@openhands/agent-canvas 1.9.0 → 1.11.0

package/dist/api/launch-child-conversation-client-tool.js

@@ -0,0 +1,93 @@
+import { CHILD_CONVERSATION_ISOLATIONS as e, CHILD_CONVERSATION_RESULT_PREFIX as t, CHILD_CONVERSATION_TARGETS as n, LAUNCH_CHILD_CONVERSATION_TOOL_NAME as r } from "../constants/child-conversation.js";
+var i = {
+	name: r,
+	description: `Start a NEW, independent conversation to work on a well-scoped task in parallel with this one, without the user having to run any CLI command. The new conversation is recorded as a child of this one.
+
+The child runs on its own. It does not block you, you do not see its output,
+and it cannot see this conversation's history — everything it needs must be in
+the task brief.
+
+Choosing target:
+
+* target="local" — runs on the same machine, in this conversation's workspace.
+  Fast, no repository clone, no sandbox provisioning. Use this by default when
+  the work is on code that is already checked out here.
+
+* target="cloud" — runs on OpenHands Cloud in its own isolated sandbox, from a
+  git repository. Use this when the work should not touch the user's machine or
+  when it needs a repository that is not checked out locally. Requires the user
+  to have an OpenHands Cloud backend connected in Agent Canvas; if none is
+  connected you will be told so and should fall back to target="local".
+
+Writing the task brief:
+
+* Put everything the child needs in "task": the goal, the relevant file paths,
+  the constraints, the expected deliverable, and how it should report back.
+* Keep each child's scope independent of its siblings so parallel children do
+  not fight over the same files.
+* One call per delegated task. Do NOT call this tool twice for the same task.
+
+Parameter rules (a call that breaks one of these launches nothing and comes
+back with corrective guidance):
+
+* "repository" and "branch" apply to target="cloud" only. A local child always
+  inherits this conversation's workspace, so do not pass them with
+  target="local".
+* "isolation" applies to target="local" only. Cloud sandboxes are always
+  isolated, so do not pass it with target="cloud".
+* isolation="worktree" (the default) gives the child its own git worktree and
+  branch, cut from the repository's default branch — it will NOT see this
+  conversation's uncommitted or committed work. isolation="shared" puts the
+  child in this conversation's exact directory; only choose it when the child
+  genuinely must see work in progress, and expect the two agents to conflict.
+
+What comes back: this tool is acknowledged immediately, before the conversation
+exists. The real outcome arrives moments later as a follow-up message starting
+with "${t.trim()}" that carries the child's
+conversation id, URL, target and initial status — or an error with guidance.
+Wait for it, then tell the user what you launched and give them the URL. If it
+reports an error, fix the parameters and call this tool again.`,
+	parameters: {
+		type: "object",
+		additionalProperties: !1,
+		properties: {
+			target: {
+				type: "string",
+				enum: [...n],
+				description: "Where the child runs. 'local' reuses this machine and this conversation's workspace; 'cloud' runs in an isolated OpenHands Cloud sandbox."
+			},
+			task: {
+				type: "string",
+				description: "Self-contained task brief, sent as the child's first message. The child cannot see this conversation, so state the goal, constraints, expected output and handoff criteria."
+			},
+			title: {
+				type: "string",
+				description: "Optional short title for the child conversation. Omit to let it title itself from the task."
+			},
+			repository: {
+				type: "string",
+				description: "target='cloud' only. Repository to clone into the sandbox, as 'owner/repo'. Defaults to this conversation's repository when it has one."
+			},
+			branch: {
+				type: "string",
+				description: "target='cloud' only, and only together with 'repository'. Defaults to the repository's default branch."
+			},
+			isolation: {
+				type: "string",
+				enum: [...e],
+				description: "target='local' only. 'worktree' (default) gives the child its own git worktree and branch; 'shared' runs it in this conversation's exact directory."
+			}
+		},
+		required: ["target", "task"]
+	},
+	annotations: {
+		readOnlyHint: !1,
+		destructiveHint: !1,
+		idempotentHint: !1,
+		openWorldHint: !0
+	}
+};
+//#endregion
+export { i as LAUNCH_CHILD_CONVERSATION_CLIENT_TOOL };
+
+//# sourceMappingURL=launch-child-conversation-client-tool.js.map

package/dist/api/launch-child-conversation-client-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-child-conversation-client-tool.js","names":[],"sources":["../../src/api/launch-child-conversation-client-tool.ts"],"sourcesContent":["import {\n  CHILD_CONVERSATION_ISOLATIONS,\n  CHILD_CONVERSATION_RESULT_PREFIX,\n  CHILD_CONVERSATION_TARGETS,\n  LAUNCH_CHILD_CONVERSATION_TOOL_NAME,\n} from \"#/constants/child-conversation\";\nimport type { ClientToolSpec } from \"./canvas-ui-client-tool\";\n\nexport {\n  LAUNCH_CHILD_CONVERSATION_ACTION_KIND,\n  LAUNCH_CHILD_CONVERSATION_TOOL_NAME,\n} from \"#/constants/child-conversation\";\n\nconst LAUNCH_CHILD_CONVERSATION_DESCRIPTION = `Start a NEW, independent conversation to work on a well-scoped task in parallel with this one, without the user having to run any CLI command. The new conversation is recorded as a child of this one.\n\nThe child runs on its own. It does not block you, you do not see its output,\nand it cannot see this conversation's history — everything it needs must be in\nthe task brief.\n\nChoosing target:\n\n* target=\"local\" — runs on the same machine, in this conversation's workspace.\n  Fast, no repository clone, no sandbox provisioning. Use this by default when\n  the work is on code that is already checked out here.\n\n* target=\"cloud\" — runs on OpenHands Cloud in its own isolated sandbox, from a\n  git repository. Use this when the work should not touch the user's machine or\n  when it needs a repository that is not checked out locally. Requires the user\n  to have an OpenHands Cloud backend connected in Agent Canvas; if none is\n  connected you will be told so and should fall back to target=\"local\".\n\nWriting the task brief:\n\n* Put everything the child needs in \"task\": the goal, the relevant file paths,\n  the constraints, the expected deliverable, and how it should report back.\n* Keep each child's scope independent of its siblings so parallel children do\n  not fight over the same files.\n* One call per delegated task. Do NOT call this tool twice for the same task.\n\nParameter rules (a call that breaks one of these launches nothing and comes\nback with corrective guidance):\n\n* \"repository\" and \"branch\" apply to target=\"cloud\" only. A local child always\n  inherits this conversation's workspace, so do not pass them with\n  target=\"local\".\n* \"isolation\" applies to target=\"local\" only. Cloud sandboxes are always\n  isolated, so do not pass it with target=\"cloud\".\n* isolation=\"worktree\" (the default) gives the child its own git worktree and\n  branch, cut from the repository's default branch — it will NOT see this\n  conversation's uncommitted or committed work. isolation=\"shared\" puts the\n  child in this conversation's exact directory; only choose it when the child\n  genuinely must see work in progress, and expect the two agents to conflict.\n\nWhat comes back: this tool is acknowledged immediately, before the conversation\nexists. The real outcome arrives moments later as a follow-up message starting\nwith \"${CHILD_CONVERSATION_RESULT_PREFIX.trim()}\" that carries the child's\nconversation id, URL, target and initial status — or an error with guidance.\nWait for it, then tell the user what you launched and give them the URL. If it\nreports an error, fix the parameters and call this tool again.`;\n\nexport const LAUNCH_CHILD_CONVERSATION_CLIENT_TOOL: ClientToolSpec = {\n  name: LAUNCH_CHILD_CONVERSATION_TOOL_NAME,\n  description: LAUNCH_CHILD_CONVERSATION_DESCRIPTION,\n  parameters: {\n    type: \"object\",\n    additionalProperties: false,\n    properties: {\n      target: {\n        type: \"string\",\n        enum: [...CHILD_CONVERSATION_TARGETS],\n        description:\n          \"Where the child runs. 'local' reuses this machine and this conversation's workspace; 'cloud' runs in an isolated OpenHands Cloud sandbox.\",\n      },\n      task: {\n        type: \"string\",\n        description:\n          \"Self-contained task brief, sent as the child's first message. The child cannot see this conversation, so state the goal, constraints, expected output and handoff criteria.\",\n      },\n      title: {\n        type: \"string\",\n        description:\n          \"Optional short title for the child conversation. Omit to let it title itself from the task.\",\n      },\n      repository: {\n        type: \"string\",\n        description:\n          \"target='cloud' only. Repository to clone into the sandbox, as 'owner/repo'. Defaults to this conversation's repository when it has one.\",\n      },\n      branch: {\n        type: \"string\",\n        description:\n          \"target='cloud' only, and only together with 'repository'. Defaults to the repository's default branch.\",\n      },\n      isolation: {\n        type: \"string\",\n        enum: [...CHILD_CONVERSATION_ISOLATIONS],\n        description:\n          \"target='local' only. 'worktree' (default) gives the child its own git worktree and branch; 'shared' runs it in this conversation's exact directory.\",\n      },\n    },\n    required: [\"target\", \"task\"],\n  },\n  annotations: {\n    // Launching a conversation writes real state and is not repeatable, so the\n    // agent is asked to predict a security risk before every call.\n    readOnlyHint: false,\n    destructiveHint: false,\n    idempotentHint: false,\n    // The cloud target reaches OpenHands Cloud.\n    openWorldHint: true,\n  },\n};\n"],"mappings":";AA4DA,IAAa,IAAwD;CACnE,MAAM;CACN,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAPP,EAAiC,KAAK,EAAE;;;;CAQ9C,YAAY;EACV,MAAM;EACN,sBAAsB;EACtB,YAAY;GACV,QAAQ;IACN,MAAM;IACN,MAAM,CAAC,GAAG,CAA0B;IACpC,aACE;GACJ;GACA,MAAM;IACJ,MAAM;IACN,aACE;GACJ;GACA,OAAO;IACL,MAAM;IACN,aACE;GACJ;GACA,YAAY;IACV,MAAM;IACN,aACE;GACJ;GACA,QAAQ;IACN,MAAM;IACN,aACE;GACJ;GACA,WAAW;IACT,MAAM;IACN,MAAM,CAAC,GAAG,CAA6B;IACvC,aACE;GACJ;EACF;EACA,UAAU,CAAC,UAAU,MAAM;CAC7B;CACA,aAAa;EAGX,cAAc;EACd,iBAAiB;EACjB,gBAAgB;EAEhB,eAAe;CACjB;AACF"}

package/dist/api/mcp-service/mcp-redacted-credentials.cjs

@@ -1,2 +1,2 @@
-require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../utils/mcp-config.cjs"),t=require("../settings-service/settings-service.api.cjs"),n=require("../../types/mcp-auth.cjs");var r=e=>!!e&&typeof e==`object`&&!Array.isArray(e),i=e=>{if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0},a=e=>!!e&&Object.values(e).some(e=>e===`**********`),o=(e,t)=>e===`sse`?t===`sse`:e===`shttp`?t===void 0||t===`http`||t===`shttp`||t===`streamable-http`:!1,s=e=>{if(!e)return;let t=/^stdio-(\d+)$/.exec(e);return t?Number.parseInt(t[1],10):void 0},c=(e,t)=>{let n=s(e);if(n!==void 0)return Object.entries(t).filter(([,e])=>!e.url)[n]?.[1]},l=(e,t)=>e.type===`stdio`?c(e.id,t)??(e.name?t[e.name]:void 0):e.name&&t[e.name]?t[e.name]:Object.values(t).find(t=>t.url===e.url&&o(e.type,t.transport));async function u(e){let n=(await t.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(r(n))return l(e,n)}async function d(t){let r=t.type===`stdio`&&a(t.env),o=(t.type===`sse`||t.type===`shttp`)&&e.hasRedactedMcpSecretLeaf(t.auth);if(!r&&!o)return t;try{let e=await u(t);if(!e)return t;if(r){let n=i(e.env)??{},r=Object.fromEntries(Object.entries(t.env??{}).map(([e,t])=>[e,t===`**********`&&typeof n[e]==`string`?n[e]:t]));return{...t,env:r}}return o&&n.isMcpAuthCredential(e.auth)?{...t,auth:e.auth}:t}catch{return t}}exports.substituteRedactedMcpCredentials=d;
+require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../types/mcp-auth.cjs"),t=require("../../utils/mcp-config.cjs"),n=require("../settings-service/settings-service.api.cjs");var r=e=>!!e&&typeof e==`object`&&!Array.isArray(e),i=e=>{if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0},a=e=>!!e&&Object.values(e).some(e=>e===`**********`);function o(e,t){if(!r(e))return e;let n=r(t)?t:{},i={...e};for(let[t,a]of Object.entries(e))if(a===`**********`){let e=n[t];typeof e==`string`&&e!==`**********`&&(i[t]=e)}else r(a)&&(i[t]=o(a,n[t]));return i}var s=(e,t)=>t[e.id];async function c(e){let t=(await n.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(r(t))return s(e,t)}async function l(n){let r=n.type===`stdio`&&a(n.env),s=(n.type===`sse`||n.type===`shttp`)&&t.hasRedactedMcpSecretLeaf(n.auth),l=(n.type===`sse`||n.type===`shttp`)&&a(n.headers);if(!r&&!s&&!l)return n;try{let t=await c(n);if(!t)return n;if(r){let e=i(t.env)??{},r=Object.fromEntries(Object.entries(n.env??{}).map(([t,n])=>[t,n===`**********`&&typeof e[t]==`string`?e[t]:n]));return{...n,env:r}}let a={...n};if(s&&e.isMcpAuthCredential(t.auth)&&(a.auth=o(n.auth,t.auth)),l){let e=i(t.headers)??{};a.headers=Object.fromEntries(Object.entries(n.headers??{}).map(([t,n])=>[t,n===`**********`&&typeof e[t]==`string`?e[t]:n]))}return a}catch{return n}}exports.substituteRedactedMcpCredentials=l;
 //# sourceMappingURL=mcp-redacted-credentials.cjs.map

package/dist/api/mcp-service/mcp-redacted-credentials.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n  hasRedactedMcpSecretLeaf,\n  REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  auth?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\nconst remoteTransportMatches = (\n  type: MCPServerConfig[\"type\"],\n  transport: unknown,\n) => {\n  if (type === \"sse\") return transport === \"sse\";\n  if (type === \"shttp\") {\n    return (\n      transport === undefined ||\n      transport === \"http\" ||\n      transport === \"shttp\" ||\n      transport === \"streamable-http\"\n    );\n  }\n  return false;\n};\n\n// The editor assigns each stdio server an id of the form ``stdio-<i>`` matching\n// its position in ``parseMcpConfig``'s stdio array. That position is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries (those\n// without a ``url``) in ``Object.entries`` order, identical for the redacted\n// and encrypted settings. Resolve the original stored entry by position so a\n// renamed stdio server still finds its stored encrypted env, instead of\n// looking it up by the new (no-longer-matching) display name.\nconst stdioIndexFromId = (id: string | undefined): number | undefined => {\n  if (!id) return undefined;\n  const match = /^stdio-(\\d+)$/.exec(id);\n  return match ? Number.parseInt(match[1], 10) : undefined;\n};\n\nconst findStoredStdioByIndex = (\n  id: string | undefined,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  const index = stdioIndexFromId(id);\n  if (index === undefined) return undefined;\n  const stdioEntries = Object.entries(storedServers).filter(\n    ([, stored]) => !stored.url,\n  );\n  return stdioEntries[index]?.[1];\n};\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  if (server.type === \"stdio\") {\n    // Prefer the positional id: a rename changes the display name (the stored\n    // dict key), and a rename onto an existing name would otherwise restore the\n    // wrong server's secrets. Fall back to a name match only when no id-based\n    // position is available (e.g. configs built without an editor-assigned id).\n    return (\n      findStoredStdioByIndex(server.id, storedServers) ??\n      (server.name ? storedServers[server.name] : undefined)\n    );\n  }\n\n  if (server.name && storedServers[server.name]) {\n    return storedServers[server.name];\n  }\n\n  return Object.values(storedServers).find(\n    (stored) =>\n      stored.url === server.url &&\n      remoteTransportMatches(server.type, stored.transport),\n  );\n};\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/**\n * The MCP editor sees redacted settings (`**********`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so tests and saves round-trip the real\n * credential without exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteAuth =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedMcpSecretLeaf(server.auth);\n\n  if (!redactedStdioEnv && !redactedRemoteAuth) {\n    return server;\n  }\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    if (!redactedRemoteAuth) return server;\n    if (isMcpAuthCredential(stored.auth)) {\n      return { ...server, auth: stored.auth };\n    }\n    return server;\n  } catch {\n    return server;\n  }\n}\n"],"mappings":"8LAkBA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,EAExD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,EAEM,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,CAAM,EAAE,KAAM,GAAU,IAAA,YAAmC,EAErE,GACJ,EACA,IAEI,IAAS,MAAc,IAAc,MACrC,IAAS,QAET,IAAc,IAAA,IACd,IAAc,QACd,IAAc,SACd,IAAc,kBAGX,GAUH,EAAoB,GAA+C,CACvE,GAAI,CAAC,EAAI,OACT,IAAM,EAAQ,gBAAgB,KAAK,CAAE,EACrC,OAAO,EAAQ,OAAO,SAAS,EAAM,GAAI,EAAE,EAAI,IAAA,EACjD,EAEM,GACJ,EACA,IACgC,CAChC,IAAM,EAAQ,EAAiB,CAAE,EAC7B,OAAU,IAAA,GAId,OAHqB,OAAO,QAAQ,CAAa,EAAE,QAChD,EAAG,KAAY,CAAC,EAAO,GAEnB,EAAa,KAAS,EAC/B,EAEM,GACJ,EACA,IAEI,EAAO,OAAS,QAMhB,EAAuB,EAAO,GAAI,CAAa,IAC9C,EAAO,KAAO,EAAc,EAAO,MAAQ,IAAA,IAI5C,EAAO,MAAQ,EAAc,EAAO,MAC/B,EAAc,EAAO,MAGvB,OAAO,OAAO,CAAa,EAAE,KACjC,GACC,EAAO,MAAQ,EAAO,KACtB,EAAuB,EAAO,KAAM,EAAO,SAAS,CACxD,EAGF,eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,WAAW,GAC5C,gBAAgB,WACtC,KAAS,CAAS,EAGvB,OAAO,EAAiB,EAAQ,CAA4B,CAC9D,CAQA,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,GAAG,EAClD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAA,yBAAyB,EAAO,IAAI,EAEtC,GAAI,CAAC,GAAoB,CAAC,EACxB,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,CAAM,EACtD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,GAAG,GAAK,CAAC,EACzC,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,CACN,CAAC,CACH,EACA,MAAO,CAAE,GAAG,EAAQ,KAAI,CAC1B,CAMA,OAJK,GACD,EAAA,oBAAoB,EAAO,IAAI,EAC1B,CAAE,GAAG,EAAQ,KAAM,EAAO,IAAK,EAEjC,CACT,MAAQ,CACN,OAAO,CACT,CACF"}
+{"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n  hasRedactedMcpSecretLeaf,\n  REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  auth?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\n/**\n * Recursively replace only the redacted display placeholders inside\n * ``submitted`` with the corresponding stored (encrypted) leaf. Fresh\n * non-redacted edits and untouched structure are preserved verbatim, so a\n * probe request exercises the server exactly as it will be persisted.\n */\nfunction substituteRedactedLeaves<T>(submitted: T, stored: unknown): T {\n  if (!isRecord(submitted)) return submitted;\n\n  const storedRecord = isRecord(stored) ? stored : {};\n  const merged: Record<string, unknown> = { ...submitted };\n  for (const [key, value] of Object.entries(submitted)) {\n    if (value === REDACTED_MCP_SECRET_VALUE) {\n      const storedValue = storedRecord[key];\n      if (\n        typeof storedValue === \"string\" &&\n        storedValue !== REDACTED_MCP_SECRET_VALUE\n      ) {\n        merged[key] = storedValue;\n      }\n    } else if (isRecord(value)) {\n      merged[key] = substituteRedactedLeaves(value, storedRecord[key]);\n    }\n  }\n  return merged as T;\n}\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => storedServers[server.id];\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/**\n * The MCP editor sees redacted settings (`**********`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so a connectivity test can exercise the real\n * credential without exposing plaintext in the browser. Persistence never\n * calls this helper; sparse settings patches omit unchanged secrets.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteAuth =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedMcpSecretLeaf(server.auth);\n  const redactedRemoteHeaders =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedValue(server.headers);\n\n  if (!redactedStdioEnv && !redactedRemoteAuth && !redactedRemoteHeaders) {\n    return server;\n  }\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    const nextServer = { ...server };\n    if (redactedRemoteAuth && isMcpAuthCredential(stored.auth)) {\n      nextServer.auth = substituteRedactedLeaves(server.auth, stored.auth);\n    }\n    if (redactedRemoteHeaders) {\n      const storedHeaders = stringRecord(stored.headers) ?? {};\n      nextServer.headers = Object.fromEntries(\n        Object.entries(server.headers ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedHeaders[key] === \"string\"\n            ? storedHeaders[key]\n            : value,\n        ]),\n      );\n    }\n    return nextServer;\n  } catch {\n    return server;\n  }\n}\n"],"mappings":"8LAkBA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,CAAK,EAExD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,OACtB,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OACnC,GAAqC,OAAO,EAAM,IAAO,QAC5D,EACA,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,CAAO,EAAI,IAAA,EAC5D,EAEM,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,CAAM,EAAE,KAAM,GAAU,IAAA,YAAmC,EAQ3E,SAAS,EAA4B,EAAc,EAAoB,CACrE,GAAI,CAAC,EAAS,CAAS,EAAG,OAAO,EAEjC,IAAM,EAAe,EAAS,CAAM,EAAI,EAAS,CAAC,EAC5C,EAAkC,CAAE,GAAG,CAAU,EACvD,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAS,EACjD,GAAI,IAAA,aAAqC,CACvC,IAAM,EAAc,EAAa,GAE/B,OAAO,GAAgB,UACvB,IAAA,eAEA,EAAO,GAAO,EAElB,MAAW,EAAS,CAAK,IACvB,EAAO,GAAO,EAAyB,EAAO,EAAa,EAAI,GAGnE,OAAO,CACT,CAEA,IAAM,GACJ,EACA,IACgC,EAAc,EAAO,IAEvD,eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,WAAW,GAC5C,gBAAgB,WACtC,KAAS,CAAS,EAGvB,OAAO,EAAiB,EAAQ,CAA4B,CAC9D,CASA,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,GAAG,EAClD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAA,yBAAyB,EAAO,IAAI,EAChC,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAiB,EAAO,OAAO,EAEjC,GAAI,CAAC,GAAoB,CAAC,GAAsB,CAAC,EAC/C,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,CAAM,EACtD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,GAAG,GAAK,CAAC,EACzC,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,CACN,CAAC,CACH,EACA,MAAO,CAAE,GAAG,EAAQ,KAAI,CAC1B,CAEA,IAAM,EAAa,CAAE,GAAG,CAAO,EAI/B,GAHI,GAAsB,EAAA,oBAAoB,EAAO,IAAI,IACvD,EAAW,KAAO,EAAyB,EAAO,KAAM,EAAO,IAAI,GAEjE,EAAuB,CACzB,IAAM,EAAgB,EAAa,EAAO,OAAO,GAAK,CAAC,EACvD,EAAW,QAAU,OAAO,YAC1B,OAAO,QAAQ,EAAO,SAAW,CAAC,CAAC,EAAE,KAAK,CAAC,EAAK,KAAW,CACzD,EACA,IAAA,cACA,OAAO,EAAc,IAAS,SAC1B,EAAc,GACd,CACN,CAAC,CACH,CACF,CACA,OAAO,CACT,MAAQ,CACN,OAAO,CACT,CACF"}

package/dist/api/mcp-service/mcp-redacted-credentials.d.ts

@@ -2,7 +2,8 @@ import type { MCPServerConfig } from "#/types/mcp-server";
 /**
  * The MCP editor sees redacted settings (`**********`). When the user leaves
  * a secret unchanged, replace that placeholder with the stored encrypted
- * env/header/OAuth state value so tests and saves round-trip the real
- * credential without exposing plaintext in the browser.
+ * env/header/OAuth state value so a connectivity test can exercise the real
+ * credential without exposing plaintext in the browser. Persistence never
+ * calls this helper; sparse settings patches omit unchanged secrets.
  */
 export declare function substituteRedactedMcpCredentials(server: MCPServerConfig): Promise<MCPServerConfig>;

package/dist/api/mcp-service/mcp-redacted-credentials.js

@@ -1,45 +1,50 @@
-import { hasRedactedMcpSecretLeaf as e } from "../../utils/mcp-config.js";
-import t from "../settings-service/settings-service.api.js";
-import { isMcpAuthCredential as n } from "../../types/mcp-auth.js";
+import { isMcpAuthCredential as e } from "../../types/mcp-auth.js";
+import { hasRedactedMcpSecretLeaf as t } from "../../utils/mcp-config.js";
+import n from "../settings-service/settings-service.api.js";
 //#region src/api/mcp-service/mcp-redacted-credentials.ts
 var r = (e) => !!e && typeof e == "object" && !Array.isArray(e), i = (e) => {
 	if (!r(e)) return;
 	let t = Object.entries(e).filter((e) => typeof e[1] == "string");
 	return t.length > 0 ? Object.fromEntries(t) : void 0;
-}, a = (e) => !!e && Object.values(e).some((e) => e === "**********"), o = (e, t) => e === "sse" ? t === "sse" : e === "shttp" ? t === void 0 || t === "http" || t === "shttp" || t === "streamable-http" : !1, s = (e) => {
-	if (!e) return;
-	let t = /^stdio-(\d+)$/.exec(e);
-	return t ? Number.parseInt(t[1], 10) : void 0;
-}, c = (e, t) => {
-	let n = s(e);
-	if (n !== void 0) return Object.entries(t).filter(([, e]) => !e.url)[n]?.[1];
-}, l = (e, t) => e.type === "stdio" ? c(e.id, t) ?? (e.name ? t[e.name] : void 0) : e.name && t[e.name] ? t[e.name] : Object.values(t).find((t) => t.url === e.url && o(e.type, t.transport));
-async function u(e) {
-	let n = (await t.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
-	if (r(n)) return l(e, n);
+}, a = (e) => !!e && Object.values(e).some((e) => e === "**********");
+function o(e, t) {
+	if (!r(e)) return e;
+	let n = r(t) ? t : {}, i = { ...e };
+	for (let [t, a] of Object.entries(e)) if (a === "**********") {
+		let e = n[t];
+		typeof e == "string" && e !== "**********" && (i[t] = e);
+	} else r(a) && (i[t] = o(a, n[t]));
+	return i;
 }
-async function d(t) {
-	let r = t.type === "stdio" && a(t.env), o = (t.type === "sse" || t.type === "shttp") && e(t.auth);
-	if (!r && !o) return t;
+var s = (e, t) => t[e.id];
+async function c(e) {
+	let t = (await n.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
+	if (r(t)) return s(e, t);
+}
+async function l(n) {
+	let r = n.type === "stdio" && a(n.env), s = (n.type === "sse" || n.type === "shttp") && t(n.auth), l = (n.type === "sse" || n.type === "shttp") && a(n.headers);
+	if (!r && !s && !l) return n;
 	try {
-		let e = await u(t);
-		if (!e) return t;
+		let t = await c(n);
+		if (!t) return n;
 		if (r) {
-			let n = i(e.env) ?? {}, r = Object.fromEntries(Object.entries(t.env ?? {}).map(([e, t]) => [e, t === "**********" && typeof n[e] == "string" ? n[e] : t]));
+			let e = i(t.env) ?? {}, r = Object.fromEntries(Object.entries(n.env ?? {}).map(([t, n]) => [t, n === "**********" && typeof e[t] == "string" ? e[t] : n]));
 			return {
-				...t,
+				...n,
 				env: r
 			};
 		}
-		return o && n(e.auth) ? {
-			...t,
-			auth: e.auth
-		} : t;
+		let a = { ...n };
+		if (s && e(t.auth) && (a.auth = o(n.auth, t.auth)), l) {
+			let e = i(t.headers) ?? {};
+			a.headers = Object.fromEntries(Object.entries(n.headers ?? {}).map(([t, n]) => [t, n === "**********" && typeof e[t] == "string" ? e[t] : n]));
+		}
+		return a;
 	} catch {
-		return t;
+		return n;
 	}
 }
 //#endregion
-export { d as substituteRedactedMcpCredentials };
+export { l as substituteRedactedMcpCredentials };
 
 //# sourceMappingURL=mcp-redacted-credentials.js.map

package/dist/api/mcp-service/mcp-redacted-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-redacted-credentials.js","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n  hasRedactedMcpSecretLeaf,\n  REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  auth?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\nconst remoteTransportMatches = (\n  type: MCPServerConfig[\"type\"],\n  transport: unknown,\n) => {\n  if (type === \"sse\") return transport === \"sse\";\n  if (type === \"shttp\") {\n    return (\n      transport === undefined ||\n      transport === \"http\" ||\n      transport === \"shttp\" ||\n      transport === \"streamable-http\"\n    );\n  }\n  return false;\n};\n\n// The editor assigns each stdio server an id of the form ``stdio-<i>`` matching\n// its position in ``parseMcpConfig``'s stdio array. That position is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries (those\n// without a ``url``) in ``Object.entries`` order, identical for the redacted\n// and encrypted settings. Resolve the original stored entry by position so a\n// renamed stdio server still finds its stored encrypted env, instead of\n// looking it up by the new (no-longer-matching) display name.\nconst stdioIndexFromId = (id: string | undefined): number | undefined => {\n  if (!id) return undefined;\n  const match = /^stdio-(\\d+)$/.exec(id);\n  return match ? Number.parseInt(match[1], 10) : undefined;\n};\n\nconst findStoredStdioByIndex = (\n  id: string | undefined,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  const index = stdioIndexFromId(id);\n  if (index === undefined) return undefined;\n  const stdioEntries = Object.entries(storedServers).filter(\n    ([, stored]) => !stored.url,\n  );\n  return stdioEntries[index]?.[1];\n};\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  if (server.type === \"stdio\") {\n    // Prefer the positional id: a rename changes the display name (the stored\n    // dict key), and a rename onto an existing name would otherwise restore the\n    // wrong server's secrets. Fall back to a name match only when no id-based\n    // position is available (e.g. configs built without an editor-assigned id).\n    return (\n      findStoredStdioByIndex(server.id, storedServers) ??\n      (server.name ? storedServers[server.name] : undefined)\n    );\n  }\n\n  if (server.name && storedServers[server.name]) {\n    return storedServers[server.name];\n  }\n\n  return Object.values(storedServers).find(\n    (stored) =>\n      stored.url === server.url &&\n      remoteTransportMatches(server.type, stored.transport),\n  );\n};\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/**\n * The MCP editor sees redacted settings (`**********`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so tests and saves round-trip the real\n * credential without exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteAuth =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedMcpSecretLeaf(server.auth);\n\n  if (!redactedStdioEnv && !redactedRemoteAuth) {\n    return server;\n  }\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    if (!redactedRemoteAuth) return server;\n    if (isMcpAuthCredential(stored.auth)) {\n      return { ...server, auth: stored.auth };\n    }\n    return server;\n  } catch {\n    return server;\n  }\n}\n"],"mappings":";;;;AAkBA,IAAM,KAAY,MAChB,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK,GAExD,KAAgB,MAAuD;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D,GAEM,KAAoB,MACxB,CAAC,CAAC,KACF,OAAO,OAAO,CAAM,EAAE,MAAM,MAAU,MAAA,YAAmC,GAErE,KACJ,GACA,MAEI,MAAS,QAAc,MAAc,QACrC,MAAS,UAET,MAAc,KAAA,KACd,MAAc,UACd,MAAc,WACd,MAAc,oBAGX,IAUH,KAAoB,MAA+C;CACvE,IAAI,CAAC,GAAI;CACT,IAAM,IAAQ,gBAAgB,KAAK,CAAE;CACrC,OAAO,IAAQ,OAAO,SAAS,EAAM,IAAI,EAAE,IAAI,KAAA;AACjD,GAEM,KACJ,GACA,MACgC;CAChC,IAAM,IAAQ,EAAiB,CAAE;CAC7B,UAAU,KAAA,GAId,OAHqB,OAAO,QAAQ,CAAa,EAAE,QAChD,GAAG,OAAY,CAAC,EAAO,GAEnB,EAAa,KAAS;AAC/B,GAEM,KACJ,GACA,MAEI,EAAO,SAAS,UAMhB,EAAuB,EAAO,IAAI,CAAa,MAC9C,EAAO,OAAO,EAAc,EAAO,QAAQ,KAAA,KAI5C,EAAO,QAAQ,EAAc,EAAO,QAC/B,EAAc,EAAO,QAGvB,OAAO,OAAO,CAAa,EAAE,MACjC,MACC,EAAO,QAAQ,EAAO,OACtB,EAAuB,EAAO,MAAM,EAAO,SAAS,CACxD;AAGF,eAAe,EACb,GACsC;CAEtC,IAAM,KAAY,MADK,EAAgB,qBAAqB,WAAW,GAC5C,gBAAgB;CACtC,MAAS,CAAS,GAGvB,OAAO,EAAiB,GAAQ,CAA4B;AAC9D;AAQA,eAAsB,EACpB,GAC0B;CAC1B,IAAM,IACJ,EAAO,SAAS,WAAW,EAAiB,EAAO,GAAG,GAClD,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAyB,EAAO,IAAI;CAEtC,IAAI,CAAC,KAAoB,CAAC,GACxB,OAAO;CAGT,IAAI;EACF,IAAM,IAAS,MAAM,EAA2B,CAAM;EACtD,IAAI,CAAC,GAAQ,OAAO;EAEpB,IAAI,GAAkB;GACpB,IAAM,IAAY,EAAa,EAAO,GAAG,KAAK,CAAC,GACzC,IAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACrD,GACA,MAAA,gBACA,OAAO,EAAU,MAAS,WACtB,EAAU,KACV,CACN,CAAC,CACH;GACA,OAAO;IAAE,GAAG;IAAQ;GAAI;EAC1B;EAMA,OAJK,KACD,EAAoB,EAAO,IAAI,IAC1B;GAAE,GAAG;GAAQ,MAAM,EAAO;EAAK,IAEjC;CACT,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"mcp-redacted-credentials.js","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n  hasRedactedMcpSecretLeaf,\n  REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  auth?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\n/**\n * Recursively replace only the redacted display placeholders inside\n * ``submitted`` with the corresponding stored (encrypted) leaf. Fresh\n * non-redacted edits and untouched structure are preserved verbatim, so a\n * probe request exercises the server exactly as it will be persisted.\n */\nfunction substituteRedactedLeaves<T>(submitted: T, stored: unknown): T {\n  if (!isRecord(submitted)) return submitted;\n\n  const storedRecord = isRecord(stored) ? stored : {};\n  const merged: Record<string, unknown> = { ...submitted };\n  for (const [key, value] of Object.entries(submitted)) {\n    if (value === REDACTED_MCP_SECRET_VALUE) {\n      const storedValue = storedRecord[key];\n      if (\n        typeof storedValue === \"string\" &&\n        storedValue !== REDACTED_MCP_SECRET_VALUE\n      ) {\n        merged[key] = storedValue;\n      }\n    } else if (isRecord(value)) {\n      merged[key] = substituteRedactedLeaves(value, storedRecord[key]);\n    }\n  }\n  return merged as T;\n}\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => storedServers[server.id];\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/**\n * The MCP editor sees redacted settings (`**********`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so a connectivity test can exercise the real\n * credential without exposing plaintext in the browser. Persistence never\n * calls this helper; sparse settings patches omit unchanged secrets.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteAuth =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedMcpSecretLeaf(server.auth);\n  const redactedRemoteHeaders =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedValue(server.headers);\n\n  if (!redactedStdioEnv && !redactedRemoteAuth && !redactedRemoteHeaders) {\n    return server;\n  }\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    const nextServer = { ...server };\n    if (redactedRemoteAuth && isMcpAuthCredential(stored.auth)) {\n      nextServer.auth = substituteRedactedLeaves(server.auth, stored.auth);\n    }\n    if (redactedRemoteHeaders) {\n      const storedHeaders = stringRecord(stored.headers) ?? {};\n      nextServer.headers = Object.fromEntries(\n        Object.entries(server.headers ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedHeaders[key] === \"string\"\n            ? storedHeaders[key]\n            : value,\n        ]),\n      );\n    }\n    return nextServer;\n  } catch {\n    return server;\n  }\n}\n"],"mappings":";;;;AAkBA,IAAM,KAAY,MAChB,CAAC,CAAC,KAAS,OAAO,KAAU,YAAY,CAAC,MAAM,QAAQ,CAAK,GAExD,KAAgB,MAAuD;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;CACtB,IAAM,IAAU,OAAO,QAAQ,CAAK,EAAE,QACnC,MAAqC,OAAO,EAAM,MAAO,QAC5D;CACA,OAAO,EAAQ,SAAS,IAAI,OAAO,YAAY,CAAO,IAAI,KAAA;AAC5D,GAEM,KAAoB,MACxB,CAAC,CAAC,KACF,OAAO,OAAO,CAAM,EAAE,MAAM,MAAU,MAAA,YAAmC;AAQ3E,SAAS,EAA4B,GAAc,GAAoB;CACrE,IAAI,CAAC,EAAS,CAAS,GAAG,OAAO;CAEjC,IAAM,IAAe,EAAS,CAAM,IAAI,IAAS,CAAC,GAC5C,IAAkC,EAAE,GAAG,EAAU;CACvD,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAS,GACjD,IAAI,MAAA,cAAqC;EACvC,IAAM,IAAc,EAAa;EACjC,AACE,OAAO,KAAgB,YACvB,MAAA,iBAEA,EAAO,KAAO;CAElB,OAAO,AAAI,EAAS,CAAK,MACvB,EAAO,KAAO,EAAyB,GAAO,EAAa,EAAI;CAGnE,OAAO;AACT;AAEA,IAAM,KACJ,GACA,MACgC,EAAc,EAAO;AAEvD,eAAe,EACb,GACsC;CAEtC,IAAM,KAAY,MADK,EAAgB,qBAAqB,WAAW,GAC5C,gBAAgB;CACtC,MAAS,CAAS,GAGvB,OAAO,EAAiB,GAAQ,CAA4B;AAC9D;AASA,eAAsB,EACpB,GAC0B;CAC1B,IAAM,IACJ,EAAO,SAAS,WAAW,EAAiB,EAAO,GAAG,GAClD,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAyB,EAAO,IAAI,GAChC,KACH,EAAO,SAAS,SAAS,EAAO,SAAS,YAC1C,EAAiB,EAAO,OAAO;CAEjC,IAAI,CAAC,KAAoB,CAAC,KAAsB,CAAC,GAC/C,OAAO;CAGT,IAAI;EACF,IAAM,IAAS,MAAM,EAA2B,CAAM;EACtD,IAAI,CAAC,GAAQ,OAAO;EAEpB,IAAI,GAAkB;GACpB,IAAM,IAAY,EAAa,EAAO,GAAG,KAAK,CAAC,GACzC,IAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACrD,GACA,MAAA,gBACA,OAAO,EAAU,MAAS,WACtB,EAAU,KACV,CACN,CAAC,CACH;GACA,OAAO;IAAE,GAAG;IAAQ;GAAI;EAC1B;EAEA,IAAM,IAAa,EAAE,GAAG,EAAO;EAI/B,IAHI,KAAsB,EAAoB,EAAO,IAAI,MACvD,EAAW,OAAO,EAAyB,EAAO,MAAM,EAAO,IAAI,IAEjE,GAAuB;GACzB,IAAM,IAAgB,EAAa,EAAO,OAAO,KAAK,CAAC;GACvD,EAAW,UAAU,OAAO,YAC1B,OAAO,QAAQ,EAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,GAAK,OAAW,CACzD,GACA,MAAA,gBACA,OAAO,EAAc,MAAS,WAC1B,EAAc,KACd,CACN,CAAC,CACH;EACF;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/api/mcp-service/mcp-service.api.cjs

@@ -1,2 +1,2 @@
-require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs");require("../../node_modules/@openhands/typescript-client/dist/clients.cjs");const t=require("../backend-registry/active-store.cjs"),n=require("../agent-server-client-options.cjs"),r=require("./mcp-redacted-credentials.cjs"),i=require("../../utils/mcp-credential-validation.cjs"),a=require("../../utils/redact-mcp-secrets.cjs");var o=120;function s(e){return e.type===`stdio`?{transport:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{transport:e.type===`sse`?`sse`:`http`,url:e.url,...e.headers&&Object.keys(e.headers).length>0&&{headers:e.headers},...e.auth?{auth:e.auth}:{}}}function c(e){return e.auth?.strategy===`oauth2`?o:e.timeout}async function l(e){let t=i.getCredentialValidationForServer(e),n=await r.substituteRedactedMcpCredentials(e),a=s(n),o=c(e);return{request:{server:a,...e.name?{name:e.name}:{},...o===void 0?{}:{timeout:o},...t?{tool_call:t.toolCall}:{}},substituted:n}}function u(e,t){return e.ok?e.tool_result?{...e,tool_result:{...e.tool_result,text:a.redactMcpSecrets(e.tool_result.text,...t)}}:e:{...e,error:a.redactMcpSecrets(e.error,...t)}}function d(e,t,n){let r=u(e,n);if(r.ok&&t&&r.tool_result&&r.tools.includes(t.toolCall.name)){let e=t.interpret(r.tool_result);if(e)return{ok:!1,error:e,error_kind:`credentials`}}return r}function f(){if(t.getActiveBackend().backend.kind===`local`){let{host:e,apiKey:t}=n.getAgentServerClientOptions();return{host:e,...t?{apiKey:t}:{}}}let e=t.getRegisteredBackends().find(e=>e.kind===`local`&&e.host);if(e)return{host:e.host.replace(/\/+$/,``),...e.apiKey?{apiKey:e.apiKey}:{}};throw Error(`OAuth authorization requires a reachable local backend.`)}function p(){let{host:t,apiKey:n}=f();return new e.MCPClient({host:t,...n?{apiKey:n}:{},timeout:125e3})}function m(e){return e.status===`succeeded`?{ok:!0,tools:e.tools??[],...e.tool_result!==void 0&&{tool_result:e.tool_result},...e.oauth_state!==void 0&&{oauth_state:e.oauth_state}}:{ok:!1,error:e.error||`OAuth authorization did not complete`,error_kind:e.error_kind||`unknown`}}var h=e=>new Promise(t=>{window.setTimeout(t,e)}),g=class r{static async testServer(r){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let a=i.getCredentialValidationForServer(r),{host:o,apiKey:s}=n.getAgentServerClientOptions(),c=new e.MCPClient({host:o,...s?{apiKey:s}:{}});try{let{request:e,substituted:t}=await l(r);return d(await c.testServer(e),a,[t,r])}finally{c.close()}}static async startOAuth(e){let t=p();try{return await r.startOAuthWithClient(t,e)}finally{t.close()}}static async getOAuthStatus(e){let t=p();try{return await r.getOAuthStatusWithClient(t,e)}finally{t.close()}}static async submitOAuthCallback(e,t){let n=p();try{return await r.submitOAuthCallbackWithClient(n,e,t)}finally{n.close()}}static async authorizeOAuth(e){let t=i.getCredentialValidationForServer(e),n=n=>d(n,t,[e]),a=window.open(`about:blank`,`_blank`),s=p();try{let t=await r.startOAuthWithClient(s,e);if(!t.ok||!t.job_id||!t.authorization_url)return a?.close(),n({ok:!1,error:t.error||`Could not start OAuth authorization`,error_kind:t.error_kind||`unknown`});let i=await r.getOAuthStatusWithClient(s,t.job_id);for(let e=0;e<20;e+=1){if(i.status===`succeeded`||i.status===`failed`)return a?.close(),n(m(i));if(i.callback_ready)break;await h(250),i=await r.getOAuthStatusWithClient(s,t.job_id)}a&&(a.location.href=t.authorization_url);for(let e=0;e<o;e+=1)if(await h(1e3),i=await r.getOAuthStatusWithClient(s,t.job_id),i.status===`succeeded`||i.status===`failed`)return a?.close(),n(m(i));return{ok:!1,error:`OAuth authorization timed out`,error_kind:`timeout`}}finally{s.close()}}static async startOAuthWithClient(e,t){let{request:n}=await l(t);return e.startOAuth(n)}static async getOAuthStatusWithClient(e,t){return await e.getOAuthStatus(t)}static async submitOAuthCallbackWithClient(e,t,n){return await e.submitOAuthCallback(t,{callback_url:n})}};exports.default=g;
+require("../../_virtual/_rolldown/runtime.cjs");const e=require("../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs");require("../../node_modules/@openhands/typescript-client/dist/clients.cjs");const t=require("../backend-registry/active-store.cjs"),n=require("../agent-server-client-options.cjs"),r=require("../../utils/mcp-credential-validation.cjs"),i=require("../../utils/redact-mcp-secrets.cjs"),a=require("./mcp-redacted-credentials.cjs");var o=120;function s(e){return e.type===`stdio`?{type:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{type:e.type===`sse`?`sse`:`http`,url:e.url,...e.headers&&Object.keys(e.headers).length>0&&{headers:e.headers},...e.auth?{auth:e.auth}:{}}}function c(e){return e.auth?.strategy===`oauth2`?o:e.timeout}async function l(e){let t=r.getCredentialValidationForServer(e),n=await a.substituteRedactedMcpCredentials(e),i=s(n),o=c(e);return{request:{server:i,...e.name?{name:e.name}:{},...o===void 0?{}:{timeout:o},...t?{tool_call:t.toolCall}:{}},substituted:n}}function u(e,t){return e.ok?e.tool_result?{...e,tool_result:{...e.tool_result,text:i.redactMcpSecrets(e.tool_result.text,...t)}}:e:{...e,error:i.redactMcpSecrets(e.error,...t)}}function d(e,t,n){let r=u(e,n);if(r.ok&&t&&r.tool_result&&r.tools.includes(t.toolCall.name)){let e=t.interpret(r.tool_result);if(e)return{ok:!1,error:e,error_kind:`credentials`}}return r}function f(){if(t.getActiveBackend().backend.kind===`local`){let{host:e,apiKey:t}=n.getAgentServerClientOptions();return{host:e,...t?{apiKey:t}:{}}}let e=t.getRegisteredBackends().find(e=>e.kind===`local`&&e.host);if(e)return{host:e.host.replace(/\/+$/,``),...e.apiKey?{apiKey:e.apiKey}:{}};throw Error(`OAuth authorization requires a reachable local backend.`)}function p(){let{host:t,apiKey:n}=f();return new e.MCPClient({host:t,...n?{apiKey:n}:{},timeout:125e3})}function m(e){return e.status===`succeeded`?{ok:!0,tools:e.tools??[],...e.tool_result!==void 0&&{tool_result:e.tool_result},...e.oauth_state!==void 0&&{oauth_state:e.oauth_state}}:{ok:!1,error:e.error||`OAuth authorization did not complete`,error_kind:e.error_kind||`unknown`}}var h=e=>new Promise(t=>{window.setTimeout(t,e)}),g=class i{static async testServer(i){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let a=r.getCredentialValidationForServer(i),{host:o,apiKey:s}=n.getAgentServerClientOptions(),c=new e.MCPClient({host:o,...s?{apiKey:s}:{}});try{let{request:e,substituted:t}=await l(i);return d(await c.testServer(e),a,[t,i])}finally{c.close()}}static async startOAuth(e){let t=p();try{return await i.startOAuthWithClient(t,e)}finally{t.close()}}static async getOAuthStatus(e){let t=p();try{return await i.getOAuthStatusWithClient(t,e)}finally{t.close()}}static async submitOAuthCallback(e,t){let n=p();try{return await i.submitOAuthCallbackWithClient(n,e,t)}finally{n.close()}}static async authorizeOAuth(e){let t=r.getCredentialValidationForServer(e),n=n=>d(n,t,[e]),a=window.open(`about:blank`,`_blank`),s=p();try{let t=await i.startOAuthWithClient(s,e);if(!t.ok||!t.job_id||!t.authorization_url)return a?.close(),n({ok:!1,error:t.error||`Could not start OAuth authorization`,error_kind:t.error_kind||`unknown`});let r=await i.getOAuthStatusWithClient(s,t.job_id);for(let e=0;e<20;e+=1){if(r.status===`succeeded`||r.status===`failed`)return a?.close(),n(m(r));if(r.callback_ready)break;await h(250),r=await i.getOAuthStatusWithClient(s,t.job_id)}a&&(a.location.href=t.authorization_url);for(let e=0;e<o;e+=1)if(await h(1e3),r=await i.getOAuthStatusWithClient(s,t.job_id),r.status===`succeeded`||r.status===`failed`)return a?.close(),n(m(r));return{ok:!1,error:`OAuth authorization timed out`,error_kind:`timeout`}}finally{s.close()}}static async startOAuthWithClient(e,t){let{request:n}=await l(t);return e.startOAuth(n)}static async getOAuthStatusWithClient(e,t){return await e.getOAuthStatus(t)}static async submitOAuthCallbackWithClient(e,t,n){return await e.submitOAuthCallback(t,{callback_url:n})}};exports.default=g;
 //# sourceMappingURL=mcp-service.api.cjs.map

package/dist/api/mcp-service/mcp-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { MCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n  getCredentialValidationForServer,\n  type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type { MCPAuthCredential } from \"#/types/mcp-auth\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\ntype MCPTestServer = {\n  transport?: \"stdio\" | \"http\" | \"sse\";\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  auth?: MCPAuthCredential;\n};\n\ninterface ExtendedMCPTestRequest {\n  server: MCPTestServer;\n  name?: string;\n  timeout?: number;\n  tool_call?: {\n    name: string;\n    arguments: Record<string, unknown>;\n  };\n}\n\nfunction toMcpServer(server: MCPServerConfig): MCPTestServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n  request: ExtendedMCPTestRequest;\n  substituted: MCPServerConfig;\n}> {\n  const validation = getCredentialValidationForServer(server);\n  const substituted = await substituteRedactedMcpCredentials(server);\n  const serverSpec = toMcpServer(substituted);\n  const timeout = getMcpTestTimeout(server);\n  return {\n    request: {\n      server: serverSpec,\n      ...(server.name ? { name: server.name } : {}),\n      ...(timeout !== undefined ? { timeout } : {}),\n      ...(validation ? { tool_call: validation.toolCall } : {}),\n    },\n    substituted,\n  };\n}\n\nfunction redactMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  if (!result.ok) {\n    return {\n      ...result,\n      error: redactMcpSecrets(result.error, ...redactionSources),\n    };\n  }\n  if (result.tool_result) {\n    return {\n      ...result,\n      tool_result: {\n        ...result.tool_result,\n        text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n      },\n    };\n  }\n  return result;\n}\n\n/**\n * Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n */\nfunction finalizeMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  validation: CredentialValidation | undefined,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  const redacted = redactMcpTestResponse(result, redactionSources);\n  if (\n    redacted.ok &&\n    validation &&\n    redacted.tool_result &&\n    redacted.tools.includes(validation.toolCall.name)\n  ) {\n    const credentialError = validation.interpret(redacted.tool_result);\n    if (credentialError) {\n      return {\n        ok: false,\n        error: credentialError,\n        error_kind: \"credentials\",\n      };\n    }\n  }\n  return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const { request, substituted } = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      // Redact against both config forms: `server` may hold fresh plaintext\n      // input, `substituted` the stored (encrypted) round-trip values.\n      return finalizeMcpTestResponse(result, validation, [substituted, server]);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const validation = getCredentialValidationForServer(server);\n    const finalize = (result: ExtendedMCPTestResponse) =>\n      finalizeMcpTestResponse(result, validation, [server]);\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return finalize({\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        });\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const { request } = await buildMcpTestRequest(server);\n    return client.startOAuth(request as MCPTestRequest);\n  }\n\n  // typescript-client 1.36 types the OAuth probes with the generated\n  // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n  // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n  // wire shape is unchanged, so narrow back to the app's boundary type.\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.submitOAuthCallback(jobId, {\n      callback_url: callbackUrl,\n    })) as MCPOAuthStatusResponse;\n  }\n}\n\nexport default McpService;\n"],"mappings":"qdAqBA,IAAM,EAAiC,IAsBvC,SAAS,EAAY,EAAwC,CAU3D,OATI,EAAO,OAAS,QACX,CACL,UAAW,QACX,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,IAAK,EAC/C,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,GAAG,EAAE,OAAS,GAAK,CAAE,IAAK,EAAO,GAAI,CAC5D,EAEK,CACL,UAAW,EAAO,OAAS,MAAQ,MAAQ,OAC3C,IAAK,EAAO,IACZ,GAAI,EAAO,SACT,OAAO,KAAK,EAAO,OAAO,EAAE,OAAS,GAAK,CAAE,QAAS,EAAO,OAAQ,EACtE,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,CAC7C,CACF,CAEA,SAAS,EAAkB,EAA6C,CAEtE,OADI,EAAO,MAAM,WAAa,SACvB,EADwC,EAAO,OAExD,CAEA,eAAe,EAAoB,EAGhC,CACD,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAc,MAAM,EAAA,iCAAiC,CAAM,EAC3D,EAAa,EAAY,CAAW,EACpC,EAAU,EAAkB,CAAM,EACxC,MAAO,CACL,QAAS,CACP,OAAQ,EACR,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EAC3C,GAAI,IAAY,IAAA,GAA0B,CAAC,EAAf,CAAE,SAAQ,EACtC,GAAI,EAAa,CAAE,UAAW,EAAW,QAAS,EAAI,CAAC,CACzD,EACA,aACF,CACF,CAEA,SAAS,EACP,EACA,EACyB,CAgBzB,OAfK,EAAO,GAMR,EAAO,YACF,CACL,GAAG,EACH,YAAa,CACX,GAAG,EAAO,YACV,KAAM,EAAA,iBAAiB,EAAO,YAAY,KAAM,GAAG,CAAgB,CACrE,CACF,EAEK,EAdE,CACL,GAAG,EACH,MAAO,EAAA,iBAAiB,EAAO,MAAO,GAAG,CAAgB,CAC3D,CAYJ,CAYA,SAAS,EACP,EACA,EACA,EACyB,CACzB,IAAM,EAAW,EAAsB,EAAQ,CAAgB,EAC/D,GACE,EAAS,IACT,GACA,EAAS,aACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,EAChD,CACA,IAAM,EAAkB,EAAW,UAAU,EAAS,WAAW,EACjE,GAAI,EACF,MAAO,CACL,GAAI,GACJ,MAAO,EACP,WAAY,aACd,CAEJ,CACA,OAAO,CACT,CAEA,SAAS,GAAwD,CAE/D,GADe,EAAA,iBAAiB,EAAE,QACvB,OAAS,QAAS,CAC3B,GAAM,CAAE,OAAM,UAAW,EAAA,4BAA4B,EACrD,MAAO,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAC/C,CAEA,IAAM,EAAe,EAAA,sBAAsB,EAAE,KAC1C,GAAY,EAAQ,OAAS,SAAW,EAAQ,IACnD,EACA,GAAI,EACF,MAAO,CACL,KAAM,EAAa,KAAK,QAAQ,OAAQ,EAAE,EAC1C,GAAI,EAAa,OAAS,CAAE,OAAQ,EAAa,MAAO,EAAI,CAAC,CAC/D,EAEF,MAAU,MAAM,yDAAyD,CAC3E,CAEA,SAAS,GAAkC,CACzC,GAAM,CAAE,OAAM,UAAW,EAAmB,EAC5C,OAAO,IAAI,EAAA,UAAU,CACnB,OACA,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,EAC3B,QAAS,KACX,CAAC,CACH,CAEA,SAAS,EACP,EACyB,CAazB,OAZI,EAAO,SAAW,YACb,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,CAAC,EACxB,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,EACA,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,CACF,EAEK,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,uCACvB,WAAY,EAAO,YAAc,SACnC,CACF,CAEA,IAAM,EAAS,GACb,IAAI,QAAe,GAAY,CAC7B,OAAO,WAAW,EAAS,CAAE,CAC/B,CAAC,EAEG,EAAN,MAAM,CAAW,CACf,aAAa,WACX,EACkC,CAWlC,GAAI,EAAA,iBAAiB,EAAE,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,CAAC,CAAE,EAE/B,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,CAAE,OAAM,UAAW,EAAA,4BAA4B,EAC/C,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAAC,EACpE,GAAI,CACF,GAAM,CAAE,UAAS,eAAgB,MAAM,EAAoB,CAAM,EAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,EAGuC,EAAY,CAAC,EAAa,CAAM,CAAC,CAC1E,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,WACX,EACgC,CAChC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,qBAAqB,EAAQ,CAAM,CAC7D,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eAAe,EAAgD,CAC1E,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,yBAAyB,EAAQ,CAAK,CAChE,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,oBACX,EACA,EACiC,CACjC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,8BACtB,EACA,EACA,CACF,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eACX,EACkC,CAClC,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAY,GAChB,EAAwB,EAAQ,EAAY,CAAC,CAAM,CAAC,EAChD,EAAQ,OAAO,KAAK,cAAe,QAAQ,EAC3C,EAAS,EAAqB,EACpC,GAAI,CACF,IAAM,EAAQ,MAAM,EAAW,qBAAqB,EAAQ,CAAM,EAClE,GAAI,CAAC,EAAM,IAAM,CAAC,EAAM,QAAU,CAAC,EAAM,kBAEvC,OADA,GAAO,MAAM,EACN,EAAS,CACd,GAAI,GACJ,MAAO,EAAM,OAAS,sCACtB,WAAY,EAAM,YAAc,SAClC,CAAC,EAGH,IAAI,EAAS,MAAM,EAAW,yBAC5B,EACA,EAAM,MACR,EACA,IAAK,IAAI,EAAU,EAAG,EAAU,GAAI,GAAW,EAAG,CAChD,GAAI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAEnD,GAAI,EAAO,eAAgB,MAC3B,MAAM,EAAM,GAAG,EACf,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,CACF,CAEI,IACF,EAAM,SAAS,KAAO,EAAM,mBAG9B,IACE,IAAI,EAAU,EACd,EAAU,EACV,GAAW,EAOX,GALA,MAAM,EAAM,GAAI,EAChB,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,EACI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAIrD,MAAO,CACL,GAAI,GACJ,MAAO,gCACP,WAAY,SACd,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAqB,qBACnB,EACA,EACgC,CAChC,GAAM,CAAE,WAAY,MAAM,EAAoB,CAAM,EACpD,OAAO,EAAO,WAAW,CAAyB,CACpD,CAMA,aAAqB,yBACnB,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,eAAe,CAAK,CAC3C,CAEA,aAAqB,8BACnB,EACA,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,oBAAoB,EAAO,CAC9C,aAAc,CAChB,CAAC,CACH,CACF"}
+{"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { AgentServerMCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n  getCredentialValidationForServer,\n  type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\nfunction toMcpServer(\n  server: MCPServerConfig,\n): AgentServerMCPTestRequest[\"server\"] {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n  request: AgentServerMCPTestRequest;\n  substituted: MCPServerConfig;\n}> {\n  const validation = getCredentialValidationForServer(server);\n  const substituted = await substituteRedactedMcpCredentials(server);\n  const serverSpec = toMcpServer(substituted);\n  const timeout = getMcpTestTimeout(server);\n  return {\n    request: {\n      server: serverSpec,\n      ...(server.name ? { name: server.name } : {}),\n      ...(timeout !== undefined ? { timeout } : {}),\n      ...(validation ? { tool_call: validation.toolCall } : {}),\n    },\n    substituted,\n  };\n}\n\nfunction redactMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  if (!result.ok) {\n    return {\n      ...result,\n      error: redactMcpSecrets(result.error, ...redactionSources),\n    };\n  }\n  if (result.tool_result) {\n    return {\n      ...result,\n      tool_result: {\n        ...result.tool_result,\n        text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n      },\n    };\n  }\n  return result;\n}\n\n/**\n * Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n */\nfunction finalizeMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  validation: CredentialValidation | undefined,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  const redacted = redactMcpTestResponse(result, redactionSources);\n  if (\n    redacted.ok &&\n    validation &&\n    redacted.tool_result &&\n    redacted.tools.includes(validation.toolCall.name)\n  ) {\n    const credentialError = validation.interpret(redacted.tool_result);\n    if (credentialError) {\n      return {\n        ok: false,\n        error: credentialError,\n        error_kind: \"credentials\",\n      };\n    }\n  }\n  return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const { request, substituted } = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request,\n      )) as ExtendedMCPTestResponse;\n      // Redact against both config forms: `server` may hold fresh plaintext\n      // input, `substituted` the stored (encrypted) round-trip values.\n      return finalizeMcpTestResponse(result, validation, [substituted, server]);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const validation = getCredentialValidationForServer(server);\n    const finalize = (result: ExtendedMCPTestResponse) =>\n      finalizeMcpTestResponse(result, validation, [server]);\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return finalize({\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        });\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const { request } = await buildMcpTestRequest(server);\n    return client.startOAuth(request);\n  }\n\n  // typescript-client 1.36 types the OAuth probes with the generated\n  // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n  // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n  // wire shape is unchanged, so narrow back to the app's boundary type.\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.submitOAuthCallback(jobId, {\n      callback_url: callbackUrl,\n    })) as MCPOAuthStatusResponse;\n  }\n}\n\nexport default McpService;\n"],"mappings":"qdAoBA,IAAM,EAAiC,IAEvC,SAAS,EACP,EACqC,CAUrC,OATI,EAAO,OAAS,QACX,CACL,KAAM,QACN,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,IAAK,EAC/C,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,GAAG,EAAE,OAAS,GAAK,CAAE,IAAK,EAAO,GAAI,CAC5D,EAEK,CACL,KAAM,EAAO,OAAS,MAAQ,MAAQ,OACtC,IAAK,EAAO,IACZ,GAAI,EAAO,SACT,OAAO,KAAK,EAAO,OAAO,EAAE,OAAS,GAAK,CAAE,QAAS,EAAO,OAAQ,EACtE,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,CAC7C,CACF,CAEA,SAAS,EAAkB,EAA6C,CAEtE,OADI,EAAO,MAAM,WAAa,SACvB,EADwC,EAAO,OAExD,CAEA,eAAe,EAAoB,EAGhC,CACD,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAc,MAAM,EAAA,iCAAiC,CAAM,EAC3D,EAAa,EAAY,CAAW,EACpC,EAAU,EAAkB,CAAM,EACxC,MAAO,CACL,QAAS,CACP,OAAQ,EACR,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,EAC3C,GAAI,IAAY,IAAA,GAA0B,CAAC,EAAf,CAAE,SAAQ,EACtC,GAAI,EAAa,CAAE,UAAW,EAAW,QAAS,EAAI,CAAC,CACzD,EACA,aACF,CACF,CAEA,SAAS,EACP,EACA,EACyB,CAgBzB,OAfK,EAAO,GAMR,EAAO,YACF,CACL,GAAG,EACH,YAAa,CACX,GAAG,EAAO,YACV,KAAM,EAAA,iBAAiB,EAAO,YAAY,KAAM,GAAG,CAAgB,CACrE,CACF,EAEK,EAdE,CACL,GAAG,EACH,MAAO,EAAA,iBAAiB,EAAO,MAAO,GAAG,CAAgB,CAC3D,CAYJ,CAYA,SAAS,EACP,EACA,EACA,EACyB,CACzB,IAAM,EAAW,EAAsB,EAAQ,CAAgB,EAC/D,GACE,EAAS,IACT,GACA,EAAS,aACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,EAChD,CACA,IAAM,EAAkB,EAAW,UAAU,EAAS,WAAW,EACjE,GAAI,EACF,MAAO,CACL,GAAI,GACJ,MAAO,EACP,WAAY,aACd,CAEJ,CACA,OAAO,CACT,CAEA,SAAS,GAAwD,CAE/D,GADe,EAAA,iBAAiB,EAAE,QACvB,OAAS,QAAS,CAC3B,GAAM,CAAE,OAAM,UAAW,EAAA,4BAA4B,EACrD,MAAO,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAC/C,CAEA,IAAM,EAAe,EAAA,sBAAsB,EAAE,KAC1C,GAAY,EAAQ,OAAS,SAAW,EAAQ,IACnD,EACA,GAAI,EACF,MAAO,CACL,KAAM,EAAa,KAAK,QAAQ,OAAQ,EAAE,EAC1C,GAAI,EAAa,OAAS,CAAE,OAAQ,EAAa,MAAO,EAAI,CAAC,CAC/D,EAEF,MAAU,MAAM,yDAAyD,CAC3E,CAEA,SAAS,GAAkC,CACzC,GAAM,CAAE,OAAM,UAAW,EAAmB,EAC5C,OAAO,IAAI,EAAA,UAAU,CACnB,OACA,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,EAC3B,QAAS,KACX,CAAC,CACH,CAEA,SAAS,EACP,EACyB,CAazB,OAZI,EAAO,SAAW,YACb,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,CAAC,EACxB,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,EACA,GAAI,EAAO,cAAgB,IAAA,IAAa,CACtC,YAAa,EAAO,WACtB,CACF,EAEK,CACL,GAAI,GACJ,MAAO,EAAO,OAAS,uCACvB,WAAY,EAAO,YAAc,SACnC,CACF,CAEA,IAAM,EAAS,GACb,IAAI,QAAe,GAAY,CAC7B,OAAO,WAAW,EAAS,CAAE,CAC/B,CAAC,EAEG,EAAN,MAAM,CAAW,CACf,aAAa,WACX,EACkC,CAWlC,GAAI,EAAA,iBAAiB,EAAE,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,CAAC,CAAE,EAE/B,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,CAAE,OAAM,UAAW,EAAA,4BAA4B,EAC/C,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,QAAO,EAAI,CAAC,CAAG,CAAC,EACpE,GAAI,CACF,GAAM,CAAE,UAAS,eAAgB,MAAM,EAAoB,CAAM,EAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,EAGuC,EAAY,CAAC,EAAa,CAAM,CAAC,CAC1E,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,WACX,EACgC,CAChC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,qBAAqB,EAAQ,CAAM,CAC7D,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eAAe,EAAgD,CAC1E,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,yBAAyB,EAAQ,CAAK,CAChE,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,oBACX,EACA,EACiC,CACjC,IAAM,EAAS,EAAqB,EACpC,GAAI,CACF,OAAO,MAAM,EAAW,8BACtB,EACA,EACA,CACF,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAa,eACX,EACkC,CAClC,IAAM,EAAa,EAAA,iCAAiC,CAAM,EACpD,EAAY,GAChB,EAAwB,EAAQ,EAAY,CAAC,CAAM,CAAC,EAChD,EAAQ,OAAO,KAAK,cAAe,QAAQ,EAC3C,EAAS,EAAqB,EACpC,GAAI,CACF,IAAM,EAAQ,MAAM,EAAW,qBAAqB,EAAQ,CAAM,EAClE,GAAI,CAAC,EAAM,IAAM,CAAC,EAAM,QAAU,CAAC,EAAM,kBAEvC,OADA,GAAO,MAAM,EACN,EAAS,CACd,GAAI,GACJ,MAAO,EAAM,OAAS,sCACtB,WAAY,EAAM,YAAc,SAClC,CAAC,EAGH,IAAI,EAAS,MAAM,EAAW,yBAC5B,EACA,EAAM,MACR,EACA,IAAK,IAAI,EAAU,EAAG,EAAU,GAAI,GAAW,EAAG,CAChD,GAAI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAEnD,GAAI,EAAO,eAAgB,MAC3B,MAAM,EAAM,GAAG,EACf,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,CACF,CAEI,IACF,EAAM,SAAS,KAAO,EAAM,mBAG9B,IACE,IAAI,EAAU,EACd,EAAU,EACV,GAAW,EAOX,GALA,MAAM,EAAM,GAAI,EAChB,EAAS,MAAM,EAAW,yBACxB,EACA,EAAM,MACR,EACI,EAAO,SAAW,aAAe,EAAO,SAAW,SAErD,OADA,GAAO,MAAM,EACN,EAAS,EAA0B,CAAM,CAAC,EAIrD,MAAO,CACL,GAAI,GACJ,MAAO,gCACP,WAAY,SACd,CACF,QAAU,CACR,EAAO,MAAM,CACf,CACF,CAEA,aAAqB,qBACnB,EACA,EACgC,CAChC,GAAM,CAAE,WAAY,MAAM,EAAoB,CAAM,EACpD,OAAO,EAAO,WAAW,CAAO,CAClC,CAMA,aAAqB,yBACnB,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,eAAe,CAAK,CAC3C,CAEA,aAAqB,8BACnB,EACA,EACA,EACiC,CACjC,OAAQ,MAAM,EAAO,oBAAoB,EAAO,CAC9C,aAAc,CAChB,CAAC,CACH,CACF"}

package/dist/api/mcp-service/mcp-service.api.js

@@ -2,19 +2,19 @@ import { MCPClient as e } from "../../node_modules/@openhands/typescript-client/
 import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { getActiveBackend as t, getRegisteredBackends as n } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as r } from "../agent-server-client-options.js";
-import { substituteRedactedMcpCredentials as i } from "./mcp-redacted-credentials.js";
-import { getCredentialValidationForServer as a } from "../../utils/mcp-credential-validation.js";
-import { redactMcpSecrets as o } from "../../utils/redact-mcp-secrets.js";
+import { getCredentialValidationForServer as i } from "../../utils/mcp-credential-validation.js";
+import { redactMcpSecrets as a } from "../../utils/redact-mcp-secrets.js";
+import { substituteRedactedMcpCredentials as o } from "./mcp-redacted-credentials.js";
 //#region src/api/mcp-service/mcp-service.api.ts
 var s = 120;
 function c(e) {
 	return e.type === "stdio" ? {
-		transport: "stdio",
+		type: "stdio",
 		command: e.command,
 		...e.args?.length && { args: e.args },
 		...e.env && Object.keys(e.env).length > 0 && { env: e.env }
 	} : {
-		transport: e.type === "sse" ? "sse" : "http",
+		type: e.type === "sse" ? "sse" : "http",
 		url: e.url,
 		...e.headers && Object.keys(e.headers).length > 0 && { headers: e.headers },
 		...e.auth ? { auth: e.auth } : {}
@@ -24,12 +24,12 @@ function l(e) {
 	return e.auth?.strategy === "oauth2" ? s : e.timeout;
 }
 async function u(e) {
-	let t = a(e), n = await i(e), r = c(n), o = l(e);
+	let t = i(e), n = await o(e), r = c(n), a = l(e);
 	return {
 		request: {
 			server: r,
 			...e.name ? { name: e.name } : {},
-			...o === void 0 ? {} : { timeout: o },
+			...a === void 0 ? {} : { timeout: a },
 			...t ? { tool_call: t.toolCall } : {}
 		},
 		substituted: n
@@ -40,11 +40,11 @@ function d(e, t) {
 		...e,
 		tool_result: {
 			...e.tool_result,
-			text: o(e.tool_result.text, ...t)
+			text: a(e.tool_result.text, ...t)
 		}
 	} : e : {
 		...e,
-		error: o(e.error, ...t)
+		error: a(e.error, ...t)
 	};
 }
 function f(e, t, n) {
@@ -102,13 +102,13 @@ var g = (e) => new Promise((t) => {
 			ok: !0,
 			tools: []
 		};
-		let i = a(n), { host: o, apiKey: s } = r(), c = new e({
+		let a = i(n), { host: o, apiKey: s } = r(), c = new e({
 			host: o,
 			...s ? { apiKey: s } : {}
 		});
 		try {
 			let { request: e, substituted: t } = await u(n);
-			return f(await c.testServer(e), i, [t, n]);
+			return f(await c.testServer(e), a, [t, n]);
 		} finally {
 			c.close();
 		}
@@ -138,22 +138,22 @@ var g = (e) => new Promise((t) => {
 		}
 	}
 	static async authorizeOAuth(e) {
-		let t = a(e), r = (n) => f(n, t, [e]), i = window.open("about:blank", "_blank"), o = m();
+		let t = i(e), r = (n) => f(n, t, [e]), a = window.open("about:blank", "_blank"), o = m();
 		try {
 			let t = await n.startOAuthWithClient(o, e);
-			if (!t.ok || !t.job_id || !t.authorization_url) return i?.close(), r({
+			if (!t.ok || !t.job_id || !t.authorization_url) return a?.close(), r({
 				ok: !1,
 				error: t.error || "Could not start OAuth authorization",
 				error_kind: t.error_kind || "unknown"
 			});
-			let a = await n.getOAuthStatusWithClient(o, t.job_id);
+			let i = await n.getOAuthStatusWithClient(o, t.job_id);
 			for (let e = 0; e < 20; e += 1) {
-				if (a.status === "succeeded" || a.status === "failed") return i?.close(), r(h(a));
-				if (a.callback_ready) break;
-				await g(250), a = await n.getOAuthStatusWithClient(o, t.job_id);
+				if (i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
+				if (i.callback_ready) break;
+				await g(250), i = await n.getOAuthStatusWithClient(o, t.job_id);
 			}
-			i && (i.location.href = t.authorization_url);
-			for (let e = 0; e < s; e += 1) if (await g(1e3), a = await n.getOAuthStatusWithClient(o, t.job_id), a.status === "succeeded" || a.status === "failed") return i?.close(), r(h(a));
+			a && (a.location.href = t.authorization_url);
+			for (let e = 0; e < s; e += 1) if (await g(1e3), i = await n.getOAuthStatusWithClient(o, t.job_id), i.status === "succeeded" || i.status === "failed") return a?.close(), r(h(i));
 			return {
 				ok: !1,
 				error: "OAuth authorization timed out",

package/dist/api/mcp-service/mcp-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { MCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n  getCredentialValidationForServer,\n  type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type { MCPAuthCredential } from \"#/types/mcp-auth\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\ntype MCPTestServer = {\n  transport?: \"stdio\" | \"http\" | \"sse\";\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  auth?: MCPAuthCredential;\n};\n\ninterface ExtendedMCPTestRequest {\n  server: MCPTestServer;\n  name?: string;\n  timeout?: number;\n  tool_call?: {\n    name: string;\n    arguments: Record<string, unknown>;\n  };\n}\n\nfunction toMcpServer(server: MCPServerConfig): MCPTestServer {\n  if (server.type === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    transport: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n  request: ExtendedMCPTestRequest;\n  substituted: MCPServerConfig;\n}> {\n  const validation = getCredentialValidationForServer(server);\n  const substituted = await substituteRedactedMcpCredentials(server);\n  const serverSpec = toMcpServer(substituted);\n  const timeout = getMcpTestTimeout(server);\n  return {\n    request: {\n      server: serverSpec,\n      ...(server.name ? { name: server.name } : {}),\n      ...(timeout !== undefined ? { timeout } : {}),\n      ...(validation ? { tool_call: validation.toolCall } : {}),\n    },\n    substituted,\n  };\n}\n\nfunction redactMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  if (!result.ok) {\n    return {\n      ...result,\n      error: redactMcpSecrets(result.error, ...redactionSources),\n    };\n  }\n  if (result.tool_result) {\n    return {\n      ...result,\n      tool_result: {\n        ...result.tool_result,\n        text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n      },\n    };\n  }\n  return result;\n}\n\n/**\n * Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n */\nfunction finalizeMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  validation: CredentialValidation | undefined,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  const redacted = redactMcpTestResponse(result, redactionSources);\n  if (\n    redacted.ok &&\n    validation &&\n    redacted.tool_result &&\n    redacted.tools.includes(validation.toolCall.name)\n  ) {\n    const credentialError = validation.interpret(redacted.tool_result);\n    if (credentialError) {\n      return {\n        ok: false,\n        error: credentialError,\n        error_kind: \"credentials\",\n      };\n    }\n  }\n  return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const { request, substituted } = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      // Redact against both config forms: `server` may hold fresh plaintext\n      // input, `substituted` the stored (encrypted) round-trip values.\n      return finalizeMcpTestResponse(result, validation, [substituted, server]);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const validation = getCredentialValidationForServer(server);\n    const finalize = (result: ExtendedMCPTestResponse) =>\n      finalizeMcpTestResponse(result, validation, [server]);\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return finalize({\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        });\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const { request } = await buildMcpTestRequest(server);\n    return client.startOAuth(request as MCPTestRequest);\n  }\n\n  // typescript-client 1.36 types the OAuth probes with the generated\n  // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n  // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n  // wire shape is unchanged, so narrow back to the app's boundary type.\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.submitOAuthCallback(jobId, {\n      callback_url: callbackUrl,\n    })) as MCPOAuthStatusResponse;\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;;;;;AAqBA,IAAM,IAAiC;AAsBvC,SAAS,EAAY,GAAwC;CAU3D,OATI,EAAO,SAAS,UACX;EACL,WAAW;EACX,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,KAAK;EAC/C,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,GAAG,EAAE,SAAS,KAAK,EAAE,KAAK,EAAO,IAAI;CAC5D,IAEK;EACL,WAAW,EAAO,SAAS,QAAQ,QAAQ;EAC3C,KAAK,EAAO;EACZ,GAAI,EAAO,WACT,OAAO,KAAK,EAAO,OAAO,EAAE,SAAS,KAAK,EAAE,SAAS,EAAO,QAAQ;EACtE,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;CAC7C;AACF;AAEA,SAAS,EAAkB,GAA6C;CAEtE,OADI,EAAO,MAAM,aAAa,WACvB,IADwC,EAAO;AAExD;AAEA,eAAe,EAAoB,GAGhC;CACD,IAAM,IAAa,EAAiC,CAAM,GACpD,IAAc,MAAM,EAAiC,CAAM,GAC3D,IAAa,EAAY,CAAW,GACpC,IAAU,EAAkB,CAAM;CACxC,OAAO;EACL,SAAS;GACP,QAAQ;GACR,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;GAC3C,GAAI,MAAY,KAAA,IAA0B,CAAC,IAAf,EAAE,WAAQ;GACtC,GAAI,IAAa,EAAE,WAAW,EAAW,SAAS,IAAI,CAAC;EACzD;EACA;CACF;AACF;AAEA,SAAS,EACP,GACA,GACyB;CAgBzB,OAfK,EAAO,KAMR,EAAO,cACF;EACL,GAAG;EACH,aAAa;GACX,GAAG,EAAO;GACV,MAAM,EAAiB,EAAO,YAAY,MAAM,GAAG,CAAgB;EACrE;CACF,IAEK,IAdE;EACL,GAAG;EACH,OAAO,EAAiB,EAAO,OAAO,GAAG,CAAgB;CAC3D;AAYJ;AAYA,SAAS,EACP,GACA,GACA,GACyB;CACzB,IAAM,IAAW,EAAsB,GAAQ,CAAgB;CAC/D,IACE,EAAS,MACT,KACA,EAAS,eACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,GAChD;EACA,IAAM,IAAkB,EAAW,UAAU,EAAS,WAAW;EACjE,IAAI,GACF,OAAO;GACL,IAAI;GACJ,OAAO;GACP,YAAY;EACd;CAEJ;CACA,OAAO;AACT;AAEA,SAAS,IAAwD;CAE/D,IADe,EAAiB,EAAE,QACvB,SAAS,SAAS;EAC3B,IAAM,EAAE,SAAM,cAAW,EAA4B;EACrD,OAAO;GAAE;GAAM,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAAG;CAC/C;CAEA,IAAM,IAAe,EAAsB,EAAE,MAC1C,MAAY,EAAQ,SAAS,WAAW,EAAQ,IACnD;CACA,IAAI,GACF,OAAO;EACL,MAAM,EAAa,KAAK,QAAQ,QAAQ,EAAE;EAC1C,GAAI,EAAa,SAAS,EAAE,QAAQ,EAAa,OAAO,IAAI,CAAC;CAC/D;CAEF,MAAU,MAAM,yDAAyD;AAC3E;AAEA,SAAS,IAAkC;CACzC,IAAM,EAAE,SAAM,cAAW,EAAmB;CAC5C,OAAO,IAAI,EAAU;EACnB;EACA,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAC3B,SAAS;CACX,CAAC;AACH;AAEA,SAAS,EACP,GACyB;CAazB,OAZI,EAAO,WAAW,cACb;EACL,IAAI;EACJ,OAAO,EAAO,SAAS,CAAC;EACxB,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,YACtB;EACA,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,YACtB;CACF,IAEK;EACL,IAAI;EACJ,OAAO,EAAO,SAAS;EACvB,YAAY,EAAO,cAAc;CACnC;AACF;AAEA,IAAM,KAAS,MACb,IAAI,SAAe,MAAY;CAC7B,OAAO,WAAW,GAAS,CAAE;AAC/B,CAAC,GAEG,IAAN,MAAM,EAAW;CACf,aAAa,WACX,GACkC;EAWlC,IAAI,EAAiB,EAAE,QAAQ,SAAS,SACtC,OAAO;GAAE,IAAI;GAAM,OAAO,CAAC;EAAE;EAE/B,IAAM,IAAa,EAAiC,CAAM,GACpD,EAAE,SAAM,cAAW,EAA4B,GAC/C,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAAG,CAAC;EACpE,IAAI;GACF,IAAM,EAAE,YAAS,mBAAgB,MAAM,EAAoB,CAAM;GAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,GAGuC,GAAY,CAAC,GAAa,CAAM,CAAC;EAC1E,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,WACX,GACgC;EAChC,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,qBAAqB,GAAQ,CAAM;EAC7D,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,eAAe,GAAgD;EAC1E,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,yBAAyB,GAAQ,CAAK;EAChE,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,oBACX,GACA,GACiC;EACjC,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,8BACtB,GACA,GACA,CACF;EACF,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,eACX,GACkC;EAClC,IAAM,IAAa,EAAiC,CAAM,GACpD,KAAY,MAChB,EAAwB,GAAQ,GAAY,CAAC,CAAM,CAAC,GAChD,IAAQ,OAAO,KAAK,eAAe,QAAQ,GAC3C,IAAS,EAAqB;EACpC,IAAI;GACF,IAAM,IAAQ,MAAM,EAAW,qBAAqB,GAAQ,CAAM;GAClE,IAAI,CAAC,EAAM,MAAM,CAAC,EAAM,UAAU,CAAC,EAAM,mBAEvC,OADA,GAAO,MAAM,GACN,EAAS;IACd,IAAI;IACJ,OAAO,EAAM,SAAS;IACtB,YAAY,EAAM,cAAc;GAClC,CAAC;GAGH,IAAI,IAAS,MAAM,EAAW,yBAC5B,GACA,EAAM,MACR;GACA,KAAK,IAAI,IAAU,GAAG,IAAU,IAAI,KAAW,GAAG;IAChD,IAAI,EAAO,WAAW,eAAe,EAAO,WAAW,UAErD,OADA,GAAO,MAAM,GACN,EAAS,EAA0B,CAAM,CAAC;IAEnD,IAAI,EAAO,gBAAgB;IAE3B,AADA,MAAM,EAAM,GAAG,GACf,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,MACR;GACF;GAEA,AAAI,MACF,EAAM,SAAS,OAAO,EAAM;GAG9B,KACE,IAAI,IAAU,GACd,IAAU,GACV,KAAW,GAOX,IALA,MAAM,EAAM,GAAI,GAChB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,MACR,GACI,EAAO,WAAW,eAAe,EAAO,WAAW,UAErD,OADA,GAAO,MAAM,GACN,EAAS,EAA0B,CAAM,CAAC;GAIrD,OAAO;IACL,IAAI;IACJ,OAAO;IACP,YAAY;GACd;EACF,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAqB,qBACnB,GACA,GACgC;EAChC,IAAM,EAAE,eAAY,MAAM,EAAoB,CAAM;EACpD,OAAO,EAAO,WAAW,CAAyB;CACpD;CAMA,aAAqB,yBACnB,GACA,GACiC;EACjC,OAAQ,MAAM,EAAO,eAAe,CAAK;CAC3C;CAEA,aAAqB,8BACnB,GACA,GACA,GACiC;EACjC,OAAQ,MAAM,EAAO,oBAAoB,GAAO,EAC9C,cAAc,EAChB,CAAC;CACH;AACF"}
+{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type { AgentServerMCPTestRequest } from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport {\n  getActiveBackend,\n  getRegisteredBackends,\n} from \"../backend-registry/active-store\";\nimport {\n  getCredentialValidationForServer,\n  type CredentialValidation,\n} from \"#/utils/mcp-credential-validation\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPOAuthStartResponse,\n  MCPOAuthStatusResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\nimport { redactMcpSecrets } from \"#/utils/redact-mcp-secrets\";\nimport { substituteRedactedMcpCredentials } from \"./mcp-redacted-credentials\";\n\nconst OAUTH_MCP_TEST_TIMEOUT_SECONDS = 120;\n\nfunction toMcpServer(\n  server: MCPServerConfig,\n): AgentServerMCPTestRequest[\"server\"] {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type === \"sse\" ? \"sse\" : \"http\",\n    url: server.url!,\n    ...(server.headers &&\n      Object.keys(server.headers).length > 0 && { headers: server.headers }),\n    ...(server.auth ? { auth: server.auth } : {}),\n  };\n}\n\nfunction getMcpTestTimeout(server: MCPServerConfig): number | undefined {\n  if (server.auth?.strategy !== \"oauth2\") return server.timeout;\n  return OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n}\n\nasync function buildMcpTestRequest(server: MCPServerConfig): Promise<{\n  request: AgentServerMCPTestRequest;\n  substituted: MCPServerConfig;\n}> {\n  const validation = getCredentialValidationForServer(server);\n  const substituted = await substituteRedactedMcpCredentials(server);\n  const serverSpec = toMcpServer(substituted);\n  const timeout = getMcpTestTimeout(server);\n  return {\n    request: {\n      server: serverSpec,\n      ...(server.name ? { name: server.name } : {}),\n      ...(timeout !== undefined ? { timeout } : {}),\n      ...(validation ? { tool_call: validation.toolCall } : {}),\n    },\n    substituted,\n  };\n}\n\nfunction redactMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  if (!result.ok) {\n    return {\n      ...result,\n      error: redactMcpSecrets(result.error, ...redactionSources),\n    };\n  }\n  if (result.tool_result) {\n    return {\n      ...result,\n      tool_result: {\n        ...result.tool_result,\n        text: redactMcpSecrets(result.tool_result.text, ...redactionSources),\n      },\n    };\n  }\n  return result;\n}\n\n/**\n * Display-boundary post-processing shared by the test and OAuth probes:\n * scrub secrets from error/tool-result text, then let the catalog entry's\n * credential validation turn a failed read-only tool call into a\n * `credentials` failure. The interpretation only runs when the probe tool\n * is actually advertised in `tools` — a server variant that doesn't expose\n * the tool (e.g. a hosted alternative to the stdio server the spec was\n * written for) must degrade to a connectivity-only success, not be\n * misreported as bad credentials.\n */\nfunction finalizeMcpTestResponse(\n  result: ExtendedMCPTestResponse,\n  validation: CredentialValidation | undefined,\n  redactionSources: (MCPServerConfig | undefined)[],\n): ExtendedMCPTestResponse {\n  const redacted = redactMcpTestResponse(result, redactionSources);\n  if (\n    redacted.ok &&\n    validation &&\n    redacted.tool_result &&\n    redacted.tools.includes(validation.toolCall.name)\n  ) {\n    const credentialError = validation.interpret(redacted.tool_result);\n    if (credentialError) {\n      return {\n        ok: false,\n        error: credentialError,\n        error_kind: \"credentials\",\n      };\n    }\n  }\n  return redacted;\n}\n\nfunction getMcpProbeOptions(): { host: string; apiKey?: string } {\n  const active = getActiveBackend().backend;\n  if (active.kind === \"local\") {\n    const { host, apiKey } = getAgentServerClientOptions();\n    return { host, ...(apiKey ? { apiKey } : {}) };\n  }\n\n  const localBackend = getRegisteredBackends().find(\n    (backend) => backend.kind === \"local\" && backend.host,\n  );\n  if (localBackend) {\n    return {\n      host: localBackend.host.replace(/\\/+$/, \"\"),\n      ...(localBackend.apiKey ? { apiKey: localBackend.apiKey } : {}),\n    };\n  }\n  throw new Error(\"OAuth authorization requires a reachable local backend.\");\n}\n\nfunction createMcpProbeClient(): MCPClient {\n  const { host, apiKey } = getMcpProbeOptions();\n  return new MCPClient({\n    host,\n    ...(apiKey ? { apiKey } : {}),\n    timeout: OAUTH_MCP_TEST_TIMEOUT_SECONDS * 1000 + 5000,\n  });\n}\n\nfunction oauthStatusToTestResponse(\n  status: MCPOAuthStatusResponse,\n): ExtendedMCPTestResponse {\n  if (status.status === \"succeeded\") {\n    return {\n      ok: true,\n      tools: status.tools ?? [],\n      ...(status.tool_result !== undefined && {\n        tool_result: status.tool_result,\n      }),\n      ...(status.oauth_state !== undefined && {\n        oauth_state: status.oauth_state,\n      }),\n    };\n  }\n  return {\n    ok: false,\n    error: status.error || \"OAuth authorization did not complete\",\n    error_kind: status.error_kind || \"unknown\",\n  };\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => {\n    window.setTimeout(resolve, ms);\n  });\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      const { request, substituted } = await buildMcpTestRequest(server);\n      const result = (await client.testServer(\n        request,\n      )) as ExtendedMCPTestResponse;\n      // Redact against both config forms: `server` may hold fresh plaintext\n      // input, `substituted` the stored (encrypted) round-trip values.\n      return finalizeMcpTestResponse(result, validation, [substituted, server]);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async startOAuth(\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.startOAuthWithClient(client, server);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async getOAuthStatus(jobId: string): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.getOAuthStatusWithClient(client, jobId);\n    } finally {\n      client.close();\n    }\n  }\n\n  static async submitOAuthCallback(\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    const client = createMcpProbeClient();\n    try {\n      return await McpService.submitOAuthCallbackWithClient(\n        client,\n        jobId,\n        callbackUrl,\n      );\n    } finally {\n      client.close();\n    }\n  }\n\n  static async authorizeOAuth(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    const validation = getCredentialValidationForServer(server);\n    const finalize = (result: ExtendedMCPTestResponse) =>\n      finalizeMcpTestResponse(result, validation, [server]);\n    const popup = window.open(\"about:blank\", \"_blank\");\n    const client = createMcpProbeClient();\n    try {\n      const start = await McpService.startOAuthWithClient(client, server);\n      if (!start.ok || !start.job_id || !start.authorization_url) {\n        popup?.close();\n        return finalize({\n          ok: false,\n          error: start.error || \"Could not start OAuth authorization\",\n          error_kind: start.error_kind || \"unknown\",\n        });\n      }\n\n      let status = await McpService.getOAuthStatusWithClient(\n        client,\n        start.job_id,\n      );\n      for (let attempt = 0; attempt < 20; attempt += 1) {\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n        if (status.callback_ready) break;\n        await sleep(250);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n      }\n\n      if (popup) {\n        popup.location.href = start.authorization_url;\n      }\n\n      for (\n        let attempt = 0;\n        attempt < OAUTH_MCP_TEST_TIMEOUT_SECONDS;\n        attempt += 1\n      ) {\n        await sleep(1000);\n        status = await McpService.getOAuthStatusWithClient(\n          client,\n          start.job_id,\n        );\n        if (status.status === \"succeeded\" || status.status === \"failed\") {\n          popup?.close();\n          return finalize(oauthStatusToTestResponse(status));\n        }\n      }\n\n      return {\n        ok: false,\n        error: \"OAuth authorization timed out\",\n        error_kind: \"timeout\",\n      };\n    } finally {\n      client.close();\n    }\n  }\n\n  private static async startOAuthWithClient(\n    client: MCPClient,\n    server: MCPServerConfig,\n  ): Promise<MCPOAuthStartResponse> {\n    const { request } = await buildMcpTestRequest(server);\n    return client.startOAuth(request);\n  }\n\n  // typescript-client 1.36 types the OAuth probes with the generated\n  // agent-server models, which describe the opaque `oauth_state` JSON blobs as\n  // `unknown` rather than the recursive `MCPJsonValue` the local types use. The\n  // wire shape is unchanged, so narrow back to the app's boundary type.\n  private static async getOAuthStatusWithClient(\n    client: MCPClient,\n    jobId: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.getOAuthStatus(jobId)) as MCPOAuthStatusResponse;\n  }\n\n  private static async submitOAuthCallbackWithClient(\n    client: MCPClient,\n    jobId: string,\n    callbackUrl: string,\n  ): Promise<MCPOAuthStatusResponse> {\n    return (await client.submitOAuthCallback(jobId, {\n      callback_url: callbackUrl,\n    })) as MCPOAuthStatusResponse;\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;;;;;AAoBA,IAAM,IAAiC;AAEvC,SAAS,EACP,GACqC;CAUrC,OATI,EAAO,SAAS,UACX;EACL,MAAM;EACN,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,KAAK;EAC/C,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,GAAG,EAAE,SAAS,KAAK,EAAE,KAAK,EAAO,IAAI;CAC5D,IAEK;EACL,MAAM,EAAO,SAAS,QAAQ,QAAQ;EACtC,KAAK,EAAO;EACZ,GAAI,EAAO,WACT,OAAO,KAAK,EAAO,OAAO,EAAE,SAAS,KAAK,EAAE,SAAS,EAAO,QAAQ;EACtE,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;CAC7C;AACF;AAEA,SAAS,EAAkB,GAA6C;CAEtE,OADI,EAAO,MAAM,aAAa,WACvB,IADwC,EAAO;AAExD;AAEA,eAAe,EAAoB,GAGhC;CACD,IAAM,IAAa,EAAiC,CAAM,GACpD,IAAc,MAAM,EAAiC,CAAM,GAC3D,IAAa,EAAY,CAAW,GACpC,IAAU,EAAkB,CAAM;CACxC,OAAO;EACL,SAAS;GACP,QAAQ;GACR,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,KAAK,IAAI,CAAC;GAC3C,GAAI,MAAY,KAAA,IAA0B,CAAC,IAAf,EAAE,WAAQ;GACtC,GAAI,IAAa,EAAE,WAAW,EAAW,SAAS,IAAI,CAAC;EACzD;EACA;CACF;AACF;AAEA,SAAS,EACP,GACA,GACyB;CAgBzB,OAfK,EAAO,KAMR,EAAO,cACF;EACL,GAAG;EACH,aAAa;GACX,GAAG,EAAO;GACV,MAAM,EAAiB,EAAO,YAAY,MAAM,GAAG,CAAgB;EACrE;CACF,IAEK,IAdE;EACL,GAAG;EACH,OAAO,EAAiB,EAAO,OAAO,GAAG,CAAgB;CAC3D;AAYJ;AAYA,SAAS,EACP,GACA,GACA,GACyB;CACzB,IAAM,IAAW,EAAsB,GAAQ,CAAgB;CAC/D,IACE,EAAS,MACT,KACA,EAAS,eACT,EAAS,MAAM,SAAS,EAAW,SAAS,IAAI,GAChD;EACA,IAAM,IAAkB,EAAW,UAAU,EAAS,WAAW;EACjE,IAAI,GACF,OAAO;GACL,IAAI;GACJ,OAAO;GACP,YAAY;EACd;CAEJ;CACA,OAAO;AACT;AAEA,SAAS,IAAwD;CAE/D,IADe,EAAiB,EAAE,QACvB,SAAS,SAAS;EAC3B,IAAM,EAAE,SAAM,cAAW,EAA4B;EACrD,OAAO;GAAE;GAAM,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAAG;CAC/C;CAEA,IAAM,IAAe,EAAsB,EAAE,MAC1C,MAAY,EAAQ,SAAS,WAAW,EAAQ,IACnD;CACA,IAAI,GACF,OAAO;EACL,MAAM,EAAa,KAAK,QAAQ,QAAQ,EAAE;EAC1C,GAAI,EAAa,SAAS,EAAE,QAAQ,EAAa,OAAO,IAAI,CAAC;CAC/D;CAEF,MAAU,MAAM,yDAAyD;AAC3E;AAEA,SAAS,IAAkC;CACzC,IAAM,EAAE,SAAM,cAAW,EAAmB;CAC5C,OAAO,IAAI,EAAU;EACnB;EACA,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAC3B,SAAS;CACX,CAAC;AACH;AAEA,SAAS,EACP,GACyB;CAazB,OAZI,EAAO,WAAW,cACb;EACL,IAAI;EACJ,OAAO,EAAO,SAAS,CAAC;EACxB,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,YACtB;EACA,GAAI,EAAO,gBAAgB,KAAA,KAAa,EACtC,aAAa,EAAO,YACtB;CACF,IAEK;EACL,IAAI;EACJ,OAAO,EAAO,SAAS;EACvB,YAAY,EAAO,cAAc;CACnC;AACF;AAEA,IAAM,KAAS,MACb,IAAI,SAAe,MAAY;CAC7B,OAAO,WAAW,GAAS,CAAE;AAC/B,CAAC,GAEG,IAAN,MAAM,EAAW;CACf,aAAa,WACX,GACkC;EAWlC,IAAI,EAAiB,EAAE,QAAQ,SAAS,SACtC,OAAO;GAAE,IAAI;GAAM,OAAO,CAAC;EAAE;EAE/B,IAAM,IAAa,EAAiC,CAAM,GACpD,EAAE,SAAM,cAAW,EAA4B,GAC/C,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,UAAO,IAAI,CAAC;EAAG,CAAC;EACpE,IAAI;GACF,IAAM,EAAE,YAAS,mBAAgB,MAAM,EAAoB,CAAM;GAMjE,OAAO,EAAwB,MALT,EAAO,WAC3B,CACF,GAGuC,GAAY,CAAC,GAAa,CAAM,CAAC;EAC1E,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,WACX,GACgC;EAChC,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,qBAAqB,GAAQ,CAAM;EAC7D,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,eAAe,GAAgD;EAC1E,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,yBAAyB,GAAQ,CAAK;EAChE,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,oBACX,GACA,GACiC;EACjC,IAAM,IAAS,EAAqB;EACpC,IAAI;GACF,OAAO,MAAM,EAAW,8BACtB,GACA,GACA,CACF;EACF,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAa,eACX,GACkC;EAClC,IAAM,IAAa,EAAiC,CAAM,GACpD,KAAY,MAChB,EAAwB,GAAQ,GAAY,CAAC,CAAM,CAAC,GAChD,IAAQ,OAAO,KAAK,eAAe,QAAQ,GAC3C,IAAS,EAAqB;EACpC,IAAI;GACF,IAAM,IAAQ,MAAM,EAAW,qBAAqB,GAAQ,CAAM;GAClE,IAAI,CAAC,EAAM,MAAM,CAAC,EAAM,UAAU,CAAC,EAAM,mBAEvC,OADA,GAAO,MAAM,GACN,EAAS;IACd,IAAI;IACJ,OAAO,EAAM,SAAS;IACtB,YAAY,EAAM,cAAc;GAClC,CAAC;GAGH,IAAI,IAAS,MAAM,EAAW,yBAC5B,GACA,EAAM,MACR;GACA,KAAK,IAAI,IAAU,GAAG,IAAU,IAAI,KAAW,GAAG;IAChD,IAAI,EAAO,WAAW,eAAe,EAAO,WAAW,UAErD,OADA,GAAO,MAAM,GACN,EAAS,EAA0B,CAAM,CAAC;IAEnD,IAAI,EAAO,gBAAgB;IAE3B,AADA,MAAM,EAAM,GAAG,GACf,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,MACR;GACF;GAEA,AAAI,MACF,EAAM,SAAS,OAAO,EAAM;GAG9B,KACE,IAAI,IAAU,GACd,IAAU,GACV,KAAW,GAOX,IALA,MAAM,EAAM,GAAI,GAChB,IAAS,MAAM,EAAW,yBACxB,GACA,EAAM,MACR,GACI,EAAO,WAAW,eAAe,EAAO,WAAW,UAErD,OADA,GAAO,MAAM,GACN,EAAS,EAA0B,CAAM,CAAC;GAIrD,OAAO;IACL,IAAI;IACJ,OAAO;IACP,YAAY;GACd;EACF,UAAU;GACR,EAAO,MAAM;EACf;CACF;CAEA,aAAqB,qBACnB,GACA,GACgC;EAChC,IAAM,EAAE,eAAY,MAAM,EAAoB,CAAM;EACpD,OAAO,EAAO,WAAW,CAAO;CAClC;CAMA,aAAqB,yBACnB,GACA,GACiC;EACjC,OAAQ,MAAM,EAAO,eAAe,CAAK;CAC3C;CAEA,aAAqB,8BACnB,GACA,GACA,GACiC;EACjC,OAAQ,MAAM,EAAO,oBAAoB,GAAO,EAC9C,cAAc,EAChB,CAAC;CACH;AACF"}