@samanhappy/mcphub 1.0.38 → 1.0.40

package/dist/services/mcpService.js

@@ -40,9 +40,11 @@ import { assertHostedToolAllowed, filterHostedTools, reserveHostedToolCall, sett
 import { formatErrorForLogging, sanitizeStringForLogging, summarizeErrorForLogging, } from '../utils/serialization.js';
 import { addStdioErrorContext, observeStdioStderr } from '../utils/stdioDiagnostics.js';
 import { MCP_APPS_CAPABILITIES, filterModelVisibleTools, hasMcpAppsCapability, isAppOnlyTool, stripMcpAppsMetadata, } from '../utils/mcpApps.js';
-import { supportsCacheRefresh, injectRefreshFlag, clearRunnerCache } from '../utils/cacheUtils.js';
+import { supportsCacheRefresh, injectRefreshFlag, clearRunnerCache, resolveRunnerPackageVersion } from '../utils/cacheUtils.js';
+import { checkPackageUpdate } from '../utils/packageUpdate.js';
 const servers = {};
 import { setupClientKeepAlive } from './keepAliveService.js';
+import { createUpstreamRequestError, isUpstreamConnectionFailure, UpstreamRequestError, } from '../utils/upstreamError.js';
 import { logger } from '../utils/logger.js';
 /**
  * Check if proxychains4 is available on the system (Linux/macOS only).
@@ -439,7 +441,12 @@ export const syncToolEmbedding = async (serverName, toolName) => {
         logger.warn(`Server not found: ${serverName}`);
         return;
     }
-    const tool = serverInfo.tools.find((t) => t.name === toolName);
+    // The runtime cache names tools with the server prefix, but a direct API call
+    // (or a client that only knows the upstream name) may pass the bare name.
+    // Match both, mirroring the dual lookup used for the disabled-tool check, so a
+    // description update always reaches the right tool (see #1198).
+    const tool = serverInfo.tools.find((t) => t.name === toolName) ??
+        serverInfo.tools.find((t) => normalizeToolNameForServer(serverInfo.name, t.name) === toolName);
     if (!tool) {
         logger.warn(`Tool not found: ${toolName} on server: ${serverName}`);
         return;
@@ -448,7 +455,7 @@ export const syncToolEmbedding = async (serverName, toolName) => {
         return;
     }
     // Save tool as vector embedding for search
-    syncToolsAsVectorEmbeddings(serverName, [tool]).catch((error) => {
+    syncToolsAsVectorEmbeddings(serverName, [tool], { partial: true }).catch((error) => {
         logger.warn(`[EMBED_SYNC_ERROR] Failed to sync embedding for tool "${toolName}" on server "${serverName}"`);
         logger.error('Error syncing single tool embedding', { serverName, toolName, error });
     });
@@ -486,9 +493,38 @@ const buildToolWithDescriptionMetadata = (tool, toolConfig) => {
         enabled: toolConfig?.enabled !== false,
     };
 };
+// Apply any per-tool description override before the tool text is embedded for
+// Smart Routing search. Deliberately narrower than buildToolWithDescriptionMetadata:
+// only `description` (plus the hasDescriptionOverride marker used by the
+// tool-set hash) is touched, so serverInfo.tools (built by
+// normalizeToolForCache/updateServerToolsCache) still never carries `enabled` --
+// preserving the existing invariant that execution gating reads the persisted
+// config directly, not this projection. Without this step, overrides only
+// affected client-facing output (tools/list, describe_tool, dashboard) while
+// search_tools embeddings kept ranking against the raw upstream description (#1198).
+const applyDescriptionOverridesForEmbedding = async (serverName, tools) => {
+    const serverConfig = await getServerDao().findById(serverName);
+    if (!serverConfig?.tools) {
+        return tools;
+    }
+    return tools.map((tool) => {
+        const bareToolName = normalizeToolNameForServer(serverName, tool.name);
+        const toolConfig = serverConfig.tools?.[tool.name] ?? serverConfig.tools?.[bareToolName];
+        return hasDescriptionOverride(toolConfig)
+            ? {
+                ...tool,
+                description: resolveDescriptionOverride(tool.description, toolConfig),
+                hasDescriptionOverride: true,
+            }
+            : tool;
+    });
+};
 const syncToolsAsVectorEmbeddings = async (serverName, tools, options) => {
-    const modelVisibleTools = filterModelVisibleTools(tools);
+    const toolsWithOverrides = await applyDescriptionOverridesForEmbedding(serverName, tools);
+    const modelVisibleTools = filterModelVisibleTools(toolsWithOverrides);
     if (modelVisibleTools.length === 0) {
+        if (options?.partial)
+            return;
         await removeServerToolEmbeddings(serverName);
         return;
     }
@@ -754,6 +790,7 @@ export const connected = () => {
 };
 // Global cleanup function to close all connections
 export const cleanupAllServers = () => {
+    stopPackageUpdateSweep();
     principalRuntimes.invalidate();
     for (const serverInfo of serverInfos) {
         try {
@@ -1625,6 +1662,8 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 const serverVersion = client.getServerVersion?.();
                 info.version = serverVersion?.version;
                 info.instructions = client.getInstructions?.();
+                // Record the resolved npx/uvx package version backing this server.
+                applyResolvedPackageVersion(info, expandedConf);
                 const capabilities = client.getServerCapabilities();
                 logger.log('Server capabilities', JSON.stringify(capabilities));
                 let dataError = null;
@@ -1839,15 +1878,15 @@ export const getServersInfo = async (page, limit, user) => {
         catch (error) {
             return {
                 ...info,
-                error: error instanceof CredentialBindingError
+                error: error instanceof CredentialBindingError || error instanceof UpstreamRequestError
                     ? error.message
-                    : 'Unable to resolve personal credentials',
+                    : 'Unable to prepare upstream server',
             };
         }
     }));
     const infos = presentedInfos
         .filter((info) => requestedServerNames.has(info.name)) // Only include requested servers
-        .map(({ name, version, instructions, owner, visibility, status, tools, prompts, resources, createTime, error, oauth, }) => {
+        .map(({ name, version, packageVersion, latestVersion, updateAvailable, instructions, owner, visibility, status, tools, prompts, resources, createTime, error, oauth, }) => {
         const serverConfig = allServers.find((server) => server.name === name);
         const enabled = serverConfig ? serverConfig.enabled !== false : true;
         const resolvedType = inferServerType(serverConfig);
@@ -1891,6 +1930,12 @@ export const getServersInfo = async (page, limit, user) => {
             resources: resourcesWithEnabled,
             createTime,
             enabled,
+            // Resolved npx/uvx package version + registry update hint (#1166).
+            // Runtime state, kept at the top level like `version` so it can never
+            // be round-tripped into a persisted ServerConfig.
+            ...(packageVersion ? { packageVersion } : {}),
+            ...(latestVersion ? { latestVersion } : {}),
+            ...(updateAvailable !== undefined ? { updateAvailable } : {}),
             oauth: oauth || oauthConnected
                 ? {
                     ...(oauth
@@ -1969,6 +2014,75 @@ export const reconnectServer = async (serverName) => {
     await initializeClientsFromSettings(false, serverName);
     logger.log(`Successfully reconnected server: ${serverName}`);
 };
+/**
+ * Resolve the installed package version for an npx/uvx stdio server and record
+ * it on the live ServerInfo, so the dashboard can answer "what version is
+ * actually running" (see #1166). Also checks the configured registry for a
+ * newer version and marks updateAvailable. Fire-and-forget: best-effort
+ * display data — a resolution failure must never break or delay a connection.
+ *
+ * On any failure the runtime fields are cleared so the UI never shows a stale
+ * version or a stale "update available" hint from an earlier, healthier check.
+ */
+const applyResolvedPackageVersion = (info, config) => {
+    const command = config?.command;
+    if (!command || !supportsCacheRefresh(command))
+        return;
+    void (async () => {
+        try {
+            const args = config.args ?? [];
+            const version = await resolveRunnerPackageVersion(command, args);
+            if (!version) {
+                info.packageVersion = undefined;
+                info.latestVersion = undefined;
+                info.updateAvailable = undefined;
+                return;
+            }
+            info.packageVersion = version;
+            const systemConfig = await getSystemConfigDao().get();
+            const update = await checkPackageUpdate(command, args, version, {
+                npmRegistry: systemConfig?.install?.npmRegistry,
+                pythonIndexUrl: systemConfig?.install?.pythonIndexUrl,
+            });
+            if (update?.latestVersion) {
+                info.latestVersion = update.latestVersion;
+                info.updateAvailable = update.updateAvailable;
+            }
+            else {
+                // Registry unreachable or no metadata: hide the hint rather than keep
+                // a stale "update available" from a previous successful check.
+                info.latestVersion = undefined;
+                info.updateAvailable = undefined;
+            }
+        }
+        catch (error) {
+            logger.warn(`Failed to resolve package update for ${info.name}`, { error });
+            info.latestVersion = undefined;
+            info.updateAvailable = undefined;
+        }
+    })();
+};
+// Periodically refresh the "update available" flag for npx/uvx servers (#1166).
+// Each check respects the TTL cache inside checkPackageUpdate, so this only
+// re-queries packages whose last registry lookup has gone stale. The timer is
+// unref'd so it never keeps the process alive by itself.
+//
+// Note: personal-runtime servers (credential-template bindings) are not part of
+// `serverInfos` and are therefore not swept here — their flags refresh when a
+// new per-user connection is created in createPrincipalRuntime instead.
+const PACKAGE_UPDATE_SWEEP_MS = 6 * 60 * 60 * 1000;
+const packageUpdateSweepTimer = setInterval(() => {
+    for (const info of serverInfos) {
+        if (!info.config?.command)
+            continue;
+        applyResolvedPackageVersion(info, info.config);
+    }
+}, PACKAGE_UPDATE_SWEEP_MS);
+packageUpdateSweepTimer.unref?.();
+/** Stop the periodic package-update sweep (called on shutdown). */
+export const stopPackageUpdateSweep = () => {
+    clearInterval(packageUpdateSweepTimer);
+};
 // Reinstall server: clear package cache and reconnect.
 // For npx: deletes ~/.npm/_npx before reconnect (--ignore-existing removed in npm 7+).
 // For uvx: schedules --refresh flag injection on next spawn via pendingReinstalls Set.
@@ -2303,6 +2417,8 @@ const ensureServerReady = async (serverInfo) => {
         serverInfo.version = client.getServerVersion?.()?.version;
         serverInfo.instructions = client.getInstructions?.();
         serverInfo.config = expandedConf;
+        // Record the resolved npx/uvx package version backing this server.
+        applyResolvedPackageVersion(serverInfo, expandedConf);
         serverInfo.status = 'connected';
         serverInfo.error = null;
         let toolCount = 0;
@@ -3569,9 +3685,12 @@ const createPrincipalRuntime = async (name, resolvedConfig) => {
                 try {
                     return await value.apply(target, args);
                 }
-                catch {
-                    info.status = 'disconnected';
-                    throw new CredentialBindingError(`Personal credential request failed for '${name}'. Check your binding in Credentials.`);
+                catch (error) {
+                    if (isUpstreamConnectionFailure(error))
+                        info.status = 'disconnected';
+                    const failure = createUpstreamRequestError(name, String(property), error, resolvedConfig);
+                    logger.error(failure.message);
+                    throw failure;
                 }
             };
         },
@@ -3606,6 +3725,8 @@ const createPrincipalRuntime = async (name, resolvedConfig) => {
             if (capabilities?.resources)
                 info.resources = (await client.listResources({}, resolvedConfig.options)).resources.map(normalizeResourceForCache);
             info.version = client.getServerVersion()?.version;
+            // Record the resolved npx/uvx package version backing this server.
+            applyResolvedPackageVersion(info, resolvedConfig);
             client.onclose = () => {
                 info.status = 'disconnected';
             };
@@ -3613,12 +3734,36 @@ const createPrincipalRuntime = async (name, resolvedConfig) => {
         info.status = 'connected';
         return info;
     }
-    catch {
+    catch (error) {
         closeServerRuntime(info);
-        throw new CredentialBindingError(`Unable to connect '${name}' with your personal credentials. Check your binding in Credentials.`);
+        const failure = createUpstreamRequestError(name, 'connect', error, resolvedConfig);
+        logger.error(failure.message);
+        throw failure;
     }
 };
 const principalRuntimes = new PrincipalRuntimeService(createPrincipalRuntime, closeServerRuntime);
+/**
+ * Resolve the tools of a personal-credential server on behalf of an explicit
+ * principal, outside any request context.
+ *
+ * Servers that declare a credential template are never connected globally (see
+ * the `hasCredentialTemplate` branch in `initializeClientsFromSettings`); their
+ * runtime only exists for the principals who bound their own credentials. Any
+ * caller that needs the tool list of such a server — smart routing reindex, for
+ * instance — must therefore borrow one of those principals instead of relying
+ * on the ambient request user, which may hold no binding at all.
+ *
+ * The returned list is a snapshot: the lease is released before returning.
+ */
+export const getServerToolsForPrincipal = async (serverName, principal) => {
+    const lease = await principalRuntimes.acquire(serverName, principal);
+    try {
+        return lease.info.tools ?? [];
+    }
+    finally {
+        lease.release();
+    }
+};
 const withPrincipalServers = (handler, operation) => async (request, extra) => {
     if (!serverInfos.some((info) => hasCredentialTemplate(info.config)))
         return handler(request, extra);
@@ -3641,12 +3786,25 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
     const requestedName = ['call_tool', 'describe_tool'].includes(request?.params?.name)
         ? request.params.arguments?.toolName
         : request?.params?.name;
-    const target = candidates.find((info) => {
-        const exposedName = getExposedServerName(info.name, serverConfigsByName.get(info.name));
-        return (extra?.server === info.name ||
-            (typeof requestedName === 'string' &&
-                requestedName.startsWith(`${exposedName}${getNameSeparator()}`)));
-    });
+    // An explicit REST target takes precedence over every qualified-name prefix.
+    // Otherwise prefer the longest exposed prefix, including group aliases.
+    let target = extra?.server
+        ? candidates.find((info) => info.name === extra.server)
+        : undefined;
+    if (extra?.server && !target && (operation === 'tool' || operation === 'prompt')) {
+        throw new ToolUnavailableError(`Tool not available: ${requestedName}`, 'server-or-name-not-found');
+    }
+    if (!extra?.server && typeof requestedName === 'string') {
+        let longestPrefix = 0;
+        for (const info of candidates) {
+            const exposedName = getExposedServerName(info.name, serverConfigsByName.get(info.name));
+            const prefix = `${exposedName}${getNameSeparator()}`;
+            if (prefix.length > longestPrefix && requestedName.startsWith(prefix)) {
+                target = info;
+                longestPrefix = prefix.length;
+            }
+        }
+    }
     // A call to a known target must not spawn or keep unrelated personal children alive.
     const selected = target && (operation === 'tool' || operation === 'prompt') ? [target] : candidates;
     const templated = selected.filter((info) => hasCredentialTemplate(info.config));
@@ -3668,9 +3826,9 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
                 scoped.set(info.name, lease.info);
             }
             catch (error) {
-                failures.set(info.name, error instanceof CredentialBindingError
+                failures.set(info.name, error instanceof CredentialBindingError || error instanceof UpstreamRequestError
                     ? error
-                    : new CredentialBindingError('Unable to resolve personal credentials'));
+                    : new Error(`Unable to prepare upstream '${info.name}'`));
             }
         }));
         const requiredTarget = target ||