@wolpertingerlabs/drawlatch 1.0.0-alpha.2 → 1.0.0-alpha.29

package/dist/remote/tool-dispatch.js

@@ -0,0 +1,910 @@
+/**
+ * Canonical MCP tool implementations — the single source of truth.
+ *
+ * These handlers implement every proxy/management tool drawlatch exposes:
+ *   http_request, list_routes, poll_events, ingestor_status,
+ *   test_connection, test_ingestor, control_listener,
+ *   list_listener_configs, resolve_listener_options,
+ *   get/set_listener_params, list/delete_listener_instance,
+ *   list_connection_templates, set_connection_enabled,
+ *   set_secrets, get_secret_status.
+ *
+ * Consumed by:
+ *   - The remote secure server's `/request` dispatch (src/remote/server.ts)
+ *   - The password-gated admin API (src/remote/admin-mutations.ts)
+ *   - Any in-process host (e.g. callboard) that imports
+ *     `@wolpertingerlabs/drawlatch/remote/tool-dispatch` instead of
+ *     re-implementing a LocalProxy.
+ *
+ * Pure in the sense that handlers take `routes` + `context` as input rather
+ * than reading global session state. The only side effects are the outbound
+ * fetch() and config/.env writes (which mirror what the live daemon does).
+ */
+import { loadRemoteConfig, saveRemoteConfig, resolvePlaceholders, } from '../shared/config.js';
+import { listConnectionTemplates } from '../shared/connections.js';
+import { isSecretSetForCaller, setCallerSecrets } from '../shared/env-utils.js';
+// ── Endpoint matching ────────────────────────────────────────────────────────
+export function isEndpointAllowed(url, patterns) {
+    if (patterns.length === 0)
+        return true; // no restrictions if empty
+    return patterns.some((pattern) => {
+        // Support simple glob patterns: * matches anything within a segment, ** matches across segments
+        const regex = new RegExp('^' +
+            pattern
+                .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
+                .replace(/\*\*/g, '.__DOUBLE_STAR__.')
+                .replace(/\*/g, '[^/]*')
+                .replace(/\.__DOUBLE_STAR__\./g, '.*') +
+            '$');
+        return regex.test(url);
+    });
+}
+/**
+ * Find the first route whose allowedEndpoints match the given URL.
+ * Routes with empty allowedEndpoints match nothing.
+ */
+export function matchRoute(url, routes) {
+    for (const route of routes) {
+        if (route.allowedEndpoints.length > 0 && isEndpointAllowed(url, route.allowedEndpoints)) {
+            return route;
+        }
+    }
+    return null;
+}
+/**
+ * Core proxy request execution — route matching, secret injection, and fetch.
+ *
+ * Pure in the sense that it takes routes as input rather than reading global
+ * state. The only side effect is the outbound fetch().
+ */
+export async function executeProxyRequest(input, routes) {
+    const { method, url, headers = {}, body, files, bodyFieldName } = input;
+    // Step 1: Find matching route — try raw URL first
+    let matched = matchRoute(url, routes);
+    let resolvedUrl = url;
+    if (matched) {
+        // Resolve URL placeholders using matched route's secrets
+        resolvedUrl = resolvePlaceholders(url, matched.secrets);
+    }
+    else {
+        // Try resolving URL with each route's secrets to find a match
+        for (const route of routes) {
+            if (route.allowedEndpoints.length === 0)
+                continue;
+            const candidateUrl = resolvePlaceholders(url, route.secrets);
+            if (isEndpointAllowed(candidateUrl, route.allowedEndpoints)) {
+                matched = route;
+                resolvedUrl = candidateUrl;
+                break;
+            }
+        }
+    }
+    if (!matched) {
+        throw new Error(`Endpoint not allowed: ${url}`);
+    }
+    // Step 2: Resolve client headers using matched route's secrets
+    const resolvedHeaders = {};
+    for (const [k, v] of Object.entries(headers)) {
+        resolvedHeaders[k] = resolvePlaceholders(v, matched.secrets);
+    }
+    // Step 3: Check for header conflicts — reject if client provides a header
+    // that conflicts with a route-level header (case-insensitive)
+    const routeHeaderKeys = new Set(Object.keys(matched.headers).map((k) => k.toLowerCase()));
+    for (const clientKey of Object.keys(resolvedHeaders)) {
+        if (routeHeaderKeys.has(clientKey.toLowerCase())) {
+            throw new Error(`Header conflict: client-provided header "${clientKey}" conflicts with a route-level header. Remove it from the request.`);
+        }
+    }
+    // Step 4: Merge route-level headers (they take effect after conflict check)
+    for (const [k, v] of Object.entries(matched.headers)) {
+        resolvedHeaders[k] = v;
+    }
+    // Step 5: Resolve body placeholders using matched route's secrets.
+    // Only when the route explicitly opts in via resolveSecretsInBody — prevents
+    // exfiltration of secrets by writing placeholder strings into API resources
+    // and reading them back.
+    let fetchBody;
+    if (files?.length) {
+        // ── Multipart mode: build FormData with file attachments ──
+        const form = new FormData();
+        // Add the JSON body as a named part (default: "payload_json" for Discord-style APIs)
+        if (body !== null && body !== undefined) {
+            const serialized = typeof body === 'string' ? body : JSON.stringify(body);
+            const resolvedPayload = matched.resolveSecretsInBody
+                ? resolvePlaceholders(serialized, matched.secrets)
+                : serialized;
+            form.append(bodyFieldName ?? 'payload_json', resolvedPayload);
+        }
+        // Attach each file from base64 data
+        for (const file of files) {
+            const buffer = Buffer.from(file.data, 'base64');
+            const blob = new Blob([buffer], { type: file.contentType });
+            form.append(file.field, blob, file.filename);
+        }
+        fetchBody = form;
+        // Let fetch auto-set Content-Type with the correct multipart boundary —
+        // remove any Content-Type that may have been set by route headers
+        delete resolvedHeaders['Content-Type'];
+        delete resolvedHeaders['content-type'];
+    }
+    else {
+        // ── Standard JSON/string body ──
+        if (typeof body === 'string') {
+            fetchBody = matched.resolveSecretsInBody ? resolvePlaceholders(body, matched.secrets) : body;
+        }
+        else if (body !== null && body !== undefined) {
+            const serialized = JSON.stringify(body);
+            fetchBody = matched.resolveSecretsInBody
+                ? resolvePlaceholders(serialized, matched.secrets)
+                : serialized;
+            if (!resolvedHeaders['content-type'] && !resolvedHeaders['Content-Type']) {
+                resolvedHeaders['Content-Type'] = 'application/json';
+            }
+        }
+    }
+    // Step 6: Final endpoint check on fully resolved URL
+    if (!isEndpointAllowed(resolvedUrl, matched.allowedEndpoints)) {
+        throw new Error(`Endpoint not allowed after resolution: ${url}`);
+    }
+    // Step 7: Make the actual HTTP request
+    const resp = await fetch(resolvedUrl, {
+        method,
+        headers: resolvedHeaders,
+        body: fetchBody,
+    });
+    const contentType = resp.headers.get('content-type') ?? '';
+    let responseBody;
+    if (contentType.includes('application/json')) {
+        responseBody = await resp.json();
+    }
+    else {
+        responseBody = await resp.text();
+    }
+    return {
+        status: resp.status,
+        statusText: resp.statusText,
+        headers: Object.fromEntries(resp.headers.entries()),
+        body: responseBody,
+    };
+}
+export const toolHandlers = {
+    /**
+     * Proxied HTTP request with route-scoped secret injection.
+     * Delegates to the extracted executeProxyRequest() function.
+     */
+    async http_request(input, routes, _context) {
+        return executeProxyRequest(input, routes);
+    },
+    /**
+     * List available routes with metadata, endpoint patterns, and secret names (not values).
+     * Provides full disclosure of available routes for the local agent.
+     */
+    list_routes(_input, routes, _context) {
+        const routeList = routes.map((route, index) => {
+            const info = { index };
+            if (route.alias)
+                info.alias = route.alias;
+            if (route.name)
+                info.name = route.name;
+            if (route.description)
+                info.description = route.description;
+            if (route.docsUrl)
+                info.docsUrl = route.docsUrl;
+            if (route.openApiUrl)
+                info.openApiUrl = route.openApiUrl;
+            if (route.stability)
+                info.stability = route.stability;
+            if (route.category)
+                info.category = route.category;
+            info.allowedEndpoints = route.allowedEndpoints;
+            info.secretNames = Object.keys(route.secrets);
+            info.autoHeaders = Object.keys(route.headers);
+            // Ingestor & testing metadata
+            info.hasTestConnection = route.testConnection !== undefined;
+            info.hasIngestor = route.ingestorConfig !== undefined;
+            if (route.ingestorConfig) {
+                info.ingestorType = route.ingestorConfig.type;
+                info.hasTestIngestor = route.testIngestor !== undefined && route.testIngestor !== null;
+                info.hasListenerConfig = route.listenerConfig !== undefined;
+                if (route.listenerConfig) {
+                    info.listenerParamKeys = route.listenerConfig.fields.map((f) => f.key);
+                    info.supportsMultiInstance = route.listenerConfig.supportsMultiInstance ?? false;
+                }
+            }
+            return info;
+        });
+        return Promise.resolve(routeList);
+    },
+    /**
+     * Poll for new events from ingestors (Discord Gateway, webhooks, pollers).
+     * Returns events since a cursor, optionally filtered by connection.
+     */
+    poll_events(input, _routes, context) {
+        const { connection, after_id, instance_id } = input;
+        const afterId = after_id ?? -1;
+        if (connection) {
+            return Promise.resolve(context.ingestorManager.getEvents(context.callerAlias, connection, afterId, instance_id));
+        }
+        return Promise.resolve(context.ingestorManager.getAllEvents(context.callerAlias, afterId));
+    },
+    /**
+     * Get the status of all active ingestors for this caller.
+     */
+    ingestor_status(_input, _routes, context) {
+        return Promise.resolve(context.ingestorManager.getStatuses(context.callerAlias));
+    },
+    /**
+     * Test a connection's API credentials by executing a pre-configured,
+     * non-destructive read-only request. Returns success/failure with status details.
+     */
+    async test_connection(input, routes, _context) {
+        const { connection } = input;
+        // Find the route matching this connection alias
+        const route = routes.find((r) => r.alias === connection);
+        if (!route) {
+            return { success: false, connection, error: `Unknown connection: ${connection}` };
+        }
+        if (!route.testConnection) {
+            return {
+                success: false,
+                connection,
+                supported: false,
+                error: 'This connection does not have a test configuration.',
+            };
+        }
+        const testConfig = route.testConnection;
+        const method = testConfig.method ?? 'GET';
+        const expectedStatus = testConfig.expectedStatus ?? [200];
+        try {
+            const result = await executeProxyRequest({
+                method,
+                url: testConfig.url,
+                headers: testConfig.headers,
+                body: testConfig.body,
+            }, routes);
+            const isSuccess = expectedStatus.includes(result.status);
+            return {
+                success: isSuccess,
+                connection,
+                status: result.status,
+                statusText: result.statusText,
+                description: testConfig.description,
+                ...(isSuccess
+                    ? {}
+                    : {
+                        error: `Unexpected status ${result.status} (expected ${expectedStatus.join(' or ')})`,
+                    }),
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                connection,
+                description: testConfig.description,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+    /**
+     * Test an event listener / ingestor's configuration by running a lightweight
+     * verification appropriate to its type (auth check, secret check, poll check).
+     */
+    async test_ingestor(input, routes, _context) {
+        const { connection } = input;
+        const route = routes.find((r) => r.alias === connection);
+        if (!route) {
+            return { success: false, connection, error: `Unknown connection: ${connection}` };
+        }
+        if (!route.ingestorConfig) {
+            return {
+                success: false,
+                connection,
+                supported: false,
+                error: 'This connection does not have an event listener.',
+            };
+        }
+        // testIngestor is explicitly null = not testable
+        if (route.testIngestor === null) {
+            return {
+                success: false,
+                connection,
+                supported: false,
+                error: 'This event listener does not support testing.',
+            };
+        }
+        if (!route.testIngestor) {
+            return {
+                success: false,
+                connection,
+                supported: false,
+                error: 'This event listener does not have a test configuration.',
+            };
+        }
+        const testConfig = route.testIngestor;
+        try {
+            switch (testConfig.strategy) {
+                case 'webhook_verify': {
+                    // Verify that all required secrets are present and non-empty
+                    const missing = [];
+                    for (const secretName of testConfig.requireSecrets ?? []) {
+                        if (!route.secrets[secretName]) {
+                            missing.push(secretName);
+                        }
+                    }
+                    if (missing.length > 0) {
+                        return {
+                            success: false,
+                            connection,
+                            strategy: testConfig.strategy,
+                            description: testConfig.description,
+                            error: `Missing required secrets: ${missing.join(', ')}`,
+                        };
+                    }
+                    return {
+                        success: true,
+                        connection,
+                        strategy: testConfig.strategy,
+                        description: testConfig.description,
+                        message: 'All required webhook secrets are configured.',
+                    };
+                }
+                case 'websocket_auth':
+                case 'http_request':
+                case 'poll_once': {
+                    // Execute the test HTTP request
+                    if (!testConfig.request) {
+                        return {
+                            success: false,
+                            connection,
+                            strategy: testConfig.strategy,
+                            description: testConfig.description,
+                            error: 'Test configuration missing request details.',
+                        };
+                    }
+                    const method = testConfig.request.method ?? 'GET';
+                    const expectedStatus = testConfig.request.expectedStatus ?? [200];
+                    const result = await executeProxyRequest({
+                        method,
+                        url: testConfig.request.url,
+                        headers: testConfig.request.headers,
+                        body: testConfig.request.body,
+                    }, routes);
+                    const isSuccess = expectedStatus.includes(result.status);
+                    return {
+                        success: isSuccess,
+                        connection,
+                        strategy: testConfig.strategy,
+                        status: result.status,
+                        statusText: result.statusText,
+                        description: testConfig.description,
+                        ...(isSuccess
+                            ? { message: 'Listener test passed.' }
+                            : { error: `Unexpected status ${result.status}` }),
+                    };
+                }
+                default:
+                    return {
+                        success: false,
+                        connection,
+                        error: `Unknown test strategy: ${String(testConfig.strategy)}`,
+                    };
+            }
+        }
+        catch (err) {
+            return {
+                success: false,
+                connection,
+                strategy: testConfig.strategy,
+                description: testConfig.description,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+    /**
+     * List listener configuration schemas for all connections that have configurable
+     * event listeners. Returns the schema fields, current values, and metadata.
+     */
+    list_listener_configs(_input, routes, _context) {
+        const configs = routes
+            .filter((r) => r.listenerConfig)
+            .map((r) => ({
+            connection: r.alias,
+            name: r.listenerConfig.name,
+            description: r.listenerConfig.description,
+            fields: r.listenerConfig.fields,
+            ingestorType: r.ingestorConfig?.type,
+            supportsMultiInstance: r.listenerConfig.supportsMultiInstance ?? false,
+            instanceKeyField: r.listenerConfig.fields.find((f) => f.instanceKey)?.key,
+        }));
+        return Promise.resolve(configs);
+    },
+    /**
+     * Resolve dynamic options for a listener configuration field.
+     * Fetches options from the external API (e.g., list of Trello boards).
+     */
+    async resolve_listener_options(input, routes, _context) {
+        const { connection, paramKey } = input;
+        const route = routes.find((r) => r.alias === connection);
+        if (!route?.listenerConfig) {
+            return { success: false, error: `No listener config for connection: ${connection}` };
+        }
+        const field = route.listenerConfig.fields.find((f) => f.key === paramKey);
+        if (!field?.dynamicOptions) {
+            return { success: false, error: `No dynamic options for field: ${paramKey}` };
+        }
+        const { url, method = 'GET', body, responsePath, labelField, valueField, } = field.dynamicOptions;
+        try {
+            const result = await executeProxyRequest({ method, url, headers: {}, body }, routes);
+            // Navigate to the response path to find the items array
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- navigating unknown response shape
+            let items = result.body;
+            if (responsePath) {
+                for (const segment of responsePath.split('.')) {
+                    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-assignment
+                    items = items?.[segment];
+                }
+            }
+            if (!Array.isArray(items)) {
+                return { success: false, error: 'Response did not contain an array at the expected path.' };
+            }
+            const options = items.map((item) => ({
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+                value: item[valueField],
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+                label: item[labelField],
+            }));
+            return { success: true, connection, paramKey, options };
+        }
+        catch (err) {
+            return {
+                success: false,
+                connection,
+                paramKey,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+    /**
+     * Start, stop, or restart an event listener for a specific connection.
+     */
+    async control_listener(input, _routes, context) {
+        const { connection, action, instance_id } = input;
+        const mgr = context.ingestorManager;
+        try {
+            switch (action) {
+                case 'start':
+                    return await mgr.startOne(context.callerAlias, connection, instance_id);
+                case 'stop':
+                    return await mgr.stopOne(context.callerAlias, connection, instance_id);
+                case 'restart':
+                    return await mgr.restartOne(context.callerAlias, connection, instance_id);
+                default:
+                    return { success: false, error: `Unknown action: ${String(action)}` };
+            }
+        }
+        catch (err) {
+            return {
+                success: false,
+                connection,
+                action,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+    /**
+     * Read current listener parameter overrides for a connection.
+     * Returns current param values and schema defaults for form population.
+     */
+    get_listener_params(input, routes, context) {
+        const { connection, instance_id } = input;
+        // Find the route for this connection
+        const route = routes.find((r) => r.alias === connection);
+        if (!route) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: `Unknown connection: ${connection}`,
+            });
+        }
+        if (!route.listenerConfig) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: 'This connection does not have a listener configuration.',
+            });
+        }
+        // Build defaults from schema fields
+        const defaults = {};
+        for (const field of route.listenerConfig.fields) {
+            if (field.default !== undefined) {
+                defaults[field.key] = field.default;
+            }
+        }
+        // Load config to read current overrides
+        const config = loadRemoteConfig();
+        const callerConfig = config.callers[context.callerAlias];
+        if (!callerConfig) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: `Caller not found: ${context.callerAlias}`,
+            });
+        }
+        let params = {};
+        if (instance_id) {
+            // Multi-instance: read from listenerInstances
+            const instanceOverrides = callerConfig.listenerInstances?.[connection]?.[instance_id];
+            if (!instanceOverrides) {
+                return Promise.resolve({
+                    success: false,
+                    connection,
+                    instance_id,
+                    error: `Instance not found: ${instance_id}`,
+                });
+            }
+            params = instanceOverrides.params ?? {};
+        }
+        else {
+            // Single-instance: read from ingestorOverrides
+            const overrides = callerConfig.ingestorOverrides?.[connection];
+            params = overrides?.params ?? {};
+        }
+        // When no instance_id is given on a multi-instance connection, include
+        // the list of configured instance IDs so callers can discover them
+        // without needing a separate list_listener_instances call.
+        let instances;
+        if (!instance_id && route.listenerConfig.supportsMultiInstance) {
+            const instanceMap = callerConfig.listenerInstances?.[connection] ?? {};
+            instances = Object.keys(instanceMap);
+        }
+        return Promise.resolve({
+            success: true,
+            connection,
+            ...(instance_id && { instance_id }),
+            params,
+            defaults,
+            ...(instances !== undefined && { instances }),
+        });
+    },
+    /**
+     * Add or edit listener parameter overrides for a connection.
+     * Merges params into existing config. For multi-instance, set create_instance
+     * to true to create a new instance if it doesn't exist.
+     * After saving, restarts the affected ingestor so new params take effect immediately.
+     */
+    async set_listener_params(input, routes, context) {
+        const { connection, instance_id, params, create_instance } = input;
+        // Find the route for this connection
+        const route = routes.find((r) => r.alias === connection);
+        if (!route) {
+            return { success: false, connection, error: `Unknown connection: ${connection}` };
+        }
+        if (!route.listenerConfig) {
+            return {
+                success: false,
+                connection,
+                error: 'This connection does not have a listener configuration.',
+            };
+        }
+        // Validate param keys against schema
+        const validKeys = new Set(route.listenerConfig.fields.map((f) => f.key));
+        const unknownKeys = Object.keys(params).filter((k) => !validKeys.has(k));
+        if (unknownKeys.length > 0) {
+            return {
+                success: false,
+                connection,
+                error: `Unknown parameter keys: ${unknownKeys.join(', ')}. Valid keys: ${Array.from(validKeys).join(', ')}`,
+            };
+        }
+        // Load config, modify, save
+        const config = loadRemoteConfig();
+        const callerConfig = config.callers[context.callerAlias];
+        if (!callerConfig) {
+            return {
+                success: false,
+                connection,
+                error: `Caller not found: ${context.callerAlias}`,
+            };
+        }
+        let mergedParams;
+        if (instance_id) {
+            // Multi-instance: write to listenerInstances
+            callerConfig.listenerInstances ??= {};
+            callerConfig.listenerInstances[connection] ??= {};
+            const existing = callerConfig.listenerInstances[connection][instance_id];
+            if (!existing && !create_instance) {
+                return {
+                    success: false,
+                    connection,
+                    instance_id,
+                    error: `Instance "${instance_id}" does not exist. Set create_instance to true to create it.`,
+                };
+            }
+            if (existing) {
+                existing.params = { ...(existing.params ?? {}), ...params };
+                mergedParams = existing.params;
+            }
+            else {
+                callerConfig.listenerInstances[connection][instance_id] = { params };
+                mergedParams = params;
+            }
+        }
+        else {
+            // Single-instance: write to ingestorOverrides
+            callerConfig.ingestorOverrides ??= {};
+            callerConfig.ingestorOverrides[connection] ??= {};
+            const overrides = callerConfig.ingestorOverrides[connection];
+            overrides.params = { ...(overrides.params ?? {}), ...params };
+            mergedParams = overrides.params;
+        }
+        saveRemoteConfig(config);
+        // Restart the affected ingestor so new params take effect immediately.
+        // This matches callboard's local-proxy behavior (which calls reinitialize()).
+        const mgr = context.ingestorManager;
+        if (mgr.has(context.callerAlias, connection, instance_id)) {
+            try {
+                await mgr.restartOne(context.callerAlias, connection, instance_id);
+            }
+            catch (err) {
+                // Config was saved successfully — log the restart failure but don't fail the operation
+                console.error(`[remote] Warning: params saved but failed to restart ingestor ${context.callerAlias}:${connection}${instance_id ? `:${instance_id}` : ''}:`, err);
+                return {
+                    success: true,
+                    connection,
+                    ...(instance_id && { instance_id }),
+                    params: mergedParams,
+                    warning: 'Params saved but ingestor restart failed. Use control_listener to restart manually.',
+                };
+            }
+        }
+        return {
+            success: true,
+            connection,
+            ...(instance_id && { instance_id }),
+            params: mergedParams,
+        };
+    },
+    /**
+     * List all configured listener instances for a multi-instance connection.
+     * Returns every instance from config (including stopped/disabled ones),
+     * unlike ingestor_status which only shows running instances.
+     */
+    list_listener_instances(input, routes, context) {
+        const { connection } = input;
+        // Find the route for this connection
+        const route = routes.find((r) => r.alias === connection);
+        if (!route) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: `Unknown connection: ${connection}`,
+            });
+        }
+        if (!route.listenerConfig?.supportsMultiInstance) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: 'This connection does not support multi-instance listeners.',
+            });
+        }
+        // Read from config
+        const config = loadRemoteConfig();
+        const callerConfig = config.callers[context.callerAlias];
+        if (!callerConfig) {
+            return Promise.resolve({
+                success: false,
+                connection,
+                error: `Caller not found: ${context.callerAlias}`,
+            });
+        }
+        const instanceMap = callerConfig.listenerInstances?.[connection] ?? {};
+        const instances = Object.entries(instanceMap).map(([instanceId, overrides]) => ({
+            instanceId,
+            disabled: overrides.disabled ?? false,
+            params: overrides.params ?? {},
+        }));
+        return Promise.resolve({
+            success: true,
+            connection,
+            instances,
+        });
+    },
+    /**
+     * Delete a multi-instance listener instance.
+     * Removes from config and stops the running ingestor if active.
+     */
+    async delete_listener_instance(input, _routes, context) {
+        const { connection, instance_id } = input;
+        // Load config
+        const config = loadRemoteConfig();
+        const callerConfig = config.callers[context.callerAlias];
+        if (!callerConfig) {
+            return {
+                success: false,
+                connection,
+                instance_id,
+                error: `Caller not found: ${context.callerAlias}`,
+            };
+        }
+        const instances = callerConfig.listenerInstances?.[connection];
+        if (!instances || !(instance_id in instances)) {
+            return {
+                success: false,
+                connection,
+                instance_id,
+                error: `Instance "${instance_id}" not found for connection "${connection}".`,
+            };
+        }
+        // Stop the running ingestor if active
+        const mgr = context.ingestorManager;
+        if (mgr.has(context.callerAlias, connection, instance_id)) {
+            try {
+                await mgr.stopOne(context.callerAlias, connection, instance_id, { permanent: true });
+            }
+            catch (err) {
+                // Log but don't fail the delete
+                console.error(`[remote] Warning: failed to stop ingestor ${context.callerAlias}:${connection}:${instance_id}:`, err);
+            }
+        }
+        // Remove from config
+        const { [instance_id]: _removed, ...remainingInstances } = instances;
+        // Clean up empty maps
+        if (Object.keys(remainingInstances).length === 0) {
+            if (callerConfig.listenerInstances) {
+                const { [connection]: _removedConn, ...remainingConns } = callerConfig.listenerInstances;
+                if (Object.keys(remainingConns).length === 0) {
+                    delete callerConfig.listenerInstances;
+                }
+                else {
+                    callerConfig.listenerInstances = remainingConns;
+                }
+            }
+        }
+        else {
+            callerConfig.listenerInstances[connection] = remainingInstances;
+        }
+        saveRemoteConfig(config);
+        return { success: true, connection, instance_id };
+    },
+    // ── Config management tools ─────────────────────────────────────────────
+    /**
+     * List all available connection templates with caller-specific status.
+     * Returns template metadata, which ones the caller has enabled,
+     * and which secrets are configured.
+     */
+    list_connection_templates: (_input, _routes, context) => {
+        const config = loadRemoteConfig();
+        const caller = config.callers[context.callerAlias];
+        const enabledSet = new Set(caller.connections);
+        const templates = listConnectionTemplates();
+        return templates.map((t) => {
+            const callerEnv = caller.env;
+            const requiredSecretsSet = {};
+            for (const s of t.requiredSecrets) {
+                requiredSecretsSet[s] = isSecretSetForCaller(s, context.callerAlias, callerEnv);
+            }
+            const optionalSecretsSet = {};
+            for (const s of t.optionalSecrets) {
+                optionalSecretsSet[s] = isSecretSetForCaller(s, context.callerAlias, callerEnv);
+            }
+            return {
+                alias: t.alias,
+                name: t.name,
+                ...(t.description !== undefined && { description: t.description }),
+                ...(t.docsUrl !== undefined && { docsUrl: t.docsUrl }),
+                ...(t.openApiUrl !== undefined && { openApiUrl: t.openApiUrl }),
+                stability: t.stability,
+                category: t.category,
+                requiredSecrets: t.requiredSecrets,
+                optionalSecrets: t.optionalSecrets,
+                hasIngestor: t.hasIngestor,
+                ...(t.ingestorType !== undefined && { ingestorType: t.ingestorType }),
+                allowedEndpoints: t.allowedEndpoints,
+                enabled: enabledSet.has(t.alias),
+                requiredSecretsSet,
+                optionalSecretsSet,
+            };
+        });
+    },
+    /**
+     * Enable or disable a connection for the authenticated caller.
+     */
+    set_connection_enabled: async (input, _routes, context) => {
+        const connection = input.connection;
+        const enabled = input.enabled;
+        if (!connection || typeof enabled !== 'boolean') {
+            throw new Error('Required: connection (string) and enabled (boolean)');
+        }
+        const config = loadRemoteConfig();
+        const caller = config.callers[context.callerAlias];
+        // Verify the connection template exists (built-in or custom connector)
+        const connectorAliases = new Set((config.connectors ?? []).map((c) => c.alias).filter(Boolean));
+        const templateAliases = new Set(listConnectionTemplates().map((t) => t.alias));
+        if (!connectorAliases.has(connection) && !templateAliases.has(connection)) {
+            throw new Error(`Unknown connection: ${connection}`);
+        }
+        const connectionSet = new Set(caller.connections);
+        if (enabled) {
+            connectionSet.add(connection);
+        }
+        else {
+            connectionSet.delete(connection);
+            // Stop any running ingestors for this connection
+            const ingestorManager = context.ingestorManager;
+            try {
+                await ingestorManager.stopOne(context.callerAlias, connection);
+            }
+            catch {
+                // Ingestor may not be running — that's fine
+            }
+        }
+        caller.connections = [...connectionSet];
+        saveRemoteConfig(config);
+        // Invalidate cached resolved routes so connection changes take effect immediately
+        context.refreshRoutes();
+        return { success: true, connection, enabled };
+    },
+    /**
+     * Set or delete secrets for the authenticated caller.
+     * Uses prefixed env vars to prevent cross-caller collisions.
+     */
+    set_secrets: (input, _routes, context) => {
+        const secrets = input.secrets;
+        if (!secrets || typeof secrets !== 'object') {
+            throw new Error('Required: secrets (Record<string, string>)');
+        }
+        const config = loadRemoteConfig();
+        const { config: updatedConfig, status } = setCallerSecrets(secrets, context.callerAlias, config);
+        saveRemoteConfig(updatedConfig);
+        // Invalidate cached resolved routes so new secrets take effect immediately
+        context.refreshRoutes();
+        return { success: true, secretsSet: status };
+    },
+    /**
+     * Check which secrets are set for the authenticated caller (never returns values).
+     */
+    get_secret_status: (input, _routes, context) => {
+        const connection = input.connection;
+        if (!connection) {
+            throw new Error('Required: connection (string)');
+        }
+        // Find the connection template
+        const templates = listConnectionTemplates();
+        const template = templates.find((t) => t.alias === connection);
+        if (!template) {
+            throw new Error(`Unknown connection: ${connection}`);
+        }
+        const config = loadRemoteConfig();
+        const caller = config.callers[context.callerAlias];
+        const callerEnv = caller.env;
+        const requiredSecretsSet = {};
+        for (const s of template.requiredSecrets) {
+            requiredSecretsSet[s] = isSecretSetForCaller(s, context.callerAlias, callerEnv);
+        }
+        const optionalSecretsSet = {};
+        for (const s of template.optionalSecrets) {
+            optionalSecretsSet[s] = isSecretSetForCaller(s, context.callerAlias, callerEnv);
+        }
+        return {
+            success: true,
+            connection,
+            requiredSecretsSet,
+            optionalSecretsSet,
+        };
+    },
+};
+/**
+ * Dispatch a single tool call by name. Throws on unknown tool.
+ *
+ * The canonical entry point for in-process hosts (admin API, callboard) that
+ * want to invoke a tool without going through the encrypted `/request` path.
+ */
+export async function dispatchTool(toolName, input, routes, context) {
+    const handler = toolHandlers[toolName];
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime validation for untrusted input
+    if (!handler) {
+        throw new Error(`Unknown tool: ${toolName}`);
+    }
+    return handler(input, routes, context);
+}
+//# sourceMappingURL=tool-dispatch.js.map