make mcp config registration private

Author: charlesvien

packages/workspace-server/src/services/agent/agent.test.ts

@@ -164,6 +164,7 @@ function createMockDependencies() {
       getPluginPath: vi.fn(() => "/mock/plugin"),
     },
     agentAuthAdapter: {
+      getCurrentCredentials: vi.fn().mockResolvedValue(null),
       ensureGatewayProxy: vi.fn().mockResolvedValue("http://127.0.0.1:9999"),
       configureProcessEnv: vi.fn().mockResolvedValue(undefined),
       createPosthogConfig: vi.fn((credentials) => ({
@@ -277,6 +278,62 @@ describe("AgentService", () => {
     vi.unstubAllGlobals();
   });
 
+  describe("mcp-apps config resolver", () => {
+    function registeredResolver(): (serverName: string) => Promise<void> {
+      const call = deps.mcpAppsService.setConfigResolver.mock.calls[0];
+      expect(call).toBeDefined();
+      return call[0];
+    }
+
+    it("registers server configs from the current credentials", async () => {
+      deps.agentAuthAdapter.getCurrentCredentials.mockResolvedValue({
+        apiHost: "https://app.posthog.com",
+        projectId: 1,
+      });
+      deps.agentAuthAdapter.buildMcpServers.mockResolvedValue({
+        servers: [
+          {
+            name: "posthog",
+            type: "http",
+            url: "https://mcp.posthog.com/mcp",
+            headers: [
+              { name: "Authorization", value: "Bearer token" },
+              { name: "x-posthog-mcp-consumer", value: "posthog-code" },
+            ],
+          },
+        ],
+        toolApprovals: {},
+        toolInstallations: {},
+      });
+
+      await registeredResolver()("posthog");
+
+      expect(deps.agentAuthAdapter.buildMcpServers).toHaveBeenCalledWith({
+        apiHost: "https://app.posthog.com",
+        projectId: 1,
+      });
+      expect(deps.mcpAppsService.addServerConfigs).toHaveBeenCalledWith([
+        {
+          name: "posthog",
+          url: "https://mcp.posthog.com/mcp",
+          headers: {
+            Authorization: "Bearer token",
+            "x-posthog-mcp-consumer": "posthog-code",
+          },
+        },
+      ]);
+    });
+
+    it("no-ops when there are no current credentials", async () => {
+      deps.agentAuthAdapter.getCurrentCredentials.mockResolvedValue(null);
+
+      await registeredResolver()("posthog");
+
+      expect(deps.agentAuthAdapter.buildMcpServers).not.toHaveBeenCalled();
+      expect(deps.mcpAppsService.addServerConfigs).not.toHaveBeenCalled();
+    });
+  });
+
   describe("MCP servers", () => {
     it("marks desktop sessions as local even though they have a taskRunId", async () => {
       await service.startSession({

packages/workspace-server/src/services/agent/agent.ts

@@ -714,10 +714,12 @@ If a repository IS genuinely required, attach one in this priority order:
    * service without starting an agent session. A cloud run's agent lives in the
    * sandbox, so getOrCreateSession never runs on the desktop and the mcp-apps
    * service has no config to fetch a UI-app resource through — the review card
-   * then fails with "No server config for: posthog" and renders as text. The
-   * task view calls this when a cloud-run tool result carries a UI app.
+   * then fails with "No server config for: posthog" and renders as text.
+   * Invoked via the config resolver registered in the constructor.
    */
-  async ensureMcpAppsServerConfigs(credentials: Credentials): Promise<void> {
+  private async ensureMcpAppsServerConfigs(
+    credentials: Credentials,
+  ): Promise<void> {
     const { servers } =
       await this.agentAuthAdapter.buildMcpServers(credentials);
     this.mcpAppsService.addServerConfigs(

packages/workspace-server/src/services/agent/auth-adapter.test.ts

@@ -26,6 +26,9 @@ function createDependencies() {
         accessToken: "fresh-access-token",
         apiHost: "https://app.posthog.com",
       }),
+      getState: vi.fn((): { currentProjectId: number | null } => ({
+        currentProjectId: 1,
+      })),
       authenticatedFetch: vi
         .fn()
         .mockImplementation(
@@ -82,6 +85,23 @@ describe("AgentAuthAdapter", () => {
     vi.restoreAllMocks();
   });
 
+  describe("getCurrentCredentials", () => {
+    it("returns the auth host and selected project", async () => {
+      deps.authService.getState.mockReturnValue({ currentProjectId: 42 });
+
+      await expect(adapter.getCurrentCredentials()).resolves.toEqual({
+        apiHost: "https://app.posthog.com",
+        projectId: 42,
+      });
+    });
+
+    it("returns null when no project is selected", async () => {
+      deps.authService.getState.mockReturnValue({ currentProjectId: null });
+
+      await expect(adapter.getCurrentCredentials()).resolves.toBeNull();
+    });
+  });
+
   it("builds the default PostHog MCP server routed through the local proxy", async () => {
     const { servers } = await adapter.buildMcpServers(baseCredentials);