crewly 1.20.246 → 1.20.248

package/dist/backend/backend/src/services/connector/remote-mcp.service.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Remote MCP servers — streamable-HTTP MCP servers the owner connects once
+ * (Zoho MCP first, any other server the same way) and Crewly hands to every
+ * agent whose role may use them.
+ *
+ * Stored at `<CREWLY_HOME>/remote-mcp-servers.json` with mode 0600. The URL
+ * (Zoho's carries the server's API key) and any headers are secrets: they
+ * are never logged, never returned in full by {@link toView}, and never
+ * written into a project directory (a project `.mcp.json` would be
+ * committed). Agents get them through per-session files under CREWLY_HOME
+ * (see remote-mcp-launch.service).
+ *
+ * Each server is a gated connector `mcp:<id>` in
+ * {@link ConnectorAccessService}: open to every agent until the owner picks
+ * roles.
+ *
+ * @module services/connector/remote-mcp.service
+ */
+import { ConnectorAccessService } from './connector-access.service.js';
+/** Catalog preset a server was added from. */
+export type RemoteMcpProvider = 'zoho' | 'custom';
+/** One stored server (secrets included — never send this to a client). */
+export interface RemoteMcpServer {
+    /** Stable id; also the MCP server name agents see and the `mcp:<id>` access key. */
+    id: string;
+    /** Owner-facing name. */
+    label: string;
+    /** Streamable-HTTP endpoint (secret). */
+    url: string;
+    /** Extra request headers (secret values). */
+    headers?: Record<string, string>;
+    /** Catalog preset. */
+    provider?: RemoteMcpProvider;
+    /** ISO time it was added. */
+    createdAt: string;
+}
+/** What the API returns: no secrets. */
+export interface RemoteMcpServerView {
+    id: string;
+    label: string;
+    provider: RemoteMcpProvider;
+    /** Scheme + host only, e.g. `https://crm-123.zohomcp.com/…`. */
+    urlMasked: string;
+    /** Header names (values withheld). */
+    headerNames: string[];
+    createdAt: string;
+    /** Key of its role allowlist in connector access. */
+    connectorId: string;
+}
+/** Input for {@link RemoteMcpService.add}. */
+export interface AddRemoteMcpInput {
+    label: string;
+    url: string;
+    headers?: Record<string, string>;
+    provider?: string;
+}
+/** A validation failure the API turns into a 400. */
+export declare class RemoteMcpValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * The connector-access id of a server.
+ *
+ * @param id - Server id
+ * @returns `mcp:<id>`
+ */
+export declare function remoteMcpConnectorId(id: string): string;
+/**
+ * Show a URL without its secret parts: scheme and host only.
+ *
+ * @param url - Stored URL
+ * @returns e.g. `https://crm-123.zohomcp.com/…`, or `(hidden)` when it does not parse
+ */
+export declare function maskRemoteMcpUrl(url: string): string;
+/**
+ * Validate a server URL: https (http only for localhost), no whitespace,
+ * quotes or backslashes (it is embedded in launch files), bounded length.
+ *
+ * @param raw - Pasted URL
+ * @returns The trimmed URL
+ * @throws RemoteMcpValidationError when it is not usable (message never echoes the URL)
+ */
+export declare function validateRemoteMcpUrl(raw: unknown): string;
+/**
+ * Validate optional headers: token-shaped names, single-line values.
+ *
+ * @param raw - Headers object or undefined
+ * @returns Clean headers, or undefined when none
+ * @throws RemoteMcpValidationError on a bad name or value
+ */
+export declare function validateRemoteMcpHeaders(raw: unknown): Record<string, string> | undefined;
+/**
+ * Clean a label.
+ *
+ * @param raw - Label input
+ * @returns Trimmed label
+ * @throws RemoteMcpValidationError when empty
+ */
+export declare function normalizeRemoteMcpLabel(raw: unknown): string;
+/**
+ * Derive an id (MCP server name) from a label: lowercase slug, unique.
+ *
+ * @param label - Label
+ * @param taken - Ids already in use
+ * @returns e.g. `zoho`, `zoho-2`
+ */
+export declare function deriveRemoteMcpId(label: string, taken: Set<string>): string;
+/**
+ * Turn a stored server into its API shape.
+ *
+ * @param server - Stored server
+ * @returns The view (no URL, no header values)
+ */
+export declare function toView(server: RemoteMcpServer): RemoteMcpServerView;
+/**
+ * Reads and writes the remote MCP server store.
+ */
+export declare class RemoteMcpService {
+    private static instance;
+    private readonly logger;
+    private readonly filePath;
+    private readonly access;
+    private writeChain;
+    /**
+     * @param crewlyHome - Override the home directory (tests)
+     * @param access - Connector access service (tests)
+     */
+    constructor(crewlyHome?: string, access?: ConnectorAccessService);
+    static getInstance(): RemoteMcpService;
+    /** Reset the singleton (tests). */
+    static resetInstance(): void;
+    /** Absolute path of the store file. */
+    getFilePath(): string;
+    /**
+     * Every stored server, with secrets. Unreadable entries are dropped.
+     *
+     * @returns Servers in the order they were added
+     */
+    list(): Promise<RemoteMcpServer[]>;
+    /**
+     * One server, with secrets.
+     *
+     * @param id - Server id
+     * @returns The server or undefined
+     */
+    get(id: string): Promise<RemoteMcpServer | undefined>;
+    /**
+     * Add a server.
+     *
+     * @param input - Label, URL, optional headers and provider
+     * @returns The stored server
+     * @throws RemoteMcpValidationError on bad input or a full store
+     */
+    add(input: AddRemoteMcpInput): Promise<RemoteMcpServer>;
+    /**
+     * Rename a server (its id, and so its MCP name and allowlist, stay).
+     *
+     * @param id - Server id
+     * @param label - New label
+     * @returns The updated server, or undefined when there is none
+     */
+    rename(id: string, label: string): Promise<RemoteMcpServer | undefined>;
+    /**
+     * Remove a server and its allowlist.
+     *
+     * @param id - Server id
+     * @returns True when it existed
+     */
+    remove(id: string): Promise<boolean>;
+    /**
+     * Servers an agent role may use (its `mcp:<id>` allowlist passes).
+     *
+     * @param role - Agent role
+     * @returns Allowed servers, with secrets
+     */
+    serversForRole(role: string): Promise<RemoteMcpServer[]>;
+    /**
+     * Serialised read-modify-write; the file is written 0600.
+     *
+     * @param fn - Change to apply
+     * @returns The change's result
+     */
+    private mutate;
+}
+/**
+ * Write JSON readable only by the owner (0600), atomically.
+ *
+ * @param filePath - Destination
+ * @param data - JSON value
+ */
+export declare function writeSecretJson(filePath: string, data: unknown): Promise<void>;
+//# sourceMappingURL=remote-mcp.service.d.ts.map

package/dist/backend/backend/src/services/connector/remote-mcp.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,sBAAsB;IACtB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qDAAqD;AACrD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAkBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYzF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAI5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAM3E;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,CAUnE;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,UAAU,CAAuC;IAEzD;;;OAGG;gBACS,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,sBAAsB;IAMhE,MAAM,CAAC,WAAW,IAAI,gBAAgB;IAKtC,mCAAmC;IACnC,MAAM,CAAC,aAAa,IAAI,IAAI;IAI5B,uCAAuC;IACvC,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAqBxC;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAI3D;;;;;;OAMG;IACG,GAAG,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAe7D;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAY7E;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAY1C;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAU9D;;;;;OAKG;YACW,MAAM;CASrB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpF"}

package/dist/backend/backend/src/services/connector/remote-mcp.service.js

@@ -0,0 +1,334 @@
+/**
+ * Remote MCP servers — streamable-HTTP MCP servers the owner connects once
+ * (Zoho MCP first, any other server the same way) and Crewly hands to every
+ * agent whose role may use them.
+ *
+ * Stored at `<CREWLY_HOME>/remote-mcp-servers.json` with mode 0600. The URL
+ * (Zoho's carries the server's API key) and any headers are secrets: they
+ * are never logged, never returned in full by {@link toView}, and never
+ * written into a project directory (a project `.mcp.json` would be
+ * committed). Agents get them through per-session files under CREWLY_HOME
+ * (see remote-mcp-launch.service).
+ *
+ * Each server is a gated connector `mcp:<id>` in
+ * {@link ConnectorAccessService}: open to every agent until the owner picks
+ * roles.
+ *
+ * @module services/connector/remote-mcp.service
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { LoggerService } from '../core/logger.service.js';
+import { REMOTE_MCP_CONSTANTS } from '../../constants.js';
+import { ConnectorAccessService } from './connector-access.service.js';
+const C = REMOTE_MCP_CONSTANTS;
+/** A validation failure the API turns into a 400. */
+export class RemoteMcpValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RemoteMcpValidationError';
+    }
+}
+/**
+ * The connector-access id of a server.
+ *
+ * @param id - Server id
+ * @returns `mcp:<id>`
+ */
+export function remoteMcpConnectorId(id) {
+    return `${C.CONNECTOR_PREFIX}${id}`;
+}
+/**
+ * Show a URL without its secret parts: scheme and host only.
+ *
+ * @param url - Stored URL
+ * @returns e.g. `https://crm-123.zohomcp.com/…`, or `(hidden)` when it does not parse
+ */
+export function maskRemoteMcpUrl(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}/…`;
+    }
+    catch {
+        return '(hidden)';
+    }
+}
+/**
+ * Validate a server URL: https (http only for localhost), no whitespace,
+ * quotes or backslashes (it is embedded in launch files), bounded length.
+ *
+ * @param raw - Pasted URL
+ * @returns The trimmed URL
+ * @throws RemoteMcpValidationError when it is not usable (message never echoes the URL)
+ */
+export function validateRemoteMcpUrl(raw) {
+    const url = typeof raw === 'string' ? raw.trim() : '';
+    if (!url)
+        throw new RemoteMcpValidationError('Paste the server URL.');
+    if (url.length > C.MAX_URL_LENGTH)
+        throw new RemoteMcpValidationError('That URL is too long.');
+    if (/[\s"'`\\<>]/.test(url) || /[\u0000-\u001f\u007f]/.test(url)) {
+        throw new RemoteMcpValidationError('That URL contains spaces or quotes — paste only the URL.');
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new RemoteMcpValidationError('That is not a valid URL.');
+    }
+    const local = ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && local)) {
+        throw new RemoteMcpValidationError('The URL must start with https://');
+    }
+    return url;
+}
+/**
+ * Validate optional headers: token-shaped names, single-line values.
+ *
+ * @param raw - Headers object or undefined
+ * @returns Clean headers, or undefined when none
+ * @throws RemoteMcpValidationError on a bad name or value
+ */
+export function validateRemoteMcpHeaders(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== 'object' || Array.isArray(raw))
+        throw new RemoteMcpValidationError('headers must be an object of name → value.');
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (!/^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/.test(name))
+            throw new RemoteMcpValidationError(`Header name "${name.slice(0, 64)}" is not valid.`);
+        if (typeof value !== 'string' || /[\r\n\u0000]/.test(value) || value.length > 4096) {
+            throw new RemoteMcpValidationError(`Header "${name}" needs a single-line text value.`);
+        }
+        out[name] = value;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * Clean a label.
+ *
+ * @param raw - Label input
+ * @returns Trimmed label
+ * @throws RemoteMcpValidationError when empty
+ */
+export function normalizeRemoteMcpLabel(raw) {
+    const label = (typeof raw === 'string' ? raw : '').replace(/\s+/g, ' ').trim().slice(0, C.MAX_LABEL_LENGTH);
+    if (!label)
+        throw new RemoteMcpValidationError('Give the server a name.');
+    return label;
+}
+/**
+ * Derive an id (MCP server name) from a label: lowercase slug, unique.
+ *
+ * @param label - Label
+ * @param taken - Ids already in use
+ * @returns e.g. `zoho`, `zoho-2`
+ */
+export function deriveRemoteMcpId(label, taken) {
+    let base = label.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32);
+    if (!base || !/^[a-z0-9]/.test(base))
+        base = 'mcp';
+    let id = base;
+    for (let n = 2; taken.has(id); n++)
+        id = `${base}-${n}`;
+    return id;
+}
+/**
+ * Turn a stored server into its API shape.
+ *
+ * @param server - Stored server
+ * @returns The view (no URL, no header values)
+ */
+export function toView(server) {
+    return {
+        id: server.id,
+        label: server.label,
+        provider: server.provider ?? 'custom',
+        urlMasked: maskRemoteMcpUrl(server.url),
+        headerNames: Object.keys(server.headers ?? {}),
+        createdAt: server.createdAt,
+        connectorId: remoteMcpConnectorId(server.id),
+    };
+}
+/**
+ * Reads and writes the remote MCP server store.
+ */
+export class RemoteMcpService {
+    static instance = null;
+    logger;
+    filePath;
+    access;
+    writeChain = Promise.resolve();
+    /**
+     * @param crewlyHome - Override the home directory (tests)
+     * @param access - Connector access service (tests)
+     */
+    constructor(crewlyHome, access) {
+        this.logger = LoggerService.getInstance().createComponentLogger('RemoteMcp');
+        this.filePath = path.join(crewlyHome || getCrewlyHomePath(), C.STORE_FILE);
+        this.access = () => access ?? ConnectorAccessService.getInstance();
+    }
+    static getInstance() {
+        if (!RemoteMcpService.instance)
+            RemoteMcpService.instance = new RemoteMcpService();
+        return RemoteMcpService.instance;
+    }
+    /** Reset the singleton (tests). */
+    static resetInstance() {
+        RemoteMcpService.instance = null;
+    }
+    /** Absolute path of the store file. */
+    getFilePath() {
+        return this.filePath;
+    }
+    /**
+     * Every stored server, with secrets. Unreadable entries are dropped.
+     *
+     * @returns Servers in the order they were added
+     */
+    async list() {
+        let raw;
+        try {
+            raw = await fs.readFile(this.filePath, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return [];
+            throw err;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            this.logger.error('Remote MCP store is not valid JSON — treating it as empty', { file: this.filePath });
+            return [];
+        }
+        const servers = parsed?.servers;
+        if (!Array.isArray(servers))
+            return [];
+        return servers.filter((s) => !!s && typeof s.id === 'string' && C.ID_PATTERN.test(s.id) && typeof s.url === 'string' && typeof s.label === 'string');
+    }
+    /**
+     * One server, with secrets.
+     *
+     * @param id - Server id
+     * @returns The server or undefined
+     */
+    async get(id) {
+        return (await this.list()).find((s) => s.id === id);
+    }
+    /**
+     * Add a server.
+     *
+     * @param input - Label, URL, optional headers and provider
+     * @returns The stored server
+     * @throws RemoteMcpValidationError on bad input or a full store
+     */
+    async add(input) {
+        const label = normalizeRemoteMcpLabel(input.label);
+        const url = validateRemoteMcpUrl(input.url);
+        const headers = validateRemoteMcpHeaders(input.headers);
+        const provider = input.provider === 'zoho' ? 'zoho' : 'custom';
+        return this.mutate(async (servers) => {
+            if (servers.length >= C.MAX_SERVERS)
+                throw new RemoteMcpValidationError(`At most ${C.MAX_SERVERS} servers.`);
+            if (servers.some((s) => s.url === url))
+                throw new RemoteMcpValidationError('That server is already connected.');
+            const id = deriveRemoteMcpId(label, new Set(servers.map((s) => s.id)));
+            const server = { id, label, url, ...(headers ? { headers } : {}), provider, createdAt: new Date().toISOString() };
+            this.logger.info('Remote MCP server added', { id, provider, host: maskRemoteMcpUrl(url) });
+            return { servers: [...servers, server], result: server };
+        });
+    }
+    /**
+     * Rename a server (its id, and so its MCP name and allowlist, stay).
+     *
+     * @param id - Server id
+     * @param label - New label
+     * @returns The updated server, or undefined when there is none
+     */
+    async rename(id, label) {
+        const clean = normalizeRemoteMcpLabel(label);
+        return this.mutate(async (servers) => {
+            const idx = servers.findIndex((s) => s.id === id);
+            if (idx < 0)
+                return { servers, result: undefined };
+            const next = [...servers];
+            next[idx] = { ...next[idx], label: clean };
+            this.logger.info('Remote MCP server renamed', { id });
+            return { servers: next, result: next[idx] };
+        });
+    }
+    /**
+     * Remove a server and its allowlist.
+     *
+     * @param id - Server id
+     * @returns True when it existed
+     */
+    async remove(id) {
+        const removed = await this.mutate(async (servers) => {
+            const next = servers.filter((s) => s.id !== id);
+            return { servers: next, result: next.length !== servers.length };
+        });
+        if (removed) {
+            await this.access().removeRule(remoteMcpConnectorId(id));
+            this.logger.info('Remote MCP server removed', { id });
+        }
+        return removed;
+    }
+    /**
+     * Servers an agent role may use (its `mcp:<id>` allowlist passes).
+     *
+     * @param role - Agent role
+     * @returns Allowed servers, with secrets
+     */
+    async serversForRole(role) {
+        const servers = await this.list();
+        const out = [];
+        for (const s of servers) {
+            // An empty role must not read as "the owner" here: launch always has one.
+            if (await this.access().isAllowed(remoteMcpConnectorId(s.id), role || 'unknown'))
+                out.push(s);
+        }
+        return out;
+    }
+    /**
+     * Serialised read-modify-write; the file is written 0600.
+     *
+     * @param fn - Change to apply
+     * @returns The change's result
+     */
+    async mutate(fn) {
+        const run = this.writeChain.then(async () => {
+            const { servers, result } = await fn(await this.list());
+            await writeSecretJson(this.filePath, { servers });
+            return result;
+        });
+        this.writeChain = run.catch(() => undefined);
+        return run;
+    }
+}
+/**
+ * Write JSON readable only by the owner (0600), atomically.
+ *
+ * @param filePath - Destination
+ * @param data - JSON value
+ */
+export async function writeSecretJson(filePath, data) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
+    try {
+        await fs.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        await fs.chmod(tmp, 0o600);
+        await fs.rename(tmp, filePath);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+}
+//# sourceMappingURL=remote-mcp.service.js.map

package/dist/backend/backend/src/services/connector/remote-mcp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,CAAC,GAAG,oBAAoB,CAAC;AA2C/B,qDAAqD;AACrD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,GAAG,CAAC,CAAC,gBAAgB,GAAG,EAAE,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,cAAc;QAAE,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC/F,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,wBAAwB,CAAC,0DAA0D,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,wBAAwB,CAAC,kCAAkC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,4CAA4C,CAAC,CAAC;IACpI,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAC7I,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACnF,MAAM,IAAI,wBAAwB,CAAC,WAAW,IAAI,mCAAmC,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC5G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAkB;IACjE,IAAI,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,KAAK,CAAC;IACnD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IACxD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,MAAuB;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAC,QAAQ,GAA4B,IAAI,CAAC;IACvC,MAAM,CAAkB;IACxB,QAAQ,CAAS;IACjB,MAAM,CAA+B;IAC9C,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEzD;;;OAGG;IACH,YAAY,UAAmB,EAAE,MAA+B;QAC9D,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,sBAAsB,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,gBAAgB,CAAC,QAAQ;YAAE,gBAAgB,CAAC,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnF,OAAO,gBAAgB,CAAC,QAAQ,CAAC;IACnC,CAAC;IAED,mCAAmC;IACnC,MAAM,CAAC,aAAa;QAClB,gBAAgB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACnC,CAAC;IAED,uCAAuC;IACvC,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAI,MAAgC,EAAE,OAAO,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChD,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC5H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAwB;QAChC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAsB,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW;gBAAE,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAC,WAAW,WAAW,CAAC,CAAC;YAC7G,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,wBAAwB,CAAC,mCAAmC,CAAC,CAAC;YAChH,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,MAAM,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACnI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAa;QACpC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,0EAA0E;YAC1E,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,MAAM,CAAI,EAAsF;QAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC;IACb,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/core/credential-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA0BzD"}
+{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA6BzD"}

package/dist/backend/backend/src/services/core/credential-files.js

@@ -12,7 +12,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { getCrewlyHomePath } from './crewly-home.utils.js';
 import { getApiTokenFilePath } from './api-token.service.js';
-import { HARNESS_CONSTANTS, SLACK_AGENT_IDENTITY_CONSTANTS, SLACK_CLOUD_CONSTANTS, TELEGRAM_CONSTANTS, WHATSAPP_CONSTANTS } from '../../constants.js';
+import { HARNESS_CONSTANTS, REMOTE_MCP_CONSTANTS, SLACK_AGENT_IDENTITY_CONSTANTS, SLACK_CLOUD_CONSTANTS, TELEGRAM_CONSTANTS, WHATSAPP_CONSTANTS } from '../../constants.js';
 import { CREWLY_CONSTANTS } from '../../../../config/constants.js';
 /**
  * `~/.crewly` as the modules that ignore CREWLY_HOME build it (Slack and
@@ -55,6 +55,9 @@ export function getGuardedCredentialPaths() {
     add('credential-store', path.join(home, 'credentials'), true);
     add('whatsapp-session', path.join(home, WHATSAPP_CONSTANTS.AUTH_DIR), true);
     add('claude-accounts', path.join(home, HARNESS_CONSTANTS.CLAUDE.ACCOUNTS.DIR), true);
+    // Remote MCP server URLs carry their key (Zoho MCP); runtimes read the launch files themselves.
+    add('remote-mcp-servers', path.join(home, REMOTE_MCP_CONSTANTS.STORE_FILE), false);
+    add('remote-mcp-launch-files', path.join(home, REMOTE_MCP_CONSTANTS.RUNTIME_DIR), true);
     return out;
 }
 //# sourceMappingURL=credential-files.js.map

package/dist/backend/backend/src/services/core/credential-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5K,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,gGAAgG;IAChG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/backend/backend/src/services/worktree/docker-reclaim.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Docker reclaim for the low-disk pass.
+ *
+ * Agents that deploy build images on this machine all day; Docker Desktop's
+ * disk grew 23 GB in one night (2026-10-07) and took the Mac to 2.3 GB free
+ * while the worktree janitor found "nothing safe to delete". Only things that
+ * can be rebuilt or pulled again are removed:
+ *
+ *   - older tags of registry images (`host/repo:tag`) — the newest tag of
+ *     each repository stays, so the next build still has its layers; an image
+ *     a container uses cannot be removed (docker refuses, we move on)
+ *   - dangling images
+ *   - build cache beyond a few GB, for the default builder and every
+ *     docker-container (buildx) builder
+ *
+ * Never volumes, never containers. Skipped when the docker CLI or daemon is
+ * not there. Never throws.
+ *
+ * @module services/worktree/docker-reclaim
+ */
+/** Runs a docker command; resolves stdout, rejects on failure. */
+export type DockerExec = (args: string[], timeoutMs: number) => Promise<string>;
+/** What a reclaim did. */
+export interface DockerReclaimResult {
+    /** Docker was reachable */
+    ran: boolean;
+    /** Image tags removed */
+    removedImages: string[];
+}
+/** Build cache kept per builder. */
+export declare const DOCKER_RECLAIM_KEEP_STORAGE = "3gb";
+/**
+ * Older tags of each registry repository, newest first in `docker images`
+ * output (which lists newest first).
+ *
+ * @param listing - `docker images --format '{{.Repository}} {{.Tag}}'` output
+ * @returns `repo:tag` names to remove
+ */
+export declare function olderRegistryTags(listing: string): string[];
+/**
+ * Names of docker-container (buildx) builders.
+ *
+ * @param listing - `docker buildx ls` output
+ * @returns Builder names
+ */
+export declare function containerBuilders(listing: string): string[];
+/**
+ * Free what Docker holds that can be rebuilt or pulled again.
+ *
+ * @param exec - docker runner (tests)
+ * @returns What was done
+ */
+export declare function reclaimDocker(exec?: DockerExec): Promise<DockerReclaimResult>;
+//# sourceMappingURL=docker-reclaim.d.ts.map

package/dist/backend/backend/src/services/worktree/docker-reclaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-reclaim.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/worktree/docker-reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhF,0BAA0B;AAC1B,MAAM,WAAW,mBAAmB;IACnC,2BAA2B;IAC3B,GAAG,EAAE,OAAO,CAAC;IACb,yBAAyB;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,oCAAoC;AACpC,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAY3D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ3D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE,UAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBhG"}