fix(ui): keep MCP header helpers browser-safe

[richardfogaca]

Linked issue

Fixes #1832

Summary

• Move pure MCP template pattern checks into a browser-safe module.
• Keep the full MCP template resolver as the server/runtime path.
• Point MCP HTTP header helpers at the browser-safe pattern helper.

Why / context

The settings UI imports MCP header validation helpers for form handling. Those helpers depended on the full MCP template resolver, which also imports environment resolution and database code. In a browser bundle, that chain can reach node:async_hooks through tenant context and fail before React mounts, leaving the page blank with no daemon-side error.

Implementation notes

The new template-patterns module intentionally contains only pure string checks. template-resolver re-exports those helpers to preserve the existing server-side import surface, while http-headers imports the browser-safe module directly.

Validation / test plan

• pnpm exec biome check packages/core/src/mcp/template-patterns.ts packages/core/src/mcp/template-resolver.ts packages/core/src/tools/mcp/http-headers.ts
• pnpm --filter @agor/core test -- src/tools/mcp/http-headers.test.ts src/mcp/template-resolver.test.ts
• Browser runtime check for http://localhost:5173/: root mounted and no server-only module exception.

Screenshots / demos

Not applicable.

Risks / rollout / rollback

Low risk. This is a pure helper extraction with the existing resolver export preserved. Roll back by reverting the helper split if needed.

Out of scope / follow-ups

The unrelated local daemon package script edit is not part of this PR.

[Copilot]

Pull request overview

This PR fixes a UI blank-screen failure caused by browser bundles pulling in server-only MCP template-resolution dependencies via MCP HTTP header helper imports. It extracts pure template-pattern checks into a browser-safe module and updates header helpers to depend on that module instead of the full server/runtime template resolver.

Changes:

• Introduced a new browser-safe template-patterns module containing only pure string/regex checks (containsTemplate, isUserEnvPlaceholder).
• Updated http-headers helpers to import isUserEnvPlaceholder from the browser-safe module to avoid server-only dependency chains in the UI bundle.
• Updated template-resolver to import/re-export the pattern helpers to preserve the existing server-side import surface while removing the in-file implementations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/core/src/tools/mcp/http-headers.ts	Switches placeholder detection import to the browser-safe helper module to prevent server-only imports in UI bundles.
packages/core/src/mcp/template-resolver.ts	Reuses and re-exports the extracted pattern helpers, removing the duplicated local implementations.
packages/core/src/mcp/template-patterns.ts	Adds browser-safe template pattern utilities with no Handlebars/env/DB imports.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mistercrunch]

Not about this PR per-se, but thinking we shouldn't do regex processing, and just use Handlebars lib here. Having an agent look into why/how we deviated from simply using handlebars on the backend for template processing.