hammoc 1.4.0 → 1.6.0

package/packages/server/dist/services/harnessMcpService.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Story 28.3: Harness MCP service.
+ *
+ * Combines three sources of MCP server definitions — the active project's
+ * `<projectRoot>/.mcp.json`, the global `~/.claude/.mcp.json` (or
+ * `~/.claude/settings.json.mcpServers` if Spike B confirms the alternative),
+ * and every installed plugin bundle (`<installPath>/.mcp.json` + the
+ * `mcpServers` field of `<installPath>/.claude-plugin/plugin.json`) — into a
+ * single card list used by the "Harness Workbench → MCP" panel.
+ *
+ * Spike A / B routing:
+ *   - `DISABLE_STRATEGY` is wired into every read/list/update path; the
+ *     post-impl default is `'backup'` (entry moves into mcp.disabled.json).
+ *     If Spike A later confirms that Claude Code honors a per-server `enabled`
+ *     flag on disk, switching the constant to `'flag'` and updating the
+ *     `disable()` branch of `toggleEnabled()` is the only required change.
+ *   - `getUserMcpFilePath()` returns `~/.claude/.mcp.json` by default. If
+ *     Spike B confirms candidate 2 (settings.json.mcpServers), update this
+ *     helper to return the settings.json path and bump the response
+ *     `userFileKind` to `'settings.json'` — every other call site already
+ *     consumes that field.
+ *
+ * Containment guards differ by scope:
+ *   - `<projectRoot>/.mcp.json` is the SIBLING of `.claude/`, so the standard
+ *     `harnessService` helpers (which clamp to `.claude/`) cannot reach it.
+ *     Project-scope reads / writes go through dedicated `MainFileAccessor`
+ *     helpers that fs-stat the file directly with a strict containment guard.
+ *   - plugin reads use `path.resolve()` containment under each plugin's
+ *     `installPath`, mirroring `harnessSkillService.enumeratePluginSkills`.
+ *   - global `~/.claude/.mcp.json` (or `~/.claude/settings.json`) and the two
+ *     `mcp.disabled.json` backup files all live inside one of the two
+ *     `harnessService` scopes, so the round-trip there reuses the existing
+ *     clamp.
+ */
+import { type HarnessMcpCopyRequest, type HarnessMcpCopyResponse, type HarnessMcpDeleteRequest, type HarnessMcpListResponse, type HarnessMcpReadResponse, type HarnessMcpServerConfig, type HarnessMcpSourceFileKind, type HarnessMcpSourceLocation, type HarnessMcpSourceScope, type HarnessMcpUpdateRequest, type HarnessMcpUpdateResponse } from '@hammoc/shared';
+/**
+ * Story 30.1 (Task 1.2): the previous SECRET_PATTERNS / ENV_REF_RE /
+ * `detectSecretsInConfig` walker have moved to `utils/secretHeuristic.ts`
+ * (`detectSecretsInValue`). MCP's old patterns were stricter than the other
+ * three services (40-char anchored base64, anchored bearer); the canonical
+ * resolution adopts the looser 32-char unanchored shape so detection is
+ * unified across the four harness services. The wrapper below preserves
+ * MCP's `{ matched, paths }` external signature.
+ */
+export interface DetectSecretsResult {
+    matched: boolean;
+    paths: string[];
+}
+export declare function detectSecretsInConfig(value: unknown, basePath?: string[]): DetectSecretsResult;
+declare class HarnessMcpService {
+    listCards(currentProjectSlug?: string): Promise<HarnessMcpListResponse>;
+    readServer(source: HarnessMcpSourceLocation, name: string): Promise<HarnessMcpReadResponse>;
+    updateServer(source: HarnessMcpSourceLocation, name: string, body: HarnessMcpUpdateRequest): Promise<HarnessMcpUpdateResponse>;
+    copyServer(req: HarnessMcpCopyRequest): Promise<HarnessMcpCopyResponse>;
+    deleteServer(source: HarnessMcpSourceLocation, name: string, body: HarnessMcpDeleteRequest): Promise<{
+        success: true;
+    }>;
+    /**
+     * Story 30.7 (Task A.1): redirect a project-scope mcp save to the
+     * `.mcp.local.json` sibling. The local sibling sits alongside `.mcp.json`
+     * at the project root (outside `.claude/`), so we follow the same own
+     * write path the project accessor uses for `.mcp.json` — bypassing
+     * `harnessService.write` because the target is not in the harness
+     * whitelist. The `assertNoSecretOnShared` guard still runs against the
+     * `.mcp.local.json` relative path; if the project's `.gitignore` excludes
+     * the local sibling, the verdict is `local` and the write succeeds. When
+     * the pattern is missing the guard re-throws `HARNESS_SECRET_ON_SHARED`
+     * for the local path, which the client should pre-empt with the gitignore
+     * guidance flow (Task D).
+     */
+    writeLocalSibling(input: {
+        projectSlug: string;
+        name: string;
+        config: HarnessMcpServerConfig;
+        expectedMtime?: string;
+    }): Promise<{
+        success: true;
+        mtime: string;
+        siblingRelativePath: string;
+    }>;
+    private enumerateProjectMcps;
+    private enumerateUserMcps;
+    private enumeratePluginMcps;
+    private toggleEnabled;
+}
+interface ResolveSourceArgs {
+    scope: HarnessMcpSourceScope;
+    name: string;
+    projectSlug?: string;
+    pluginKey?: string;
+    fileKind?: HarnessMcpSourceFileKind;
+}
+export declare function resolveSourceLocation(input: ResolveSourceArgs): Promise<HarnessMcpSourceLocation>;
+export declare const harnessMcpService: HarnessMcpService;
+export declare const SPIKE_RESULTS: {
+    disableStrategy: "backup";
+    userFileKind: "mcp.json";
+};
+export {};
+//# sourceMappingURL=harnessMcpService.d.ts.map

package/packages/server/dist/services/harnessMcpService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessMcpService.d.ts","sourceRoot":"","sources":["../../src/services/harnessMcpService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAE3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAG3B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAE9B,MAAM,gBAAgB,CAAC;AA0CxB;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,EAAO,GACtB,mBAAmB,CAGrB;AA4ND,cAAM,iBAAiB;IAGf,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0CvE,UAAU,CACd,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,sBAAsB,CAAC;IAW5B,YAAY,CAChB,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,wBAAwB,CAAC;IA0C9B,UAAU,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAoEvE,YAAY,CAChB,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAS7B;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,sBAAsB,CAAC;QAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC;YA6D5D,oBAAoB;YA+BpB,iBAAiB;YA4BjB,mBAAmB;YAmEnB,aAAa;CAiF5B;AA6JD,UAAU,iBAAiB;IACzB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,wBAAwB,CAAC,CA+CnC;AA6CD,eAAO,MAAM,iBAAiB,mBAA0B,CAAC;AACzD,eAAO,MAAM,aAAa;;;CAGzB,CAAC"}