crewly 1.20.265 → 1.20.267

package/dist/backend/backend/src/services/connector/remote-mcp-oauth.js

@@ -0,0 +1,351 @@
+/**
+ * MCP authorization, client side: the protocol pieces a remote MCP server
+ * that wants OAuth needs (MCP spec "Authorization", 2025-06-18).
+ *
+ * 1. The server answers 401 with
+ *    `WWW-Authenticate: Bearer resource_metadata="<url>"` ({@link parseWwwAuthenticate}).
+ * 2. Protected resource metadata (RFC 9728) names the authorization server
+ *    ({@link fetchProtectedResourceMetadata}).
+ * 3. Authorization server metadata (RFC 8414, OpenID Connect discovery as a
+ *    fallback) gives the endpoints ({@link fetchAuthorizationServerMetadata}).
+ * 4. Dynamic client registration (RFC 7591) when the server offers it
+ *    ({@link registerClient}); otherwise the owner enters a client id.
+ * 5. Authorization code + PKCE S256 ({@link createPkcePair},
+ *    {@link buildAuthorizeUrl}), `resource` (RFC 8707) on every request.
+ * 6. Code exchange and refresh ({@link exchangeCode}, {@link refreshTokens}).
+ *
+ * Pure functions over an injectable fetch. No URL, code, token or secret
+ * ever goes into an error message.
+ *
+ * @module services/connector/remote-mcp-oauth
+ */
+import { createHash, randomBytes } from 'crypto';
+import { REMOTE_MCP_CONSTANTS } from '../../constants.js';
+const C = REMOTE_MCP_CONSTANTS;
+/** An OAuth failure. `code` is stable; the message is owner-safe. */
+export class RemoteMcpOAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RemoteMcpOAuthError';
+    }
+}
+/**
+ * Parse `WWW-Authenticate` for a Bearer challenge.
+ *
+ * @param header - Header value (may hold several challenges)
+ * @returns The Bearer challenge's parameters, or null when there is none
+ */
+export function parseWwwAuthenticate(header) {
+    if (!header)
+        return null;
+    const m = /(?:^|,\s*)Bearer\b(.*)$/i.exec(header) ?? /^\s*Bearer\b(.*)$/i.exec(header);
+    if (!m)
+        return null;
+    const params = {};
+    const re = /([A-Za-z_][A-Za-z0-9_-]*)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g;
+    let p;
+    while ((p = re.exec(m[1])) !== null)
+        params[p[1].toLowerCase()] = (p[2] ?? p[3] ?? '').replace(/\\(.)/g, '$1');
+    return {
+        ...(params['resource_metadata'] ? { resourceMetadata: params['resource_metadata'] } : {}),
+        ...(params['scope'] ? { scope: params['scope'] } : {}),
+        ...(params['error'] ? { error: params['error'] } : {}),
+    };
+}
+/**
+ * A discovery URL must be https (http only for a localhost server).
+ *
+ * @param raw - URL from a header or document
+ * @param serverUrl - The MCP server (decides whether http is acceptable)
+ * @returns The parsed URL, or null when unacceptable
+ */
+export function safeDiscoveryUrl(raw, serverUrl) {
+    if (typeof raw !== 'string' || !raw)
+        return null;
+    try {
+        const u = new URL(raw);
+        if (u.username || u.password)
+            return null;
+        if (u.protocol === 'https:')
+            return u;
+        const local = ['localhost', '127.0.0.1', '[::1]'].includes(new URL(serverUrl).hostname);
+        return u.protocol === 'http:' && local && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname) ? u : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * GET a JSON document.
+ *
+ * @param fetchImpl - fetch
+ * @param url - Where
+ * @returns The parsed object, or null on any failure
+ */
+async function getJson(fetchImpl, url) {
+    try {
+        const res = await fetchImpl(url, { method: 'GET', headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(C.OAUTH_REQUEST_TIMEOUT_MS) });
+        if (!res.ok)
+            return null;
+        const parsed = JSON.parse(await res.text());
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * RFC 9728 metadata: the URL the challenge named, else the well-known
+ * locations (path-suffixed first, then root).
+ *
+ * @param serverUrl - MCP server URL
+ * @param challenge - Parsed challenge, if any
+ * @param fetchImpl - fetch
+ * @returns The metadata, or null when the server publishes none
+ */
+export async function fetchProtectedResourceMetadata(serverUrl, challenge, fetchImpl) {
+    const candidates = [];
+    const named = safeDiscoveryUrl(challenge?.resourceMetadata, serverUrl);
+    if (named)
+        candidates.push(named.toString());
+    const u = new URL(serverUrl);
+    // The path-suffixed form would carry the server's key path (Zoho), so it
+    // is only tried when the challenge named nothing.
+    if (!named) {
+        if (u.pathname && u.pathname !== '/')
+            candidates.push(`${u.origin}/.well-known/oauth-protected-resource${u.pathname.replace(/\/$/, '')}`);
+        candidates.push(`${u.origin}/.well-known/oauth-protected-resource`);
+    }
+    for (const url of candidates) {
+        const doc = await getJson(fetchImpl, url);
+        if (doc && Array.isArray(doc.authorization_servers) && doc.authorization_servers.length > 0)
+            return doc;
+    }
+    return null;
+}
+/**
+ * RFC 8414 / OIDC discovery for an issuer, in the order the MCP spec gives.
+ *
+ * @param issuer - Authorization server issuer URL
+ * @param serverUrl - MCP server (for the https rule)
+ * @param fetchImpl - fetch
+ * @returns The metadata
+ * @throws RemoteMcpOAuthError discovery_failed | pkce_unsupported
+ */
+export async function fetchAuthorizationServerMetadata(issuer, serverUrl, fetchImpl) {
+    const base = safeDiscoveryUrl(issuer, serverUrl);
+    if (!base)
+        throw new RemoteMcpOAuthError('discovery_failed', 'The server named an authorization server that is not https.');
+    const path = base.pathname.replace(/\/$/, '');
+    const candidates = path
+        ? [
+            `${base.origin}/.well-known/oauth-authorization-server${path}`,
+            `${base.origin}/.well-known/openid-configuration${path}`,
+            `${base.origin}${path}/.well-known/openid-configuration`,
+        ]
+        : [`${base.origin}/.well-known/oauth-authorization-server`, `${base.origin}/.well-known/openid-configuration`];
+    for (const url of candidates) {
+        const doc = await getJson(fetchImpl, url);
+        if (!doc)
+            continue;
+        const auth = safeDiscoveryUrl(doc.authorization_endpoint, serverUrl);
+        const token = safeDiscoveryUrl(doc.token_endpoint, serverUrl);
+        if (!auth || !token)
+            continue;
+        const methods = doc.code_challenge_methods_supported;
+        if (Array.isArray(methods) && !methods.includes('S256')) {
+            throw new RemoteMcpOAuthError('pkce_unsupported', 'The authorization server does not support PKCE (S256), which MCP requires.');
+        }
+        const registration = safeDiscoveryUrl(doc.registration_endpoint, serverUrl);
+        return {
+            ...doc,
+            authorization_endpoint: auth.toString(),
+            token_endpoint: token.toString(),
+            ...(registration ? { registration_endpoint: registration.toString() } : { registration_endpoint: undefined }),
+        };
+    }
+    throw new RemoteMcpOAuthError('discovery_failed', 'Could not read the authorization server\'s metadata.');
+}
+/**
+ * Full discovery from a 401 challenge.
+ *
+ * @param serverUrl - MCP server URL (secret; never in errors)
+ * @param challenge - Parsed `WWW-Authenticate`, if any
+ * @param fetchImpl - fetch
+ * @returns Resource, scope, issuer and endpoints
+ * @throws RemoteMcpOAuthError discovery_failed | pkce_unsupported
+ */
+export async function discoverAuthorization(serverUrl, challenge, fetchImpl) {
+    const prm = await fetchProtectedResourceMetadata(serverUrl, challenge, fetchImpl);
+    const u = new URL(serverUrl);
+    // 2025-03-26 servers have no resource metadata: the server's origin is the AS.
+    const issuer = prm?.authorization_servers?.[0] ?? u.origin;
+    const metadata = await fetchAuthorizationServerMetadata(issuer, serverUrl, fetchImpl);
+    // `resource` from the metadata; otherwise the origin — never the full
+    // URL, whose path is the server's key on Zoho.
+    const resource = typeof prm?.resource === 'string' && prm.resource ? prm.resource : u.origin;
+    const scope = challenge?.scope
+        ?? (Array.isArray(prm?.scopes_supported) && prm.scopes_supported.length ? prm.scopes_supported.join(' ') : undefined);
+    return { resource, issuer, metadata, ...(scope ? { scope } : {}) };
+}
+/**
+ * Register Crewly as a public client (RFC 7591).
+ *
+ * @param metadata - AS metadata (must have `registration_endpoint`)
+ * @param redirectUri - The Cloud callback
+ * @param fetchImpl - fetch
+ * @returns The client
+ * @throws RemoteMcpOAuthError registration_unsupported | registration_failed
+ */
+export async function registerClient(metadata, redirectUri, fetchImpl) {
+    if (!metadata.registration_endpoint) {
+        throw new RemoteMcpOAuthError('registration_unsupported', 'This server does not let Crewly register itself. Enter a client ID from the server\'s developer console.');
+    }
+    const methods = metadata.token_endpoint_auth_methods_supported;
+    const wanted = !methods || methods.includes('none') ? 'none' : methods.includes('client_secret_post') ? 'client_secret_post' : 'client_secret_basic';
+    let res;
+    try {
+        res = await fetchImpl(metadata.registration_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({
+                client_name: C.OAUTH_CLIENT_NAME,
+                redirect_uris: [redirectUri],
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+                token_endpoint_auth_method: wanted,
+            }),
+            signal: AbortSignal.timeout(C.OAUTH_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new RemoteMcpOAuthError('network', 'Could not reach the authorization server to register Crewly.');
+    }
+    const body = (await res.text().then((t) => JSON.parse(t)).catch(() => ({})));
+    if (!res.ok || typeof body['client_id'] !== 'string' || !body['client_id']) {
+        const why = typeof body['error'] === 'string' ? ` (${String(body['error']).slice(0, 60)})` : '';
+        throw new RemoteMcpOAuthError('registration_failed', `The authorization server refused to register Crewly: ${res.status}${why}.`);
+    }
+    const secret = typeof body['client_secret'] === 'string' && body['client_secret'] ? body['client_secret'] : undefined;
+    const method = body['token_endpoint_auth_method'];
+    const tokenAuthMethod = method === 'client_secret_post' || method === 'client_secret_basic' || method === 'none'
+        ? method
+        : secret ? 'client_secret_post' : 'none';
+    return { clientId: body['client_id'], ...(secret ? { clientSecret: secret } : {}), tokenAuthMethod, redirectUri };
+}
+/**
+ * A PKCE verifier and its S256 challenge.
+ *
+ * @param random - Random source (tests)
+ * @returns `{ verifier, challenge }`
+ */
+export function createPkcePair(random = randomBytes) {
+    const verifier = random(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+/**
+ * The authorize URL, without `state` (the Cloud broker adds it).
+ *
+ * @param discovered - Discovery result
+ * @param client - Client
+ * @param challenge - PKCE challenge
+ * @returns The URL
+ */
+export function buildAuthorizeUrl(discovered, client, challenge) {
+    const u = new URL(discovered.metadata.authorization_endpoint);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('client_id', client.clientId);
+    u.searchParams.set('redirect_uri', client.redirectUri);
+    u.searchParams.set('code_challenge', challenge);
+    u.searchParams.set('code_challenge_method', 'S256');
+    u.searchParams.set('resource', discovered.resource);
+    if (discovered.scope)
+        u.searchParams.set('scope', discovered.scope);
+    // Zoho (and Google-style servers) only return a refresh token when asked.
+    u.searchParams.set('access_type', 'offline');
+    u.searchParams.set('prompt', 'consent');
+    return u.toString();
+}
+/**
+ * One token-endpoint call.
+ *
+ * @param tokenEndpoint - Endpoint
+ * @param client - Client (decides how it authenticates)
+ * @param form - Grant parameters
+ * @param fetchImpl - fetch
+ * @param now - Clock
+ * @returns Tokens
+ * @throws RemoteMcpOAuthError invalid_grant | token_failed | network
+ */
+async function tokenRequest(tokenEndpoint, client, form, fetchImpl, now) {
+    const body = new URLSearchParams({ ...form, client_id: client.clientId });
+    const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' };
+    if (client.clientSecret && client.tokenAuthMethod === 'client_secret_basic') {
+        const enc = (v) => encodeURIComponent(v).replace(/%20/g, '+');
+        headers['Authorization'] = `Basic ${Buffer.from(`${enc(client.clientId)}:${enc(client.clientSecret)}`).toString('base64')}`;
+    }
+    else if (client.clientSecret) {
+        body.set('client_secret', client.clientSecret);
+    }
+    let res;
+    try {
+        res = await fetchImpl(tokenEndpoint, { method: 'POST', headers, body: body.toString(), signal: AbortSignal.timeout(C.OAUTH_REQUEST_TIMEOUT_MS) });
+    }
+    catch {
+        throw new RemoteMcpOAuthError('network', 'Could not reach the authorization server.');
+    }
+    const data = (await res.text().then((t) => JSON.parse(t)).catch(() => ({})));
+    const error = typeof data['error'] === 'string' ? data['error'] : '';
+    if (!res.ok || error || typeof data['access_token'] !== 'string' || !data['access_token']) {
+        // Zoho answers 200 with {"error":"invalid_code"} for a dead code/refresh token.
+        if (['invalid_grant', 'invalid_code', 'invalid_token', 'unauthorized_client'].includes(error)) {
+            throw new RemoteMcpOAuthError('invalid_grant', 'The sign-in is no longer valid; the owner needs to authorize again.');
+        }
+        throw new RemoteMcpOAuthError('token_failed', `The authorization server refused the token request (${res.status}${error ? `, ${error.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 40)}` : ''}).`);
+    }
+    const expiresIn = Number(data['expires_in']);
+    return {
+        accessToken: data['access_token'],
+        ...(typeof data['refresh_token'] === 'string' && data['refresh_token'] ? { refreshToken: data['refresh_token'] } : {}),
+        expiresAt: now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1000 : C.OAUTH_DEFAULT_TOKEN_TTL_MS),
+        ...(typeof data['scope'] === 'string' ? { scope: data['scope'] } : {}),
+        tokenType: typeof data['token_type'] === 'string' ? data['token_type'] : 'Bearer',
+    };
+}
+/**
+ * Exchange an authorization code.
+ *
+ * @param args - Endpoint, client, code, verifier, resource
+ * @param fetchImpl - fetch
+ * @param now - Clock
+ * @returns Tokens
+ */
+export function exchangeCode(args, fetchImpl, now = Date.now) {
+    return tokenRequest(args.tokenEndpoint, args.client, {
+        grant_type: 'authorization_code',
+        code: args.code,
+        redirect_uri: args.client.redirectUri,
+        code_verifier: args.verifier,
+        resource: args.resource,
+    }, fetchImpl, now);
+}
+/**
+ * Refresh an access token. A server that does not rotate refresh tokens
+ * returns none; the caller keeps the old one.
+ *
+ * @param args - Endpoint, client, refresh token, resource
+ * @param fetchImpl - fetch
+ * @param now - Clock
+ * @returns Tokens
+ */
+export function refreshTokens(args, fetchImpl, now = Date.now) {
+    return tokenRequest(args.tokenEndpoint, args.client, {
+        grant_type: 'refresh_token',
+        refresh_token: args.refreshToken,
+        resource: args.resource,
+    }, fetchImpl, now);
+}
+//# sourceMappingURL=remote-mcp-oauth.js.map

package/dist/backend/backend/src/services/connector/remote-mcp-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-oauth.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAU/B,qEAAqE;AACrE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,IAAiJ,EAC1J,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAA6I;QAI1J,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AA0DD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAG,oEAAoE,CAAC;IAChF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/G,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,OAAO,CAAI,SAAqB,EAAE,GAAW;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACtJ,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QACvD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,SAAiB,EAAE,SAAiC,EAAE,SAAqB;IAC9H,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1I,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAA4B,SAAS,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAqB;IAC7G,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;IAC5H,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI;QACrB,CAAC,CAAC;YACE,GAAG,IAAI,CAAC,MAAM,0CAA0C,IAAI,EAAE;YAC9D,GAAG,IAAI,CAAC,MAAM,oCAAoC,IAAI,EAAE;YACxD,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,mCAAmC;SACzD;QACH,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,yCAAyC,EAAE,GAAG,IAAI,CAAC,MAAM,mCAAmC,CAAC,CAAC;IACjH,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAA8B,SAAS,EAAE,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,4EAA4E,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO;YACL,GAAG,GAAG;YACN,sBAAsB,EAAE,IAAI,CAAC,QAAQ,EAAE;YACvC,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE;YAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,SAAiC,EAAE,SAAqB;IACrH,MAAM,GAAG,GAAG,MAAM,8BAA8B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,MAAM,MAAM,GAAG,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACtF,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK;WACzB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,GAAI,CAAC,gBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAI,CAAC,gBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5H,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAqC,EAAE,WAAmB,EAAE,SAAqB;IACpH,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,0GAA0G,CAAC,CAAC;IACxK,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,qCAAqC,CAAC;IAC/D,MAAM,MAAM,GAAmC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACrL,IAAI,GAAoC,CAAC;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,CAAC,CAAC,iBAAiB;gBAChC,aAAa,EAAE,CAAC,WAAW,CAAC;gBAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;aACnC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,8DAA8D,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IACnI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,wDAAwD,GAAG,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,MAAM,GAAG,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClD,MAAM,eAAe,GAAmC,MAAM,KAAK,oBAAoB,IAAI,MAAM,KAAK,qBAAqB,IAAI,MAAM,KAAK,MAAM;QAC9I,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAC9H,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAgC,WAAW;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAmC,EAAE,MAAmB,EAAE,SAAiB;IAC3G,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC9D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,KAAK;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACpE,0EAA0E;IAC1E,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,MAAmB,EAAE,IAA4B,EAAE,SAAqB,EAAE,GAAiB;IAC5I,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC5H,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,KAAK,qBAAqB,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtE,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9H,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAoC,CAAC;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IACnI,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1F,gFAAgF;QAChF,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,qEAAqE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,cAAc,EAAE,uDAAuD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChM,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,cAAc,CAAW;QAC3C,GAAG,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChI,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAClH,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,QAAQ;KAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAsG,EACtG,SAAqB,EACrB,MAAoB,IAAI,CAAC,GAAG;IAE5B,OAAO,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE;QACnD,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;QACrC,aAAa,EAAE,IAAI,CAAC,QAAQ;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA4F,EAC5F,SAAqB,EACrB,MAAoB,IAAI,CAAC,GAAG;IAE5B,OAAO,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE;QACnD,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.d.ts

@@ -18,7 +18,9 @@ export type RemoteMcpProbeResult = {
     tools: string[];
 } | {
     ok: false;
-    error: string;
+    error: string; /** The server answered 401 with a Bearer challenge: it wants OAuth. */
+    needsAuth?: boolean; /** Its `WWW-Authenticate` value (no secrets: metadata URL + scope). */
+    wwwAuthenticate?: string;
 };
 /** Minimal fetch signature (injectable for tests). */
 export type FetchLike = (url: string, init: {

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp-probe.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,yBAAyB;AACzB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAC/I,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,2BAA2B;AAC3B,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAsBvG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,GAAE,SAAyC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiE1K"}
+{"version":3,"file":"remote-mcp-probe.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,yBAAyB;AACzB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,CAAC,uEAAuE;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,uEAAuE;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhO,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAC/I,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,2BAA2B;AAC3B,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAsBvG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,GAAE,SAAyC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwE1K"}

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.js

@@ -82,6 +82,7 @@ export async function probeRemoteMcp(server, fetchImpl = fetch) {
     const { url } = server;
     let sessionId = null;
     let protocolVersion = C.PROTOCOL_VERSION;
+    let challenge = null;
     const post = async (payload) => {
         const headers = {
             ...(server.headers ?? {}),
@@ -93,6 +94,8 @@ export async function probeRemoteMcp(server, fetchImpl = fetch) {
         if (payload.method !== 'initialize')
             headers['MCP-Protocol-Version'] = protocolVersion;
         const res = await fetchImpl(url, { method: 'POST', headers, body: JSON.stringify(payload), signal: AbortSignal.timeout(C.TEST_TIMEOUT_MS) });
+        if (res.status === 401)
+            challenge = res.headers.get('www-authenticate');
         const sid = res.headers.get('mcp-session-id');
         if (sid)
             sessionId = sid;
@@ -149,6 +152,11 @@ export async function probeRemoteMcp(server, fetchImpl = fetch) {
             ? (err.name === 'TimeoutError' || err.name === 'AbortError' ? 'The server did not answer in time.' : err.message)
             : String(err);
         const cause = err instanceof Error && err.cause instanceof Error ? ` (${err.cause.message})` : '';
+        // Assigned inside `post`, so TypeScript cannot see it here.
+        const seen = challenge;
+        if (seen && /\bBearer\b/i.test(seen)) {
+            return { ok: false, error: 'The server wants you to sign in (OAuth).', needsAuth: true, wwwAuthenticate: seen };
+        }
         return { ok: false, error: scrubUrl(`${raw}${cause}`, url) };
     }
 }

package/dist/backend/backend/src/services/connector/remote-mcp-probe.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp-probe.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAuB/B;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAW;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrG,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,IAAY,EAAE,EAAU;IACxE,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,4EAA4E;QAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrH,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;IAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAgD,EAAE,YAAuB,KAA6B;IACzI,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,eAAe,GAAW,CAAC,CAAC,gBAAgB,CAAC;IAEjD,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgC,EAAkE,EAAE;QACtH,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACzB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,eAAe,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7I,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,SAAS,GAAG,GAAG,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5G,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAE,MAAc,EAAE,MAA+B,EAAoC,EAAE;QACnH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,kDAAkD,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,4CAA4C,CAAC,CAAC;QACzG,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAChJ,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;YACvC,eAAe,EAAE,CAAC,CAAC,gBAAgB;YACnC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;SACjD,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAAE,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,UAA4C,CAAC;QACrE,kEAAkE;QAClE,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,KAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,IAAI,CAAC,MAAM;gBAAE,MAAM;QACrB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,OAAO,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK;YAC9B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACjH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,GAAG,GAAG,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC"}
+{"version":3,"file":"remote-mcp-probe.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-probe.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAuB/B;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAW;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrG,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,IAAY,EAAE,EAAU;IACxE,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,4EAA4E;QAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrH,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;IAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAgD,EAAE,YAAuB,KAA6B;IACzI,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,eAAe,GAAW,CAAC,CAAC,gBAAgB,CAAC;IAEjD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgC,EAAkE,EAAE;QACtH,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACzB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,eAAe,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7I,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,SAAS,GAAG,GAAG,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5G,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAE,MAAc,EAAE,MAA+B,EAAoC,EAAE;QACnH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,kDAAkD,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,4CAA4C,CAAC,CAAC;QACzG,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAChJ,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;YACvC,eAAe,EAAE,CAAC,CAAC,gBAAgB;YACnC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;SACjD,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAAE,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,UAA4C,CAAC;QACrE,kEAAkE;QAClE,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,KAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,IAAI,CAAC,MAAM;gBAAE,MAAM;QACrB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,OAAO,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK;YAC9B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACjH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,4DAA4D;QAC5D,MAAM,IAAI,GAAG,SAA0B,CAAC;QACxC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,GAAG,GAAG,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/core/credential-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA6BzD"}
+{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA+BzD"}

package/dist/backend/backend/src/services/core/credential-files.js

@@ -58,6 +58,8 @@ export function getGuardedCredentialPaths() {
     // Remote MCP server URLs carry their key (Zoho MCP); runtimes read the launch files themselves.
     add('remote-mcp-servers', path.join(home, REMOTE_MCP_CONSTANTS.STORE_FILE), false);
     add('remote-mcp-launch-files', path.join(home, REMOTE_MCP_CONSTANTS.RUNTIME_DIR), true);
+    // Remote MCP OAuth clients + tokens (encrypted with the master key).
+    add('remote-mcp-oauth', path.join(home, REMOTE_MCP_CONSTANTS.OAUTH_STORE_FILE), false);
     return out;
 }
 //# sourceMappingURL=credential-files.js.map

package/dist/backend/backend/src/services/core/credential-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5K,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,gGAAgG;IAChG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5K,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,gGAAgG;IAChG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,qEAAqE;IACrE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/backend/backend/src/services/slack/slack-file-fetch.service.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Slack file fetch — get a Slack file by link or id, even one your own bot
+ * cannot see.
+ *
+ * Slack serves a file only to members of a channel it was shared in. An
+ * agent asked to work on a colleague's file from another channel, often
+ * posted from another machine so the event never reached this one, had no
+ * way to open it. Rex asked Ella to "paste the text into the thread"
+ * instead (2026-10-08, `longform-en.md` in #pro-crewly-marketing).
+ *
+ * Order:
+ *   1. Locally, with the bot tokens this instance holds: the requesting
+ *      agent's own bot, the uploader's bot, bots of agents in the channel,
+ *      the workspace bot, then any other installed identity. The first one
+ *      `files.info` answers for downloads the file.
+ *   2. Otherwise Crewly Cloud (`POST /api/cloud/slack/files/fetch`), which
+ *      holds every bot of the account and tries them the same way.
+ *
+ * Files land in the same directory as inbound Slack attachments
+ * (`~/.crewly/tmp/slack-files/<id>-<name>`).
+ *
+ * @module services/slack/slack-file-fetch
+ */
+import { type SlackFileRef } from './slack-file-ref.js';
+/** Stable failure codes (the route maps them to HTTP statuses). */
+export type SlackFileGetErrorCode = 'validation' | 'not_visible' | 'no_file_in_message' | 'file_deleted' | 'too_large' | 'foreign_workspace' | 'cloud_unavailable' | 'slack_error';
+/** HTTP status per code. */
+export declare const SLACK_FILE_GET_STATUS: Record<SlackFileGetErrorCode, number>;
+/** A failure with a stable code. */
+export declare class SlackFileGetError extends Error {
+    readonly code: SlackFileGetErrorCode;
+    constructor(code: SlackFileGetErrorCode, message: string);
+}
+/** What the caller learns about a fetched file. */
+export interface SlackFetchedFileMeta {
+    id: string;
+    name: string;
+    mimetype: string;
+    size: number;
+    user: string | null;
+    channels: string[];
+    permalink: string | null;
+    isText: boolean;
+    /** Who could see it: `local:<session>`, `local:workspace`, or `cloud:<bot>`. */
+    via: string;
+    /** Other files on the same message (message links). */
+    otherFileIds?: string[];
+}
+/** A fetched file, saved on disk. */
+export interface SlackFetchedFile {
+    meta: SlackFetchedFileMeta;
+    localPath: string;
+}
+/** One bot token this instance may try. */
+export interface LocalTokenCandidate {
+    token: string;
+    /** For logs and the result: `<session>` or `workspace`. */
+    label: string;
+}
+/** Collaborators (injectable for tests). */
+export interface SlackFileFetchDeps {
+    /** Local bot tokens in the order to try them. */
+    localCandidates: (ref: SlackFileRef, requesterAgent?: string) => LocalTokenCandidate[] | Promise<LocalTokenCandidate[]>;
+    /** Cloud base URL and access token; null when not signed in. */
+    cloud: () => {
+        baseUrl: string;
+        token: string;
+    } | null;
+    /** Where files are written. Default `~/.crewly/tmp/slack-files`. */
+    saveDir?: string;
+    fetchImpl?: typeof fetch;
+    slackApiBase?: string;
+}
+/**
+ * The service — see module docs.
+ */
+export declare class SlackFileFetchService {
+    private readonly deps;
+    private readonly logger;
+    private readonly fetchImpl;
+    private readonly apiBase;
+    private readonly saveDir;
+    constructor(deps: SlackFileFetchDeps);
+    /**
+     * Fetch a file: locally first, then through Cloud.
+     *
+     * @param fileRef - File id, permalink, download URL or message link
+     * @param opts - `requesterAgent` (preferred bot, audit), `maxBytes` (default 25 MB)
+     * @returns Metadata and the saved path
+     * @throws {SlackFileGetError}
+     */
+    get(fileRef: string, opts?: {
+        requesterAgent?: string;
+        maxBytes?: number;
+    }): Promise<SlackFetchedFile>;
+    private getLocal;
+    private fileFromMessage;
+    private download;
+    private getViaCloud;
+    private save;
+    private slack;
+}
+/**
+ * The first lines of a text file, for a one-glance preview.
+ *
+ * @param localPath - Saved file
+ * @returns Up to PREVIEW_LINES lines / PREVIEW_CHARS characters
+ */
+export declare function previewTextFile(localPath: string): Promise<string>;
+/**
+ * The process-wide service, wired to this instance's Slack identities and
+ * Cloud sign-in. Built on first use.
+ *
+ * @returns The service
+ */
+export declare function getSlackFileFetchService(): Promise<SlackFileFetchService>;
+/** Replace the process-wide service (tests). */
+export declare function setSlackFileFetchService(service: SlackFileFetchService | null): void;
+//# sourceMappingURL=slack-file-fetch.service.d.ts.map

package/dist/backend/backend/src/services/slack/slack-file-fetch.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-file-fetch.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/slack/slack-file-fetch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAAsD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE5G,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAC7B,YAAY,GACZ,aAAa,GACb,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,CAAC;AAElB,4BAA4B;AAC5B,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CASvE,CAAC;AAEF,oCAAoC;AACpC,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAC3C,OAAO,EAAE,MAAM;CAKlB;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,eAAe,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACxH,gEAAgE;IAChE,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;GAEG;AACH,qBAAa,qBAAqB;IAMpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAEJ,IAAI,EAAE,kBAAkB;IAOrD;;;;;;;OAOG;IACG,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAiClG,QAAQ;YA+CR,eAAe;YA6Bf,QAAQ;YA6CR,WAAW;YAoEX,IAAI;YASJ,KAAK;CAuBpB;AAiCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAID;;;;;GAKG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAqC/E;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAEpF"}