crewly 1.20.280 → 1.20.281

package/dist/backend/backend/src/controllers/connector/remote-mcp-proxy.controller.js

@@ -17,6 +17,11 @@
  *    retried; when that fails the owner gets a sign-in card (throttled) and
  *    the agent gets a JSON-RPC error saying so.
  *
+ * 5. for servers with a per-tool deny list (CREW-400: no agent sends Zoho
+ *    mail) a denied `tools/call` — alone or inside a batch — is refused
+ *    without reaching the server, and denied tools are removed from
+ *    `tools/list`.
+ *
  * Nothing about the URL, token or body is logged.
  *
  * @module controllers/connector/remote-mcp-proxy.controller
@@ -29,6 +34,7 @@ import { ConnectorAccessService } from '../../services/connector/connector-acces
 import { RemoteMcpService, remoteMcpConnectorId } from '../../services/connector/remote-mcp.service.js';
 import { RemoteMcpAuthService } from '../../services/connector/remote-mcp-auth.service.js';
 import { REMOTE_MCP_CONSTANTS } from '../../constants.js';
+import { deniedToolsFor, parseRpc, isDeniedCall, isToolsList, filterToolsBody } from './remote-mcp-tool-policy.js';
 const logger = LoggerService.getInstance().createComponentLogger('RemoteMcpProxy');
 const C = REMOTE_MCP_CONSTANTS;
 /** Request headers passed upstream. */
@@ -92,7 +98,7 @@ function refuse(res, body, message, httpStatus, rpcCode = -32000) {
 export async function proxyRemoteMcp(req, res) {
     const id = String(req.params.id ?? '');
     const raw = req.rawBody;
-    const body = req.method === 'POST' ? (raw ?? (req.body && Object.keys(req.body).length ? JSON.stringify(req.body) : undefined)) : undefined;
+    let body = req.method === 'POST' ? (raw ?? (req.body && Object.keys(req.body).length ? JSON.stringify(req.body) : undefined)) : undefined;
     const identity = getCallerIdentity(req);
     if (identity.kind !== 'agent') {
         res.status(403).json({ success: false, error: 'agents_only', message: 'This endpoint is for Crewly agents. The owner manages servers in Connections.' });
@@ -116,6 +122,30 @@ export async function proxyRemoteMcp(req, res) {
         refuse(res, body, `Your role (${caller.role}) may not use ${server.label}. The owner limited it to: ${allowed.join(', ')}.`, 403);
         return;
     }
+    // Per-tool deny list: inspect what we forward, and forward exactly that
+    // (re-serialised), so a parser difference upstream cannot disagree with us.
+    const denied = deniedToolsFor(server);
+    let filterList = false;
+    if (denied.size > 0 && req.method === 'POST') {
+        const rpc = parseRpc(body);
+        if (!rpc) {
+            refuse(res, undefined, 'Only JSON-RPC requests are accepted for this server.', 400);
+            return;
+        }
+        if (rpc.messages.some((m) => isDeniedCall(m, denied))) {
+            const names = rpc.messages.filter((m) => isDeniedCall(m, denied)).map((m) => String(m.params?.name));
+            logger.warn('Remote MCP proxy: denied tool call refused', { id, session: caller.session, tool: names.join(',') });
+            const error = { code: -32000, message: C.DENIED_TOOL_MESSAGE };
+            const answers = rpc.messages.filter((m) => m.id !== undefined).map((m) => ({ jsonrpc: '2.0', id: m.id, error }));
+            if (answers.length === 0)
+                res.status(403).json({ success: false, error: C.DENIED_TOOL_MESSAGE });
+            else
+                res.status(200).json(rpc.batch ? answers : answers[0]);
+            return;
+        }
+        filterList = rpc.messages.some(isToolsList);
+        body = JSON.stringify(rpc.parsed);
+    }
     const auth = deps.auth();
     const oauth = await auth.usesOAuth(server.id);
     const needsSignIn = async () => {
@@ -179,6 +209,17 @@ export async function proxyRemoteMcp(req, res) {
         refuse(res, body, `${server.label} is unreachable right now.`, 502);
         return;
     }
+    if (filterList && upstream.status === 200) {
+        const type = upstream.headers.get('content-type') ?? '';
+        const text = filterToolsBody(await upstream.text(), type, denied);
+        for (const name of FORWARD_RESPONSE) {
+            const v = upstream.headers.get(name);
+            if (v)
+                res.setHeader(name, v);
+        }
+        res.status(200).send(text);
+        return;
+    }
     res.status(upstream.status);
     for (const name of FORWARD_RESPONSE) {
         const v = upstream.headers.get(name);

package/dist/backend/backend/src/controllers/connector/remote-mcp-proxy.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp-proxy.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/connector/remote-mcp-proxy.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAwB,MAAM,gDAAgD,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AACnF,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAE/B,uCAAuC;AACvC,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAC9G,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAkBrG,IAAI,IAAI,GAAc;IACpB,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE;IAC7C,IAAI,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,WAAW,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE;IAClD,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAyC;CACnF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6E,CAAC;QAC5G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,GAAa,EAAE,IAAwB,EAAE,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAG,CAAC,KAAK;IAC5G,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAI,GAAsC,CAAC,OAAO,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtJ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC,CAAC;QACzJ,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/G,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClI,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,KAAK,IAAI,CAAC,cAAc,CAAC,MAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,MAAM,CACJ,GAAG,EACH,IAAI,EACJ,GAAG,MAAO,CAAC,KAAK,wKAAwK,EACxL,GAAG,EACH,CAAC,CAAC,yBAAyB,CAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,CAAC,MAAqB,EAA6B,EAAE;QAChE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,qCAAqC,CAAC;QAClF,IAAI,MAAM;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC;IAEF,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnC,2EAA2E;YAC3E,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,+EAA+E,EAAE,GAAG,CAAC,CAAC;YACvH,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACtC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAsD,CAAC,CAAC;IACjG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"remote-mcp-proxy.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/connector/remote-mcp-proxy.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAwB,MAAM,gDAAgD,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnH,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AACnF,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAE/B,uCAAuC;AACvC,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAC9G,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAkBrG,IAAI,IAAI,GAAc;IACpB,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE;IAC7C,IAAI,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,WAAW,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE;IAClD,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAyC;CACnF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6E,CAAC;QAC5G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,GAAa,EAAE,IAAwB,EAAE,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAG,CAAC,KAAK;IAC5G,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAI,GAAsC,CAAC,OAAO,CAAC;IAC5D,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpJ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC,CAAC;QACzJ,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/G,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClI,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,sDAAsD,EAAE,GAAG,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClH,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACjH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;;gBAC5F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,KAAK,IAAI,CAAC,cAAc,CAAC,MAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,MAAM,CACJ,GAAG,EACH,IAAI,EACJ,GAAG,MAAO,CAAC,KAAK,wKAAwK,EACxL,GAAG,EACH,CAAC,CAAC,yBAAyB,CAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,CAAC,MAAqB,EAA6B,EAAE;QAChE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,qCAAqC,CAAC;QAClF,IAAI,MAAM;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC;IAEF,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnC,2EAA2E;YAC3E,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,+EAA+E,EAAE,GAAG,CAAC,CAAC;YACvH,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACtC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAsD,CAAC,CAAC;IACjG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/backend/backend/src/controllers/connector/remote-mcp-tool-policy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Per-tool deny policy for agents using a remote MCP server through the
+ * proxy (CREW-400): refuse `tools/call` for a denied tool and hide denied
+ * tools from `tools/list`. Pure functions; the proxy wires them in.
+ *
+ * @module controllers/connector/remote-mcp-tool-policy
+ */
+/** A parsed JSON-RPC message (loosely typed: it is agent input). */
+export type RpcMessage = {
+    id?: string | number | null;
+    method?: unknown;
+    params?: {
+        name?: unknown;
+    } & Record<string, unknown>;
+    result?: {
+        tools?: unknown;
+    } & Record<string, unknown>;
+};
+/**
+ * The denied tool names (normalised) for a server, or an empty set.
+ *
+ * @param server - The server's provider and id
+ * @returns Normalised denied names
+ */
+export declare function deniedToolsFor(server: {
+    id: string;
+    provider?: string;
+}): Set<string>;
+/**
+ * Parse a request body into its JSON-RPC messages.
+ *
+ * @param body - Raw body
+ * @returns Messages and whether it was a batch, or null when not JSON
+ */
+export declare function parseRpc(body: string | undefined): {
+    messages: RpcMessage[];
+    batch: boolean;
+    parsed: unknown;
+} | null;
+/**
+ * Is this message a call to a denied tool?
+ *
+ * @param msg - JSON-RPC message
+ * @param denied - Normalised denied names
+ * @returns True when it must be refused
+ */
+export declare function isDeniedCall(msg: RpcMessage, denied: Set<string>): boolean;
+/**
+ * Is this message a `tools/list` request?
+ *
+ * @param msg - JSON-RPC message
+ * @returns True for tools/list
+ */
+export declare function isToolsList(msg: RpcMessage): boolean;
+/**
+ * Remove denied tools from a tools/list JSON-RPC response (single or batch).
+ *
+ * @param payload - Parsed response
+ * @param denied - Normalised denied names
+ * @returns The payload with denied tools removed
+ */
+export declare function filterToolsResult(payload: unknown, denied: Set<string>): unknown;
+/**
+ * Filter an upstream tools/list body, JSON or `text/event-stream`.
+ *
+ * @param text - Upstream body
+ * @param contentType - Upstream content type
+ * @param denied - Normalised denied names
+ * @returns Filtered body (unchanged when it cannot be parsed)
+ */
+export declare function filterToolsBody(text: string, contentType: string, denied: Set<string>): string;
+//# sourceMappingURL=remote-mcp-tool-policy.d.ts.map

package/dist/backend/backend/src/controllers/connector/remote-mcp-tool-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-tool-policy.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/connector/remote-mcp-tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAO1L;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAIrF;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAUrH;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAWhF;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAmB9F"}

package/dist/backend/backend/src/controllers/connector/remote-mcp-tool-policy.js

@@ -0,0 +1,113 @@
+/**
+ * Per-tool deny policy for agents using a remote MCP server through the
+ * proxy (CREW-400): refuse `tools/call` for a denied tool and hide denied
+ * tools from `tools/list`. Pure functions; the proxy wires them in.
+ *
+ * @module controllers/connector/remote-mcp-tool-policy
+ */
+import { REMOTE_MCP_CONSTANTS } from '../../constants.js';
+/** Normalise a tool or method name for comparison. */
+function norm(name) {
+    return typeof name === 'string' ? name.normalize('NFKC').trim().toLowerCase() : '';
+}
+/**
+ * The denied tool names (normalised) for a server, or an empty set.
+ *
+ * @param server - The server's provider and id
+ * @returns Normalised denied names
+ */
+export function deniedToolsFor(server) {
+    const map = REMOTE_MCP_CONSTANTS.DENIED_AGENT_TOOLS;
+    const names = (server.provider && map[server.provider]) || map[server.id] || [];
+    return new Set(names.map(norm));
+}
+/**
+ * Parse a request body into its JSON-RPC messages.
+ *
+ * @param body - Raw body
+ * @returns Messages and whether it was a batch, or null when not JSON
+ */
+export function parseRpc(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body);
+        const batch = Array.isArray(parsed);
+        const list = (batch ? parsed : [parsed]);
+        return { messages: list.filter((m) => !!m && typeof m === 'object'), batch, parsed };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Is this message a call to a denied tool?
+ *
+ * @param msg - JSON-RPC message
+ * @param denied - Normalised denied names
+ * @returns True when it must be refused
+ */
+export function isDeniedCall(msg, denied) {
+    return norm(msg.method) === 'tools/call' && denied.has(norm(msg.params?.name));
+}
+/**
+ * Is this message a `tools/list` request?
+ *
+ * @param msg - JSON-RPC message
+ * @returns True for tools/list
+ */
+export function isToolsList(msg) {
+    return norm(msg.method) === 'tools/list';
+}
+/**
+ * Remove denied tools from a tools/list JSON-RPC response (single or batch).
+ *
+ * @param payload - Parsed response
+ * @param denied - Normalised denied names
+ * @returns The payload with denied tools removed
+ */
+export function filterToolsResult(payload, denied) {
+    const one = (m) => {
+        if (!m || typeof m !== 'object')
+            return m;
+        const msg = m;
+        if (msg.result && Array.isArray(msg.result.tools)) {
+            const tools = msg.result.tools.filter((t) => !denied.has(norm(t?.name)));
+            return { ...msg, result: { ...msg.result, tools } };
+        }
+        return m;
+    };
+    return Array.isArray(payload) ? payload.map(one) : one(payload);
+}
+/**
+ * Filter an upstream tools/list body, JSON or `text/event-stream`.
+ *
+ * @param text - Upstream body
+ * @param contentType - Upstream content type
+ * @param denied - Normalised denied names
+ * @returns Filtered body (unchanged when it cannot be parsed)
+ */
+export function filterToolsBody(text, contentType, denied) {
+    if (contentType.includes('text/event-stream')) {
+        return text
+            .split('\n')
+            .map((line) => {
+            if (!line.startsWith('data:'))
+                return line;
+            try {
+                return `data: ${JSON.stringify(filterToolsResult(JSON.parse(line.slice(5)), denied))}`;
+            }
+            catch {
+                return line;
+            }
+        })
+            .join('\n');
+    }
+    try {
+        return JSON.stringify(filterToolsResult(JSON.parse(text), denied));
+    }
+    catch {
+        return text;
+    }
+}
+//# sourceMappingURL=remote-mcp-tool-policy.js.map

package/dist/backend/backend/src/controllers/connector/remote-mcp-tool-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-tool-policy.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/connector/remote-mcp-tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,sDAAsD;AACtD,SAAS,IAAI,CAAC,IAAa;IACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyC;IACtE,MAAM,GAAG,GAAG,oBAAoB,CAAC,kBAAkB,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAChF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAc,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,MAAmB;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,MAAmB;IACrE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAW,EAAE;QAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,CAAe,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAI,GAAG,CAAC,MAAM,CAAC,KAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACxG,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,WAAmB,EAAE,MAAmB;IACpF,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI;aACR,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,IAAI,CAAC;gBACH,OAAO,SAAS,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6TjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IACpE,8DAA8D;IAC9D,OAAO,CAAC,iBAAiB,CAAmG;IAK5H,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAuuC1B,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,eAAe;IA4MvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0wE5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C,kEAAkE;IAClE,OAAO,CAAC,iBAAiB,CAA4E;IAErG;;;;;;OAMG;YACW,uBAAuB;IAsCrC;;;;;OAKG;YACW,eAAe;IAuB7B;;;;;OAKG;YACW,iCAAiC;IAgL/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAczC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsG1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAoExC;;;;OAIG;YACW,qBAAqB;IA+DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;IACH;;;;;;;OAOG;YACW,yBAAyB;YASzB,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,eAAe;YA6Cf,kBAAkB;IA2IhC;;;;;;OAMG;YACW,0BAA0B;IAkFxC;;;;;;;OAOG;YACW,wBAAwB;YAuCxB,yBAAyB;IA2FvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YA0Hf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA+W1H,SAAS,IAAI,aAAa;CAG1B;AAmCD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6TjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IACpE,8DAA8D;IAC9D,OAAO,CAAC,iBAAiB,CAAmG;IAK5H,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAuuC1B,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,eAAe;IA4MvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0wE5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C,kEAAkE;IAClE,OAAO,CAAC,iBAAiB,CAA4E;IAErG;;;;;;OAMG;YACW,uBAAuB;IAsCrC;;;;;OAKG;YACW,eAAe;IAuB7B;;;;;OAKG;YACW,iCAAiC;IAgL/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAczC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsG1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAoExC;;;;OAIG;YACW,qBAAqB;IA+DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;IACH;;;;;;;OAOG;YACW,yBAAyB;YASzB,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,eAAe;YA6Cf,kBAAkB;IA2IhC;;;;;;OAMG;YACW,0BAA0B;IAkFxC;;;;;;;OAOG;YACW,wBAAwB;YAuCxB,yBAAyB;IA2FvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YA0Hf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA+W1H,SAAS,IAAI,aAAa;CAG1B;AAyDD,eAAe,YAAY,CAAC"}

package/dist/backend/backend/src/index.js

@@ -6878,15 +6878,39 @@ if (isMainModule) {
     // A stale build throws here and stops startup — that is the point. Every
     // other outcome (unstamped build, no repository, skip flag set) only
     // warns, so this can never block a legitimate container deploy.
+    let wrongBranchAlert = null;
     try {
         assertBuildProvenance({
             log: (message) => logger.info(message),
             warn: (message) => logger.warn(message),
+            // Stale build because the live checkout sits on a non-main branch
+            // with no local changes (an agent switched it): still refuse to
+            // start, but tell the owner how to fix it instead of going quiet.
+            onWrongBranch: (_state, line) => {
+                wrongBranchAlert = line;
+            },
         });
     }
     catch (error) {
         logger.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
+        const alertLine = wrongBranchAlert;
+        if (!alertLine)
+            process.exit(1);
+        void (async () => {
+            try {
+                const { loadSlackCredentials } = await import('./services/slack/slack-credentials.service.js');
+                const { postBootOwnerAlert } = await import('./utils/boot-owner-alert.js');
+                await postBootOwnerAlert(alertLine, getCrewlyHomePath(), async () => {
+                    const creds = await loadSlackCredentials();
+                    const channel = creds?.allowedUserIds?.[0] ?? creds?.defaultChannelId;
+                    return creds && channel ? { botToken: creds.botToken, channel } : null;
+                });
+            }
+            catch {
+                /* best effort */
+            }
+            process.exit(1);
+        })();
     }
     server.start().catch((error) => {
         logger.error('Failed to start Crewly server', { error: error instanceof Error ? error.message : String(error) });