Add MCP servers and custom tools for bots

Two new settings pages, MCPs and Tools. Super admins define them; super
admins and admins attach them to bots, to workspaces (every bot there),
or to every bot. Bots get them in chat replies and tasks.

- Custom tools: a JSON-schema of arguments plus an HTTP request, a script
  on the bot's computer, or a prompt, templated with {{args.x}} and
  {{env.KEY}}, secrets redacted from results.
- MCP servers: remote (URL and headers) or stdio commands run on the host
  with a setup command and an isolated env, in a per-process pool. Tools
  are listed into a cache and connect on first call.
- Add, edit, access and try open in modals.
- Markdown, JSON and command fields use twui's AceEditor (CodeEditor),
  its scripts loaded on demand.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/extensions/sync-mcp-server.ts

@@ -0,0 +1,60 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import listMcpTools from "@/src/harness/mcp/list-mcp-tools";
+import openMcpServer from "@/src/harness/mcp/open-mcp-server";
+import runMcpSetup from "@/src/harness/mcp/run-mcp-setup";
+import grabMcpStdioEnv from "@/src/harness/mcp/grab-mcp-stdio-env";
+import { stopStdioMcpServer } from "@/src/harness/mcp/mcp-stdio-pool";
+import redactSecrets from "@/src/utils/redact-secrets";
+import grabMcpServer from "./grab-mcp-server";
+import grabRunEnvs from "./grab-run-envs";
+
+type Params = {
+    mcp_server_id: number | string;
+    /**
+     * Runs a stdio server's setup again first, even if it already ran.
+     */
+    reinstall?: boolean;
+};
+
+/**
+ * Connects to an MCP server (a stdio one is started, after its setup) and
+ * saves the tools it lists, which is what runs build their tools from.
+ * Saves the outcome on the server (`status`, `last_error`, secrets
+ * blanked out) and returns it; never throws for the server's own failure.
+ */
+export default async function syncMcpServer({ mcp_server_id, reinstall }: Params) {
+    const server = await grabMcpServer({ mcp_server_id });
+    const envs = await grabRunEnvs();
+    const open = openMcpServer({ server, envs });
+    const now = Date.now();
+
+    try {
+        if (reinstall && server.transport == "stdio") {
+            stopStdioMcpServer({ server_id: server.id });
+            await runMcpSetup({ server, env: grabMcpStdioEnv({ server, envs }), force: true });
+        }
+
+        const tools = await listMcpTools({ client: await open.client() });
+
+        await BunSQLite.sql({
+            sql: `UPDATE mcp_servers SET tools_cache = ?, status = 'ok', last_error = '', last_synced_at = ?, updated_at = ? WHERE id = ?`,
+            values: [JSON.stringify(tools), now, now, server.id],
+        });
+
+        return { ok: true as const, tools };
+    } catch (error: unknown) {
+        const message = redactSecrets({
+            text: error instanceof Error ? error.message : String(error),
+            secrets: envs.filter((env) => env.secret),
+        }).slice(0, 4000);
+
+        await BunSQLite.sql({
+            sql: `UPDATE mcp_servers SET status = 'error', last_error = ?, last_synced_at = ?, updated_at = ? WHERE id = ?`,
+            values: [message, now, now, server.id],
+        });
+
+        return { ok: false as const, error: message };
+    } finally {
+        await open.close();
+    }
+}