@50arms/platform-mcp 0.1.442 → 0.1.443

package/README.md

@@ -18,6 +18,7 @@ BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from boa
 ## Signing in (DX-4390): request and approve
 
 An operator session has no stored credential. Signed out, `plan_connect` (optionally with `title`, the session's own Claude title) posts `POST /api/access-requests` and answers at once `{state: "approval_required", approvalUrl, confirmCode, expiresAt, instruction}`: show the user the code and open the URL; they approve in the dashboard. The server polls `POST /api/access-requests/claim` in the background, so the key is stored when the approval lands; the next `plan_connect` waits up to about 45 seconds for it, then connects, or answers `approval_pending`. One tool call never blocks for minutes. `denied` is reported once; a request that lapsed (the dashboard deletes it within about a minute of expiry, so a claim answers 404) starts a fresh one on the next call.
+- **A machine secret and an auto-approved request (DX-6764, PLAN-128).** Every `session` access request also sends `machineSecret`: one random secret per machine and per dashboard, made the first time it is needed in `~/.config/danxbot/machine-secrets/<sha12(dashboard url)>.json` (mode 0600, written durably, then hard-linked into place so two sessions starting at once on a fresh machine end up with the same one; an unusable file is a loud error, never replaced). The dashboard keeps only its hash, so a person can let later sessions from this machine sign in by themselves; it is never sent to another dashboard, and the `machine` daemon's request and a dispatched agent's credential are unchanged. When the create answer says `autoApproved: true` no person decides the request: the first claim is not delayed, `plan_connect` waits up to about 45 seconds for the key and answers signed in with no `approvalUrl` or `confirmCode`; a claim slower than that answers `{state: "signing_in"}`, still with no link. `autoApproved` is required in the create answer: a dashboard that does not send it fails the request loudly. A request left pending behaves as above.
 - **A launch token (DX-6801, DEC-522).** `plan_connect` and `card_connect` take an optional `launch_token`: the one-use token the session that started this one passed in its prompt. A signed-out session given one redeems it once per process through the public `POST /api/access-requests/claim` with `{secret: <token>, labelId: <this session's id>}` (`labelId` is sent only on a redeem); `approved` stores the key like an approval and answers signed in, with no access request. Any other answer (`claimed`, `expired`, 404, 409 `launch_grant_refused` with its `reason`, 429) spends the token and falls through to the usual person's request, the answer carrying a `note` that names why the token was not used. A signed-in session ignores the token.
 
 - **Storage.** `~/.config/danxbot/session-keys/<sha12(dashboard url)>/<session id>.json`, mode 0600, written write-then-rename, pruned after 7 days. One file per dashboard and per session; this server reads it at boot, and `restart_notice` reads the same file through the `session-key` credential source and proves the fingerprint. The key lapses on the dashboard after 24 hours without use (every authenticated call, the relay's heartbeat included, renews it), and is revocable from the account page.

package/dist/access-request.js

@@ -54,7 +54,8 @@ function isCreated(value) {
         typeof v.secret === "string" &&
         typeof v.confirmCode === "string" &&
         typeof v.approvalUrl === "string" &&
-        typeof v.pollMs === "number");
+        typeof v.pollMs === "number" &&
+        typeof v.autoApproved === "boolean");
 }
 export async function createAccessRequest(fetchImpl, dashboardUrl, input) {
     const url = `${baseOf(dashboardUrl)}/api/access-requests`;

package/dist/machine-secret.js

@@ -0,0 +1,93 @@
+/**
+ * DX-6764 (PLAN-128) - the secret that proves which machine a session's access request comes from.
+ *
+ * One random secret per machine and per dashboard, kept in `~/.config/danxbot/machine-secrets/<sha12(dashboard url)>.json`
+ * (mode 0600). A `session` access request sends it so a person can let later sessions from this machine sign in by themselves
+ * (the dashboard keeps only its hash). It is made the first time it is needed and never changes after, and it is only ever sent to
+ * the dashboard its file is named for: a different dashboard URL is a different file and a different secret.
+ *
+ * TWO SESSIONS ON A FRESH MACHINE. Both find no file and both make a candidate; a plain write-then-rename would let the second
+ * replace the first, so the two sessions would send different secrets. The candidate is written (durably) to its own temp name, then
+ * HARD-LINKED to the target: a link never replaces an existing file, so exactly one candidate wins, and every session reads the
+ * target back and uses what is there. A file that exists but is unusable is a loud error, never replaced: replacing it would
+ * silently orphan any grant a person made for the secret it held.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { linkSync, readFileSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { writeFileDurable } from "./durable-write.js";
+/** One canonical shape (CLAUDE.md Core Principle 1): a file of any other version is refused. */
+export const MACHINE_SECRET_SCHEMA_VERSION = 1;
+/** The dashboard refuses a shorter secret (`MACHINE_SECRET_MIN` in `src/dashboard/access-request-routes.ts`); 32 random bytes as hex is twice that. */
+const SECRET_BYTES = 32;
+const SECRET_MIN_LENGTH = 32;
+const dashboardHash = (dashboardUrl) => createHash("sha256").update(dashboardUrl.replace(/\/+$/, "")).digest("hex").slice(0, 12);
+export function machineSecretPath(dashboardUrl, home = homedir()) {
+    return join(home, ".config", "danxbot", "machine-secrets", `${dashboardHash(dashboardUrl)}.json`);
+}
+function unusable(path, why) {
+    return new Error(`[platform-mcp] the machine secret file ${path} is unusable: ${why}; fix or delete it, then call plan_connect again`);
+}
+/** The secret in `path`, or null when the file is absent. A file that is there but of another shape throws. */
+function readSecret(path, dashboardUrl) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw unusable(path, err.message);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw unusable(path, `not JSON (${err.message})`);
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        throw unusable(path, "it is not an object");
+    const record = parsed;
+    if (record.schemaVersion !== MACHINE_SECRET_SCHEMA_VERSION) {
+        throw unusable(path, `schemaVersion is ${JSON.stringify(record.schemaVersion)}, not ${MACHINE_SECRET_SCHEMA_VERSION}`);
+    }
+    if (typeof record.secret !== "string" || record.secret.length < SECRET_MIN_LENGTH) {
+        throw unusable(path, `secret is not a string of at least ${SECRET_MIN_LENGTH} characters`);
+    }
+    if (typeof record.dashboardUrl !== "string" || record.dashboardUrl.replace(/\/+$/, "") !== dashboardUrl.replace(/\/+$/, "")) {
+        throw unusable(path, `it names the dashboard ${JSON.stringify(record.dashboardUrl)}, not ${dashboardUrl}`);
+    }
+    return record.secret;
+}
+/** This machine's secret for `dashboardUrl`, made (once, race-safe) if it does not exist yet. */
+export function machineSecretFor(dashboardUrl, options = {}) {
+    const path = machineSecretPath(dashboardUrl, options.home);
+    const existing = readSecret(path, dashboardUrl);
+    if (existing !== null)
+        return existing;
+    const record = {
+        schemaVersion: MACHINE_SECRET_SCHEMA_VERSION,
+        dashboardUrl: dashboardUrl.replace(/\/+$/, ""),
+        secret: randomBytes(SECRET_BYTES).toString("hex"),
+        createdAt: new Date(options.now ?? Date.now()).toISOString(),
+    };
+    const candidate = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.candidate`;
+    writeFileDurable(candidate, JSON.stringify(record), { mode: 0o600 });
+    try {
+        linkSync(candidate, path);
+    }
+    catch (err) {
+        // Another session made the file between the read above and this link: its secret is the machine's.
+        if (err.code !== "EEXIST")
+            throw err;
+    }
+    finally {
+        unlinkSync(candidate);
+    }
+    const stored = readSecret(path, dashboardUrl);
+    if (stored === null)
+        throw unusable(path, "it vanished right after it was made");
+    return stored;
+}

package/dist/machine-toolkit.js

@@ -250,7 +250,7 @@ function resolveToolkitVersion(stamped, readManifest) {
   return stamped ?? readManifest();
 }
 var readOwnManifest = () => JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8")).version;
-var TOOLKIT_VERSION = resolveToolkitVersion(false ? void 0 : "0.1.442", readOwnManifest);
+var TOOLKIT_VERSION = resolveToolkitVersion(false ? void 0 : "0.1.443", readOwnManifest);
 function envelope(now) {
   return { contract_version: CONTRACT_VERSION, toolkit_version: TOOLKIT_VERSION, profile: PROFILE, measured_at: now.toISOString() };
 }

package/dist/session-access.js

@@ -29,6 +29,7 @@ import { hostname } from "node:os";
 import { claimAccessRequest, createAccessRequest } from "./access-request.js";
 import { credentialFingerprint } from "./credential.js";
 import { keyRevocationOf, keyRevokedHalt } from "./key-revoked-halt.js";
+import { machineSecretFor } from "./machine-secret.js";
 import { deleteSessionKey, writeSessionKey } from "./session-key.js";
 import { McpOutdatedError } from "./version-floor.js";
 /** Longest a `plan_connect` call waits for an approval already asked for. */
@@ -48,6 +49,9 @@ const APPROVAL_REQUIRED_INSTRUCTION = "Show the user the confirm code and open t
     "The request stays open until this session ends, however long the user takes.";
 const APPROVAL_PENDING_INSTRUCTION = "Still waiting for the user to approve; the request stays open until this session ends. Remind them of the " +
     "confirm code and the URL, then call `plan_connect` again.";
+/** DX-6764: a machine grant approved the request; nothing for the user to open or confirm, the next call picks the sign-in up. */
+const SIGNING_IN_INSTRUCTION = "This machine's auto-approval signs the session in; no approval link is involved. Call `plan_connect` again in a moment.";
+const AUTO_APPROVED_EXPIRED_ERROR = "the dashboard approved this request by itself, but it expired before this process claimed the key; call plan_connect again";
 const DENIED_INSTRUCTION = "The user denied the request. Do not retry unless they ask; a new `plan_connect` makes a new request.";
 const DASHBOARD_OUTDATED_ERROR = "this dashboard does not support request-and-approve yet (POST /api/access-requests answered 404): " +
     "it must be updated before this session can sign in";
@@ -271,21 +275,10 @@ export class SessionAccess {
             }
         }
         if (this.pending !== null) {
-            const pending = this.pending;
-            const outcome = await Promise.race([pending.settled, this.sleep(this.awaitMs).then(() => null)]);
-            if (outcome === null)
-                return notReady(this.requestAnswer("approval_pending", pending.request), false);
-            this.pending = null;
-            switch (outcome.kind) {
-                case "approved":
-                    return { signedIn: true };
-                case "denied":
-                    return notReady({ state: "denied", instruction: DENIED_INSTRUCTION }, false);
-                case "failed":
-                    return notReady({ state: "request_failed", error: outcome.error }, true);
-                case "expired":
-                    note = EXPIRED_NOTE;
-            }
+            const settled = await this.awaitPending(this.pending);
+            if (settled !== "expired")
+                return settled;
+            note = EXPIRED_NOTE;
         }
         const created = await this.createRequest(sessionId, title, note);
         // DX-6801: a refused or failed request carries the launch note too, so the reason is never lost.
@@ -294,6 +287,27 @@ export class SessionAccess {
         }
         return created;
     }
+    /**
+     * Wait up to `awaitMs` for the open request, then answer how it stands: signed in, still pending (the link to open, or for an
+     * auto-approved request the plain "signing in" state, which has no link), denied or failed. `expired` is for the caller: a person's
+     * request that lapsed is asked again, an auto-approved one is an error.
+     */
+    async awaitPending(pending) {
+        const outcome = await Promise.race([pending.settled, this.sleep(this.awaitMs).then(() => null)]);
+        if (outcome === null)
+            return notReady(this.requestAnswer("approval_pending", pending.request), false);
+        this.pending = null;
+        switch (outcome.kind) {
+            case "approved":
+                return { signedIn: true };
+            case "denied":
+                return notReady({ state: "denied", instruction: DENIED_INSTRUCTION }, false);
+            case "failed":
+                return notReady({ state: "request_failed", error: outcome.error }, true);
+            case "expired":
+                return "expired";
+        }
+    }
     async createRequest(sessionId, title, note) {
         const repo = this.deps.readRepo === undefined ? null : await this.deps.readRepo();
         const created = await createAccessRequest(this.fetchImpl, this.deps.dashboardUrl, {
@@ -304,6 +318,7 @@ export class SessionAccess {
             clientVersion: this.deps.clientVersion,
             ...(repo === null ? {} : { repo }),
             ...(this.deps.team === undefined ? {} : { team: this.deps.team }),
+            machineSecret: machineSecretFor(this.deps.dashboardUrl, { home: this.deps.home, now: this.now() }),
         });
         switch (created.kind) {
             case "dashboard_outdated":
@@ -316,10 +331,18 @@ export class SessionAccess {
                 return notReady({ state: "request_refused", status: created.status, body: created.body }, true);
             case "created":
                 this.pending = { request: created.request, settled: this.pollUntilSettled(created.request) };
+                // DX-6764: a machine grant approved it: no person decides, so the key is a claim away. Wait for it as a second call would,
+                // and never hand the agent a link.
+                if (created.request.autoApproved) {
+                    const settled = await this.awaitPending(this.pending);
+                    return settled === "expired" ? notReady({ state: "request_failed", error: AUTO_APPROVED_EXPIRED_ERROR }, true) : settled;
+                }
                 return notReady({ ...this.requestAnswer("approval_required", created.request), ...(note ? { note } : {}) }, false);
         }
     }
     requestAnswer(state, request) {
+        if (request.autoApproved)
+            return { state: "signing_in", instruction: SIGNING_IN_INSTRUCTION };
         return {
             state,
             approvalUrl: request.approvalUrl,
@@ -329,7 +352,8 @@ export class SessionAccess {
     }
     // DX-4530: no give-up time - the polls are what keep the request open, until the dashboard answers how it ended.
     async pollUntilSettled(request) {
-        let waitMs = request.pollMs;
+        // DX-6764: an auto-approved request is decided already, so its first claim is not delayed.
+        let waitMs = request.autoApproved ? 0 : request.pollMs;
         for (;;) {
             await this.sleep(waitMs);
             waitMs = request.pollMs;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@50arms/platform-mcp",
-  "version": "0.1.442",
+  "version": "0.1.443",
   "description": "Stdio MCP server fronting the 50 Arms dashboard API for agents (operator sessions and dispatched workers alike): the generic 50arms_api/50arms_api_list/50arms_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and 50arms_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",