {
-	let r = t.type === "stdio" && a(t.env), o = (t.type === "sse" || t.type === "shttp") && e(t.auth);
-	if (!r && !o) return t;
+var s = (e, t) => t[e.id];
+async function c(e) {
+	let t = (await n.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
+	if (r(t)) return s(e, t);
+}
+async function l(n) {
+	let r = n.type === "stdio" && a(n.env), s = (n.type === "sse" || n.type === "shttp") && t(n.auth), l = (n.type === "sse" || n.type === "shttp") && a(n.headers);
+	if (!r && !s && !l) return n;
 	try {
-		let e = await u(t);
-		if (!e) return t;
+		let t = await c(n);
+		if (!t) return n;
 		if (r) {
-			let n = i(e.env) ?? {}, r = Object.fromEntries(Object.entries(t.env ?? {}).map(([e, t]) => [e, t === "**********" && typeof n[e] == "string" ? n[e] : t]));
+			let e = i(t.env) ?? {}, r = Object.fromEntries(Object.entries(n.env ?? {}).map(([t, n]) => [t, n === "**********" && typeof e[t] == "string" ? e[t] : n]));
 			return {
-				...t,
+				...n,
 				env: r
 			};
 		}
-		return o && n(e.auth) ? {
-			...t,
-			auth: e.auth
-		} : t;
+		let a = { ...n };
+		if (s && e(t.auth) && (a.auth = o(n.auth, t.auth)), l) {
+			let e = i(t.headers) ?? {};
+			a.headers = Object.fromEntries(Object.entries(n.headers ?? {}).map(([t, n]) => [t, n === "**********" && typeof e[t] == "string" ? e[t] : n]));
+		}
+		return a;
 	} catch {
-		return t;
+		return n;
 	}
 }
 //#endregion
-export { d as substituteRedactedMcpCredentials };
+export { l as substituteRedactedMcpCredentials };
 //# sourceMappingURL=mcp-redacted-credentials.js.map

package/dist/api/mcp-service/mcp-redacted-credentials.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-redacted-credentials.js","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n hasRedactedMcpSecretLeaf,\n REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n url?: unknown;\n transport?: unknown;\n env?: unknown;\n auth?: unknown;\n headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> \| undefined => {\n if (!isRecord(value)) return undefined;\n const entries = Object.entries(value).filter(\n (entry): entry is [string, string] => typeof entry[1] === \"string\",\n );\n return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> \| undefined) =>\n !!values &&\n Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\~~nconst remoteTransportMatches = (\~~n ~~type: MCPServerConfig[\"type\"],\~~n ~~transport:~~ ~~unknown,\n)~~ => ~~{\n if~~ ~~(type~~ ~~===~~ ~~\"sse\")~~ ~~return~~ ~~transport~~ ~~===~~ \~~"sse\";\~~n if ~~(type~~ === \"shttp\") {\n return (\n transport === undefined \|\|\n transport === \"http\" \|\|\n transport === \"shttp\" \|\|\n transport === \"streamable-http\"\n );\n }\n return false;\n};\n\n// The editor assigns each stdio server an id of the form ``~~stdio-<i>`` matching\n// its position in~~ ``~~parseMcpConfig``'s~~ ~~stdio~~ ~~array.~~ ~~That~~ ~~position~~ ~~is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries~~ (~~those\n// without a ``url``~~) ~~in ``Object~~.~~entries``~~ ~~order, identical for the redacted~~\n// ~~and~~ ~~encrypted~~ ~~settings.~~ ~~Resolve~~ ~~the~~ ~~original~~ ~~stored~~ ~~entry~~ by ~~position~~ so a\n// ~~renamed~~ ~~stdio~~ ~~server~~ ~~still~~ ~~finds~~ ~~its~~ ~~stored~~ ~~encrypted~~ ~~env, instead of\n// looking~~ it up by ~~the new (no-longer-matching) display name~~.\~~nconst~~ ~~stdioIndexFromId~~ = (id: ~~string~~ \| ~~undefined~~): ~~number~~ ~~\| undefined =>~~ {\n if (!id) return ~~undefined~~;\n const ~~match~~ = ~~/^stdio-~~(~~\\d+~~)~~$/.exec(id);\n return~~ ~~match~~ ? ~~Number.parseInt(match[1],~~ ~~10)~~ : ~~undefined;\n~~};\n~~\nconst~~ ~~findStoredStdioByIndex = (\n id~~: string \| ~~undefined,\n storedServers:~~ ~~StoredMcpConfig,\n): StoredMcpServer \| undefined =>~~ {~~\n const~~ ~~index~~ ~~= stdioIndexFromId(id)~~;\n if (~~index~~ ~~===~~ ~~undefined)~~ ~~return~~ ~~undefined;\n const stdioEntries =~~ Object.entries(~~storedServers~~)~~.filter(~~\n ([, ~~stored]~~) ~~=> !stored.url,\~~n ~~);\n return~~ ~~stdioEntries~~[~~index~~]~~?.[1]~~;\n~~};\n\nconst~~ ~~findStoredServer =~~ (\n ~~server:~~ ~~MCPServerConfig,\n storedServers:~~ ~~StoredMcpConfig,\n): StoredMcpServer \| undefined => {\n if (server.type~~ === \"~~stdio~~\") {\n // ~~Prefer~~ ~~the positional id: a rename changes the display name (the stored~~\n ~~// dict key~~), ~~and a rename onto an existing name would otherwise restore the~~\n // ~~wrong~~ ~~server's secrets. Fall back to a name match only when no id-based~~\n // ~~position~~ is ~~available~~ (~~e.g. configs built without an editor-assigned id~~)~~.\n return~~ (\n ~~findStoredStdioByIndex(server.id,~~ ~~storedServers)~~ ~~??\n~~ (~~server.name~~ ~~? storedServers~~[~~server.name~~] ~~: undefined~~)\n ~~);\~~n }\n\n if ~~(server.name~~ && ~~storedServers[server.name]) {\n return storedServers[server.name]~~;\n }\n\n ~~return~~ ~~Object.values(~~storedServers~~).find(\~~n ~~(stored~~) ~~=>\n stored.url~~ ~~===~~ ~~server.url~~ ~~&&\n remoteTransportMatches(~~server.~~type, stored.transport),\n )~~;\n~~};\n~~\nasync function fetchEncryptedStoredServer(\n server: MCPServerConfig,\n): Promise<StoredMcpServer \| undefined> {\n const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n const mcpConfig = response.agent_settings?.mcp_config;\n if (!isRecord(mcpConfig)) {\n return undefined;\n }\n return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/*\n The MCP editor sees redacted settings (`*********`). When the user leaves\n a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so ~~tests~~ ~~and~~ ~~saves~~ ~~round-trip~~ the real\n * credential without exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n const redactedStdioEnv =\n server.type === \"stdio\" && hasRedactedValue(server.env);\n const redactedRemoteAuth =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedMcpSecretLeaf(server.auth);\n\n if (!redactedStdioEnv && !redactedRemoteAuth) {\n return server;\n }\n\n try {\n const stored = await fetchEncryptedStoredServer(server);\n if (!stored) return server;\n\n if (redactedStdioEnv) {\n const storedEnv = stringRecord(stored.env) ?? {};\n const env = Object.fromEntries(\n Object.entries(server.env ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedEnv[key] === \"string\"\n ? storedEnv[key]\n : value,\n ]),\n );\n return { ...server, env };\n }\n\n if ~~(!redactedRemoteAuth)~~ ~~return~~ server;\n if (isMcpAuthCredential(stored.auth)) {\n ~~return~~ { ~~...~~server, auth: stored.~~auth~~ };\n }\n return ~~server~~;\n } catch {\n return server;\n }\n}\n"],"mappings":";;;;AAkBA,IAAM,KAAY,MAChB,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK,GAExD,KAAgB,MAAuD;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D,GAEM,KAAoB,MACxB,CAAC,CAAC,KACF,OAAO,OAAO,CAAM,EAAE,MAAM,MAAU,MAAA,YAAmC,~~GAErE~~,~~KACJ~~,~~GACA~~,~~MAEI,MAAS,QAAc,MAAc,QACrC,MAAS,UAET,MAAc,KAAA,KACd,MAAc,UACd,MAAc,WACd,MAAc,oBAGX,IAUH,KAAoB,MAA+C~~;~~CACvE~~,IAAI,CAAC,~~GAAI;CACT~~,~~IAAM~~,~~IAAQ~~,~~gBAAgB,KAAK,CAAE~~;~~CACrC~~,~~OAAO~~,~~IAAQ~~,~~OAAO~~,~~SAAS~~,~~EAAM,~~IAAI,~~EAAE~~,~~IAAI~~,~~KAAA;AACjD~~,~~GAEM~~,~~KACJ~~,~~GACA~~,~~MACgC~~;~~CAChC~~,IAAM,~~IAAQ~~,~~EAAiB~~,~~CAAE;CAC7B~~,~~UAAU,KAAA,GAId,OAHqB,~~OAAO,QAAQ,~~CAAa~~,~~EAAE~~,~~QAChD~~,~~GAAG~~,~~OAAY~~,~~CAAC~~,~~EAAO~~,~~GAEnB,~~EAAa~~,KAAS~~;~~AAC/B~~,~~GAEM~~,~~KACJ~~,~~GACA~~,~~MAEI~~,~~EAAO~~,~~SAAS~~,~~UAMhB,EAAuB,~~EAAO,~~IAAI~~,~~CAAa,MAC9C,EAAO,~~OAAO,~~EAAc~~,~~EAAO~~,~~QAAQ~~,~~KAAA~~,~~KAI5C,~~EAAO,~~QAAQ~~,~~EAAc~~,~~EAAO~~,~~QAC/B~~,~~EAAc~~,~~EAAO,QAGvB,~~OAAO,~~OAAO~~,~~CAAa~~,~~EAAE~~,~~MACjC~~,~~MACC~~,EAAO~~,QAAQ,EAAO,OACtB,EAAuB,EAAO,MAAM,EAAO,SAAS,CACxD~~;~~AAGF~~,eAAe,EACb,GACsC;CAEtC,IAAM,KAAY,MADK,EAAgB,qBAAqB,WAAW,GAC5C,gBAAgB;CACtC,MAAS,CAAS,GAGvB,OAAO,EAAiB,GAAQ,CAA4B;AAC9D;~~AAQA~~,eAAsB,EACpB,GAC0B;CAC1B,IAAM,IACJ,EAAO,SAAS,WAAW,EAAiB,EAAO,GAAG,GAClD,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAyB,EAAO,IAAI;~~CAEtC~~,IAAI,CAAC,KAAoB,CAAC,~~GACxB~~,OAAO;CAGT,IAAI;EACF,IAAM,IAAS,MAAM,EAA2B,CAAM;EACtD,IAAI,CAAC,GAAQ,OAAO;EAEpB,IAAI,GAAkB;GACpB,IAAM,IAAY,EAAa,EAAO,GAAG,KAAK,CAAC,GACzC,IAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACrD,GACA,MAAA,gBACA,OAAO,EAAU,MAAS,WACtB,EAAU,KACV,CACN,CAAC,CACH;GACA,OAAO;IAAE,GAAG;IAAQ;GAAI;EAC1B;~~EAMA~~,~~OAJK~~,~~KACD~~,EAAoB,EAAO,IAAI,~~IAC1B~~;~~GAAE~~,~~GAAG~~;~~GAAQ~~,~~MAAM~~,EAAO;~~EAAK~~,~~IAEjC~~;CACT,QAAQ;EACN,OAAO;CACT;AACF"}
1	+ {"version":3,"file":"mcp-redacted-credentials.js","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n hasRedactedMcpSecretLeaf,\n REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n url?: unknown;\n transport?: unknown;\n env?: unknown;\n auth?: unknown;\n headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> \| undefined => {\n if (!isRecord(value)) return undefined;\n const entries = Object.entries(value).filter(\n (entry): entry is [string, string] => typeof entry[1] === \"string\",\n );\n return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> \| undefined) =>\n !!values &&\n Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\n/*\n Recursively replace only the redacted display placeholders inside\n * ``submitted`` with the corresponding stored (encrypted) leaf. Fresh\n * non-redacted edits and untouched structure are preserved verbatim, so a\n * probe request exercises the server exactly as it will be persisted.\n /\nfunction substituteRedactedLeaves<T>(submitted: T, stored: unknown): T {\n if (!isRecord(submitted)) return submitted;\n\n const storedRecord = isRecord(stored) ? stored : {};\n const merged: Record<string, unknown> = { ...submitted };\n for (const [key, value] of Object.entries(submitted)) {\n if (value === REDACTED_MCP_SECRET_VALUE) {\n const storedValue = storedRecord[key];\n if (\n typeof storedValue === \"string\" &&\n storedValue !== REDACTED_MCP_SECRET_VALUE\n ) {\n merged[key] = storedValue;\n }\n } else if (isRecord(value)) {\n merged[key] = substituteRedactedLeaves(value, storedRecord[key]);\n }\n }\n return merged as T;\n}\n\nconst findStoredServer = (\n server: MCPServerConfig,\n storedServers: StoredMcpConfig,\n): StoredMcpServer \| undefined => storedServers[server.id];\n\nasync function fetchEncryptedStoredServer(\n server: MCPServerConfig,\n): Promise<StoredMcpServer \| undefined> {\n const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n const mcpConfig = response.agent_settings?.mcp_config;\n if (!isRecord(mcpConfig)) {\n return undefined;\n }\n return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/\n The MCP editor sees redacted settings (`*********`). When the user leaves\n a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so a connectivity test can exercise the real\n * credential without exposing plaintext in the browser. Persistence never\n * calls this helper; sparse settings patches omit unchanged secrets.\n */\nexport async function substituteRedactedMcpCredentials(\n server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n const redactedStdioEnv =\n server.type === \"stdio\" && hasRedactedValue(server.env);\n const redactedRemoteAuth =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedMcpSecretLeaf(server.auth);\n const redactedRemoteHeaders =\n (server.type === \"sse\" \|\| server.type === \"shttp\") &&\n hasRedactedValue(server.headers);\n\n if (!redactedStdioEnv && !redactedRemoteAuth && !redactedRemoteHeaders) {\n return server;\n }\n\n try {\n const stored = await fetchEncryptedStoredServer(server);\n if (!stored) return server;\n\n if (redactedStdioEnv) {\n const storedEnv = stringRecord(stored.env) ?? {};\n const env = Object.fromEntries(\n Object.entries(server.env ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedEnv[key] === \"string\"\n ? storedEnv[key]\n : value,\n ]),\n );\n return { ...server, env };\n }\n\n const nextServer = { ...server };\n if (redactedRemoteAuth && isMcpAuthCredential(stored.auth)) {\n nextServer.auth = substituteRedactedLeaves(server.auth, stored.auth);\n }\n if (redactedRemoteHeaders) {\n const storedHeaders = stringRecord(stored.headers) ?? {};\n nextServer.headers = Object.fromEntries(\n Object.entries(server.headers ?? {}).map(([key, value]) => [\n key,\n value === REDACTED_MCP_SECRET_VALUE &&\n typeof storedHeaders[key] === \"string\"\n ? storedHeaders[key]\n : value,\n ]),\n );\n }\n return nextServer;\n } catch {\n return server;\n }\n}\n"],"mappings":";;;;AAkBA,IAAM,KAAY,MAChB,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK,GAExD,KAAgB,MAAuD;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D,GAEM,KAAoB,MACxB,CAAC,CAAC,KACF,OAAO,OAAO,CAAM,EAAE,MAAM,MAAU,MAAA,YAAmC;AAQ3E,SAAS,EAA4B,GAAc,GAAoB;CACrE,IAAI,CAAC,EAAS,CAAS,GAAG,OAAO;CAEjC,IAAM,IAAe,EAAS,CAAM,IAAI,IAAS,CAAC,GAC5C,IAAkC,EAAE,GAAG,EAAU;CACvD,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAS,GACjD,IAAI,MAAA,cAAqC;EACvC,IAAM,IAAc,EAAa;EACjC,AACE,OAAO,KAAgB,YACvB,MAAA,iBAEA,EAAO,KAAO;CAElB,OAAO,AAAI,EAAS,CAAK,MACvB,EAAO,KAAO,EAAyB,GAAO,EAAa,EAAI;CAGnE,OAAO;AACT;AAEA,IAAM,KACJ,GACA,MACgC,EAAc,EAAO;AAEvD,eAAe,EACb,GACsC;CAEtC,IAAM,KAAY,MADK,EAAgB,qBAAqB,WAAW,GAC5C,gBAAgB;CACtC,MAAS,CAAS,GAGvB,OAAO,EAAiB,GAAQ,CAA4B;AAC9D;AASA,eAAsB,EACpB,GAC0B;CAC1B,IAAM,IACJ,EAAO,SAAS,WAAW,EAAiB,EAAO,GAAG,GAClD,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAyB,EAAO,IAAI,GAChC,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAiB,EAAO,OAAO;CAEjC,IAAI,CAAC,KAAoB,CAAC,KAAsB,CAAC,GAC/C,OAAO;CAGT,IAAI;EACF,IAAM,IAAS,MAAM,EAA2B,CAAM;EACtD,IAAI,CAAC,GAAQ,OAAO;EAEpB,IAAI,GAAkB;GACpB,IAAM,IAAY,EAAa,EAAO,GAAG,KAAK,CAAC,GACzC,IAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACrD,GACA,MAAA,gBACA,OAAO,EAAU,MAAS,WACtB,EAAU,KACV,CACN,CAAC,CACH;GACA,OAAO;IAAE,GAAG;IAAQ;GAAI;EAC1B;EAEA,IAAM,IAAa,EAAE,GAAG,EAAO;EAI/B,IAHI,KAAsB,EAAoB,EAAO,IAAI,MACvD,EAAW,OAAO,EAAyB,EAAO,MAAM,EAAO,IAAI,IAEjE,GAAuB;GACzB,IAAM,IAAgB,EAAa,EAAO,OAAO,KAAK,CAAC;GACvD,EAAW,UAAU,OAAO,YAC1B,OAAO,QAAQ,EAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACzD,GACA,MAAA,gBACA,OAAO,EAAc,MAAS,WAC1B,EAAc,KACd,CACN,CAAC,CACH;EACF;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/api/mcp-service/mcp-service.api.cjs CHANGED Viewed

@@ -1,2 +1,2 @@
-require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs");require("../../node_modules/@openhands/typescript-client/dist/clients.cjs");const t=require("../backend-registry/active-store.cjs"),n=require("../agent-server-client-options.cjs"),r=require("./mcp-redacted-credentials.cjs"),i=require("../../utils/mcp-credential-validation.cjs"),a=require("../../utils/redact-mcp-secrets.cjs");var o=120;function s(e){return e.type===`stdio`?{transport:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{transport:e.type===`sse`?`sse`:`http`,url:e.url,...e.headers&&Object.keys(e.headers).length>0&&{headers:e.headers},...e.auth?{auth:e.auth}:{}}}function c(e){return e.auth?.strategy===`oauth2`?o:e.timeout}async function l(e){let t=i.getCredentialValidationForServer(e),n=await r.substituteRedactedMcpCredentials(e),a=s(n),o=c(e);return{request:{server:a,...e.name?{name:e.name}:{},...o===void 0?{}:{timeout:o},...t?{tool_call:t.toolCall}:{}},substituted:n}}function u(e,t){return e.ok?e.tool_result?{...e,tool_result:{...e.tool_result,text:a.redactMcpSecrets(e.tool_result.text,...t)}}:e:{...e,error:a.redactMcpSecrets(e.error,...t)}}function d(e,t,n){let r=u(e,n);if(r.ok&&t&&r.tool_result&&r.tools.includes(t.toolCall.name)){let e=t.interpret(r.tool_result);if(e)return{ok:!1,error:e,error_kind:`credentials`}}return r}function f(){if(t.getActiveBackend().backend.kind===`local`){let{host:e,apiKey:t}=n.getAgentServerClientOptions();return{host:e,...t?{apiKey:t}:{}}}let e=t.getRegisteredBackends().find(e=>e.kind===`local`&&e.host);if(e)return{host:e.host.replace(/\/+$/,``),...e.apiKey?{apiKey:e.apiKey}:{}};throw Error(`OAuth authorization requires a reachable local backend.`)}function p(){let{host:t,apiKey:n}=f();return new e.MCPClient({host:t,...n?{apiKey:n}:{},timeout:125e3})}function m(e){return e.status===`succeeded`?{ok:!0,tools:e.tools??[],...e.tool_result!==void 0&&{tool_result:e.tool_result},...e.oauth_state!==void 0&&{oauth_state:e.oauth_state}}:{ok:!1,error:e.error||`OAuth authorization did not complete`,error_kind:e.error_kind||`unknown`}}var h=e=>new Promise(t=>{window.setTimeout(t,e)}),g=class r{static async testServer(r){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let a=i.getCredentialValidationForServer(r),{host:o,apiKey:s}=n.getAgentServerClientOptions(),c=new e.MCPClient({host:o,...s?{apiKey:s}:{}});try{let{request:e,substituted:t}=await l(r);return d(await c.testServer(e),a,[t,r])}finally{c.close()}}static async startOAuth(e){let t=p();try{return await r.startOAuthWithClient(t,e)}finally{t.close()}}static async getOAuthStatus(e){let t=p();try{return await r.getOAuthStatusWithClient(t,e)}finally{t.close()}}static async submitOAuthCallback(e,t){let n=p();try{return await r.submitOAuthCallbackWithClient(n,e,t)}finally{n.close()}}static async authorizeOAuth(e){let t=i.getCredentialValidationForServer(e),n=n=>d(n,t,[e]),a=window.open(`about:blank`,`_blank`),s=p();try{let t=await r.startOAuthWithClient(s,e);if(!t.ok||!t.job_id||!t.authorization_url)return a?.close(),n({ok:!1,error:t.error||`Could not start OAuth authorization`,error_kind:t.error_kind||`unknown`});let i=await r.getOAuthStatusWithClient(s,t.job_id);for(let e=0;e<20;e+=1){if(i.status===`succeeded`||i.status===`failed`)return a?.close(),n(m(i));if(i.callback_ready)break;await h(250),i=await r.getOAuthStatusWithClient(s,t.job_id)}a&&(a.location.href=t.authorization_url);for(let e=0;e<o;e+=1)if(await h(1e3),i=await r.getOAuthStatusWithClient(s,t.job_id),i.status===`succeeded`||i.status===`failed`)return a?.close(),n(m(i));return{ok:!1,error:`OAuth authorization timed out`,error_kind:`timeout`}}finally{s.close()}}static async startOAuthWithClient(e,t){let{request:n}=await l(t);return e.startOAuth(n)}static async getOAuthStatusWithClient(e,t){return await e.getOAuthStatus(t)}static async submitOAuthCallbackWithClient(e,t,n){return await e.submitOAuthCallback(t,{callback_url:n})}};exports.default=g;
+require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs");require("../../node_modules/@openhands/typescript-client/dist/clients.cjs");const t=require("../backend-registry/active-store.cjs"),n=require("../agent-server-client-options.cjs"),r=require("../../utils/mcp-credential-validation.cjs"),i=require("../../utils/redact-mcp-secrets.cjs"),a=require("./mcp-redacted-credentials.cjs");var o=120;function s(e){return e.type===`stdio`?{type:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{type:e.type===`sse`?`sse`:`http`,url:e.url,...e.headers&&Object.keys(e.headers).length>0&&{headers:e.headers},...e.auth?{auth:e.auth}:{}}}function c(e){return e.auth?.strategy===`oauth2`?o:e.timeout}async function l(e){let t=r.getCredentialValidationForServer(e),n=await a.substituteRedactedMcpCredentials(e),i=s(n),o=c(e);return{request:{server:i,...e.name?{name:e.name}:{},...o===void 0?{}:{timeout:o},...t?{tool_call:t.toolCall}:{}},substituted:n}}function u(e,t){return e.ok?e.tool_result?{...e,tool_result:{...e.tool_result,text:i.redactMcpSecrets(e.tool_result.text,...t)}}:e:{...e,error:i.redactMcpSecrets(e.error,...t)}}function d(e,t,n){let r=u(e,n);if(r.ok&&t&&r.tool_result&&r.tools.includes(t.toolCall.name)){let e=t.interpret(r.tool_result);if(e)return{ok:!1,error:e,error_kind:`credentials`}}return r}function f(){if(t.getActiveBackend().backend.kind===`local`){let{host:e,apiKey:t}=n.getAgentServerClientOptions();return{host:e,...t?{apiKey:t}:{}}}let e=t.getRegisteredBackends().find(e=>e.kind===`local`&&e.host);if(e)return{host:e.host.replace(/\/+$/,``),...e.apiKey?{apiKey:e.apiKey}:{}};throw Error(`OAuth authorization requires a reachable local backend.`)}function p(){let{host:t,apiKey:n}=f();return new e.MCPClient({host:t,...n?{apiKey:n}:{},timeout:125e3})}function m(e){return e.status===`succeeded`?{ok:!0,tools:e.tools??[],...e.tool_result!==void 0&&{tool_result:e.tool_result},...e.oauth_state!==void 0&&{oauth_state:e.oauth_state}}:{ok:!1,error:e.error||`OAuth authorization did not complete`,error_kind:e.error_kind||`unknown`}}var h=e=>new Promise(t=>{window.setTimeout(t,e)}),g=class i{static async testServer(i){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let a=r.getCredentialValidationForServer(i),{host:o,apiKey:s}=n.getAgentServerClientOptions(),c=new e.MCPClient({host:o,...s?{apiKey:s}:{}});try{let{request:e,substituted:t}=await l(i);return d(await c.testServer(e),a,[t,i])}finally{c.close()}}static async startOAuth(e){let t=p();try{return await i.startOAuthWithClient(t,e)}finally{t.close()}}static async getOAuthStatus(e){let t=p();try{return await i.getOAuthStatusWithClient(t,e)}finally{t.close()}}static async submitOAuthCallback(e,t){let n=p();try{return await i.submitOAuthCallbackWithClient(n,e,t)}finally{n.close()}}static async authorizeOAuth(e){let t=r.getCredentialValidationForServer(e),n=n=>d(n,t,[e]),a=window.open(`about:blank`,`_blank`),s=p();try{let t=await i.startOAuthWithClient(s,e);if(!t.ok||!t.job_id||!t.authorization_url)return a?.close(),n({ok:!1,error:t.error||`Could not start OAuth authorization`,error_kind:t.error_kind||`unknown`});let r=await i.getOAuthStatusWithClient(s,t.job_id);for(let e=0;e<20;e+=1){if(r.status===`succeeded`||r.status===`failed`)return a?.close(),n(m(r));if(r.callback_ready)break;await h(250),r=await i.getOAuthStatusWithClient(s,t.job_id)}a&&(a.location.href=t.authorization_url);for(let e=0;e<o;e+=1)if(await h(1e3),r=await i.getOAuthStatusWithClient(s,t.job_id),r.status===`succeeded`||r.status===`failed`)return a?.close(),n(m(r));return{ok:!1,error:`OAuth authorization timed out`,error_kind:`timeout`}}finally{s.close()}}static async startOAuthWithClient(e,t){let{request:n}=await l(t);return e.startOAuth(n)}static async getOAuthStatusWithClient(e,t){return await e.getOAuthStatus(t)}static async submitOAuthCallbackWithClient(e,t,n){return await e.submitOAuthCallback(t,{callback_url:n})}};exports.default=g;
 //# sourceMappingURL=mcp-service.api.cjs.map

package/dist/api/mcp-service/mcp-service.api.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { MCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n getActiveBackend,\n getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n getCredentialValidationForServer,\n type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type { MCPAuthCredential } from \"#/types/mcp-auth\";\nimport type {\n ExtendedMCPTestResponse,\n MCPOAuthStartResponse,\n MCPOAuthStatusResponse,\n MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\ntype MCPTestServer = {\n transport?: \"stdio\" \| \"http\" \| \"sse\";\n command?: string;\n args?: string[];\n env?: Record<string, string>;\n url?: string;\n headers?: Record<string, string>;\n auth?: MCPAuthCredential;\n};\n\ninterface ExtendedMCPTestRequest {\n server: MCPTestServer;\n name?: string;\n timeout?: number;\n tool_call?: {\n name: string;\n arguments: Record<string, unknown>;\n };\n}\n\nfunction toMcpServer(server: MCPServerConfig): MCPTestServer {\n if (server.type === \"stdio\") {\n return {\n transport: \"stdio\",\n command: server.command!,\n ...(server.args?.length && { args: server.args }),\n ...(server.env &&\n Object.keys(server.env).length > 0 && { env: server.env }),\n };\n }\n return {\n transport: server.type === \"sse\" ? \"sse\" : \"http\",\n url: server.url!,\n ...(server.headers &&\n Object.keys(server.headers).length > 0 && { headers: server.headers }),\n ...(server.auth ? { auth: server.auth } : {}),\n };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number \| undefined {\n if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n request: ExtendedMCPTestRequest;\n substituted: MCPServerConfig;\n}> {\n const validation = getCredentialValidationForServer(server);\n const substituted = await substituteRedactedMcpCredentials(server);\n const serverSpec = toMcpServer(substituted);\n const timeout = getMcpTestTimeout(server);\n return {\n request: {\n server: serverSpec,\n ...(server.name ? { name: server.name } : {}),\n ...(timeout !== undefined ? { timeout } : {}),\n ...(validation ? { tool_call: validation.toolCall } : {}),\n },\n substituted,\n };\n}\n\nfunction redactMcpTestResponse(\n result: ExtendedMCPTestResponse,\n redactionSources: (MCPServerConfig \| undefined)[],\n): ExtendedMCPTestResponse {\n if (!result.ok) {\n return {\n ...result,\n error: redactMcpSecrets(result.error, ...redactionSources),\n };\n }\n if (result.tool_result) {\n return {\n ...result,\n tool_result: {\n ...result.tool_result,\n text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n },\n };\n }\n return result;\n}\n\n/*\n Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n /\nfunction finalizeMcpTestResponse(\n result: ExtendedMCPTestResponse,\n validation: CredentialValidation \| undefined,\n redactionSources: (MCPServerConfig \| undefined)[],\n): ExtendedMCPTestResponse {\n const redacted = redactMcpTestResponse(result, redactionSources);\n if (\n redacted.ok &&\n validation &&\n redacted.tool_result &&\n redacted.tools.includes(validation.toolCall.name)\n ) {\n const credentialError = validation.interpret(redacted.tool_result);\n if (credentialError) {\n return {\n ok: false,\n error: credentialError,\n error_kind: \"credentials\",\n };\n }\n }\n return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n const active = getActiveBackend().backend;\n if (active.kind === \"local\") {\n const { host, apiKey } = getAgentServerClientOptions();\n return { host, ...(apiKey ? { apiKey } : {}) };\n }\n\n const localBackend = getRegisteredBackends().find(\n (backend) => backend.kind === \"local\" && backend.host,\n );\n if (localBackend) {\n return {\n host: localBackend.host.replace(/\\/+$/, \"\"),\n ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n };\n }\n throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n const { host, apiKey } = getMcpProbeOptions();\n return new MCPClient({\n host,\n ...(apiKey ? { apiKey } : {}),\n timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS 1000 + 5000,\n });\n}\n\nfunction oauthStatusToTestResponse(\n status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n if (status.status === \"succeeded\") {\n return {\n ok: true,\n tools: status.tools ?? [],\n ...(status.tool_result !== undefined && {\n tool_result: status.tool_result,\n }),\n ...(status.oauth_state !== undefined && {\n oauth_state: status.oauth_state,\n }),\n };\n }\n return {\n ok: false,\n error: status.error \|\| \"OAuth authorization did not complete\",\n error_kind: status.error_kind \|\| \"unknown\",\n };\n}\n\nconst sleep = (ms: number) =>\n new Promise<void>((resolve) => {\n window.setTimeout(resolve, ms);\n });\n\nclass McpService {\n static async testServer(\n server: MCPServerConfig,\n ): Promise<ExtendedMCPTestResponse> {\n // The MCP connectivity-test endpoint lives on the local agent-server. It\n // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n // from that process's environment. Cloud backends don't expose this\n // endpoint to the frontend — the MCP server would actually run inside the\n // cloud sandbox, which isn't reachable from the browser before the user\n // starts a conversation. Calling `getAgentServerClientOptions()` here for\n // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n // is configured.\")` and block the install flow entirely. Short-circuit\n // with a synthetic success so saving proceeds; any real connection\n // failure surfaces inside the conversation runtime instead.\n if (getActiveBackend().backend.kind === \"cloud\") {\n return { ok: true, tools: [] };\n }\n const validation = getCredentialValidationForServer(server);\n const { host, apiKey } = getAgentServerClientOptions();\n const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n try {\n const { request, substituted } = await buildMcpTestRequest(server);\n const result = (await client.testServer(\n request as MCPTestRequest,\n )) as ExtendedMCPTestResponse;\n // Redact against both config forms: `server` may hold fresh plaintext\n // input, `substituted` the stored (encrypted) round-trip values.\n return finalizeMcpTestResponse(result, validation, [substituted, server]);\n } finally {\n client.close();\n }\n }\n\n static async startOAuth(\n server: MCPServerConfig,\n ): Promise<MCPOAuthStartResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.startOAuthWithClient(client, server);\n } finally {\n client.close();\n }\n }\n\n static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.getOAuthStatusWithClient(client, jobId);\n } finally {\n client.close();\n }\n }\n\n static async submitOAuthCallback(\n jobId: string,\n callbackUrl: string,\n ): Promise<MCPOAuthStatusResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.submitOAuthCallbackWithClient(\n client,\n jobId,\n callbackUrl,\n );\n } finally {\n client.close();\n }\n }\n\n static async authorizeOAuth(\n server: MCPServerConfig,\n ): Promise<ExtendedMCPTestResponse> {\n const validation = getCredentialValidationForServer(server);\n const finalize = (result: ExtendedMCPTestResponse) =>\n finalizeMcpTestResponse(result, validation, [server]);\n const popup = window.open(\"about:blank\", \"_blank\");\n const client = createMcpProbeClient();\n try {\n const start = await McpService.startOAuthWithClient(client, server);\n if (!start.ok \|\| !start.job_id \|\| !start.authorization_url) {\n popup?.close();\n return finalize({\n ok: false,\n error: start.error \|\| \"Could not start OAuth authorization\",\n error_kind: start.error_kind \|\| \"unknown\",\n });\n }\n\n let status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n for (let attempt = 0; attempt < 20; attempt += 1) {\n if (status.status === \"succeeded\" \|\| status.status === \"failed\") {\n popup?.close();\n return finalize(oauthStatusToTestResponse(status));\n }\n if (status.callback_ready) break;\n await sleep(250);\n status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n }\n\n if (popup) {\n popup.location.href = start.authorization_url;\n }\n\n for (\n let attempt = 0;\n attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n attempt += 1\n ) {\n await sleep(1000);\n status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n if (status.status === \"succeeded\" \|\| status.status === \"failed\") {\n popup?.close();\n return finalize(oauthStatusToTestResponse(status));\n }\n }\n\n return {\n ok: false,\n error: \"OAuth authorization timed out\",\n error_kind: \"timeout\",\n };\n } finally {\n client.close();\n }\n }\n\n private static async startOAuthWithClient(\n client: MCPClient,\n server: MCPServerConfig,\n ): Promise<MCPOAuthStartResponse> {\n const { request } = await buildMcpTestRequest(server);\n return client.startOAuth(request as MCPTestRequest);\n }\n\n // typescript-client 1.36 types the OAuth probes with the generated\n // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n // wire shape is unchanged, so narrow back to the app's boundary type.\n private static async getOAuthStatusWithClient(\n client: MCPClient,\n jobId: string,\n ): Promise<MCPOAuthStatusResponse> {\n return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n }\n\n private static async submitOAuthCallbackWithClient(\n client: MCPClient,\n jobId: string,\n callbackUrl: string,\n ): Promise<MCPOAuthStatusResponse> {\n return (await client.submitOAuthCallback(jobId, {\n callback_url: callbackUrl,\n })) as MCPOAuthStatusResponse;\n }\n}\n\nexport default McpService;\n"],"mappings":"qdAqBA,IAAM,EAAiC,IAsBvC,SAAS,EAAY,EAAwC,CAU3D,OATI,EAAO,OAAS,QACX,CACL,UAAW,QACX,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,IAAK,EAC/C,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,GAAG,EAAE,OAAS,GAAK,CAAE,IAAK,EAAO,GAAI,CAC5D,EAEK,CACL,UAAW,EAAO,OAAS,MAAQ,MAAQ,OAC3C,IAAK,EAAO,IACZ,GAAI,EAAO,SACT,OAAO,KAAK,EAAO,OAAO,EAAE,OAAS,GAAK,CAAE,QAAS,EAAO,OAAQ,EACtE,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,CAC7C,CACF,CAEA,SAAS,EAAkB,EAA6C,CAEtE,OADI,EAAO,MAAM,WAAa,SACvB,EADwC,EAAO,OAExD,CAEA,eAAe,EAAoB,EAGhC,CACD,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAc,MAAM,EAAA,iCAAiC,CAAM,EAC3D,EAAa,EAAY,CAAW,EACpC,EAAU,EAAkB,CAAM,EACxC,MAAO,CACL,QAAS,CACP,OAAQ,EACR,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EAC3C,GAAI,IAAY,IAAA,GAA0B,CAAC,EAAf,CAAE,SAAQ,EACtC,GAAI,EAAa,CAAE,UAAW,EAAW,QAAS,EAAI,CAAC,CACzD,EACA,aACF,CACF,CAEA,SAAS,EACP,EACA,EACyB,CAgBzB,OAfK,EAAO,GAMR,EAAO,YACF,CACL,GAAG,EACH,YAAa,CACX,GAAG,EAAO,YACV,KAAM,EAAA,iBAAiB,EAAO,YAAY,KAAM,GAAG,CAAgB,CACrE,CACF,EAEK,EAdE,CACL,GAAG,EACH,MAAO,EAAA,iBAAiB,EAAO,MAAO,GAAG,CAAgB,CAC3D,CAYJ,CAYA,SAAS,EACP,EACA,EACA,EACyB,CACzB,IAAM,EAAW,EAAsB,EAAQ,CAAgB,EAC/D,GACE,EAAS,IACT,GACA,EAAS,aACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,EAChD,CACA,IAAM,EAAkB,EAAW,UAAU,EAAS,WAAW,EACjE,GAAI,EACF,MAAO,CACL,GAAI,GACJ,MAAO,EACP,WAAY,aACd,CAEJ,CACA,OAAO,CACT,CAEA,SAAS,GAAwD,CAE/D,GADe,EAAA,iBAAiB,EAAE,QACvB,OAAS,QAAS,CAC3B,GAAM,CAAE,OAAM,UAAW,EAAA,4BAA4B,EACrD,MAAO,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAC/C,CAEA,IAAM,EAAe,EAAA,sBAAsB,EAAE,KAC1C,GAAY,EAAQ,OAAS,SAAW,EAAQ,IACnD,EACA,GAAI,EACF,MAAO,CACL,KAAM,EAAa,KAAK,QAAQ,OAAQ,EAAE,EAC1C,GAAI,EAAa,OAAS,CAAE,OAAQ,EAAa,MAAO,EAAI,CAAC,CAC/D,EAEF,MAAU,MAAM,yDAAyD,CAC3E,CAEA,SAAS,GAAkC,CACzC,GAAM,CAAE,OAAM,UAAW,EAAmB,EAC5C,OAAO,IAAI,EAAA,UAAU,CACnB,OACA,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,EAC3B,QAAS,KACX,CAAC,CACH,CAEA,SAAS,EACP,EACyB,CAazB,OAZI,EAAO,SAAW,YACb,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,CAAC,EACxB,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,EACA,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,CACF,EAEK,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,uCACvB,WAAY,EAAO,YAAc,SACnC,CACF,CAEA,IAAM,EAAS,GACb,IAAI,QAAe,GAAY,CAC7B,OAAO,WAAW,EAAS,CAAE,CAC/B,CAAC,EAEG,EAAN,MAAM,CAAW,CACf,aAAa,WACX,EACkC,CAWlC,GAAI,EAAA,iBAAiB,EAAE,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,CAAC,CAAE,EAE/B,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,CAAE,OAAM,UAAW,EAAA,4BAA4B,EAC/C,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAAC,EACpE,GAAI,CACF,GAAM,CAAE,UAAS,eAAgB,MAAM,EAAoB,CAAM,EAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,EAGuC,EAAY,CAAC,EAAa,CAAM,CAAC,CAC1E,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,WACX,EACgC,CAChC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,qBAAqB,EAAQ,CAAM,CAC7D,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eAAe,EAAgD,CAC1E,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,yBAAyB,EAAQ,CAAK,CAChE,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,oBACX,EACA,EACiC,CACjC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,8BACtB,EACA,EACA,CACF,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eACX,EACkC,CAClC,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAY,GAChB,EAAwB,EAAQ,EAAY,CAAC,CAAM,CAAC,EAChD,EAAQ,OAAO,KAAK,cAAe,QAAQ,EAC3C,EAAS,EAAqB,EACpC,GAAI,CACF,IAAM,EAAQ,MAAM,EAAW,qBAAqB,EAAQ,CAAM,EAClE,GAAI,CAAC,EAAM,IAAM,CAAC,EAAM,QAAU,CAAC,EAAM,kBAEvC,OADA,GAAO,MAAM,EACN,EAAS,CACd,GAAI,GACJ,MAAO,EAAM,OAAS,sCACtB,WAAY,EAAM,YAAc,SAClC,CAAC,EAGH,IAAI,EAAS,MAAM,EAAW,yBAC5B,EACA,EAAM,MACR,EACA,IAAK,IAAI,EAAU,EAAG,EAAU,GAAI,GAAW,EAAG,CAChD,GAAI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAEnD,GAAI,EAAO,eAAgB,MAC3B,MAAM,EAAM,GAAG,EACf,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,CACF,CAEI,IACF,EAAM,SAAS,KAAO,EAAM,mBAG9B,IACE,IAAI,EAAU,EACd,EAAU,EACV,GAAW,EAOX,GALA,MAAM,EAAM,GAAI,EAChB,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,EACI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAIrD,MAAO,CACL,GAAI,GACJ,MAAO,gCACP,WAAY,SACd,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAqB,qBACnB,EACA,EACgC,CAChC,GAAM,CAAE,WAAY,MAAM,EAAoB,CAAM,EACpD,OAAO,EAAO,WAAW,CAAyB,CACpD,CAMA,aAAqB,yBACnB,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,eAAe,CAAK,CAC3C,CAEA,aAAqB,8BACnB,EACA,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,oBAAoB,EAAO,CAC9C,aAAc,CAChB,CAAC,CACH,CACF"}
1	+ {"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { AgentServerMCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n getActiveBackend,\n getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n getCredentialValidationForServer,\n type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type {\n ExtendedMCPTestResponse,\n MCPOAuthStartResponse,\n MCPOAuthStatusResponse,\n MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\nfunction toMcpServer(\n server: MCPServerConfig,\n): AgentServerMCPTestRequest[\"server\"] {\n if (server.type === \"stdio\") {\n return {\n type: \"stdio\",\n command: server.command!,\n ...(server.args?.length && { args: server.args }),\n ...(server.env &&\n Object.keys(server.env).length > 0 && { env: server.env }),\n };\n }\n return {\n type: server.type === \"sse\" ? \"sse\" : \"http\",\n url: server.url!,\n ...(server.headers &&\n Object.keys(server.headers).length > 0 && { headers: server.headers }),\n ...(server.auth ? { auth: server.auth } : {}),\n };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number \| undefined {\n if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n request: AgentServerMCPTestRequest;\n substituted: MCPServerConfig;\n}> {\n const validation = getCredentialValidationForServer(server);\n const substituted = await substituteRedactedMcpCredentials(server);\n const serverSpec = toMcpServer(substituted);\n const timeout = getMcpTestTimeout(server);\n return {\n request: {\n server: serverSpec,\n ...(server.name ? { name: server.name } : {}),\n ...(timeout !== undefined ? { timeout } : {}),\n ...(validation ? { tool_call: validation.toolCall } : {}),\n },\n substituted,\n };\n}\n\nfunction redactMcpTestResponse(\n result: ExtendedMCPTestResponse,\n redactionSources: (MCPServerConfig \| undefined)[],\n): ExtendedMCPTestResponse {\n if (!result.ok) {\n return {\n ...result,\n error: redactMcpSecrets(result.error, ...redactionSources),\n };\n }\n if (result.tool_result) {\n return {\n ...result,\n tool_result: {\n ...result.tool_result,\n text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n },\n };\n }\n return result;\n}\n\n/*\n Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n /\nfunction finalizeMcpTestResponse(\n result: ExtendedMCPTestResponse,\n validation: CredentialValidation \| undefined,\n redactionSources: (MCPServerConfig \| undefined)[],\n): ExtendedMCPTestResponse {\n const redacted = redactMcpTestResponse(result, redactionSources);\n if (\n redacted.ok &&\n validation &&\n redacted.tool_result &&\n redacted.tools.includes(validation.toolCall.name)\n ) {\n const credentialError = validation.interpret(redacted.tool_result);\n if (credentialError) {\n return {\n ok: false,\n error: credentialError,\n error_kind: \"credentials\",\n };\n }\n }\n return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n const active = getActiveBackend().backend;\n if (active.kind === \"local\") {\n const { host, apiKey } = getAgentServerClientOptions();\n return { host, ...(apiKey ? { apiKey } : {}) };\n }\n\n const localBackend = getRegisteredBackends().find(\n (backend) => backend.kind === \"local\" && backend.host,\n );\n if (localBackend) {\n return {\n host: localBackend.host.replace(/\\/+$/, \"\"),\n ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n };\n }\n throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n const { host, apiKey } = getMcpProbeOptions();\n return new MCPClient({\n host,\n ...(apiKey ? { apiKey } : {}),\n timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS 1000 + 5000,\n });\n}\n\nfunction oauthStatusToTestResponse(\n status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n if (status.status === \"succeeded\") {\n return {\n ok: true,\n tools: status.tools ?? [],\n ...(status.tool_result !== undefined && {\n tool_result: status.tool_result,\n }),\n ...(status.oauth_state !== undefined && {\n oauth_state: status.oauth_state,\n }),\n };\n }\n return {\n ok: false,\n error: status.error \|\| \"OAuth authorization did not complete\",\n error_kind: status.error_kind \|\| \"unknown\",\n };\n}\n\nconst sleep = (ms: number) =>\n new Promise<void>((resolve) => {\n window.setTimeout(resolve, ms);\n });\n\nclass McpService {\n static async testServer(\n server: MCPServerConfig,\n ): Promise<ExtendedMCPTestResponse> {\n // The MCP connectivity-test endpoint lives on the local agent-server. It\n // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n // from that process's environment. Cloud backends don't expose this\n // endpoint to the frontend — the MCP server would actually run inside the\n // cloud sandbox, which isn't reachable from the browser before the user\n // starts a conversation. Calling `getAgentServerClientOptions()` here for\n // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n // is configured.\")` and block the install flow entirely. Short-circuit\n // with a synthetic success so saving proceeds; any real connection\n // failure surfaces inside the conversation runtime instead.\n if (getActiveBackend().backend.kind === \"cloud\") {\n return { ok: true, tools: [] };\n }\n const validation = getCredentialValidationForServer(server);\n const { host, apiKey } = getAgentServerClientOptions();\n const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n try {\n const { request, substituted } = await buildMcpTestRequest(server);\n const result = (await client.testServer(\n request,\n )) as ExtendedMCPTestResponse;\n // Redact against both config forms: `server` may hold fresh plaintext\n // input, `substituted` the stored (encrypted) round-trip values.\n return finalizeMcpTestResponse(result, validation, [substituted, server]);\n } finally {\n client.close();\n }\n }\n\n static async startOAuth(\n server: MCPServerConfig,\n ): Promise<MCPOAuthStartResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.startOAuthWithClient(client, server);\n } finally {\n client.close();\n }\n }\n\n static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.getOAuthStatusWithClient(client, jobId);\n } finally {\n client.close();\n }\n }\n\n static async submitOAuthCallback(\n jobId: string,\n callbackUrl: string,\n ): Promise<MCPOAuthStatusResponse> {\n const client = createMcpProbeClient();\n try {\n return await McpService.submitOAuthCallbackWithClient(\n client,\n jobId,\n callbackUrl,\n );\n } finally {\n client.close();\n }\n }\n\n static async authorizeOAuth(\n server: MCPServerConfig,\n ): Promise<ExtendedMCPTestResponse> {\n const validation = getCredentialValidationForServer(server);\n const finalize = (result: ExtendedMCPTestResponse) =>\n finalizeMcpTestResponse(result, validation, [server]);\n const popup = window.open(\"about:blank\", \"_blank\");\n const client = createMcpProbeClient();\n try {\n const start = await McpService.startOAuthWithClient(client, server);\n if (!start.ok \|\| !start.job_id \|\| !start.authorization_url) {\n popup?.close();\n return finalize({\n ok: false,\n error: start.error \|\| \"Could not start OAuth authorization\",\n error_kind: start.error_kind \|\| \"unknown\",\n });\n }\n\n let status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n for (let attempt = 0; attempt < 20; attempt += 1) {\n if (status.status === \"succeeded\" \|\| status.status === \"failed\") {\n popup?.close();\n return finalize(oauthStatusToTestResponse(status));\n }\n if (status.callback_ready) break;\n await sleep(250);\n status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n }\n\n if (popup) {\n popup.location.href = start.authorization_url;\n }\n\n for (\n let attempt = 0;\n attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n attempt += 1\n ) {\n await sleep(1000);\n status = await McpService.getOAuthStatusWithClient(\n client,\n start.job_id,\n );\n if (status.status === \"succeeded\" \|\| status.status === \"failed\") {\n popup?.close();\n return finalize(oauthStatusToTestResponse(status));\n }\n }\n\n return {\n ok: false,\n error: \"OAuth authorization timed out\",\n error_kind: \"timeout\",\n };\n } finally {\n client.close();\n }\n }\n\n private static async startOAuthWithClient(\n client: MCPClient,\n server: MCPServerConfig,\n ): Promise<MCPOAuthStartResponse> {\n const { request } = await buildMcpTestRequest(server);\n return client.startOAuth(request);\n }\n\n // typescript-client 1.36 types the OAuth probes with the generated\n // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n // wire shape is unchanged, so narrow back to the app's boundary type.\n private static async getOAuthStatusWithClient(\n client: MCPClient,\n jobId: string,\n ): Promise<MCPOAuthStatusResponse> {\n return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n }\n\n private static async submitOAuthCallbackWithClient(\n client: MCPClient,\n jobId: string,\n callbackUrl: string,\n ): Promise<MCPOAuthStatusResponse> {\n return (await client.submitOAuthCallback(jobId, {\n callback_url: callbackUrl,\n })) as MCPOAuthStatusResponse;\n }\n}\n\nexport default McpService;\n"],"mappings":"qdAoBA,IAAM,EAAiC,IAEvC,SAAS,EACP,EACqC,CAUrC,OATI,EAAO,OAAS,QACX,CACL,KAAM,QACN,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,IAAK,EAC/C,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,GAAG,EAAE,OAAS,GAAK,CAAE,IAAK,EAAO,GAAI,CAC5D,EAEK,CACL,KAAM,EAAO,OAAS,MAAQ,MAAQ,OACtC,IAAK,EAAO,IACZ,GAAI,EAAO,SACT,OAAO,KAAK,EAAO,OAAO,EAAE,OAAS,GAAK,CAAE,QAAS,EAAO,OAAQ,EACtE,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,CAC7C,CACF,CAEA,SAAS,EAAkB,EAA6C,CAEtE,OADI,EAAO,MAAM,WAAa,SACvB,EADwC,EAAO,OAExD,CAEA,eAAe,EAAoB,EAGhC,CACD,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAc,MAAM,EAAA,iCAAiC,CAAM,EAC3D,EAAa,EAAY,CAAW,EACpC,EAAU,EAAkB,CAAM,EACxC,MAAO,CACL,QAAS,CACP,OAAQ,EACR,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EAC3C,GAAI,IAAY,IAAA,GAA0B,CAAC,EAAf,CAAE,SAAQ,EACtC,GAAI,EAAa,CAAE,UAAW,EAAW,QAAS,EAAI,CAAC,CACzD,EACA,aACF,CACF,CAEA,SAAS,EACP,EACA,EACyB,CAgBzB,OAfK,EAAO,GAMR,EAAO,YACF,CACL,GAAG,EACH,YAAa,CACX,GAAG,EAAO,YACV,KAAM,EAAA,iBAAiB,EAAO,YAAY,KAAM,GAAG,CAAgB,CACrE,CACF,EAEK,EAdE,CACL,GAAG,EACH,MAAO,EAAA,iBAAiB,EAAO,MAAO,GAAG,CAAgB,CAC3D,CAYJ,CAYA,SAAS,EACP,EACA,EACA,EACyB,CACzB,IAAM,EAAW,EAAsB,EAAQ,CAAgB,EAC/D,GACE,EAAS,IACT,GACA,EAAS,aACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,EAChD,CACA,IAAM,EAAkB,EAAW,UAAU,EAAS,WAAW,EACjE,GAAI,EACF,MAAO,CACL,GAAI,GACJ,MAAO,EACP,WAAY,aACd,CAEJ,CACA,OAAO,CACT,CAEA,SAAS,GAAwD,CAE/D,GADe,EAAA,iBAAiB,EAAE,QACvB,OAAS,QAAS,CAC3B,GAAM,CAAE,OAAM,UAAW,EAAA,4BAA4B,EACrD,MAAO,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAC/C,CAEA,IAAM,EAAe,EAAA,sBAAsB,EAAE,KAC1C,GAAY,EAAQ,OAAS,SAAW,EAAQ,IACnD,EACA,GAAI,EACF,MAAO,CACL,KAAM,EAAa,KAAK,QAAQ,OAAQ,EAAE,EAC1C,GAAI,EAAa,OAAS,CAAE,OAAQ,EAAa,MAAO,EAAI,CAAC,CAC/D,EAEF,MAAU,MAAM,yDAAyD,CAC3E,CAEA,SAAS,GAAkC,CACzC,GAAM,CAAE,OAAM,UAAW,EAAmB,EAC5C,OAAO,IAAI,EAAA,UAAU,CACnB,OACA,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,EAC3B,QAAS,KACX,CAAC,CACH,CAEA,SAAS,EACP,EACyB,CAazB,OAZI,EAAO,SAAW,YACb,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,CAAC,EACxB,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,EACA,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,CACF,EAEK,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,uCACvB,WAAY,EAAO,YAAc,SACnC,CACF,CAEA,IAAM,EAAS,GACb,IAAI,QAAe,GAAY,CAC7B,OAAO,WAAW,EAAS,CAAE,CAC/B,CAAC,EAEG,EAAN,MAAM,CAAW,CACf,aAAa,WACX,EACkC,CAWlC,GAAI,EAAA,iBAAiB,EAAE,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,CAAC,CAAE,EAE/B,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,CAAE,OAAM,UAAW,EAAA,4BAA4B,EAC/C,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAAC,EACpE,GAAI,CACF,GAAM,CAAE,UAAS,eAAgB,MAAM,EAAoB,CAAM,EAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,EAGuC,EAAY,CAAC,EAAa,CAAM,CAAC,CAC1E,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,WACX,EACgC,CAChC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,qBAAqB,EAAQ,CAAM,CAC7D,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eAAe,EAAgD,CAC1E,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,yBAAyB,EAAQ,CAAK,CAChE,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,oBACX,EACA,EACiC,CACjC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,8BACtB,EACA,EACA,CACF,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eACX,EACkC,CAClC,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAY,GAChB,EAAwB,EAAQ,EAAY,CAAC,CAAM,CAAC,EAChD,EAAQ,OAAO,KAAK,cAAe,QAAQ,EAC3C,EAAS,EAAqB,EACpC,GAAI,CACF,IAAM,EAAQ,MAAM,EAAW,qBAAqB,EAAQ,CAAM,EAClE,GAAI,CAAC,EAAM,IAAM,CAAC,EAAM,QAAU,CAAC,EAAM,kBAEvC,OADA,GAAO,MAAM,EACN,EAAS,CACd,GAAI,GACJ,MAAO,EAAM,OAAS,sCACtB,WAAY,EAAM,YAAc,SAClC,CAAC,EAGH,IAAI,EAAS,MAAM,EAAW,yBAC5B,EACA,EAAM,MACR,EACA,IAAK,IAAI,EAAU,EAAG,EAAU,GAAI,GAAW,EAAG,CAChD,GAAI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAEnD,GAAI,EAAO,eAAgB,MAC3B,MAAM,EAAM,GAAG,EACf,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,CACF,CAEI,IACF,EAAM,SAAS,KAAO,EAAM,mBAG9B,IACE,IAAI,EAAU,EACd,EAAU,EACV,GAAW,EAOX,GALA,MAAM,EAAM,GAAI,EAChB,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,EACI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAIrD,MAAO,CACL,GAAI,GACJ,MAAO,gCACP,WAAY,SACd,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAqB,qBACnB,EACA,EACgC,CAChC,GAAM,CAAE,WAAY,MAAM,EAAoB,CAAM,EACpD,OAAO,EAAO,WAAW,CAAO,CAClC,CAMA,aAAqB,yBACnB,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,eAAe,CAAK,CAC3C,CAEA,aAAqB,8BACnB,EACA,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,oBAAoB,EAAO,CAC9C,aAAc,CAChB,CAAC,CACH,CACF"}

package/dist/api/mcp-service/mcp-service.api.js CHANGED Viewed

@@ -2,19 +2,19 @@ import { MCPClient as e } from "../../node_modules/@openhands/typescript-client/
 import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { getActiveBackend as t, getRegisteredBackends as n } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as r } from "../agent-server-client-options.js";
-import { substituteRedactedMcpCredentials as i } from "./mcp-redacted-credentials.js";
-import { getCredentialValidationForServer as a } from "../../utils/mcp-credential-validation.js";
-import { redactMcpSecrets as o } from "../../utils/redact-mcp-secrets.js";
+import { getCredentialValidationForServer as i } from "../../utils/mcp-credential-validation.js";
+import { redactMcpSecrets as a } from "../../utils/redact-mcp-secrets.js";
+import { substituteRedactedMcpCredentials as o } from "./mcp-redacted-credentials.js";
 //#region src/api/mcp-service/mcp-service.api.ts
 var s = 120;
 function c(e) {
 	return e.type === "stdio" ? {
-		transport: "stdio",
+		type: "stdio",
 		command: e.command,
 		...e.args?.length && { args: e.args },
 		...e.env && Object.keys(e.env).length > 0 && { env: e.env }
 	} : {
-		transport: e.type === "sse" ? "sse" : "http",
+		type: e.type === "sse" ? "sse" : "http",
 		url: e.url,
 		...e.headers && Object.keys(e.headers).length > 0 && { headers: e.headers },
 		...e.auth ? { auth: e.auth } : {}
@@ -24,12 +24,12 @@ function l(e) {
 	return e.auth?.strategy === "oauth2" ? s : e.timeout;
 }
 async function u(e) {
-	let t = a(e), n = await i(e), r = c(n), o = l(e);
+	let t = i(e), n = await o(e), r = c(n), a = l(e);
 	return {
 		request: {
 			server: r,
 			...e.name ? { name: e.name } : {},
-			...o === void 0 ? {} : { timeout: o },
+			...a === void 0 ? {} : { timeout: a },
 			...t ? { tool_call: t.toolCall } : {}
 		},
 		substituted: n
@@ -40,11 +40,11 @@ function d(e, t) {
 		...e,
 		tool_result: {
 			...e.tool_result,
-			text: o(e.tool_result.text, ...t)
+			text: a(e.tool_result.text, ...t)
 		}
 	} : e : {
 		...e,
-		error: o(e.error, ...t)
+		error: a(e.error, ...t)
 	};
 }
 function f(e, t, n) {
@@ -102,13 +102,13 @@ var g = (e) => new Promise((t) => {
 			ok: !0,
 			tools: []
 		};
-		let i = a(n), { host: o, apiKey: s } = r(), c = new e({
+		let a = i(n), { host: o, apiKey: s } = r(), c = new e({
 			host: o,
 			...s ? { apiKey: s } : {}
 		});
 		try {
 			let { request: e, substituted: t } = await u(n);
-			return f(await c.testServer(e), i, [t, n]);
+			return f(await c.testServer(e), a, [t, n]);
 		} finally {
 			c.close();
 		}
@@ -138,22 +138,22 @@ var g = (e) => new Promise((t) => {
 		}
 	}
 	static async authorizeOAuth(e) {
-		let t = a(e), r = (n) => f(n, t, [e]), i = window.open("about:blank", "_blank"), o = m();
+		let t = i(e), r = (n) => f(n, t, [e]), a = window.open("about:blank", "_blank"), o = m();
 		try {
 			let t = await n.startOAuthWithClient(o, e);
-			if (!t.ok || !t.job_id || !t.authorization_url) return i?.close(), r({
+			if (!t.ok || !t.job_id || !t.authorization_url) return a?.close(), r({
 				ok: !1,
 				error: t.error || "Could not start OAuth authorization",
 				error_kind: t.error_kind || "unknown"
 			});
-			let a = await n.getOAuthStatusWithClient(o, t.job_id);
+			let i = await n.getOAuthStatusWithClient(o, t.job_id);
 			for (let e = 0; e < 20; e += 1) {
-				if (a.status === "succeeded" || a.status === "failed") return i?.close(), r(h(a));
-				if (a.callback_ready) break;
-				await g(250), a = await n.getOAuthStatusWithClient(o, t.job_id);
+				if (i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
+				if (i.callback_ready) break;
+				await g(250), i = await n.getOAuthStatusWithClient(o, t.job_id);
 			}
-			i && (i.location.href = t.authorization_url);
-			for (let e = 0; e < s; e += 1) if (await g(1e3), a = await n.getOAuthStatusWithClient(o, t.job_id), a.status === "succeeded" || a.status === "failed") return i?.close(), r(h(a));
+			a && (a.location.href = t.authorization_url);
+			for (let e = 0; e < s; e += 1) if (await g(1e3), i = await n.getOAuthStatusWithClient(o, t.job_id), i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
 			return {
 				ok: !1,
 				error: "OAuth authorization timed out",