@wolpertingerlabs/drawlatch 1.0.0-alpha.2 → 1.0.0-alpha.29

package/dist/mcp/server.js

@@ -13,38 +13,81 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import crypto from 'node:crypto';
-import { loadProxyConfig } from '../shared/config.js';
-import { loadKeyBundle, loadPublicKeys, EncryptedChannel } from '../shared/crypto/index.js';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { loadProxyConfig, resolveCallerKeyAlias, getCallerKeysDir, getServerKeysDir, getProxyConfigPath, } from '../shared/config.js';
+import { loadKeyBundle, loadPublicKeys, EncryptedChannel, extractPublicKeys, fingerprint, } from '../shared/crypto/index.js';
+import { existsSync } from 'node:fs';
 import { HandshakeInitiator, } from '../shared/protocol/index.js';
 // ── State ──────────────────────────────────────────────────────────────────
 let channel = null;
 let remoteUrl;
 // ── Handshake ──────────────────────────────────────────────────────────────
 async function establishChannel() {
+    // Pre-flight validation
+    if (!existsSync(getProxyConfigPath())) {
+        throw new Error(`No proxy config found at ${getProxyConfigPath()}. Run: drawlatch init`);
+    }
     const config = loadProxyConfig();
     remoteUrl = config.remoteUrl;
-    // Log which key identity is being used
-    const envAlias = process.env.MCP_KEY_ALIAS?.trim();
-    if (envAlias) {
-        console.error(`[mcp-proxy] Using key alias from MCP_KEY_ALIAS: "${envAlias}"`);
+    // Resolve key paths from config dir + alias
+    const alias = resolveCallerKeyAlias();
+    const callerKeysDir = path.join(getCallerKeysDir(), alias);
+    const serverKeysDir = getServerKeysDir();
+    console.error(`[mcp-proxy] Using caller alias: "${alias}"`);
+    console.error(`[mcp-proxy] Caller keys dir: ${callerKeysDir}`);
+    // Validate key paths before attempting to load
+    if (!existsSync(callerKeysDir)) {
+        throw new Error(`Caller keys not found at ${callerKeysDir}. Run: drawlatch generate-keys caller ${alias}`);
+    }
+    if (!existsSync(serverKeysDir)) {
+        throw new Error(`Server public keys not found at ${serverKeysDir}. Run: drawlatch sync`);
+    }
+    let ownKeys, remotePub;
+    try {
+        ownKeys = loadKeyBundle(callerKeysDir);
     }
-    else if (config.localKeyAlias) {
-        console.error(`[mcp-proxy] Using key alias from config: "${config.localKeyAlias}"`);
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to load caller keys from ${callerKeysDir}: ${msg}. Run: drawlatch generate-keys caller ${alias}`);
+    }
+    try {
+        remotePub = loadPublicKeys(serverKeysDir);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to load server public keys from ${serverKeysDir}: ${msg}. Run: drawlatch sync`);
     }
-    console.error(`[mcp-proxy] Local keys dir: ${config.localKeysDir}`);
-    const ownKeys = loadKeyBundle(config.localKeysDir);
-    const remotePub = loadPublicKeys(config.remotePublicKeysDir);
     const initiator = new HandshakeInitiator(ownKeys, remotePub);
     // Step 1: Send HandshakeInit
     const initMsg = initiator.createInit();
-    const initResp = await fetch(`${remoteUrl}/handshake/init`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(initMsg),
-        signal: AbortSignal.timeout(config.connectTimeout),
-    });
+    let initResp;
+    try {
+        initResp = await fetch(`${remoteUrl}/handshake/init`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(initMsg),
+            signal: AbortSignal.timeout(config.connectTimeout),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('ECONNREFUSED')) {
+            throw new Error(`Remote server is not running at ${remoteUrl}. Start it with: drawlatch start`);
+        }
+        if ((err instanceof DOMException && err.name === 'AbortError') || msg.includes('timed out')) {
+            throw new Error(`Remote server at ${remoteUrl} is not responding (timed out after ${config.connectTimeout}ms)`);
+        }
+        throw new Error(`Failed to connect to remote server at ${remoteUrl}: ${msg}`);
+    }
     if (!initResp.ok) {
         const errText = await initResp.text();
+        const localFp = fingerprint(extractPublicKeys(ownKeys));
+        if (initResp.status === 401 || initResp.status === 403) {
+            console.error(`[mcp-proxy] Handshake rejected by server. Your key fingerprint: ${localFp}`);
+            console.error('[mcp-proxy] Ensure this fingerprint matches an authorized peer on the remote server.');
+            throw new Error(`Handshake rejected (${initResp.status}). Your fingerprint: ${localFp}. Check that public keys are correctly exchanged. See: drawlatch init`);
+        }
         throw new Error(`Handshake init failed: ${initResp.status} ${errText}`);
     }
     const reply = await initResp.json();
@@ -85,21 +128,42 @@ async function sendEncryptedRequest(toolName, toolInput) {
     };
     // Encrypt the entire request
     const encrypted = ch.encryptJSON(request);
-    const resp = await fetch(`${remoteUrl}/request`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/octet-stream',
-            'X-Session-Id': ch.sessionId,
-        },
-        body: new Uint8Array(encrypted),
-        signal: AbortSignal.timeout(config.requestTimeout),
-    });
+    let resp;
+    try {
+        resp = await fetch(`${remoteUrl}/request`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                'X-Session-Id': ch.sessionId,
+            },
+            body: new Uint8Array(encrypted),
+            signal: AbortSignal.timeout(config.requestTimeout),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('ECONNREFUSED')) {
+            channel = null;
+            throw new Error(`Remote server is not running at ${remoteUrl}. Start it with: drawlatch start`);
+        }
+        if ((err instanceof DOMException && err.name === 'AbortError') || msg.includes('timed out')) {
+            throw new Error(`Remote server at ${remoteUrl} is not responding (timed out after ${config.requestTimeout}ms)`);
+        }
+        channel = null;
+        throw new Error(`Failed to reach remote server at ${remoteUrl}: ${msg}`);
+    }
     if (!resp.ok) {
         // If session expired, re-establish
         if (resp.status === 401) {
             console.error('[mcp-proxy] Session expired, re-establishing...');
             channel = null;
-            return sendEncryptedRequest(toolName, toolInput);
+            try {
+                return await sendEncryptedRequest(toolName, toolInput);
+            }
+            catch (reEstErr) {
+                const msg = reEstErr instanceof Error ? reEstErr.message : String(reEstErr);
+                throw new Error(`Session re-establishment failed: ${msg}`);
+            }
         }
         throw new Error(`Request failed: ${resp.status} ${await resp.text()}`);
     }
@@ -129,14 +193,54 @@ server.tool('secure_request', "Make an authenticated HTTP request through the en
         .optional()
         .describe('Request headers, may contain ${VAR} placeholders'),
     body: z.any().optional().describe('Request body (object for JSON, string for raw)'),
-}, async ({ method, url, headers, body }) => {
+    files: z
+        .array(z.object({
+        field: z.string().describe('Form field name (e.g., "files[0]", "file", "attachment")'),
+        path: z.string().describe('Absolute path to the file on the local filesystem'),
+        filename: z.string().describe('Filename to use in the upload'),
+        contentType: z.string().describe('MIME type (e.g., "image/png", "application/pdf")'),
+    }))
+        .optional()
+        .describe('File attachments for multipart/form-data uploads. When present, the request is sent as multipart with the JSON body as "payload_json". Use bodyFieldName to change the JSON part name.'),
+    bodyFieldName: z
+        .string()
+        .optional()
+        .describe('Form field name for the JSON body part in multipart requests (default: "payload_json"). Only used when files are present.'),
+}, async ({ method, url, headers, body, files, bodyFieldName }) => {
     try {
-        const result = await sendEncryptedRequest('http_request', {
+        const toolInput = {
             method,
             url,
             headers: headers ?? {},
             body,
-        });
+        };
+        // Read and base64-encode files from the local filesystem before sending
+        // through the encrypted channel (remote server can't access local files)
+        if (files?.length) {
+            const MAX_FILE_SIZE = 25 * 1024 * 1024; // 25 MB per file
+            const encodedFiles = await Promise.all(files.map(async ({ field, path: filePath, filename, contentType }) => {
+                if (!path.isAbsolute(filePath)) {
+                    throw new Error(`File path must be absolute: ${filePath}`);
+                }
+                let stat;
+                try {
+                    stat = await fs.stat(filePath);
+                }
+                catch {
+                    throw new Error(`File not found: ${filePath}`);
+                }
+                if (stat.size > MAX_FILE_SIZE) {
+                    throw new Error(`File too large (${(stat.size / 1024 / 1024).toFixed(1)} MB): ${filePath} — max ${MAX_FILE_SIZE / 1024 / 1024} MB`);
+                }
+                const buffer = await fs.readFile(filePath);
+                return { field, data: buffer.toString('base64'), filename, contentType };
+            }));
+            toolInput.files = encodedFiles;
+            if (bodyFieldName) {
+                toolInput.bodyFieldName = bodyFieldName;
+            }
+        }
+        const result = await sendEncryptedRequest('http_request', toolInput);
         return {
             content: [
                 {
@@ -197,11 +301,16 @@ server.tool('poll_events', 'Poll for new events from ingestors (Discord messages
         .number()
         .optional()
         .describe('Return events with id > after_id. Omit or -1 for all buffered events.'),
-}, async ({ connection, after_id }) => {
+    instance_id: z
+        .string()
+        .optional()
+        .describe('Instance ID for multi-instance listeners (e.g., "project-board"). Omit for all instances.'),
+}, async ({ connection, after_id, instance_id }) => {
     try {
         const result = await sendEncryptedRequest('poll_events', {
             connection,
             after_id,
+            instance_id,
         });
         return {
             content: [
@@ -245,11 +354,415 @@ server.tool('ingestor_status', 'Get the status of all active ingestors for this
         };
     }
 });
+/**
+ * Test connectivity for a specific connection by running a pre-configured,
+ * non-destructive read-only request against its API.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('test_connection', 'Test connectivity to a specific connection by making a non-destructive read-only request. Verifies that API credentials are valid. Returns success/failure with status details.', {
+    connection: z.string().describe('Connection alias to test (e.g., "github", "discord-bot")'),
+}, async ({ connection }) => {
+    try {
+        const result = await sendEncryptedRequest('test_connection', { connection });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Test event listener / ingestor configuration for a specific connection.
+ * Verifies credentials and listener parameters are correct.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('test_ingestor', 'Test event listener configuration for a connection. Verifies credentials and listener parameters are correct without starting the full listener. Returns success/failure with details.', {
+    connection: z.string().describe('Connection alias to test listener for (e.g., "discord-bot")'),
+}, async ({ connection }) => {
+    try {
+        const result = await sendEncryptedRequest('test_ingestor', { connection });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * List listener configuration schemas for all connections with configurable event listeners.
+ * Returns field schemas that UIs can use to render configuration forms.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('list_listener_configs', 'List configurable event listener schemas for all connections. Returns field definitions (type, label, options, defaults) that can be used to render configuration forms.', { _: z.string().optional().describe('unused') }, async () => {
+    try {
+        const result = await sendEncryptedRequest('list_listener_configs', {});
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Resolve dynamic options for a listener configuration field by fetching
+ * them from the external API (e.g., list of Trello boards, Discord guilds).
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('resolve_listener_options', 'Fetch dynamic options for a listener configuration field. Some fields (like Trello boards) require an API call to populate their options list.', {
+    connection: z.string().describe('Connection alias (e.g., "trello")'),
+    paramKey: z.string().describe('The field key to resolve options for (e.g., "boardId")'),
+}, async ({ connection, paramKey }) => {
+    try {
+        const result = await sendEncryptedRequest('resolve_listener_options', {
+            connection,
+            paramKey,
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Start, stop, or restart an event listener for a specific connection.
+ * Controls the lifecycle of ingestors at runtime without restarting the server.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('control_listener', 'Start, stop, or restart an event listener for a connection. Stopping a listener pauses event collection; starting resumes it. Use restart after configuration changes.', {
+    connection: z.string().describe('Connection alias (e.g., "discord-bot")'),
+    action: z.enum(['start', 'stop', 'restart']).describe('Lifecycle action to perform'),
+    instance_id: z
+        .string()
+        .optional()
+        .describe('Instance ID for multi-instance listeners. Omit to control all instances.'),
+}, async ({ connection, action, instance_id }) => {
+    try {
+        const result = await sendEncryptedRequest('control_listener', {
+            connection,
+            action,
+            instance_id,
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Read current listener parameter overrides for a connection.
+ * Returns current values and schema defaults for populating config forms.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('get_listener_params', 'Read current listener parameter overrides for a connection. Returns current values and schema defaults. Use instance_id for multi-instance listeners.', {
+    connection: z.string().describe('Connection alias (e.g., "trello", "discord-bot")'),
+    instance_id: z
+        .string()
+        .optional()
+        .describe('Instance ID for multi-instance listeners. Omit for single-instance.'),
+}, async ({ connection, instance_id }) => {
+    try {
+        const result = await sendEncryptedRequest('get_listener_params', { connection, instance_id });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Add or edit listener parameter overrides for a connection.
+ * Merges params into existing config. Supports creating new multi-instance listeners.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('set_listener_params', 'Add or edit listener parameter overrides for a connection. Merges params into existing config. Set create_instance to true to create a new multi-instance listener.', {
+    connection: z.string().describe('Connection alias (e.g., "trello")'),
+    instance_id: z
+        .string()
+        .optional()
+        .describe('Instance ID for multi-instance listeners. Omit for single-instance.'),
+    params: z
+        .record(z.string(), z.unknown())
+        .describe('Key-value pairs to set. Keys must match listener config field keys.'),
+    create_instance: z
+        .boolean()
+        .optional()
+        .describe("Set to true to create a new instance if it doesn't exist."),
+}, async ({ connection, instance_id, params, create_instance }) => {
+    try {
+        const result = await sendEncryptedRequest('set_listener_params', {
+            connection,
+            instance_id,
+            params,
+            create_instance,
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * List all configured listener instances for a multi-instance connection.
+ * Returns every instance from config, including stopped/disabled ones.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('list_listener_instances', 'List all configured instances for a multi-instance listener connection. Returns every instance from config (including stopped/disabled ones), unlike ingestor_status which only shows running instances.', {
+    connection: z.string().describe('Connection alias (e.g., "trello")'),
+}, async ({ connection }) => {
+    try {
+        const result = await sendEncryptedRequest('list_listener_instances', { connection });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Delete a multi-instance listener instance.
+ * Stops the running ingestor if active and removes the instance from config.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('delete_listener_instance', 'Remove a multi-instance listener instance. Stops the running ingestor if active and removes the instance from config.', {
+    connection: z.string().describe('Connection alias (e.g., "trello")'),
+    instance_id: z
+        .string()
+        .describe('Instance ID to delete (required — only for multi-instance listeners).'),
+}, async ({ connection, instance_id }) => {
+    try {
+        const result = await sendEncryptedRequest('delete_listener_instance', {
+            connection,
+            instance_id,
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * List all available connection templates with caller-specific status.
+ * Returns which connections are enabled and which secrets are configured.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('list_connection_templates', 'List all available connection templates (built-in + custom). Returns template metadata, which connections are enabled for this caller, and which secrets are configured (boolean only, never values).', { _: z.string().optional().describe('unused') }, async () => {
+    try {
+        const result = await sendEncryptedRequest('list_connection_templates', {});
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Enable or disable a connection for the authenticated caller.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('set_connection_enabled', 'Enable or disable a connection for the authenticated caller. When disabling, any running ingestors for the connection are stopped.', {
+    connection: z.string().describe('Connection alias (e.g., "github", "discord-bot")'),
+    enabled: z.boolean().describe('Whether to enable (true) or disable (false) the connection'),
+}, async ({ connection, enabled }) => {
+    try {
+        const result = await sendEncryptedRequest('set_connection_enabled', { connection, enabled });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Set or delete secrets for the authenticated caller.
+ * Uses prefixed env vars for caller isolation. Never returns secret values.
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('set_secrets', 'Set or delete secrets for the authenticated caller. Pass secret name → value pairs. Use empty string to delete a secret. Returns boolean status per secret (never values).', {
+    secrets: z
+        .record(z.string(), z.string())
+        .describe('Secret name → value pairs. Empty string deletes the secret.'),
+}, async ({ secrets }) => {
+    try {
+        const result = await sendEncryptedRequest('set_secrets', { secrets });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Check which secrets are set for the authenticated caller (never returns values).
+ */
+// eslint-disable-next-line @typescript-eslint/no-deprecated -- registerTool is not available in this SDK version
+server.tool('get_secret_status', 'Check which secrets are configured for a connection. Returns boolean status for each required and optional secret (never returns values).', {
+    connection: z.string().describe('Connection alias to check secrets for (e.g., "github")'),
+}, async ({ connection }) => {
+    try {
+        const result = await sendEncryptedRequest('get_secret_status', { connection });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: 'text', text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
 // ── Start ──────────────────────────────────────────────────────────────────
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error('[mcp-proxy] MCP Secure Proxy server started (stdio transport)');
+    // Non-blocking health check: advise user if the remote server is not reachable
+    try {
+        const config = loadProxyConfig();
+        const resp = await fetch(`${config.remoteUrl}/health`, {
+            signal: AbortSignal.timeout(3000),
+        });
+        if (resp.ok) {
+            console.error(`[mcp-proxy] Remote server reachable at ${config.remoteUrl}`);
+        }
+        else {
+            console.error(`[mcp-proxy] WARNING: Remote server at ${config.remoteUrl} returned ${resp.status}. Check server health.`);
+        }
+    }
+    catch {
+        const config = loadProxyConfig();
+        console.error(`[mcp-proxy] WARNING: Remote server at ${config.remoteUrl} is not reachable. Start it with: drawlatch start`);
+    }
 }
 main().catch((err) => {
     console.error('[mcp-proxy] Fatal error:', err);

package/dist/remote/admin-mutations.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Mutating admin API (item A), mounted behind `requireAuth` at `/api/admin/*`
+ * alongside the read-only endpoints in `admin.ts`.
+ *
+ * Every mutation reuses the canonical tool-dispatch (item D) so there is exactly
+ * one implementation of connection/secret/listener logic. Caller create/delete
+ * uses the programmatic bootstrap (item E).
+ *
+ * Security invariants (same as the read-only side):
+ *   - Secret values are write-only: set via PUT, read back only as booleans.
+ *   - No secret value, AES channel key, or process.env value is ever serialized.
+ *   - After any config mutation, the daemon's live-reload path runs so ingestors
+ *     and routes pick up the change (replacing callboard's restart banner).
+ */
+import express from 'express';
+import { type RemoteServerConfig, type ResolvedRoute } from '../shared/config.js';
+import type { IngestorManager } from './ingestors/index.js';
+export interface AdminMutationDeps {
+    ingestorManager: () => IngestorManager;
+    loadConfig: () => RemoteServerConfig;
+    /** Resolve the live routes for a caller (with secrets) for tool dispatch. */
+    resolveRoutesForCaller: (alias: string) => ResolvedRoute[];
+    /** Re-resolve routes for all active sessions of a caller (live reload). */
+    refreshCaller: (alias: string) => void;
+    /** Register/refresh the authorized peer for a newly-created caller. */
+    reloadPeer: (alias: string) => void;
+    /** Drop the authorized peer + active sessions for a deleted caller. */
+    removePeer: (alias: string) => void;
+}
+/**
+ * Mount the mutating routes onto an existing admin router.
+ *
+ * The router is already behind `requireAuth` (wired in server.ts), so these
+ * handlers can assume the request is authenticated.
+ */
+export declare function mountAdminMutations(router: express.Router, deps: AdminMutationDeps): void;
+//# sourceMappingURL=admin-mutations.d.ts.map