crewly 1.20.247 → 1.20.249

package/dist/backend/backend/src/services/connector/remote-mcp-launch.service.js

@@ -0,0 +1,132 @@
+/**
+ * Hand remote MCP servers to an agent at launch.
+ *
+ * For each server whose `mcp:<id>` allowlist admits the agent's role:
+ *
+ * | Runtime | How |
+ * |---|---|
+ * | Claude Code | `--mcp-config '<CREWLY_HOME>/runtime/remote-mcp/<session>/claude-mcp.json'` (adds to the project `.mcp.json`; no `--strict-mcp-config`) |
+ * | Codex | `-c "mcp_servers.<id>.url=$(cat '<file>')"` (+ `http_headers`), so the secret never appears on the typed command line |
+ * | Gemini CLI, Antigravity, OpenCode, crewly-agent | skipped with a log line |
+ *
+ * Every file is written under CREWLY_HOME with mode 0600 (directory 0700),
+ * never into the project. The returned flags carry only file paths.
+ *
+ * @module services/connector/remote-mcp-launch.service
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { LoggerService } from '../core/logger.service.js';
+import { REMOTE_MCP_CONSTANTS, RUNTIME_TYPES } from '../../constants.js';
+import { RemoteMcpService, writeSecretJson } from './remote-mcp.service.js';
+const C = REMOTE_MCP_CONSTANTS;
+/**
+ * Quote for a POSIX shell.
+ *
+ * @param value - Raw value
+ * @returns Single-quoted value
+ */
+function shq(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * The per-session directory for launch files.
+ *
+ * @param crewlyHome - CREWLY_HOME
+ * @param sessionName - PTY session name
+ * @returns Absolute directory
+ */
+export function remoteMcpSessionDir(crewlyHome, sessionName) {
+    const safe = sessionName.replace(/[^A-Za-z0-9._-]/g, '_').replace(/^\.+/, '_') || '_';
+    return path.join(crewlyHome, C.RUNTIME_DIR, safe);
+}
+/**
+ * Claude Code's `--mcp-config` body.
+ *
+ * @param servers - Allowed servers
+ * @returns `{ mcpServers: { <id>: { type: 'http', url, headers? } } }`
+ */
+export function buildClaudeMcpConfig(servers) {
+    const mcpServers = {};
+    for (const s of servers) {
+        mcpServers[s.id] = { type: 'http', url: s.url, ...(s.headers && Object.keys(s.headers).length ? { headers: s.headers } : {}) };
+    }
+    return { mcpServers };
+}
+/**
+ * A TOML inline table of headers (JSON strings are valid TOML basic strings).
+ *
+ * @param headers - Header map
+ * @returns e.g. `{ "Authorization" = "Bearer x" }`
+ */
+export function toTomlInlineTable(headers) {
+    const parts = Object.entries(headers).map(([k, v]) => `${JSON.stringify(k)} = ${JSON.stringify(v)}`);
+    return `{ ${parts.join(', ')} }`;
+}
+/**
+ * Write a 0600 text file.
+ *
+ * @param file - Destination
+ * @param body - Content
+ */
+async function writeSecretText(file, body) {
+    await fs.writeFile(file, body, { encoding: 'utf8', mode: 0o600 });
+    await fs.chmod(file, 0o600);
+}
+/**
+ * Write the launch files for one agent and return the flags that load them.
+ * Never throws: on any failure the agent launches without remote MCP and
+ * the error is logged (without secrets).
+ *
+ * @param input - Session, role, runtime
+ * @returns Flags and the server ids handed over
+ */
+export async function buildRemoteMcpLaunchFlags(input) {
+    const logger = LoggerService.getInstance().createComponentLogger('RemoteMcpLaunch');
+    const { sessionName, role, runtimeType } = input;
+    const crewlyHome = input.crewlyHome || getCrewlyHomePath();
+    const dir = remoteMcpSessionDir(crewlyHome, sessionName);
+    try {
+        const servers = await (input.service ?? RemoteMcpService.getInstance()).serversForRole(role);
+        // Start clean: a server removed or a role narrowed since the last launch must be gone.
+        await fs.rm(dir, { recursive: true, force: true });
+        if (servers.length === 0)
+            return { flags: [], servers: [], skipped: 'no-servers' };
+        const ids = servers.map((s) => s.id);
+        if (runtimeType !== RUNTIME_TYPES.CLAUDE_CODE && runtimeType !== RUNTIME_TYPES.CODEX_CLI) {
+            logger.info('Remote MCP servers: not supported for this runtime — skipped', { sessionName, runtimeType, servers: ids });
+            return { flags: [], servers: [], skipped: 'unsupported-runtime' };
+        }
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+        await fs.chmod(dir, 0o700);
+        if (runtimeType === RUNTIME_TYPES.CLAUDE_CODE) {
+            const file = path.join(dir, C.CLAUDE_CONFIG_FILE);
+            await writeSecretJson(file, buildClaudeMcpConfig(servers));
+            logger.info('Remote MCP servers: added via --mcp-config', { sessionName, role, servers: ids });
+            return { flags: ['--mcp-config', shq(file)], servers: ids };
+        }
+        const flags = [];
+        for (const s of servers) {
+            const urlFile = path.join(dir, `codex-${s.id}-url.toml`);
+            await writeSecretText(urlFile, JSON.stringify(s.url));
+            flags.push('-c', `"mcp_servers.${s.id}.url=$(cat ${shq(urlFile)})"`);
+            if (s.headers && Object.keys(s.headers).length > 0) {
+                const headersFile = path.join(dir, `codex-${s.id}-headers.toml`);
+                await writeSecretText(headersFile, toTomlInlineTable(s.headers));
+                flags.push('-c', `"mcp_servers.${s.id}.http_headers=$(cat ${shq(headersFile)})"`);
+            }
+        }
+        logger.info('Remote MCP servers: added via codex -c mcp_servers', { sessionName, role, servers: ids });
+        return { flags, servers: ids };
+    }
+    catch (err) {
+        logger.error('Remote MCP servers: could not prepare launch files — launching without them', {
+            sessionName,
+            runtimeType,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return { flags: [], servers: [], skipped: 'error' };
+    }
+}
+//# sourceMappingURL=remote-mcp-launch.service.js.map

package/dist/backend/backend/src/services/connector/remote-mcp-launch.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-launch.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-launch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAwB,MAAM,yBAAyB,CAAC;AAElG,MAAM,CAAC,GAAG,oBAAoB,CAAC;AA0B/B;;;;;GAKG;AACH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B;IAC7D,MAAM,UAAU,GAAoF,EAAE,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA2B;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACpF,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7F,uFAAuF;QACvF,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,IAAI,WAAW,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;YACzF,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACxH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3B,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBACjE,MAAM,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,uBAAuB,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6EAA6E,EAAE;YAC1F,WAAW;YACX,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.d.ts

@@ -0,0 +1,75 @@
+/**
+ * "Test" for a remote MCP server: MCP `initialize`, `notifications/initialized`
+ * and `tools/list` over streamable HTTP, reporting the tool count and names.
+ *
+ * Handles both response shapes the transport allows (a JSON body or a
+ * `text/event-stream` with the reply in a `data:` line) and carries the
+ * `Mcp-Session-Id` the server hands out. Never puts the URL (or anything of
+ * its path) into a result or error.
+ *
+ * @module services/connector/remote-mcp-probe.service
+ */
+import type { RemoteMcpServer } from './remote-mcp.service.js';
+/** Result of a probe. */
+export type RemoteMcpProbeResult = {
+    ok: true;
+    serverName?: string;
+    toolCount: number;
+    tools: string[];
+} | {
+    ok: false;
+    error: string;
+};
+/** Minimal fetch signature (injectable for tests). */
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    ok: boolean;
+    headers: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+}>;
+/** A JSON-RPC response. */
+interface JsonRpcResponse {
+    jsonrpc?: string;
+    id?: number | string | null;
+    result?: Record<string, unknown>;
+    error?: {
+        code?: number;
+        message?: string;
+    };
+}
+/**
+ * Remove every trace of the URL from a message: the whole URL, its path,
+ * and any long path segment (Zoho's key is one).
+ *
+ * @param message - Raw message
+ * @param url - Server URL
+ * @returns Safe message
+ */
+export declare function scrubUrl(message: string, url: string): string;
+/**
+ * Read a JSON-RPC reply out of a JSON or SSE body.
+ *
+ * @param contentType - Response content type
+ * @param body - Response text
+ * @param id - Request id to match
+ * @returns The reply, or undefined
+ */
+export declare function parseRpcBody(contentType: string, body: string, id: number): JsonRpcResponse | undefined;
+/**
+ * Probe a server: initialize, then list its tools (following `nextCursor`
+ * up to five pages).
+ *
+ * @param server - Stored server (URL and headers)
+ * @param fetchImpl - fetch (tests)
+ * @returns Tool count and names, or a safe error
+ */
+export declare function probeRemoteMcp(server: Pick<RemoteMcpServer, 'url' | 'headers'>, fetchImpl?: FetchLike): Promise<RemoteMcpProbeResult>;
+export {};
+//# sourceMappingURL=remote-mcp-probe.service.d.ts.map

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-probe.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,yBAAyB;AACzB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAC/I,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,2BAA2B;AAC3B,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAsBvG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,GAAE,SAAyC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiE1K"}

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.js

@@ -0,0 +1,155 @@
+/**
+ * "Test" for a remote MCP server: MCP `initialize`, `notifications/initialized`
+ * and `tools/list` over streamable HTTP, reporting the tool count and names.
+ *
+ * Handles both response shapes the transport allows (a JSON body or a
+ * `text/event-stream` with the reply in a `data:` line) and carries the
+ * `Mcp-Session-Id` the server hands out. Never puts the URL (or anything of
+ * its path) into a result or error.
+ *
+ * @module services/connector/remote-mcp-probe.service
+ */
+import { REMOTE_MCP_CONSTANTS } from '../../constants.js';
+const C = REMOTE_MCP_CONSTANTS;
+/**
+ * Remove every trace of the URL from a message: the whole URL, its path,
+ * and any long path segment (Zoho's key is one).
+ *
+ * @param message - Raw message
+ * @param url - Server URL
+ * @returns Safe message
+ */
+export function scrubUrl(message, url) {
+    let out = message.split(url).join('(server URL)');
+    try {
+        const u = new URL(url);
+        if (u.pathname.length > 1)
+            out = out.split(u.pathname).join('/…');
+        for (const seg of u.pathname.split('/').filter((s) => s.length >= 8))
+            out = out.split(seg).join('…');
+        if (u.search)
+            out = out.split(u.search).join('?…');
+    }
+    catch {
+        /* unparseable URL: whole-string removal above is all we can do */
+    }
+    return out;
+}
+/**
+ * Read a JSON-RPC reply out of a JSON or SSE body.
+ *
+ * @param contentType - Response content type
+ * @param body - Response text
+ * @param id - Request id to match
+ * @returns The reply, or undefined
+ */
+export function parseRpcBody(contentType, body, id) {
+    const candidates = [];
+    if (contentType.includes('text/event-stream')) {
+        // Events are separated by blank lines; a data field may span several lines.
+        for (const event of body.split(/\r?\n\r?\n/)) {
+            const data = event.split(/\r?\n/).filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trimStart()).join('\n');
+            if (!data)
+                continue;
+            try {
+                candidates.push(JSON.parse(data));
+            }
+            catch {
+                /* not JSON — skip */
+            }
+        }
+    }
+    else {
+        try {
+            candidates.push(JSON.parse(body));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const flat = candidates.flatMap((c) => (Array.isArray(c) ? c : [c]));
+    return flat.find((m) => m && m.id === id);
+}
+/**
+ * Probe a server: initialize, then list its tools (following `nextCursor`
+ * up to five pages).
+ *
+ * @param server - Stored server (URL and headers)
+ * @param fetchImpl - fetch (tests)
+ * @returns Tool count and names, or a safe error
+ */
+export async function probeRemoteMcp(server, fetchImpl = fetch) {
+    const { url } = server;
+    let sessionId = null;
+    let protocolVersion = C.PROTOCOL_VERSION;
+    const post = async (payload) => {
+        const headers = {
+            ...(server.headers ?? {}),
+            'Content-Type': 'application/json',
+            Accept: 'application/json, text/event-stream',
+        };
+        if (sessionId)
+            headers['Mcp-Session-Id'] = sessionId;
+        if (payload.method !== 'initialize')
+            headers['MCP-Protocol-Version'] = protocolVersion;
+        const res = await fetchImpl(url, { method: 'POST', headers, body: JSON.stringify(payload), signal: AbortSignal.timeout(C.TEST_TIMEOUT_MS) });
+        const sid = res.headers.get('mcp-session-id');
+        if (sid)
+            sessionId = sid;
+        return { status: res.status, contentType: res.headers.get('content-type') ?? '', body: await res.text() };
+    };
+    const call = async (id, method, params) => {
+        const res = await post({ jsonrpc: '2.0', id, method, params });
+        if (res.status === 401 || res.status === 403) {
+            throw new Error(`The server refused the request (${res.status}). Check the URL — it may have been regenerated.`);
+        }
+        if (res.status === 404)
+            throw new Error('The server was not found (404). Check the URL.');
+        if (res.status < 200 || res.status >= 300)
+            throw new Error(`The server answered ${res.status} to ${method}.`);
+        const reply = parseRpcBody(res.contentType, res.body, id);
+        if (!reply)
+            throw new Error(`The server's reply to ${method} was not MCP (is this an MCP server URL?).`);
+        if (reply.error)
+            throw new Error(`The server returned an error for ${method}: ${String(reply.error.message ?? reply.error.code ?? 'unknown')}`);
+        return reply.result ?? {};
+    };
+    try {
+        const init = await call(1, 'initialize', {
+            protocolVersion: C.PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'crewly', version: '1.0.0' },
+        });
+        if (typeof init.protocolVersion === 'string')
+            protocolVersion = init.protocolVersion;
+        const serverInfo = init.serverInfo;
+        // Notifications get 202 and no body; a failure here is not fatal.
+        await post({ jsonrpc: '2.0', method: 'notifications/initialized' }).catch(() => undefined);
+        const names = [];
+        let cursor;
+        for (let page = 0; page < 5; page++) {
+            const result = await call(2 + page, 'tools/list', cursor ? { cursor } : {});
+            const tools = Array.isArray(result.tools) ? result.tools : [];
+            for (const t of tools)
+                if (typeof t?.name === 'string')
+                    names.push(t.name);
+            cursor = typeof result.nextCursor === 'string' && result.nextCursor ? result.nextCursor : undefined;
+            if (!cursor)
+                break;
+        }
+        return {
+            ok: true,
+            ...(typeof serverInfo?.name === 'string' ? { serverName: scrubUrl(serverInfo.name, url) } : {}),
+            toolCount: names.length,
+            tools: names.slice(0, C.MAX_TOOL_NAMES),
+        };
+    }
+    catch (err) {
+        const raw = err instanceof Error
+            ? (err.name === 'TimeoutError' || err.name === 'AbortError' ? 'The server did not answer in time.' : err.message)
+            : String(err);
+        const cause = err instanceof Error && err.cause instanceof Error ? ` (${err.cause.message})` : '';
+        return { ok: false, error: scrubUrl(`${raw}${cause}`, url) };
+    }
+}
+//# sourceMappingURL=remote-mcp-probe.service.js.map

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-probe.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAuB/B;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAW;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrG,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,IAAY,EAAE,EAAU;IACxE,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,4EAA4E;QAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrH,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;IAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAgD,EAAE,YAAuB,KAA6B;IACzI,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,eAAe,GAAW,CAAC,CAAC,gBAAgB,CAAC;IAEjD,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgC,EAAkE,EAAE;QACtH,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACzB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,eAAe,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7I,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,SAAS,GAAG,GAAG,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5G,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAE,MAAc,EAAE,MAA+B,EAAoC,EAAE;QACnH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,kDAAkD,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,4CAA4C,CAAC,CAAC;QACzG,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAChJ,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;YACvC,eAAe,EAAE,CAAC,CAAC,gBAAgB;YACnC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;SACjD,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAAE,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,UAA4C,CAAC;QACrE,kEAAkE;QAClE,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,KAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,IAAI,CAAC,MAAM;gBAAE,MAAM;QACrB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,OAAO,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK;YAC9B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACjH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,GAAG,GAAG,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/connector/remote-mcp.service.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Remote MCP servers — streamable-HTTP MCP servers the owner connects once
+ * (Zoho MCP first, any other server the same way) and Crewly hands to every
+ * agent whose role may use them.
+ *
+ * Stored at `<CREWLY_HOME>/remote-mcp-servers.json` with mode 0600. The URL
+ * (Zoho's carries the server's API key) and any headers are secrets: they
+ * are never logged, never returned in full by {@link toView}, and never
+ * written into a project directory (a project `.mcp.json` would be
+ * committed). Agents get them through per-session files under CREWLY_HOME
+ * (see remote-mcp-launch.service).
+ *
+ * Each server is a gated connector `mcp:<id>` in
+ * {@link ConnectorAccessService}: open to every agent until the owner picks
+ * roles.
+ *
+ * @module services/connector/remote-mcp.service
+ */
+import { ConnectorAccessService } from './connector-access.service.js';
+/** Catalog preset a server was added from. */
+export type RemoteMcpProvider = 'zoho' | 'custom';
+/** One stored server (secrets included — never send this to a client). */
+export interface RemoteMcpServer {
+    /** Stable id; also the MCP server name agents see and the `mcp:<id>` access key. */
+    id: string;
+    /** Owner-facing name. */
+    label: string;
+    /** Streamable-HTTP endpoint (secret). */
+    url: string;
+    /** Extra request headers (secret values). */
+    headers?: Record<string, string>;
+    /** Catalog preset. */
+    provider?: RemoteMcpProvider;
+    /** ISO time it was added. */
+    createdAt: string;
+}
+/** What the API returns: no secrets. */
+export interface RemoteMcpServerView {
+    id: string;
+    label: string;
+    provider: RemoteMcpProvider;
+    /** Scheme + host only, e.g. `https://crm-123.zohomcp.com/…`. */
+    urlMasked: string;
+    /** Header names (values withheld). */
+    headerNames: string[];
+    createdAt: string;
+    /** Key of its role allowlist in connector access. */
+    connectorId: string;
+}
+/** Input for {@link RemoteMcpService.add}. */
+export interface AddRemoteMcpInput {
+    label: string;
+    url: string;
+    headers?: Record<string, string>;
+    provider?: string;
+}
+/** A validation failure the API turns into a 400. */
+export declare class RemoteMcpValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * The connector-access id of a server.
+ *
+ * @param id - Server id
+ * @returns `mcp:<id>`
+ */
+export declare function remoteMcpConnectorId(id: string): string;
+/**
+ * Show a URL without its secret parts: scheme and host only.
+ *
+ * @param url - Stored URL
+ * @returns e.g. `https://crm-123.zohomcp.com/…`, or `(hidden)` when it does not parse
+ */
+export declare function maskRemoteMcpUrl(url: string): string;
+/**
+ * Validate a server URL: https (http only for localhost), no whitespace,
+ * quotes or backslashes (it is embedded in launch files), bounded length.
+ *
+ * @param raw - Pasted URL
+ * @returns The trimmed URL
+ * @throws RemoteMcpValidationError when it is not usable (message never echoes the URL)
+ */
+export declare function validateRemoteMcpUrl(raw: unknown): string;
+/**
+ * Validate optional headers: token-shaped names, single-line values.
+ *
+ * @param raw - Headers object or undefined
+ * @returns Clean headers, or undefined when none
+ * @throws RemoteMcpValidationError on a bad name or value
+ */
+export declare function validateRemoteMcpHeaders(raw: unknown): Record<string, string> | undefined;
+/**
+ * Clean a label.
+ *
+ * @param raw - Label input
+ * @returns Trimmed label
+ * @throws RemoteMcpValidationError when empty
+ */
+export declare function normalizeRemoteMcpLabel(raw: unknown): string;
+/**
+ * Derive an id (MCP server name) from a label: lowercase slug, unique.
+ *
+ * @param label - Label
+ * @param taken - Ids already in use
+ * @returns e.g. `zoho`, `zoho-2`
+ */
+export declare function deriveRemoteMcpId(label: string, taken: Set<string>): string;
+/**
+ * Turn a stored server into its API shape.
+ *
+ * @param server - Stored server
+ * @returns The view (no URL, no header values)
+ */
+export declare function toView(server: RemoteMcpServer): RemoteMcpServerView;
+/**
+ * Reads and writes the remote MCP server store.
+ */
+export declare class RemoteMcpService {
+    private static instance;
+    private readonly logger;
+    private readonly filePath;
+    private readonly access;
+    private writeChain;
+    /**
+     * @param crewlyHome - Override the home directory (tests)
+     * @param access - Connector access service (tests)
+     */
+    constructor(crewlyHome?: string, access?: ConnectorAccessService);
+    static getInstance(): RemoteMcpService;
+    /** Reset the singleton (tests). */
+    static resetInstance(): void;
+    /** Absolute path of the store file. */
+    getFilePath(): string;
+    /**
+     * Every stored server, with secrets. Unreadable entries are dropped.
+     *
+     * @returns Servers in the order they were added
+     */
+    list(): Promise<RemoteMcpServer[]>;
+    /**
+     * One server, with secrets.
+     *
+     * @param id - Server id
+     * @returns The server or undefined
+     */
+    get(id: string): Promise<RemoteMcpServer | undefined>;
+    /**
+     * Add a server.
+     *
+     * @param input - Label, URL, optional headers and provider
+     * @returns The stored server
+     * @throws RemoteMcpValidationError on bad input or a full store
+     */
+    add(input: AddRemoteMcpInput): Promise<RemoteMcpServer>;
+    /**
+     * Rename a server (its id, and so its MCP name and allowlist, stay).
+     *
+     * @param id - Server id
+     * @param label - New label
+     * @returns The updated server, or undefined when there is none
+     */
+    rename(id: string, label: string): Promise<RemoteMcpServer | undefined>;
+    /**
+     * Remove a server and its allowlist.
+     *
+     * @param id - Server id
+     * @returns True when it existed
+     */
+    remove(id: string): Promise<boolean>;
+    /**
+     * Servers an agent role may use (its `mcp:<id>` allowlist passes).
+     *
+     * @param role - Agent role
+     * @returns Allowed servers, with secrets
+     */
+    serversForRole(role: string): Promise<RemoteMcpServer[]>;
+    /**
+     * Serialised read-modify-write; the file is written 0600.
+     *
+     * @param fn - Change to apply
+     * @returns The change's result
+     */
+    private mutate;
+}
+/**
+ * Write JSON readable only by the owner (0600), atomically.
+ *
+ * @param filePath - Destination
+ * @param data - JSON value
+ */
+export declare function writeSecretJson(filePath: string, data: unknown): Promise<void>;
+//# sourceMappingURL=remote-mcp.service.d.ts.map

package/dist/backend/backend/src/services/connector/remote-mcp.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAIvE,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,sBAAsB;IACtB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qDAAqD;AACrD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAkBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYzF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAI5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAM3E;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,CAUnE;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,UAAU,CAAuC;IAEzD;;;OAGG;gBACS,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,sBAAsB;IAMhE,MAAM,CAAC,WAAW,IAAI,gBAAgB;IAKtC,mCAAmC;IACnC,MAAM,CAAC,aAAa,IAAI,IAAI;IAI5B,uCAAuC;IACvC,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAqBxC;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAI3D;;;;;;OAMG;IACG,GAAG,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAe7D;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAY7E;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAY1C;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAU9D;;;;;OAKG;YACW,MAAM;CASrB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpF"}