crewly 1.20.265 → 1.20.267

package/dist/cli/backend/src/services/connector/remote-mcp-launch.service.d.ts

@@ -1,7 +1,12 @@
 /**
  * Hand remote MCP servers to an agent at launch.
  *
- * For each server whose `mcp:<id>` allowlist admits the agent's role:
+ * For each server whose `mcp:<id>` allowlist admits the agent's role, the
+ * agent gets the backend's proxy (`<api>/api/connectors/remote-mcp/<id>/mcp`,
+ * see remote-mcp-proxy.controller) rather than the server itself: the
+ * server URL (Zoho's carries its key) and OAuth tokens never reach an agent
+ * config. The only credential in the files is the agent's own identity
+ * (`X-Agent-Session` + badge), which the proxy checks against the allowlist.
  *
  * | Runtime | How |
  * |---|---|
@@ -27,6 +32,8 @@ export interface RemoteMcpLaunchInput {
     crewlyHome?: string;
     /** Override the store (tests). */
     service?: RemoteMcpService;
+    /** Override the backend base URL (tests). */
+    apiBaseUrl?: string;
 }
 /** What {@link buildRemoteMcpLaunchFlags} decided. */
 export interface RemoteMcpLaunchResult {
@@ -46,16 +53,33 @@ export interface RemoteMcpLaunchResult {
  */
 export declare function remoteMcpSessionDir(crewlyHome: string, sessionName: string): string;
 /**
- * Claude Code's `--mcp-config` body.
+ * The proxy URL an agent uses for a server.
+ *
+ * @param apiBaseUrl - Backend base, e.g. `http://localhost:8787`
+ * @param id - Server id
+ * @returns `<base>/api/connectors/remote-mcp/<id>/mcp`
+ */
+export declare function remoteMcpProxyUrl(apiBaseUrl: string, id: string): string;
+/**
+ * Headers that identify the agent to the proxy.
+ *
+ * @param sessionName - Agent session
+ * @returns `X-Agent-Session` and `X-Agent-Badge`
+ */
+export declare function proxyIdentityHeaders(sessionName: string): Record<string, string>;
+/**
+ * Claude Code's `--mcp-config` body: every server through the proxy.
  *
  * @param servers - Allowed servers
- * @returns `{ mcpServers: { <id>: { type: 'http', url, headers? } } }`
+ * @param sessionName - Agent session (identity headers)
+ * @param apiBaseUrl - Backend base URL
+ * @returns `{ mcpServers: { <id>: { type: 'http', url: <proxy>, headers } } }`
  */
-export declare function buildClaudeMcpConfig(servers: RemoteMcpServer[]): {
+export declare function buildClaudeMcpConfig(servers: RemoteMcpServer[], sessionName: string, apiBaseUrl: string): {
     mcpServers: Record<string, {
         type: 'http';
         url: string;
-        headers?: Record<string, string>;
+        headers: Record<string, string>;
     }>;
 };
 /**

package/dist/cli/backend/src/services/connector/remote-mcp-launch.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp-launch.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-launch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EAAE,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAIlG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sCAAsC;IACtC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,YAAY,GAAG,qBAAqB,GAAG,OAAO,CAAC;CAC1D;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGnF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;CAAE,CAMhK;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAGzE;AAaD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgD3G"}
+{"version":3,"file":"remote-mcp-launch.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-launch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,EAAE,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAMlG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sCAAsC;IACtC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,YAAY,GAAG,qBAAqB,GAAG,OAAO,CAAC;CAC1D;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGnF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;CAAE,CAMxM;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAGzE;AAaD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgD3G"}

package/dist/cli/backend/src/services/connector/remote-mcp-launch.service.js

@@ -1,7 +1,12 @@
 /**
  * Hand remote MCP servers to an agent at launch.
  *
- * For each server whose `mcp:<id>` allowlist admits the agent's role:
+ * For each server whose `mcp:<id>` allowlist admits the agent's role, the
+ * agent gets the backend's proxy (`<api>/api/connectors/remote-mcp/<id>/mcp`,
+ * see remote-mcp-proxy.controller) rather than the server itself: the
+ * server URL (Zoho's carries its key) and OAuth tokens never reach an agent
+ * config. The only credential in the files is the agent's own identity
+ * (`X-Agent-Session` + badge), which the proxy checks against the allowlist.
  *
  * | Runtime | How |
  * |---|---|
@@ -20,6 +25,8 @@ import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
 import { LoggerService } from '../core/logger.service.js';
 import { REMOTE_MCP_CONSTANTS, RUNTIME_TYPES } from '../../constants.js';
 import { RemoteMcpService, writeSecretJson } from './remote-mcp.service.js';
+import { getLocalApiBaseUrl } from '../../utils/local-api-url.utils.js';
+import { mintAgentBadge } from '../core/owner-auth.service.js';
 const C = REMOTE_MCP_CONSTANTS;
 /**
  * Quote for a POSIX shell.
@@ -42,15 +49,36 @@ export function remoteMcpSessionDir(crewlyHome, sessionName) {
     return path.join(crewlyHome, C.RUNTIME_DIR, safe);
 }
 /**
- * Claude Code's `--mcp-config` body.
+ * The proxy URL an agent uses for a server.
+ *
+ * @param apiBaseUrl - Backend base, e.g. `http://localhost:8787`
+ * @param id - Server id
+ * @returns `<base>/api/connectors/remote-mcp/<id>/mcp`
+ */
+export function remoteMcpProxyUrl(apiBaseUrl, id) {
+    return `${apiBaseUrl.replace(/\/$/, '')}/api/connectors/remote-mcp/${encodeURIComponent(id)}${C.PROXY_SUFFIX}`;
+}
+/**
+ * Headers that identify the agent to the proxy.
+ *
+ * @param sessionName - Agent session
+ * @returns `X-Agent-Session` and `X-Agent-Badge`
+ */
+export function proxyIdentityHeaders(sessionName) {
+    return { 'X-Agent-Session': sessionName, 'X-Agent-Badge': mintAgentBadge(sessionName) };
+}
+/**
+ * Claude Code's `--mcp-config` body: every server through the proxy.
  *
  * @param servers - Allowed servers
- * @returns `{ mcpServers: { <id>: { type: 'http', url, headers? } } }`
+ * @param sessionName - Agent session (identity headers)
+ * @param apiBaseUrl - Backend base URL
+ * @returns `{ mcpServers: { <id>: { type: 'http', url: <proxy>, headers } } }`
  */
-export function buildClaudeMcpConfig(servers) {
+export function buildClaudeMcpConfig(servers, sessionName, apiBaseUrl) {
     const mcpServers = {};
     for (const s of servers) {
-        mcpServers[s.id] = { type: 'http', url: s.url, ...(s.headers && Object.keys(s.headers).length ? { headers: s.headers } : {}) };
+        mcpServers[s.id] = { type: 'http', url: remoteMcpProxyUrl(apiBaseUrl, s.id), headers: proxyIdentityHeaders(sessionName) };
     }
     return { mcpServers };
 }
@@ -86,6 +114,7 @@ export async function buildRemoteMcpLaunchFlags(input) {
     const logger = LoggerService.getInstance().createComponentLogger('RemoteMcpLaunch');
     const { sessionName, role, runtimeType } = input;
     const crewlyHome = input.crewlyHome || getCrewlyHomePath();
+    const apiBaseUrl = input.apiBaseUrl || getLocalApiBaseUrl();
     const dir = remoteMcpSessionDir(crewlyHome, sessionName);
     try {
         const servers = await (input.service ?? RemoteMcpService.getInstance()).serversForRole(role);
@@ -102,20 +131,19 @@ export async function buildRemoteMcpLaunchFlags(input) {
         await fs.chmod(dir, 0o700);
         if (runtimeType === RUNTIME_TYPES.CLAUDE_CODE) {
             const file = path.join(dir, C.CLAUDE_CONFIG_FILE);
-            await writeSecretJson(file, buildClaudeMcpConfig(servers));
+            await writeSecretJson(file, buildClaudeMcpConfig(servers, sessionName, apiBaseUrl));
             logger.info('Remote MCP servers: added via --mcp-config', { sessionName, role, servers: ids });
             return { flags: ['--mcp-config', shq(file)], servers: ids };
         }
         const flags = [];
+        const headersToml = toTomlInlineTable(proxyIdentityHeaders(sessionName));
         for (const s of servers) {
             const urlFile = path.join(dir, `codex-${s.id}-url.toml`);
-            await writeSecretText(urlFile, JSON.stringify(s.url));
+            await writeSecretText(urlFile, JSON.stringify(remoteMcpProxyUrl(apiBaseUrl, s.id)));
             flags.push('-c', `"mcp_servers.${s.id}.url=$(cat ${shq(urlFile)})"`);
-            if (s.headers && Object.keys(s.headers).length > 0) {
-                const headersFile = path.join(dir, `codex-${s.id}-headers.toml`);
-                await writeSecretText(headersFile, toTomlInlineTable(s.headers));
-                flags.push('-c', `"mcp_servers.${s.id}.http_headers=$(cat ${shq(headersFile)})"`);
-            }
+            const headersFile = path.join(dir, `codex-${s.id}-headers.toml`);
+            await writeSecretText(headersFile, headersToml);
+            flags.push('-c', `"mcp_servers.${s.id}.http_headers=$(cat ${shq(headersFile)})"`);
         }
         logger.info('Remote MCP servers: added via codex -c mcp_servers', { sessionName, role, servers: ids });
         return { flags, servers: ids };

package/dist/cli/backend/src/services/connector/remote-mcp-launch.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp-launch.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-launch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAwB,MAAM,yBAAyB,CAAC;AAElG,MAAM,CAAC,GAAG,oBAAoB,CAAC;AA0B/B;;;;;GAKG;AACH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B;IAC7D,MAAM,UAAU,GAAoF,EAAE,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA2B;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACpF,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7F,uFAAuF;QACvF,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,IAAI,WAAW,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;YACzF,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACxH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3B,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBACjE,MAAM,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,uBAAuB,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6EAA6E,EAAE;YAC1F,WAAW;YACX,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"remote-mcp-launch.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-launch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAwB,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,CAAC,GAAG,oBAAoB,CAAC;AA4B/B;;;;;GAKG;AACH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,EAAU;IAC9D,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;AACjH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B,EAAE,WAAmB,EAAE,UAAkB;IACtG,MAAM,UAAU,GAAmF,EAAE,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA2B;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACpF,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,kBAAkB,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7F,uFAAuF;QACvF,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,IAAI,WAAW,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;YACzF,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACxH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3B,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACjE,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,uBAAuB,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6EAA6E,EAAE;YAC1F,WAAW;YACX,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/cli/backend/src/services/core/credential-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA6BzD"}
+{"version":3,"file":"credential-files.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,WAAW,EAAE,CA+BzD"}

package/dist/cli/backend/src/services/core/credential-files.js

@@ -58,6 +58,8 @@ export function getGuardedCredentialPaths() {
     // Remote MCP server URLs carry their key (Zoho MCP); runtimes read the launch files themselves.
     add('remote-mcp-servers', path.join(home, REMOTE_MCP_CONSTANTS.STORE_FILE), false);
     add('remote-mcp-launch-files', path.join(home, REMOTE_MCP_CONSTANTS.RUNTIME_DIR), true);
+    // Remote MCP OAuth clients + tokens (encrypted with the master key).
+    add('remote-mcp-oauth', path.join(home, REMOTE_MCP_CONSTANTS.OAUTH_STORE_FILE), false);
     return out;
 }
 //# sourceMappingURL=credential-files.js.map

package/dist/cli/backend/src/services/core/credential-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5K,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,gGAAgG;IAChG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"credential-files.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/credential-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5K,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYnE;;;;;;GAMG;AACH,SAAS,aAAa;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACxC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,QAAQ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,gGAAgG;IAChG,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,qEAAqE;IACrE,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/cli/backend/src/services/slack/slack-file-fetch.service.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Slack file fetch — get a Slack file by link or id, even one your own bot
+ * cannot see.
+ *
+ * Slack serves a file only to members of a channel it was shared in. An
+ * agent asked to work on a colleague's file from another channel, often
+ * posted from another machine so the event never reached this one, had no
+ * way to open it. Rex asked Ella to "paste the text into the thread"
+ * instead (2026-10-08, `longform-en.md` in #pro-crewly-marketing).
+ *
+ * Order:
+ *   1. Locally, with the bot tokens this instance holds: the requesting
+ *      agent's own bot, the uploader's bot, bots of agents in the channel,
+ *      the workspace bot, then any other installed identity. The first one
+ *      `files.info` answers for downloads the file.
+ *   2. Otherwise Crewly Cloud (`POST /api/cloud/slack/files/fetch`), which
+ *      holds every bot of the account and tries them the same way.
+ *
+ * Files land in the same directory as inbound Slack attachments
+ * (`~/.crewly/tmp/slack-files/<id>-<name>`).
+ *
+ * @module services/slack/slack-file-fetch
+ */
+import { type SlackFileRef } from './slack-file-ref.js';
+/** Stable failure codes (the route maps them to HTTP statuses). */
+export type SlackFileGetErrorCode = 'validation' | 'not_visible' | 'no_file_in_message' | 'file_deleted' | 'too_large' | 'foreign_workspace' | 'cloud_unavailable' | 'slack_error';
+/** HTTP status per code. */
+export declare const SLACK_FILE_GET_STATUS: Record<SlackFileGetErrorCode, number>;
+/** A failure with a stable code. */
+export declare class SlackFileGetError extends Error {
+    readonly code: SlackFileGetErrorCode;
+    constructor(code: SlackFileGetErrorCode, message: string);
+}
+/** What the caller learns about a fetched file. */
+export interface SlackFetchedFileMeta {
+    id: string;
+    name: string;
+    mimetype: string;
+    size: number;
+    user: string | null;
+    channels: string[];
+    permalink: string | null;
+    isText: boolean;
+    /** Who could see it: `local:<session>`, `local:workspace`, or `cloud:<bot>`. */
+    via: string;
+    /** Other files on the same message (message links). */
+    otherFileIds?: string[];
+}
+/** A fetched file, saved on disk. */
+export interface SlackFetchedFile {
+    meta: SlackFetchedFileMeta;
+    localPath: string;
+}
+/** One bot token this instance may try. */
+export interface LocalTokenCandidate {
+    token: string;
+    /** For logs and the result: `<session>` or `workspace`. */
+    label: string;
+}
+/** Collaborators (injectable for tests). */
+export interface SlackFileFetchDeps {
+    /** Local bot tokens in the order to try them. */
+    localCandidates: (ref: SlackFileRef, requesterAgent?: string) => LocalTokenCandidate[] | Promise<LocalTokenCandidate[]>;
+    /** Cloud base URL and access token; null when not signed in. */
+    cloud: () => {
+        baseUrl: string;
+        token: string;
+    } | null;
+    /** Where files are written. Default `~/.crewly/tmp/slack-files`. */
+    saveDir?: string;
+    fetchImpl?: typeof fetch;
+    slackApiBase?: string;
+}
+/**
+ * The service — see module docs.
+ */
+export declare class SlackFileFetchService {
+    private readonly deps;
+    private readonly logger;
+    private readonly fetchImpl;
+    private readonly apiBase;
+    private readonly saveDir;
+    constructor(deps: SlackFileFetchDeps);
+    /**
+     * Fetch a file: locally first, then through Cloud.
+     *
+     * @param fileRef - File id, permalink, download URL or message link
+     * @param opts - `requesterAgent` (preferred bot, audit), `maxBytes` (default 25 MB)
+     * @returns Metadata and the saved path
+     * @throws {SlackFileGetError}
+     */
+    get(fileRef: string, opts?: {
+        requesterAgent?: string;
+        maxBytes?: number;
+    }): Promise<SlackFetchedFile>;
+    private getLocal;
+    private fileFromMessage;
+    private download;
+    private getViaCloud;
+    private save;
+    private slack;
+}
+/**
+ * The first lines of a text file, for a one-glance preview.
+ *
+ * @param localPath - Saved file
+ * @returns Up to PREVIEW_LINES lines / PREVIEW_CHARS characters
+ */
+export declare function previewTextFile(localPath: string): Promise<string>;
+/**
+ * The process-wide service, wired to this instance's Slack identities and
+ * Cloud sign-in. Built on first use.
+ *
+ * @returns The service
+ */
+export declare function getSlackFileFetchService(): Promise<SlackFileFetchService>;
+/** Replace the process-wide service (tests). */
+export declare function setSlackFileFetchService(service: SlackFileFetchService | null): void;
+//# sourceMappingURL=slack-file-fetch.service.d.ts.map

package/dist/cli/backend/src/services/slack/slack-file-fetch.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-file-fetch.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/slack/slack-file-fetch.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAAsD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE5G,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAC7B,YAAY,GACZ,aAAa,GACb,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,CAAC;AAElB,4BAA4B;AAC5B,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CASvE,CAAC;AAEF,oCAAoC;AACpC,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAC3C,OAAO,EAAE,MAAM;CAKlB;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,eAAe,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACxH,gEAAgE;IAChE,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;GAEG;AACH,qBAAa,qBAAqB;IAMpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAEJ,IAAI,EAAE,kBAAkB;IAOrD;;;;;;;OAOG;IACG,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAiClG,QAAQ;YA+CR,eAAe;YA6Bf,QAAQ;YA6CR,WAAW;YAoEX,IAAI;YASJ,KAAK;CAuBpB;AAiCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAID;;;;;GAKG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAqC/E;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAEpF"}