@1mcp/agent 0.37.0 → 0.38.0

package/build/utils/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAExD;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEjD,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/build/utils/filePermissions.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Thrown when a credential-bearing file or directory is readable/writable by
+ * group/others and the self-heal chmod was denied, or when the credential is
+ * owned by a different uid than the running process. Read-side strictModes
+ * (OpenSSH model): heal-then-consume, fail closed when the heal is rejected.
+ * The message redacts the absolute path to a single directory name so logs
+ * can be shared without leaking user layouts; the public fields carry the
+ * same redaction so structured-log serialization cannot leak paths either.
+ */
+export declare class InsecureFilePermissionsError extends Error {
+    readonly filePath: string;
+    readonly actualMode: number;
+    constructor(filePath: string, actualMode: number, reason?: string);
+}
+/**
+ * Filesystems that cannot represent POSIX modes (FAT/exFAT/FUSE/CIFS volumes)
+ * report fictitious modes and reject chmod with capability errors. Degrade
+ * with a warn there (same policy as upstream hardenPermissionsSafely) so the
+ * OAuth stack keeps working on such volumes; real denials (EACCES/EPERM)
+ * still fail closed.
+ */
+export declare const CAPABILITY_ERROR_CODES: Set<string>;
+/**
+ * Read-side strictModes (OpenSSH sshkey_perm_ok semantic) on an already-open
+ * fd, so the permission check cannot be swapped out between stat and read
+ * (no TOCTOU). Legacy files from before the AUTH-07 fix self-heal: a
+ * group/other-open file is chmod'ed to 0o600 in place; only when that heal
+ * fails do we refuse to consume the credential. Windows ACLs do not map to
+ * fs.stat modes, so the check is skipped there.
+ */
+export declare function enforceOwnerOnlyFilePermissions(fd: number, filePath: string): void;
+/**
+ * Directory leg of strictModes: a storage dir writable/readable by group or
+ * others allows filename enumeration and file replacement. The write side
+ * already hardens the dir (chmod 0700 at creation); the read side repels
+ * downgrade by checking the same invariant before consuming data.
+ */
+export declare function assertOwnerOnlyDirPermissions(dirPath: string): void;
+/** Async twin of assertOwnerOnlyDirPermissions. */
+export declare function assertOwnerOnlyDirPermissionsAsync(dirPath: string): Promise<void>;
+/**
+ * Read-side open flags: O_NOFOLLOW rejects a symlink planted in the storage
+ * dir at open time (open fails with ELOOP), so the heal (fchmod/chmod) cannot
+ * be redirected onto an unrelated same-uid file the operator owns. libuv does
+ * not implement O_NOFOLLOW on Windows (the constant is undefined there), so we
+ * fall back to plain O_RDONLY — matching the win32 passthrough everywhere else
+ * in this module.
+ */
+export declare function credentialReadFlags(): number;
+/** True when the open was refused because the path is a symlink (or a non-file rung): ELOOP/ENOTDIR. */
+export declare function isSymlinkRefusalError(error: unknown): boolean;
+/**
+ * Open a credential file for reading, mapping a symlink refusal (O_NOFOLLOW →
+ * ELOOP) onto InsecureFilePermissionsError so callers fail closed and
+ * observably instead of treating an attacker-planted symlink as "missing".
+ */
+export declare function openCredentialReadSync(filePath: string): number;
+/**
+ * Read a credential file with full read-side strictModes on one open handle:
+ * dir 0700 check, open → stat → heal (handle.chmod) → read, no TOCTOU window.
+ * Heal-then-consume: legacy group/other-open files are healed to 0600; only a
+ * denied heal refuses the read with InsecureFilePermissionsError.
+ */
+export declare function readCredentialFile(filePath: string, storageDir: string): Promise<string>;
+//# sourceMappingURL=filePermissions.d.ts.map

package/build/utils/filePermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filePermissions.d.ts","sourceRoot":"","sources":["../../src/utils/filePermissions.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEvB,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAUlE;AAiBD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,aAAyD,CAAC;AAa7F;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAsBlF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAsBnE;AAED,mDAAmD;AACnD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAUD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgC9F"}

package/build/utils/filePermissions.js

@@ -0,0 +1,212 @@
+import fs from 'fs';
+import { chmod, open, stat } from 'node:fs/promises';
+import path from 'path';
+import logger from '../logger/logger.js';
+/**
+ * Thrown when a credential-bearing file or directory is readable/writable by
+ * group/others and the self-heal chmod was denied, or when the credential is
+ * owned by a different uid than the running process. Read-side strictModes
+ * (OpenSSH model): heal-then-consume, fail closed when the heal is rejected.
+ * The message redacts the absolute path to a single directory name so logs
+ * can be shared without leaking user layouts; the public fields carry the
+ * same redaction so structured-log serialization cannot leak paths either.
+ */
+export class InsecureFilePermissionsError extends Error {
+    filePath;
+    actualMode;
+    constructor(filePath, actualMode, reason) {
+        super(reason ??
+            `Refusing to read ${path.basename(path.dirname(filePath))} data: file permissions ` +
+                `0${(actualMode & 0o777).toString(8)} are too open (group/other bits must be 0)`);
+        this.name = 'InsecureFilePermissionsError';
+        this.filePath = path.basename(path.dirname(filePath));
+        this.actualMode = actualMode & 0o777;
+    }
+}
+/** Refuse credentials not owned by the current process uid (OpenSSH foreign-owner rule). */
+function foreignOwnershipError(filePath, mode) {
+    return new InsecureFilePermissionsError(filePath, mode, `Refusing to read ${path.basename(path.dirname(filePath))} data: file is owned by a different user`);
+}
+function logFileHealed(filePath, mode) {
+    logger.warn(`Self-healed insecure 0${(mode & 0o777).toString(8)} permissions to 0600 on ${path.basename(path.dirname(filePath))} data file`);
+}
+/**
+ * Filesystems that cannot represent POSIX modes (FAT/exFAT/FUSE/CIFS volumes)
+ * report fictitious modes and reject chmod with capability errors. Degrade
+ * with a warn there (same policy as upstream hardenPermissionsSafely) so the
+ * OAuth stack keeps working on such volumes; real denials (EACCES/EPERM)
+ * still fail closed.
+ */
+export const CAPABILITY_ERROR_CODES = new Set(['ENOTSUP', 'EOPNOTSUPP', 'EINVAL', 'ENOSYS']);
+function isCapabilityError(error) {
+    const code = error?.code;
+    return typeof code === 'string' && CAPABILITY_ERROR_CODES.has(code);
+}
+function logHealDegraded(filePath, code) {
+    logger.warn(`chmod unsupported on ${path.basename(path.dirname(filePath))} volume (${code}) — filesystem lacks POSIX modes, degrading`);
+}
+/**
+ * Read-side strictModes (OpenSSH sshkey_perm_ok semantic) on an already-open
+ * fd, so the permission check cannot be swapped out between stat and read
+ * (no TOCTOU). Legacy files from before the AUTH-07 fix self-heal: a
+ * group/other-open file is chmod'ed to 0o600 in place; only when that heal
+ * fails do we refuse to consume the credential. Windows ACLs do not map to
+ * fs.stat modes, so the check is skipped there.
+ */
+export function enforceOwnerOnlyFilePermissions(fd, filePath) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    const st = fs.fstatSync(fd);
+    if (process.geteuid && st.uid !== process.geteuid()) {
+        throw foreignOwnershipError(filePath, st.mode);
+    }
+    const mode = st.mode;
+    if ((mode & 0o077) === 0) {
+        return;
+    }
+    try {
+        fs.fchmodSync(fd, 0o600);
+        logFileHealed(filePath, mode);
+    }
+    catch (error) {
+        if (isCapabilityError(error)) {
+            logHealDegraded(filePath, String(error.code));
+            return;
+        }
+        throw new InsecureFilePermissionsError(filePath, mode);
+    }
+}
+/**
+ * Directory leg of strictModes: a storage dir writable/readable by group or
+ * others allows filename enumeration and file replacement. The write side
+ * already hardens the dir (chmod 0700 at creation); the read side repels
+ * downgrade by checking the same invariant before consuming data.
+ */
+export function assertOwnerOnlyDirPermissions(dirPath) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    const st = fs.statSync(dirPath);
+    if (process.geteuid && st.uid !== process.geteuid()) {
+        throw foreignOwnershipError(dirPath, st.mode);
+    }
+    const mode = st.mode;
+    if ((mode & 0o077) === 0) {
+        return;
+    }
+    try {
+        fs.chmodSync(dirPath, 0o700);
+        logger.warn('Self-healed insecure storage directory permissions to 0700');
+    }
+    catch (error) {
+        if (isCapabilityError(error)) {
+            logHealDegraded(dirPath, String(error.code));
+            return;
+        }
+        throw new InsecureFilePermissionsError(dirPath, mode);
+    }
+}
+/** Async twin of assertOwnerOnlyDirPermissions. */
+export async function assertOwnerOnlyDirPermissionsAsync(dirPath) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    const st = await stat(dirPath);
+    if (process.geteuid && st.uid !== process.geteuid()) {
+        throw foreignOwnershipError(dirPath, st.mode);
+    }
+    const mode = st.mode;
+    if ((mode & 0o077) === 0) {
+        return;
+    }
+    try {
+        await chmod(dirPath, 0o700);
+        logger.warn('Self-healed insecure storage directory permissions to 0700');
+    }
+    catch (error) {
+        if (isCapabilityError(error)) {
+            logHealDegraded(dirPath, String(error.code));
+            return;
+        }
+        throw new InsecureFilePermissionsError(dirPath, mode);
+    }
+}
+/**
+ * Read-side open flags: O_NOFOLLOW rejects a symlink planted in the storage
+ * dir at open time (open fails with ELOOP), so the heal (fchmod/chmod) cannot
+ * be redirected onto an unrelated same-uid file the operator owns. libuv does
+ * not implement O_NOFOLLOW on Windows (the constant is undefined there), so we
+ * fall back to plain O_RDONLY — matching the win32 passthrough everywhere else
+ * in this module.
+ */
+export function credentialReadFlags() {
+    return process.platform === 'win32' ? fs.constants.O_RDONLY : fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;
+}
+/** True when the open was refused because the path is a symlink (or a non-file rung): ELOOP/ENOTDIR. */
+export function isSymlinkRefusalError(error) {
+    const code = error?.code;
+    return code === 'ELOOP' || code === 'ENOTDIR';
+}
+function symlinkRefusalError(filePath) {
+    return new InsecureFilePermissionsError(filePath, 0, `Refusing to read ${path.basename(path.dirname(filePath))} data: path is a symlink or not a regular file`);
+}
+/**
+ * Open a credential file for reading, mapping a symlink refusal (O_NOFOLLOW →
+ * ELOOP) onto InsecureFilePermissionsError so callers fail closed and
+ * observably instead of treating an attacker-planted symlink as "missing".
+ */
+export function openCredentialReadSync(filePath) {
+    try {
+        return fs.openSync(filePath, credentialReadFlags());
+    }
+    catch (error) {
+        if (isSymlinkRefusalError(error)) {
+            throw symlinkRefusalError(filePath);
+        }
+        throw error;
+    }
+}
+/**
+ * Read a credential file with full read-side strictModes on one open handle:
+ * dir 0700 check, open → stat → heal (handle.chmod) → read, no TOCTOU window.
+ * Heal-then-consume: legacy group/other-open files are healed to 0600; only a
+ * denied heal refuses the read with InsecureFilePermissionsError.
+ */
+export async function readCredentialFile(filePath, storageDir) {
+    await assertOwnerOnlyDirPermissionsAsync(storageDir);
+    const handle = await open(filePath, credentialReadFlags()).catch((error) => {
+        if (isSymlinkRefusalError(error)) {
+            throw symlinkRefusalError(filePath);
+        }
+        throw error;
+    });
+    try {
+        if (process.platform !== 'win32') {
+            const st = await handle.stat();
+            if (process.geteuid && st.uid !== process.geteuid()) {
+                throw foreignOwnershipError(filePath, st.mode);
+            }
+            const mode = st.mode;
+            if ((mode & 0o077) !== 0) {
+                try {
+                    await handle.chmod(0o600);
+                    logFileHealed(filePath, mode);
+                }
+                catch (error) {
+                    if (isCapabilityError(error)) {
+                        logHealDegraded(filePath, String(error.code));
+                    }
+                    else {
+                        throw new InsecureFilePermissionsError(filePath, mode);
+                    }
+                }
+            }
+        }
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=filePermissions.js.map

package/build/utils/filePermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filePermissions.js","sourceRoot":"","sources":["../../src/utils/filePermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrC,QAAQ,CAAS;IACjB,UAAU,CAAS;IAEnC,YAAY,QAAgB,EAAE,UAAkB,EAAE,MAAe;QAC/D,KAAK,CACH,MAAM;YACJ,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,0BAA0B;gBACjF,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,4CAA4C,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,CAAC;CACF;AAED,4FAA4F;AAC5F,SAAS,qBAAqB,CAAC,QAAgB,EAAE,IAAY;IAC3D,OAAO,IAAI,4BAA4B,CACrC,QAAQ,EACR,IAAI,EACJ,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,0CAA0C,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,IAAI,CACT,yBAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,CAChI,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7F,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAY;IACrD,MAAM,CAAC,IAAI,CACT,wBAAwB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,IAAI,6CAA6C,CAC3H,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAU,EAAE,QAAgB;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,eAAe,CAAC,OAAO,EAAE,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAAe;IACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,eAAe,CAAC,OAAO,EAAE,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;AAChH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,IAAI,4BAA4B,CACrC,QAAQ,EACR,CAAC,EACD,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,gDAAgD,CAC1G,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,UAAkB;IAC3E,MAAM,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAClF,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC7B,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxE,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1mcp/agent",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "One MCP server to aggregate them all - A unified Model Context Protocol server implementation",
   "keywords": [
     "mcp",
@@ -55,7 +55,12 @@
     ]
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.1",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/core": "2.0.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server-legacy": "2.0.0",
     "@toon-format/toon": "^4.1.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
@@ -80,13 +85,14 @@
     "winston-transport": "^4.9.0",
     "yargs": "^18.0.0",
     "yargs-parser": "^22.0.0",
-    "zod": "^4.1.8"
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.1",
     "@eslint/js": "^9.22.0",
     "@mantine/core": "8.3.14",
     "@mantine/hooks": "8.3.14",
+    "@modelcontextprotocol/conformance": "0.2.0-alpha.11",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
@@ -138,7 +144,8 @@
     "vite-tsconfig-paths": "^6.1.1",
     "vitepress": "^1.6.3",
     "vitepress-plugin-mermaid": "^2.0.17",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "yaml": "2.9.0"
   },
   "scripts": {
     "dev": "./scripts/dev-start.sh",
@@ -152,7 +159,12 @@
     "lint:fix": "eslint . --ext .ts,.tsx --fix",
     "format": "prettier --write \"src/**/*.{js,ts,tsx}\" \"test/**/*.{js,ts,tsx}\" \"web/admin/src/**/*.{ts,tsx}\"",
     "format:check": "prettier --check \"src/**/*.{js,ts,tsx}\" \"test/**/*.{js,ts,tsx}\" \"web/admin/src/**/*.{ts,tsx}\"",
-    "ci:static": "concurrently --kill-others-on-fail --names lint,typecheck,build \"pnpm lint\" \"pnpm typecheck\" \"pnpm build\"",
+    "check:sdk-boundary": "node scripts/check-sdk-boundary.mjs",
+    "check:sdk-topology": "node scripts/check-sdk-topology.mjs",
+    "test:sdk-boundary": "node --test test/sdk-boundary/*.test.mjs",
+    "ci:static": "concurrently --kill-others-on-fail --names lint,typecheck,build,sdk-boundary,sdk-topology,sdk-policy-tests \"pnpm lint\" \"pnpm typecheck\" \"pnpm build\" \"pnpm check:sdk-boundary\" \"pnpm check:sdk-topology\" \"node --test test/sdk-boundary/*.test.mjs\"",
+    "guard:perms": "node scripts/security/check-permission-modes.mjs",
+    "test:security-permissions": "vitest run src/auth/storage/tokenPermissions.invariant.test.ts src/core/context/capabilityPermissions.invariant.test.ts && pnpm guard:perms",
     "typecheck": "tsc --noEmit --project tsconfig.test.json",
     "test": "pnpm test:unit && pnpm test:admin",
     "test:unit": "vitest run",
@@ -167,6 +179,7 @@
     "test:e2e:watch": "vitest --config vitest.e2e.config.ts",
     "test:e2e:coverage": "vitest run --config vitest.e2e.config.ts --coverage",
     "test:e2e:performance": "node scripts/test-e2e-performance.js",
+    "test:conformance": "pnpm build && node scripts/run-conformance.mjs",
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs && node scripts/validate-docs-seo.mjs",
     "docs:preview": "vitepress preview docs",