forgebadger 0.1.1 → 0.1.3

package/dist/gateway/src/services/mcp/mcp-server.js

@@ -4,7 +4,7 @@ import { toolUnavailableReason } from "../agent/tool-availability.js";
  *
  * External AI agents connect to the /mcp endpoint and invoke the same
  * platform tools the native Copilot uses. The bridge reuses the AgentTool
- * registry as-is: zod input validation, the security policy engine, the
+ * registry with MCP-only project preparation tools: zod validation, policy,
  * 48KB output cap, and — for operate tools — the platform command pipeline
  * (intent preview/decide/execute with durable receipts).
  *
@@ -13,34 +13,89 @@ import { toolUnavailableReason } from "../agent/tool-availability.js";
  * authorization — intents are previewed and approved inline with
  * `owner_action` authority (the same authority the Web console uses).
  * Operations the security policy marks as high-risk approval-gated are
- * refused instead of auto-approved. Tools the owner disabled in the Copilot
+ * refused except for root-bound project creation. Tools disabled in the Copilot
  * capability settings are hidden and rejected here too.
  */
 import { randomUUID } from "node:crypto";
+import { PlatformActionRepository } from "../../db/repositories/platform-action-repository.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { CopilotToolPreferenceRepository } from "../../db/repositories/copilot-tool-preference-repository.js";
+import { McpTokenRepository } from "../../db/repositories/mcp-token-repository.js";
+import { SessionRepository } from "../../db/repositories/session-repository.js";
+import { ProjectRepository } from "../../db/repositories/project-repository.js";
+import { ProjectManagerRepository } from "../../db/repositories/project-manager-repository.js";
 import { createSecurityPolicy, logSecurityDecision } from "../agent/security-policy.js";
+import { redactAgentErrorMessage, redactAgentValue } from "../agent/redaction.js";
 import { executeAgentTool, zodToJsonSchema } from "../agent/tool-registry.js";
 import { createPlatformTools } from "../agent/tools/index.js";
+import { createMcpProjectTools } from "../agent/tools/projects.js";
 import { agentActionInput, agentActions, TOOL_COMMANDS } from "../platform-commands/agent-actions.js";
+import { canonicalRoot } from "../platform-commands/actions.js";
 import { checkAgentScope } from "../platform-commands/agent-scope.js";
-/** CLI-control tools stay Copilot-only: MCP tokens never dispatch into terminals. */
-const MCP_EXCLUDED_TOOLS = new Set(["dispatch_task_to_session", "pm_execute_task_packet"]);
+import { resolveTaskPacketSession } from "../project-manager/task-packets.js";
+import { assertMcpTokenAuthority } from "./token-authority.js";
+const MCP_CLI_TOOLS = new Set(["pm_execute_task_packet", "import_project", "apply_project_config", "list_templates", "preview_project_config"]);
+const MCP_SCOPED_TOOLS = new Set([
+    "list_projects", "get_project", "list_sessions", "get_session", "get_session_output", "get_session_writer",
+    "list_templates", "preview_project_config", "create_project", "import_project",
+    "apply_project_config", "pm_create_work_item", "pm_update_work_item",
+    "pm_prepare_task_packet", "pm_execute_task_packet", "pm_get_task_packet",
+    "pm_list_task_packets", "pm_get_task_progress", "pm_close_task",
+    "pm_get_goal", "pm_get_work_item", "pm_get_management", "pm_list_ledger", "pm_update_management",
+    "list_project_files", "read_project_file", "project_graph_search",
+    "project_graph_symbol_detail", "project_graph_impact", "project_graph_affected_paths",
+    "start_session", "stop_session", "update_project"
+]);
+// Existing-project grants cannot create new project identities or read global catalogs.
+const MCP_SELECTED_PROJECT_EXCLUDED = new Set(["create_project", "import_project", "list_templates"]);
+// A new Copilot capability must not silently expand existing external credentials.
+// Listing, execution lookup and discovery use this same explicit capability table.
+const MCP_ALLOWED_TOOLS = new Set([...MCP_SCOPED_TOOLS,
+    'get_project_git_status', 'read_project_diff', 'research_project', 'search_project_files',
+    'list_development_tasks', 'get_development_task', 'pm_overview', 'list_playbooks',
+    'load_playbook', 'read_skill_resource', 'search_memory', 'list_memory', 'write_memory', 'get_usage_summary'
+]);
+function usesSelectedProjects(deps) {
+    return new McpTokenRepository(deps.db).findActiveById(deps.tokenId, deps.userId)?.allowedProjects != null;
+}
+const operationIdPattern = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/;
 export function buildMcpServer(deps) {
     const preferences = new CopilotToolPreferenceRepository(deps.db, deps.userId);
     const canOperate = deps.scopes.includes("operate");
-    const tools = createPlatformTools().filter((tool) => (tool.risk === "read" || canOperate) && preferences.isEnabled(tool.name) && !toolUnavailableReason(tool.name, !!deps.sessionManager) && !MCP_EXCLUDED_TOOLS.has(tool.name));
+    const canDispatch = canOperate && deps.scopes.includes("cli_dispatch");
+    const selectedProjects = usesSelectedProjects(deps);
+    const scoped = canDispatch || selectedProjects;
+    const candidates = [...createPlatformTools(), ...createMcpProjectTools()];
+    const tools = candidates.filter((tool) => MCP_ALLOWED_TOOLS.has(tool.name) && (tool.risk === "read" || canOperate) && preferences.isEnabled(tool.name) && !toolUnavailableReason(tool.name, !!deps.sessionManager) && (!MCP_CLI_TOOLS.has(tool.name) || canDispatch) && (!scoped || MCP_SCOPED_TOOLS.has(tool.name)) && (!selectedProjects || !MCP_SELECTED_PROJECT_EXCLUDED.has(tool.name)));
     const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
     const server = new Server({ name: "forgebadger-gateway", version: deps.appVersion }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
-        tools: tools.map((tool) => ({
-            name: tool.name,
-            description: tool.description,
-            inputSchema: tool.modelInputSchema ?? zodToJsonSchema(tool.inputSchema)
-        }))
+        tools: [...tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: mcpInputSchema(tool, canDispatch)
+            })), ...(canDispatch ? [{ name: "get_mcp_operation", description: "Read the durable receipt for a prior MCP operationId without replaying it.", inputSchema: { type: "object", properties: { operationId: { type: "string" } }, required: ["operationId"], additionalProperties: false } }] : [])]
     }));
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        if (request.params.name === "get_mcp_operation" && canDispatch) {
+            try {
+                const operationId = request.params.arguments?.operationId;
+                if (typeof operationId !== "string" || !operationIdPattern.test(operationId))
+                    throw new Error("Invalid operationId");
+                assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId);
+                const actions = new PlatformActionRepository(deps.db, deps.userId);
+                const intent = actions.byKey(mcpOperationKey(deps.tokenId, operationId));
+                if (!intent)
+                    return { content: [{ type: "text", text: JSON.stringify({ found: false }) }] };
+                assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, JSON.parse(intent.resources_json));
+                const receipt = actions.receipt(intent.id);
+                return { content: [{ type: "text", text: JSON.stringify({ found: true, intentId: intent.id, status: intent.status, receipt: receipt ? { outcome: receipt.outcome, createdAt: receipt.createdAt } : null }) }] };
+            }
+            catch (error) {
+                return { isError: true, content: [{ type: "text", text: redactAgentErrorMessage(error instanceof Error ? error.message : "Tool execution failed") }] };
+            }
+        }
         const tool = toolsByName.get(request.params.name);
         if (!tool) {
             return {
@@ -50,30 +105,47 @@ export function buildMcpServer(deps) {
         }
         try {
             const output = await executeMcpTool(tool, request.params.arguments ?? {}, deps);
-            return { content: [{ type: "text", text: JSON.stringify(output) }] };
+            return { content: [{ type: "text", text: JSON.stringify(redactAgentValue(output)) }] };
         }
         catch (error) {
             return {
                 isError: true,
-                content: [{ type: "text", text: error instanceof Error ? error.message : "Tool execution failed" }]
+                content: [{ type: "text", text: redactAgentErrorMessage(error instanceof Error ? error.message : "Tool execution failed") }]
             };
         }
     });
     return server;
 }
 async function executeMcpTool(tool, rawInput, deps) {
-    const parsed = tool.inputSchema.safeParse(rawInput);
+    assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId);
+    const hasCliScope = deps.scopes.includes("cli_dispatch");
+    const selectedProjects = usesSelectedProjects(deps);
+    const scoped = hasCliScope || selectedProjects;
+    const operationId = tool.risk === "operate" && hasCliScope && rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)
+        ? rawInput.operationId : undefined;
+    if (tool.risk === "operate" && hasCliScope && (typeof operationId !== "string" || !operationIdPattern.test(operationId))) {
+        throw new Error("A stable operationId is required for MCP writes");
+    }
+    const toolInput = operationId === undefined ? rawInput : Object.fromEntries(Object.entries(rawInput).filter(([key]) => key !== "operationId"));
+    const parsed = tool.inputSchema.safeParse(toolInput);
     if (!parsed.success) {
         throw new Error("Tool input is invalid");
     }
+    if (scoped && tool.risk === "read")
+        assertMcpReadInput(deps, tool.name, parsed.data);
     const context = {
         userId: deps.userId,
         db: deps.db,
         masterKey: deps.masterKey,
-        availableToolNames: createPlatformTools().filter(candidate => (candidate.risk === "read" || deps.scopes.includes("operate")) &&
+        ...(scoped && (tool.name === "list_projects" || tool.name === "list_sessions") ? { allowedProjectIds: allowedMcpProjectIds(deps) } : {}),
+        externalAuthorize: (resources) => assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, resources),
+        availableToolNames: [...createPlatformTools(), ...createMcpProjectTools()].filter(candidate => (candidate.risk === "read" || deps.scopes.includes("operate")) &&
             new CopilotToolPreferenceRepository(deps.db, deps.userId).isEnabled(candidate.name) &&
             !toolUnavailableReason(candidate.name, !!deps.sessionManager) &&
-            !MCP_EXCLUDED_TOOLS.has(candidate.name)).map(candidate => candidate.name),
+            MCP_ALLOWED_TOOLS.has(candidate.name) &&
+            (!MCP_CLI_TOOLS.has(candidate.name) || (deps.scopes.includes("operate") && hasCliScope)) &&
+            (!scoped || MCP_SCOPED_TOOLS.has(candidate.name)) &&
+            (!selectedProjects || !MCP_SELECTED_PROJECT_EXCLUDED.has(candidate.name))).map(candidate => candidate.name),
         ...(deps.sessionManager ? { sessionManager: deps.sessionManager } : {}),
         ...(deps.adapterCommandRunner ? { adapterCommandRunner: deps.adapterCommandRunner } : {})
     };
@@ -93,6 +165,10 @@ async function executeMcpTool(tool, rawInput, deps) {
         input: parsed.data
     };
     const decision = policy.evaluate(policyInput);
+    const rootScopedCreate = tool.name === "create_project" && hasCliScope && typeof parsed.data.path === "string";
+    if (rootScopedCreate) {
+        assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, { projectIds: [], rootPaths: [canonicalRoot(parsed.data.path)], revision: "" });
+    }
     logSecurityDecision({
         db: deps.db,
         userId: deps.userId,
@@ -105,7 +181,7 @@ async function executeMcpTool(tool, rawInput, deps) {
     // (there is no human in the loop to approve them). High-risk operations the
     // policy says a human must confirm are refused outright instead.
     if (decision.action === "deny" ||
-        (decision.action === "require_approval" && decision.riskClass === "high")) {
+        (decision.action === "require_approval" && decision.riskClass === "high" && !rootScopedCreate)) {
         throw new Error(`Denied by security policy: ${decision.reason}`);
     }
     if (tool.risk === "operate") {
@@ -114,21 +190,120 @@ async function executeMcpTool(tool, rawInput, deps) {
             throw new Error("Tool requires interactive approval and is unavailable over MCP");
         }
         const actions = agentActions(context);
-        let intent = actions.preview({
+        const intent = actions.preview({
             commandId,
             input: agentActionInput(tool.name, parsed.data, context),
-            idempotencyKey: randomUUID(),
-            authority: "owner_action"
+            idempotencyKey: typeof operationId === "string" ? mcpOperationKey(deps.tokenId, operationId) : randomUUID()
         });
-        if (intent.status === "pending") {
-            intent = actions.decide(intent.id, intent.digest, true);
-        }
         context.platformIntentId = intent.id;
     }
     const result = await executeAgentTool(tool, parsed.data, context);
     if (!result.ok) {
         throw new Error(result.error ?? "Tool execution failed");
     }
+    if (typeof context.platformIntentId === "string") {
+        const receipt = new PlatformActionRepository(deps.db, deps.userId).receipt(context.platformIntentId);
+        if (receipt && receipt.outcome !== "confirmed")
+            throw new Error(`MCP operation outcome ${receipt.outcome}; inspect get_mcp_operation before retrying`);
+    }
+    if (scoped && tool.risk === "read") {
+        assertMcpReadInput(deps, tool.name, parsed.data);
+        return filterMcpReadOutput(deps, tool.name, result.output);
+    }
     return result.output;
 }
+function assertMcpReadInput(deps, name, input) {
+    const values = input;
+    if (typeof values.projectId === "string") {
+        assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, { projectIds: [values.projectId], revision: "" });
+        const repo = new ProjectManagerRepository(deps.db, deps.userId);
+        if (name === "pm_list_task_packets") {
+            const items = repo.listWorkItems(values.projectId, typeof values.limit === "number" ? { limit: values.limit } : {});
+            for (const item of items)
+                assertMcpTaskSession(deps, values.projectId, item);
+        }
+        else if (["pm_get_task_packet", "pm_get_task_progress", "pm_get_work_item"].includes(name) && typeof values.workItemId === "string") {
+            const item = repo.getWorkItem(values.projectId, values.workItemId);
+            if (item)
+                assertMcpTaskSession(deps, values.projectId, item);
+        }
+        return;
+    }
+    if (typeof values.sessionId === "string") {
+        const session = new SessionRepository(deps.db, deps.userId).getById(values.sessionId);
+        if (session)
+            assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, {
+                projectIds: [session.projectId], rootPaths: [session.workingDir], revision: ""
+            });
+        return;
+    }
+    if (!["list_projects", "list_sessions", "list_templates"].includes(name))
+        throw new Error("MCP read requires a project or session ID");
+}
+function assertMcpTaskSession(deps, projectId, item) {
+    const session = resolveTaskPacketSession(deps.db, deps.userId, projectId, item);
+    if (!session)
+        return;
+    assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, {
+        projectIds: [projectId], rootPaths: [session.workingDir], revision: ""
+    });
+}
+function filterMcpReadOutput(deps, name, value) {
+    if (name !== "list_projects" && name !== "list_sessions")
+        return value;
+    const result = value;
+    const key = name === "list_projects" ? "projects" : "sessions";
+    const rows = result[key];
+    if (!Array.isArray(rows))
+        throw new Error("Scoped MCP list is too large; narrow the request");
+    const visible = rows.filter((row) => {
+        if (!row || typeof row !== "object")
+            return false;
+        const record = row;
+        const projectId = name === "list_projects" ? record.id : record.projectId;
+        if (typeof projectId !== "string")
+            return false;
+        try {
+            const session = name === "list_sessions" && typeof record.id === "string"
+                ? new SessionRepository(deps.db, deps.userId).getById(record.id)
+                : undefined;
+            if (name === "list_sessions" && !session)
+                return false;
+            assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, {
+                projectIds: [projectId], ...(session ? { rootPaths: [session.workingDir] } : {}), revision: ""
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId);
+    return { ...result, [key]: visible, count: visible.length };
+}
+function allowedMcpProjectIds(deps) {
+    const ids = [];
+    for (const project of new ProjectRepository(deps.db, deps.userId).list()) {
+        try {
+            assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId, { projectIds: [project.id], revision: "" });
+            ids.push(project.id);
+        }
+        catch { /* Only canonical projects in the token root are listed. */ }
+    }
+    assertMcpTokenAuthority(deps.db, deps.userId, deps.tokenId);
+    return ids;
+}
+function mcpOperationKey(tokenId, operationId) {
+    return `mcp:${tokenId}:${operationId}`;
+}
+function mcpInputSchema(tool, hasCliScope) {
+    const schema = tool.modelInputSchema ?? zodToJsonSchema(tool.inputSchema);
+    if (tool.risk !== "operate" || !hasCliScope)
+        return schema;
+    return {
+        ...schema,
+        properties: { ...schema.properties, operationId: { type: "string", description: "Stable caller-generated ID; reuse on retry and inspect get_mcp_operation before any new attempt." } },
+        required: [...(Array.isArray(schema.required) ? schema.required : []), "operationId"]
+    };
+}
 //# sourceMappingURL=mcp-server.js.map

package/dist/gateway/src/services/mcp/mcp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../../../../src/services/mcp/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAI9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAA4B,MAAM,6BAA6B,CAAC;AAClH,OAAO,EACL,gBAAgB,EAChB,eAAe,EAGhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAY3F,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,WAAW,GAAG,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CACrL,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EACzD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;SACxE,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gCAAgC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;aAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,QAAiB,EAAE,IAAmB;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAC3D,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;YACnF,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7D,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CACxC,CAAC,GAAG,CAAC,SAAS,CAAA,EAAE,CAAA,SAAS,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;IACF,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAK,MAAM,CAAC,IAA2B,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAwB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,KAAK,EAAE,MAAM,CAAC,IAAI;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,mBAAmB,CAAC;QAClB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjE,IACE,QAAQ,CAAC,MAAM,KAAK,MAAM;QAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAC3B,SAAS;YACT,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;YACxD,cAAc,EAAE,UAAU,EAAE;YAC5B,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC"}
+{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../../../../src/services/mcp/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAsB,MAAM,+CAA+C,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAA+B,MAAM,qDAAqD,CAAC;AAG5H,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAA4B,MAAM,6BAA6B,CAAC;AAClH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,eAAe,EAGhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAChJ,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB;IAC1G,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,gBAAgB;IAC9E,sBAAsB,EAAE,qBAAqB,EAAE,qBAAqB;IACpE,wBAAwB,EAAE,wBAAwB,EAAE,oBAAoB;IACxE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe;IAC/D,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,sBAAsB;IAChG,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB;IACjE,6BAA6B,EAAE,sBAAsB,EAAE,8BAA8B;IACrF,eAAe,EAAE,cAAc,EAAE,gBAAgB;CAClD,CAAC,CAAC;AACH,wFAAwF;AACxF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEtG,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB;IACpD,wBAAwB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB;IACzF,wBAAwB,EAAE,sBAAsB,EAAE,aAAa,EAAE,gBAAgB;IACjF,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB;CAC5G,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,IAAmB;IAC/C,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,IAAI,IAAI,CAAC;AAC5G,CAAC;AAED,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAa9D,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,WAAW,GAAG,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,IAAI,gBAAgB,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,mBAAmB,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC7V,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EACzD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;aAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,4EAA4E,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACnS,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,WAAW,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,WAAW,GAAI,OAAO,CAAC,MAAM,CAAC,SAAmD,EAAE,WAAW,CAAC;gBACrG,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACrH,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrG,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3N,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,CAAC;YAClK,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gCAAgC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC;aACtI,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,QAAiB,EAAE,IAAmB;IACnF,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,IAAI,gBAAgB,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChI,CAAC,CAAE,QAAoC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC;IAC1K,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAErF,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxI,iBAAiB,EAAE,CAAC,SAAoE,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QACnK,kBAAkB,EAAE,CAAC,GAAG,mBAAmB,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAC5F,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;YACnF,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7D,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,CAAC;YACxF,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC,CAAC,gBAAgB,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAC1E,CAAC,GAAG,CAAC,SAAS,CAAA,EAAE,CAAA,SAAS,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;IACF,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAK,MAAM,CAAC,IAA2B,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAwB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,KAAK,EAAE,MAAM,CAAC,IAAI;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,WAAW,IAAI,OAAQ,MAAM,CAAC,IAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvI,IAAI,gBAAgB,EAAE,CAAC;QACrB,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,aAAa,CAAE,MAAM,CAAC,IAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,mBAAmB,CAAC;QAClB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjE,IACE,QAAQ,CAAC,MAAM,KAAK,MAAM;QAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAC9F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAC7B,SAAS;YACT,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;YACxD,cAAc,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;SAC5G,CAAC,CAAC;QACH,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACrG,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,OAAO,6CAA6C,CAAC,CAAC;IACzJ,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACnC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAmB,EAAE,IAAY,EAAE,KAAc;IAC3E,MAAM,MAAM,GAAG,KAA4F,CAAC;IAC5G,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpH,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACtI,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,IAAI;gBAAE,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,OAAO;YAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvE,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE;aAC/E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AACzI,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAmB,EAAE,SAAiB,EAAE,IAA4B;IAChG,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;QAC1D,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE;KACvE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAmB,EAAE,IAAY,EAAE,KAAc;IAC5E,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAY,EAAE,EAAE;QAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,MAAM,GAAG,GAA4C,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1E,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,KAAK,eAAe,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBACvE,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACvD,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC1D,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAmB;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACxG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACzE,CAAC;IACD,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,WAAmB;IAC3D,OAAO,OAAO,OAAO,IAAI,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,IAAe,EAAE,WAAoB;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,GAAI,MAAM,CAAC,UAAkD,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kGAAkG,EAAE,EAAE;QAC/N,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC;KACtF,CAAC;AACJ,CAAC"}

package/dist/gateway/src/services/mcp/project-workflow.d.ts

@@ -0,0 +1,25 @@
+import type { Database } from "../../db/types.js";
+export declare function importProject(db: Database, userId: string, input: {
+    name: string;
+    path: string;
+    description?: string | undefined;
+    techStack?: string | undefined;
+    templateId?: string | undefined;
+}, authorize?: (root: string) => void): import("../../db/repositories/project-repository.js").Project;
+export declare function previewMcpConfig(db: Database, userId: string, projectId: string, templateId: string): Promise<{
+    digest: string;
+    files: {
+        relativePath: string;
+        sha256: string;
+    }[];
+    conflicts: {
+        relativePath: string;
+        conflictType: "exists" | "modified" | "unsafe_path";
+    }[];
+    applicable: boolean;
+}>;
+export declare function applyMcpConfig(db: Database, userId: string, projectId: string, templateId: string, expectedDigest: string, authorize: () => void): Promise<{
+    outcome: "applied";
+    writtenFiles: string[];
+    skippedFiles: string[];
+}>;

package/dist/gateway/src/services/mcp/project-workflow.js

@@ -0,0 +1,81 @@
+import { createHash } from "node:crypto";
+import { existsSync, statSync } from "node:fs";
+import path from "node:path";
+import { detectConfigConflicts, writeConfigPlan } from "../../config-generation/index.js";
+import { assertNewProjectResource } from "../../db/repositories/managed-project-access.js";
+import { ProjectRepository } from "../../db/repositories/project-repository.js";
+import { ProjectSkillRepository } from "../../db/repositories/project-skill-repository.js";
+import { TemplateRepository } from "../../db/repositories/template-repository.js";
+import { validateProjectRoot } from "../../lib/safe-resolve.js";
+import { canonical } from "../platform-commands/actions.js";
+import { PlatformNoEffectError } from "../platform-commands/errors.js";
+import { buildProjectConfigRenderPlan } from "../project-config-render.js";
+import { discoverLocalSkills } from "../local-skills.js";
+export function importProject(db, userId, input, authorize) {
+    const target = path.resolve(input.path.trim());
+    if (!existsSync(target))
+        throw new Error("Imported project directory must already exist");
+    const root = validateProjectRoot(target);
+    authorize?.(root);
+    if (!statSync(root).isDirectory())
+        throw new Error("Imported project path must be a directory");
+    assertNewProjectResource(db, userId, root);
+    authorize?.(root);
+    if (input.templateId && !new TemplateRepository(db, userId).getById(input.templateId))
+        throw new Error("Template not found");
+    return new ProjectRepository(db, userId).import({ ...input, path: root, aiTool: "" });
+}
+function configDigest(plan, conflicts) {
+    return createHash("sha256").update(canonical({
+        projectId: plan.projectId, targetRoot: plan.targetRoot, templateId: plan.templateId,
+        credentialMode: plan.credentialMode,
+        files: plan.files.map(file => ({ path: file.relativePath, sha256: file.sha256 })),
+        conflicts: conflicts.map(conflict => ({ path: conflict.relativePath, type: conflict.conflictType, sha256: conflict.existingSha256 ?? null }))
+    })).digest("hex");
+}
+function assertSelectedLocalSkillsFresh(db, userId, projectId) {
+    const selected = new ProjectSkillRepository(db, userId).listByProject(projectId)
+        .filter(skill => skill.isEnabled && skill.source === "local");
+    if (selected.length === 0)
+        return;
+    const discovered = new Map(discoverLocalSkills().map(skill => [skill.path, skill]));
+    for (const skill of selected) {
+        let sourcePath;
+        try {
+            sourcePath = JSON.parse(skill.resourceManifest ?? "null")?.sourcePath;
+        }
+        catch { /* A malformed manifest cannot establish freshness. */ }
+        const current = sourcePath ? discovered.get(sourcePath) : undefined;
+        if (!current || current.content !== skill.content || current.version !== skill.version || current.resourceManifest !== skill.resourceManifest) {
+            throw new Error(`Local Skill ${skill.name} changed or was rejected; refresh it in the owner UI before config export`);
+        }
+    }
+}
+export async function previewMcpConfig(db, userId, projectId, templateId) {
+    assertSelectedLocalSkillsFresh(db, userId, projectId);
+    const plan = await buildProjectConfigRenderPlan(db, userId, projectId, templateId, "host_environment", true, { syncSkills: () => ({}), readOnlyTemplates: true });
+    const conflicts = await detectConfigConflicts(plan);
+    return {
+        digest: configDigest(plan, conflicts),
+        files: plan.files.map(file => ({ relativePath: file.relativePath, sha256: file.sha256 })),
+        conflicts: conflicts.map(conflict => ({ relativePath: conflict.relativePath, conflictType: conflict.conflictType })),
+        applicable: conflicts.every(conflict => conflict.conflictType === "exists")
+    };
+}
+export async function applyMcpConfig(db, userId, projectId, templateId, expectedDigest, authorize) {
+    assertSelectedLocalSkillsFresh(db, userId, projectId);
+    const plan = await buildProjectConfigRenderPlan(db, userId, projectId, templateId, "host_environment", false, { syncSkills: () => ({}), readOnlyTemplates: true });
+    const conflicts = await detectConfigConflicts(plan);
+    if (configDigest(plan, conflicts) !== expectedDigest)
+        throw new PlatformNoEffectError("Config preview is stale");
+    if (conflicts.some(conflict => conflict.conflictType !== "exists"))
+        throw new PlatformNoEffectError("Config conflicts require owner review");
+    authorize();
+    const result = await writeConfigPlan(plan, { createOnly: true, beforeWrite: authorize });
+    if (result.outcome === "rolled_back")
+        throw new PlatformNoEffectError("Config write rolled back");
+    if (result.outcome === "rollback_failed")
+        throw new Error("Config rollback failed; inspect project files");
+    return { outcome: result.outcome, writtenFiles: result.writtenFiles, skippedFiles: result.skippedFiles };
+}
+//# sourceMappingURL=project-workflow.js.map

package/dist/gateway/src/services/mcp/project-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-workflow.js","sourceRoot":"","sources":["../../../../src/services/mcp/project-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAE1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,UAAU,aAAa,CAAC,EAAY,EAAE,MAAc,EAAE,KAE3D,EAAE,SAAkC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAChG,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7H,OAAO,IAAI,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB,EAAE,SAA2B;IACjE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;QACnF,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC;KAC9I,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,EAAY,EAAE,MAAc,EAAE,SAAiB;IACrF,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC;SAC7E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YAAC,UAAU,GAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,IAAI,MAAM,CAAoC,EAAE,UAAU,CAAC;QAAC,CAAC;QAClH,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC9I,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,CAAC,IAAI,2EAA2E,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,UAAkB;IACxG,8BAA8B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClK,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACpH,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,UAAkB,EAAE,cAAsB,EAAE,SAAqB;IACrJ,8BAA8B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACnK,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,cAAc;QAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IACjH,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAC;IAC7I,SAAS,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa;QAAE,MAAM,IAAI,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3G,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AAC3G,CAAC"}

package/dist/gateway/src/services/mcp/token-authority.d.ts

@@ -0,0 +1,6 @@
+import { type McpAllowedProject } from "../../db/repositories/mcp-token-repository.js";
+import type { Database } from "../../db/types.js";
+import type { CommandResources } from "../platform-commands/types.js";
+export declare function validateMcpAllowedRoot(raw: string): string;
+export declare function snapshotMcpProjects(db: Database, userId: string, projectIds: string[]): McpAllowedProject[];
+export declare function assertMcpTokenAuthority(db: Database, userId: string, tokenId: string, resources?: CommandResources): void;

package/dist/gateway/src/services/mcp/token-authority.js

@@ -0,0 +1,143 @@
+import { realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { ProjectRepository } from "../../db/repositories/project-repository.js";
+import { McpTokenRepository, parseMcpAllowedProjects, parseMcpTokenScopes } from "../../db/repositories/mcp-token-repository.js";
+import { validateProjectRoot } from "../../lib/safe-resolve.js";
+import { canonicalRoot } from "../platform-commands/actions.js";
+const SENSITIVE_SEGMENTS = new Set([".ssh", ".aws", ".gnupg", ".config", ".codex", ".claude", ".kube", "credentials", "secrets"]);
+export function validateMcpAllowedRoot(raw) {
+    const root = validateProjectRoot(raw);
+    if (!statSync(root).isDirectory())
+        throw new Error("MCP allowed root must be a directory");
+    const home = realpathSync(homedir());
+    if (root === home || home.startsWith(`${root}${path.sep}`))
+        throw new Error("MCP allowed root must be narrower than the home directory");
+    if (root.split(path.sep).some((part) => SENSITIVE_SEGMENTS.has(part.toLowerCase())))
+        throw new Error("MCP allowed root cannot be a credential directory");
+    return root;
+}
+function assertWithinRoot(candidate, root) {
+    const resolved = canonicalRoot(candidate);
+    const relative = path.relative(root, resolved);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error("MCP token project root is outside its allowed directory");
+    }
+    if (relative.split(path.sep).some((part) => SENSITIVE_SEGMENTS.has(part.toLowerCase())))
+        throw new Error("MCP token cannot operate in a credential directory");
+}
+function assertNoForeignProjectOverlap(db, userId, candidate) {
+    const target = canonicalRoot(candidate);
+    const rows = db.prepare("SELECT path FROM projects WHERE user_id != ?").all(userId);
+    const inside = (value) => value === "" || (value !== ".." && !value.startsWith(`..${path.sep}`) && !path.isAbsolute(value));
+    const overlaps = (foreign) => inside(path.relative(foreign, target)) || inside(path.relative(target, foreign));
+    for (const row of rows) {
+        if (overlaps(path.resolve(row.path)))
+            throw new Error("MCP project path overlaps a foreign-owned project");
+        let foreign;
+        try {
+            foreign = canonicalRoot(row.path);
+        }
+        catch {
+            // A stale foreign path cannot invalidate unrelated tenants' projects.
+            continue;
+        }
+        if (overlaps(foreign))
+            throw new Error("MCP project path overlaps a foreign-owned project");
+    }
+}
+export function snapshotMcpProjects(db, userId, projectIds) {
+    const projects = new ProjectRepository(db, userId);
+    const grants = [...new Set(projectIds)].map(id => {
+        const project = projects.getById(id);
+        if (!project)
+            throw new Error("Selected project not found");
+        const root = validateMcpAllowedRoot(project.path);
+        assertNoForeignProjectOverlap(db, userId, root);
+        return { id, root };
+    });
+    for (const grant of grants)
+        assertNoUnselectedNestedProject(db, userId, grants, grant.root);
+    return grants;
+}
+function assertNoUnselectedNestedProject(db, userId, grants, root) {
+    for (const project of new ProjectRepository(db, userId).list()) {
+        const grant = grants.find(item => item.id === project.id);
+        if (grant) {
+            try {
+                if (validateMcpAllowedRoot(project.path) === grant.root)
+                    continue;
+            }
+            catch { /* Stale grants cannot authorize nested directories. */ }
+        }
+        const candidates = [path.resolve(project.path)];
+        try {
+            candidates.push(canonicalRoot(project.path));
+        }
+        catch { /* Keep lexical protection for stale paths. */ }
+        if (candidates.some(candidate => {
+            const relative = path.relative(root, candidate);
+            return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+        }))
+            throw new Error("Selected project contains an unselected project; select nested projects too");
+    }
+}
+function assertSelectedProjects(db, userId, grants, resources) {
+    if (!resources)
+        return;
+    const projects = new ProjectRepository(db, userId);
+    const roots = (resources.projectIds ?? []).map(id => {
+        const grant = grants.find(item => item.id === id);
+        if (!grant)
+            throw new Error("Project is outside MCP token authorization");
+        const project = projects.getById(id);
+        if (!project)
+            throw new Error("Selected project not found");
+        const root = validateMcpAllowedRoot(project.path);
+        if (root !== grant.root)
+            throw new Error("MCP authorized project directory has changed");
+        assertNoForeignProjectOverlap(db, userId, root);
+        assertNoUnselectedNestedProject(db, userId, grants, root);
+        return root;
+    });
+    for (const candidate of resources.rootPaths ?? []) {
+        // Bind runtime directories to the resource's project IDs, not any granted project.
+        const resolved = canonicalRoot(candidate);
+        if (roots.length === 0 || !roots.every(root => root === resolved)) {
+            throw new Error("MCP runtime directory does not match its authorized project");
+        }
+        assertNoForeignProjectOverlap(db, userId, resolved);
+    }
+}
+export function assertMcpTokenAuthority(db, userId, tokenId, resources) {
+    const token = new McpTokenRepository(db).findActiveById(tokenId, userId);
+    if (!token)
+        throw new Error("MCP token expired or revoked");
+    const user = db.prepare("SELECT status FROM users WHERE id = ?").get(userId);
+    if (user?.status !== "active")
+        throw new Error("MCP owner is inactive");
+    const selected = parseMcpAllowedProjects(token.allowedProjects);
+    if (selected !== null) {
+        assertSelectedProjects(db, userId, selected, resources);
+        return;
+    }
+    if (!parseMcpTokenScopes(token.scopes).includes("cli_dispatch"))
+        return;
+    if (!token.allowedRoot || !token.expiresAt)
+        throw new Error("MCP CLI authorization is incomplete");
+    const root = validateMcpAllowedRoot(token.allowedRoot);
+    if (root !== token.allowedRoot)
+        throw new Error("MCP allowed root has changed");
+    for (const projectId of resources?.projectIds ?? []) {
+        const project = new ProjectRepository(db, userId).getById(projectId);
+        if (!project)
+            throw new Error("Project not found");
+        assertWithinRoot(project.path, root);
+        assertNoForeignProjectOverlap(db, userId, project.path);
+    }
+    for (const projectRoot of resources?.rootPaths ?? []) {
+        assertWithinRoot(projectRoot, root);
+        assertNoForeignProjectOverlap(db, userId, projectRoot);
+    }
+}
+//# sourceMappingURL=token-authority.js.map