connectors: announce global-server and reinstall refreshes on the bus

Five call-sites reached into the live-runtime refresh helpers from HTTP handlers, the same shape as the container remounts. Only three of them belonged on the bus, and finding out which was the point. global_enable and global_delete now emit McpGlobalServersChanged, and the marketplace reinstall emits ConnectorReinstalled. All three are pure reconciliation: the first only makes a connector appear; the second is already enforced by stop_server, with the snapshot refresh just tidying each user's filter; the third pushes metadata and code into what is already running. The reinstall gains something from being off the response path, since it re-copies files and restarts servers inside every live user's container. global_set_access and user_connectors_set keep calling refresh_global_mcp_access directly. Their writes *replace* a grant set, so anyone dropped from the list is being revoked and that refresh is what enforces it — on a best-effort broadcast a revoked user would keep the connector until their next login. Both carry a DELIBERATELY SYNCHRONOUS comment, since they are otherwise indistinguishable from the announced call-sites and are exactly what a later cleanup would sweep up. No behaviour change for the two synchronous paths; the three announced ones now return without waiting for the refresh.
2026-07-26 22:22:29 +01:00
parent 0ba140186f
commit 305bdbdd2b
5 changed files with 59 additions and 18 deletions
@@ -87,6 +87,23 @@ pub enum SystemEvent {
    UserMountsChanged {
        user_id: String,
    },
+
+    // ── Connectors (blueprint §7) ─────────────────────────────────────────────
+    /// The set of **global** MCP connectors changed — one was enabled (and started)
+    /// or deleted (and stopped). Every live user re-snapshots their access filter so
+    /// the connector appears in / disappears from `MCP_LIST` without a re-login.
+    ///
+    /// Emitted only for changes to the *server set*. Changing **who may use** a
+    /// connector is a grant/revoke and stays synchronous in its handler, for the same
+    /// reason as [`Self::UserActiveChanged`]: this bus promises "eventually", which is
+    /// the wrong promise for taking access away.
+    McpGlobalServersChanged,
+    /// A marketplace connector was (re)installed. Anything already running it — the
+    /// global runtime, each live user's per-user runtime — re-reads its metadata and
+    /// re-copies its files/deps, so the new version lands without a re-login.
+    ConnectorReinstalled {
+        catalog_name: String,
+    },
 }

 // ── Bus ───────────────────────────────────────────────────────────────────────