wicked-crew 0.7.40 → 0.7.46

package/dist/mcp/redact.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Result scrubbing for brokered MCP calls (DES-MCP-TOOLS-001 §4.3 D-2, §6 step 8).
+ *
+ * Every result an upstream returns passes through here before a worker, a log or a record sees
+ * it, in this order:
+ *
+ *  1. **Exact secrets**: every value the broker injected on THIS call is replaced wherever it
+ *     appears (`scrubSecrets`, the same pass the registry's probe uses).
+ *  2. **Field names**: a value under a credential-named key (Authorization, Cookie, *token*,
+ *     *secret*, *passw*, *credential*, *session*, api/private/access/secret key, ...) becomes
+ *     `[REDACTED:field:<name>]`, recursively.
+ *  3. **Value shapes**: credential-shaped substrings anywhere (Bearer/Basic auth, JWTs, AWS access
+ *     key ids, GitHub/OpenAI/Slack tokens, `password=...` pairs, PEM private keys) become
+ *     `[REDACTED:<pattern-id>]`.
+ *
+ * Layers 2 and 3 are ported from wicked-garden's QE evidence redactor
+ * (`scripts/qe/runner/src/redact.mjs`). One difference: garden also denies a bare `key` field.
+ * An MCP result routinely carries `key` as an identifier (a Jira issue key, a cache key), so here
+ * only the qualified credential keys are denied (`api_key`, `private-key`, `accessKey`, ...).
+ */
+export declare function isDeniedFieldName(name: string): boolean;
+interface ValuePattern {
+    id: string;
+    re: RegExp;
+    replace?: (match: string, ...groups: string[]) => string;
+}
+export declare const VALUE_PATTERNS: ReadonlyArray<ValuePattern>;
+export declare function redactString(value: string): string;
+/** Layers 2 and 3 over any JSON value. Pure: returns a new value. */
+export declare function redactDeep<T>(value: T): T;
+/** All three layers: the exact injected `secrets` first, then field names and value shapes. */
+export declare function scrubResult<T>(value: T, secrets: ReadonlyArray<string>): T;
+export {};
+//# sourceMappingURL=redact.d.ts.map

package/dist/mcp/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/mcp/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAmBH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;CAC1D;AAED,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,YAAY,CAetD,CAAC;AAEF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAczC;AAED,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAE1E"}

package/dist/mcp/redact.js

@@ -0,0 +1,84 @@
+/**
+ * Result scrubbing for brokered MCP calls (DES-MCP-TOOLS-001 §4.3 D-2, §6 step 8).
+ *
+ * Every result an upstream returns passes through here before a worker, a log or a record sees
+ * it, in this order:
+ *
+ *  1. **Exact secrets**: every value the broker injected on THIS call is replaced wherever it
+ *     appears (`scrubSecrets`, the same pass the registry's probe uses).
+ *  2. **Field names**: a value under a credential-named key (Authorization, Cookie, *token*,
+ *     *secret*, *passw*, *credential*, *session*, api/private/access/secret key, ...) becomes
+ *     `[REDACTED:field:<name>]`, recursively.
+ *  3. **Value shapes**: credential-shaped substrings anywhere (Bearer/Basic auth, JWTs, AWS access
+ *     key ids, GitHub/OpenAI/Slack tokens, `password=...` pairs, PEM private keys) become
+ *     `[REDACTED:<pattern-id>]`.
+ *
+ * Layers 2 and 3 are ported from wicked-garden's QE evidence redactor
+ * (`scripts/qe/runner/src/redact.mjs`). One difference: garden also denies a bare `key` field.
+ * An MCP result routinely carries `key` as an identifier (a Jira issue key, a cache key), so here
+ * only the qualified credential keys are denied (`api_key`, `private-key`, `accessKey`, ...).
+ */
+import { scrubSecrets } from './secrets.js';
+const REDACTED = (reason) => `[REDACTED:${reason}]`;
+const FIELD_NAME_DENY = [
+    /authorization/i,
+    /cookie/i,
+    /token/i,
+    /secret/i,
+    /passw/i,
+    /passphrase/i,
+    /credential/i,
+    /session/i,
+    /apikey/i,
+    /(api|private|access|secret|signing|client)[-_.]?key/i,
+];
+export function isDeniedFieldName(name) {
+    return FIELD_NAME_DENY.some((re) => re.test(name));
+}
+export const VALUE_PATTERNS = [
+    { id: 'bearer', re: /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/g },
+    { id: 'basic-auth', re: /\bBasic\s+[A-Za-z0-9+/=]{8,}/g },
+    { id: 'jwt', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g },
+    { id: 'aws-access-key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { id: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g },
+    { id: 'github-pat', re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+    { id: 'openai-key', re: /\bsk-[A-Za-z0-9_-]{16,}\b/g },
+    { id: 'slack-token', re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+    {
+        id: 'kv-secret',
+        re: /\b(token|secret|password|passwd|pwd|api[-_]?key|apikey|access[-_]?key|auth)=([^&\s"']{4,})/gi,
+        replace: (_m, k) => `${k}=${REDACTED('kv')}`,
+    },
+    { id: 'private-key-block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+];
+export function redactString(value) {
+    let out = value;
+    for (const { id, re, replace } of VALUE_PATTERNS) {
+        re.lastIndex = 0;
+        out = replace !== undefined ? out.replace(re, replace) : out.replace(re, REDACTED(id));
+    }
+    return out;
+}
+/** Layers 2 and 3 over any JSON value. Pure: returns a new value. */
+export function redactDeep(value) {
+    const walk = (v) => {
+        if (typeof v === 'string')
+            return redactString(v);
+        if (Array.isArray(v))
+            return v.map(walk);
+        if (v !== null && typeof v === 'object') {
+            const out = {};
+            for (const [k, inner] of Object.entries(v)) {
+                out[k] = isDeniedFieldName(k) ? REDACTED(`field:${k}`) : walk(inner);
+            }
+            return out;
+        }
+        return v;
+    };
+    return walk(value);
+}
+/** All three layers: the exact injected `secrets` first, then field names and value shapes. */
+export function scrubResult(value, secrets) {
+    return redactDeep(scrubSecrets(value, secrets));
+}
+//# sourceMappingURL=redact.js.map

package/dist/mcp/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/mcp/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,aAAa,MAAM,GAAG,CAAC;AAEpE,MAAM,eAAe,GAA0B;IAC7C,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,aAAa;IACb,aAAa;IACb,UAAU;IACV,SAAS;IACT,sDAAsD;CACvD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAQD,MAAM,CAAC,MAAM,cAAc,GAAgC;IACzD,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,oCAAoC,EAAE;IAC1D,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,+BAA+B,EAAE;IACzD,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,iEAAiE,EAAE;IACpF,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC9D,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,+CAA+C,EAAE;IAC3E,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAC7D,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,4BAA4B,EAAE;IACtD,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAC9D;QACE,EAAE,EAAE,WAAW;QACf,EAAE,EAAE,8FAA8F;QAClG,OAAO,EAAE,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE;KAC7D;IACD,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,6EAA6E,EAAE;CAC/G,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACjD,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAI,KAAQ;IACpC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAM,CAAC;AAC1B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAI,KAAQ,EAAE,OAA8B;IACrE,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/mcp/registry-store.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The MCP tools registry at rest (DES-MCP-TOOLS-001 §5): `<state home>/mcp/registry.json`.
+ *
+ * It holds upstreams and their tools with secret REFERENCES only; a value never lands here (D-2).
+ * The `mcp` entry is registered in the state-home fence registry (tests/fixtures/
+ * state-home-subtrees.json, core's `src/state_home.rs`), so a worker can't read it. The directory
+ * is created on the first save, never at boot.
+ *
+ * Writes are serialized on one promise chain and land atomically (write a sibling temp file,
+ * then rename), so a crash never leaves a torn registry. A registry that does not parse is an
+ * error the routes answer 503; it is never silently replaced by an empty one, because that
+ * would drop every server the operator registered.
+ */
+import type { McpAuthConfig, McpHealth, McpRestMapping, McpToolAnnotations, McpToolClass, McpUpstreamKind } from '../core/types.js';
+export declare const MCP_STATE_DIRNAME = "mcp";
+export declare const MCP_REGISTRY_FILENAME = "registry.json";
+/** `<state home>/mcp` — the one directory the MCP slices write under. */
+export declare function mcpStateDir(): string;
+export interface McpToolRecord {
+    name: string;
+    description: string | null;
+    inputSchema: Record<string, unknown> | null;
+    outputSchema: Record<string, unknown> | null;
+    annotations: McpToolAnnotations | null;
+    classOverride: McpToolClass | null;
+    enabled: boolean;
+    /** The hash the operator saved (registered); `null` = never registered (a tool added after the preview). */
+    schemaHash: string | null;
+    /** The hash the last probe saw; differs from `schemaHash` when the schema changed. */
+    observedSchemaHash: string;
+    /** `false` = the last probe no longer lists the tool (`gone`, kept so old records resolve). */
+    present: boolean;
+    /** A `rest` tool's request mapping (slice S5a); absent/`null` for an MCP server's tool. */
+    rest?: McpRestMapping | null;
+}
+export interface McpServerRecord {
+    name: string;
+    kind: McpUpstreamKind;
+    command: string | null;
+    args: string[];
+    url: string | null;
+    auth: McpAuthConfig | null;
+    /** `rest` only (slice S5a): the OpenAPI URL, or the pasted document; the operations picked. */
+    openapiUrl?: string | null;
+    openapi?: Record<string, unknown> | null;
+    operations?: string[] | null;
+    enabled: boolean;
+    health: McpHealth;
+    registeredAt: string;
+    updatedAt: string;
+    tools: McpToolRecord[];
+}
+export interface McpRegistryFile {
+    version: 1;
+    servers: McpServerRecord[];
+}
+export declare class McpRegistryCorruptError extends Error {
+}
+export declare class McpRegistryStore {
+    private readonly dir;
+    private tail;
+    constructor(dir?: string);
+    get path(): string;
+    read(): Promise<McpRegistryFile>;
+    /** Read, apply `fn`, write back, one mutation at a time. `fn`'s result is returned. */
+    mutate<T>(fn: (file: McpRegistryFile) => T | Promise<T>): Promise<T>;
+    private write;
+}
+//# sourceMappingURL=registry-store.d.ts.map

package/dist/mcp/registry-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-store.d.ts","sourceRoot":"","sources":["../../src/mcp/registry-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpI,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AACvC,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,yEAAyE;AACzE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AAErD,qBAAa,gBAAgB;IAGf,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,IAAI,CAAuC;gBAEtB,GAAG,GAAE,MAAsB;IAExD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAEK,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC;IAqBtC,uFAAuF;IACvF,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAWtD,KAAK;CAWpB"}

package/dist/mcp/registry-store.js

@@ -0,0 +1,82 @@
+/**
+ * The MCP tools registry at rest (DES-MCP-TOOLS-001 §5): `<state home>/mcp/registry.json`.
+ *
+ * It holds upstreams and their tools with secret REFERENCES only; a value never lands here (D-2).
+ * The `mcp` entry is registered in the state-home fence registry (tests/fixtures/
+ * state-home-subtrees.json, core's `src/state_home.rs`), so a worker can't read it. The directory
+ * is created on the first save, never at boot.
+ *
+ * Writes are serialized on one promise chain and land atomically (write a sibling temp file,
+ * then rename), so a crash never leaves a torn registry. A registry that does not parse is an
+ * error the routes answer 503; it is never silently replaced by an empty one, because that
+ * would drop every server the operator registered.
+ */
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { crewStateHome } from '../projects/state-home.js';
+export const MCP_STATE_DIRNAME = 'mcp';
+export const MCP_REGISTRY_FILENAME = 'registry.json';
+/** `<state home>/mcp` — the one directory the MCP slices write under. */
+export function mcpStateDir() {
+    return join(crewStateHome(), 'mcp');
+}
+export class McpRegistryCorruptError extends Error {
+}
+export class McpRegistryStore {
+    dir;
+    tail = Promise.resolve();
+    constructor(dir = mcpStateDir()) {
+        this.dir = dir;
+    }
+    get path() {
+        return join(this.dir, MCP_REGISTRY_FILENAME);
+    }
+    async read() {
+        let text;
+        try {
+            text = await readFile(this.path, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return { version: 1, servers: [] };
+            throw err;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new McpRegistryCorruptError(`${this.path} is not valid JSON; fix or remove it`);
+        }
+        const file = parsed;
+        if (file.version !== 1 || !Array.isArray(file.servers)) {
+            throw new McpRegistryCorruptError(`${this.path} is not a version 1 MCP registry`);
+        }
+        return file;
+    }
+    /** Read, apply `fn`, write back, one mutation at a time. `fn`'s result is returned. */
+    mutate(fn) {
+        const next = this.tail.then(async () => {
+            const file = await this.read();
+            const result = await fn(file);
+            await this.write(file);
+            return result;
+        });
+        this.tail = next.catch(() => undefined);
+        return next;
+    }
+    async write(file) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        const tmp = join(this.dir, `${MCP_REGISTRY_FILENAME}.tmp-${randomUUID()}`);
+        try {
+            await writeFile(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+            await rename(tmp, this.path);
+        }
+        catch (err) {
+            await rm(tmp, { force: true });
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=registry-store.js.map

package/dist/mcp/registry-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-store.js","sourceRoot":"","sources":["../../src/mcp/registry-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,yEAAyE;AACzE,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AA2CD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,MAAM,OAAO,gBAAgB;IAGE;IAFrB,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,YAA6B,MAAc,WAAW,EAAE;QAA3B,QAAG,GAAH,GAAG,CAAwB;IAAG,CAAC;IAE5D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACzF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,CAAC,IAAI,sCAAsC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,MAAkC,CAAC;QAChD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAAC,GAAG,IAAI,CAAC,IAAI,kCAAkC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAuB,CAAC;IACjC,CAAC;IAED,uFAAuF;IACvF,MAAM,CAAI,EAA6C;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAqB;QACvC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,QAAQ,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/mcp/registry.d.ts

@@ -0,0 +1,147 @@
+/**
+ * The MCP tools registry (DES-MCP-TOOLS-001 §5, §8; slice S2): register upstream MCP servers,
+ * keep their tool lists honest, and hold their secrets out of every response.
+ *
+ * - **Preview, then save.** `preview` probes the server and answers its tools with their classes
+ *   and a `previewHash` over the exact config and tool schemas it saw. `save` takes ONLY that hash
+ *   and registers what the preview showed. A save without a hash, or with one this daemon did not
+ *   issue (or issued more than {@link PREVIEW_TTL_MS} ago), is refused, so nothing is registered
+ *   that the operator did not see.
+ * - **Tool diff.** `test` probes a registered server again and records the difference. A tool
+ *   whose schema hash changed, and a tool the server added, is `unregistered` (D-5 denies it)
+ *   until it is previewed and saved again. A tool the server dropped is `gone`: kept, never
+ *   deleted, so old call records still resolve. Health turns `failing` after 3 consecutive
+ *   failed probes.
+ * - **Secrets.** Only a reference is stored. A value is resolved just for the probe and scrubbed
+ *   from its result (`probe.ts`).
+ */
+import type { McpDiscoveredServer, McpPreviewResponse, McpRestMapping, McpServer, McpServersResponse, McpServerTestResponse, McpTool, McpToolAnnotations, McpToolClass, McpToolDiff, McpToolStatus, McpUpstreamKind } from '../core/types.js';
+import type { McpUpstreamConfig, Prober } from './probe.js';
+import type { McpRegistryStore, McpToolRecord } from './registry-store.js';
+import { type SecretStore } from './secrets.js';
+/** How long a preview can be saved. */
+export declare const PREVIEW_TTL_MS: number;
+/** Consecutive failed probes before a server's health reads `failing`. */
+export declare const HEALTH_FAILING_AFTER = 3;
+/** A refusal the routes map to a status code. */
+export declare class McpRegistryError extends Error {
+    readonly status: 400 | 404 | 409 | 500 | 501 | 502 | 503;
+    readonly code: string;
+    constructor(status: 400 | 404 | 409 | 500 | 501 | 502 | 503, code: string, message: string);
+}
+/** What the registry holds for one brokered call's subject. */
+export interface McpCallTarget {
+    config: McpUpstreamConfig;
+    /** A `rest` tool's request mapping (slice S5a); `null` for an MCP server's tool. */
+    rest: McpRestMapping | null;
+    annotations: McpToolAnnotations | null;
+    classOverride: McpToolClass | null;
+    registered: boolean;
+}
+/** A registered, enabled tool, as the tool list judges it (`callableTools`). */
+export interface McpCallableTool {
+    server: string;
+    tool: string;
+    kind: McpUpstreamKind;
+    annotations: McpToolAnnotations | null;
+    classOverride: McpToolClass | null;
+    description: string | null;
+    inputSchema: Record<string, unknown> | null;
+}
+export interface McpRegistryDeps {
+    store: McpRegistryStore;
+    secrets: SecretStore;
+    probe: Prober;
+    discover: (managed: ReadonlySet<string>) => McpDiscoveredServer[];
+    now?: () => number;
+    env?: NodeJS.ProcessEnv;
+}
+export declare class McpRegistry {
+    private readonly deps;
+    private readonly previews;
+    private readonly now;
+    private readonly env;
+    constructor(deps: McpRegistryDeps);
+    get secretStoreAvailable(): boolean;
+    list(): Promise<McpServersResponse>;
+    get(name: string): Promise<McpServer>;
+    /**
+     * Probe `config` and hold exactly what it showed, for `save` (crew#719: with `stagedSecret`, the
+     * secret this server's own keychain reference will hold — probed with now, written only when the
+     * save commits, so the OS store and the registry row land together or not at all).
+     */
+    preview(config: McpUpstreamConfig, stagedSecret?: string | null): Promise<McpPreviewResponse>;
+    /**
+     * Register exactly what a preview showed. Saving over an existing name re-registers it: every
+     * tool of the preview becomes `registered`, a tool it no longer lists becomes `gone`, a tool's
+     * `enabled` switch survives, and a class override survives only while the schema is unchanged.
+     */
+    save(previewHash: string | undefined): Promise<McpServer>;
+    /**
+     * Run `commit`; if it throws and this save had written the OS secret store, put the entry back
+     * exactly as it was — deleted when there was no `prior` value, restored to `prior` when there
+     * was (crew#719, review of PR #724). Either way the registry row and the credential it
+     * references end up as they were before the save.
+     *
+     * A rollback that ALSO fails is reported rather than swallowed: the operator is told what was
+     * left behind and under which account, because nothing else can find a keychain entry for them.
+     */
+    private restoreSecretOnFailure;
+    /** What a held preview would register: its server name and each tool's schema hash (S6). */
+    peekPreview(previewHash: string): {
+        name: string;
+        tools: Array<{
+            name: string;
+            schemaHash: string;
+        }>;
+    } | null;
+    setServerEnabled(name: string, enabled: boolean): Promise<McpServer>;
+    /** Remove a server, and the keychain secret it owns (`keychain:wicked-mcp/<name>`). */
+    remove(name: string): Promise<void>;
+    patchTool(subject: string, patch: {
+        enabled?: boolean | undefined;
+        classOverride?: McpToolClass | null | undefined;
+    }): Promise<McpTool>;
+    /** Probe a registered server again: record its health and its tool diff. */
+    test(name: string): Promise<McpServerTestResponse>;
+    /** Write a server's secret to the OS store; answers the reference to put in its `auth.ref`. */
+    setSecret(name: string, value: string): Promise<string>;
+    /**
+     * The broker's resolution of one subject (§6 step 2). `null` = no server of that name. A server
+     * that is disabled, a tool that is disabled, `gone`, never saved, or whose schema changed since it
+     * was saved reads `registered: false`, which the engine denies (D-5).
+     */
+    resolveCall(server: string, tool: string): Promise<McpCallTarget | null>;
+    /**
+     * Every tool a call could reach right now (slice S4, the shim's `list`): enabled servers, and
+     * their enabled tools whose saved schema is the one last seen. Anything else is D-5 and would be
+     * refused by the broker, so it is never offered.
+     */
+    callableTools(): Promise<McpCallableTool[]>;
+    /**
+     * The secret a call to `config` is made with, resolved at the moment of the call and nowhere
+     * else. `missing` = the server names a secret that resolves to nothing: the call is not made
+     * unauthenticated.
+     */
+    callSecret(config: McpUpstreamConfig): Promise<{
+        secret: string | null;
+        missing: boolean;
+    }>;
+    private find;
+    private hold;
+    /**
+     * Probe with the server's secret. A server whose `auth` names a secret that resolves to nothing
+     * is NOT probed unauthenticated (that would register what an anonymous caller sees): it fails
+     * without connecting.
+     */
+    private probe;
+    private authState;
+    private view;
+}
+export declare function toolStatus(t: Pick<McpToolRecord, 'present' | 'schemaHash' | 'observedSchemaHash'>): McpToolStatus;
+/** The difference between the registered tools and a probe's (by name, then schema hash). */
+export declare function diffTools(registered: ReadonlyArray<Pick<McpToolRecord, 'name' | 'schemaHash' | 'present'>>, probed: ReadonlyArray<{
+    name: string;
+    schemaHash: string;
+}>): McpToolDiff;
+//# sourceMappingURL=registry.d.ts.map

package/dist/mcp/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAGV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,KAAK,EAAE,gBAAgB,EAAmB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAA6E,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3H,uCAAuC;AACvC,eAAO,MAAM,cAAc,QAAiB,CAAC;AAG7C,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iDAAiD;AACjD,qBAAa,gBAAiB,SAAQ,KAAK;IAIvC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAC/C,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,oFAAoF;IACpF,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC7C;AAiBD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,qBAAa,WAAW;IAKV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;gBAEX,IAAI,EAAE,eAAe;IAKlD,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAEK,IAAI,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAOnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAK3C;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CzG;;;;OAIG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IA2D/D;;;;;;;;OAQG;YACW,sBAAsB;IAwBpC,4FAA4F;IAC5F,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI;IAMvG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAU1E,uFAAuF;IACjF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBnC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,aAAa,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB7I,4EAA4E;IACtE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkDxD,+FAA+F;IACzF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB7D;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAa9E;;;;OAIG;IACG,aAAa,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAoBjD;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAQjG,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,IAAI;IAQZ;;;;OAIG;YACW,KAAK;YAWL,SAAS;YAMT,IAAI;CAqBnB;AA6BD,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,YAAY,GAAG,oBAAoB,CAAC,GAAG,aAAa,CAGjH;AAqBD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,WAAW,CAYrL"}