@agentsdock/server 1.0.7 → 1.0.8-beta.5

package/server/cursor_api_key.py

@@ -0,0 +1,64 @@
+"""Cursor-issued keys, not OpenAI-compatible endpoints or a machine login.
+
+Cursor exchanges API keys for tokens and normally persists those tokens in the
+user's credential store. Use its in-memory store for every key-bound process;
+an inherited auth token must never take precedence over the selected API key.
+"""
+from __future__ import annotations
+
+import re
+import tempfile
+
+from fastapi import HTTPException
+from cursor_agent_client import parse_cursor_models_list
+from side_questions import run_isolated_command, SideQuestionError
+
+ENDPOINT = "https://api2.cursor.sh"
+MIN_VERSION = (2026, 9, 26)  # First build verified with memory credential isolation.
+
+
+def overrides(key: str) -> dict[str, str]:
+    return {
+        "CURSOR_API_KEY": key, "CURSOR_AUTH_TOKEN": "",
+        "AGENT_CLI_CREDENTIAL_STORE": "memory",
+        "CURSOR_API_ENDPOINT": ENDPOINT, "CURSOR_AGENT_CLI_LOCAL_MODE": "false",
+        "DIRENV_DISABLE": "1",
+    }
+
+
+async def require_isolation(executable: str | None, env: dict) -> None:
+    if not executable:
+        raise HTTPException(409, "Install Cursor CLI to use a Cursor API key.")
+    try:
+        with tempfile.TemporaryDirectory(prefix="agentsdock-cursor-version-") as cwd:
+            output = await run_isolated_command([executable, "--version"], prompt="", cwd=cwd,
+                env={**env, **overrides("")}, timeout=5)
+        match = re.search(r"\b(20\d\d)\.(\d{2})\.(\d{2})\b", output)
+        if not match or tuple(map(int, match.groups())) < MIN_VERSION:
+            raise ValueError("unsupported build")
+    except (SideQuestionError, ValueError):
+        raise HTTPException(409, "Update Cursor CLI to 2026.09.26 or later to isolate API keys from CLI login.") from None
+
+
+async def catalog(selected: dict, *, executable: str | None, env: dict) -> dict:
+    try:
+        await require_isolation(executable, env)
+    except HTTPException:
+        return {"models": [], "discovery_status": "unavailable", "cli_update_required": True}
+    try:
+        # Read-only authenticated request; no conversation, model inference,
+        # project tools, or native credential writes. Never reflect CLI stderr.
+        with tempfile.TemporaryDirectory(prefix="agentsdock-cursor-key-") as cwd:
+            output = await run_isolated_command([executable, "--list-models"], prompt="", cwd=cwd,
+                env={**env, **overrides(selected["api_key"])}, timeout=20)
+        models = [{"value": item["id"], "label": item["label"]}
+                  for item in parse_cursor_models_list(output)
+                  if re.fullmatch(r"[\x21-\x7e]{1,256}", item["id"])
+                  and selected["api_key"] not in item["id"] + item["label"]]
+        if not models:
+            return {"models": [], "discovery_status": "unavailable"}
+        return {"models": models[:256], "discovery_status": "ready"}
+    except SideQuestionError:
+        # Offline and invalid keys can look identical in CLI output. Do not
+        # misclassify an outage as a logout or return key-bearing stderr.
+        return {"models": [], "discovery_status": "unavailable"}

package/server/install.sh

@@ -1839,7 +1839,7 @@ if [[ "$TEAM_HUB_MODE" == "host" && "$TEAM_HUB_OPERATION_PENDING" != "true" \
   fi
 fi
 
-RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py side_questions.py title_generation.py codex_side_question.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py cursor_process_guard.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
+RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py provider_connections.py cursor_api_key.py side_questions.py title_generation.py codex_side_question.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py cursor_process_guard.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
 RELEASE_DIRECTORIES=(agentsdock_team_hub)
 TEAM_HUB_RELEASE_FILES=(
   __init__.py
@@ -3055,21 +3055,37 @@ install_lock_control() {
   local action="$1"
   local expected_device="${2:-0}"
   local expected_inode="${3:-0}"
+  local wait_for_prepared="false"
+  # Old managed preparers do not pass a managed-update ID. The existing pinned
+  # preparation/activation modes may serialize briefly; this grants no update
+  # authority and leaves ordinary installation and recovery fail-fast.
+  if [[ "$action" == "acquire" && "${RECOVER_ONLY:-false}" != "true" \
+    && "${RECOVER_UNARMED_ONLY:-false}" != "true" \
+    && ( "${PREPARE_ONLY:-false}" == "true" || -n "${ACTIVATE_PREPARED:-}" ) \
+    && "${PREPARED_ARCHIVE_SHA256:-}" =~ ^[0-9a-f]{64}$ \
+    && "${EXPECTED_API_CONTRACT:-}" =~ ^[1-9][0-9]*$ \
+    && -n "${RELEASE_VERSION:-}" ]]; then
+    wait_for_prepared="true"
+  fi
   local python_path=""
   python_path="$(install_lock_python)" || return 1
   "$python_path" - \
-    "$action" "$INSTALL_ROOT" "$$" "$expected_device" "$expected_inode" <<'PY'
+    "$action" "$INSTALL_ROOT" "$$" "$expected_device" "$expected_inode" "$wait_for_prepared" <<'PY'
 import errno
 import os
 from pathlib import Path
 import secrets
+import signal
 import stat
 import sys
+import time
 
-action, raw_root, raw_pid, raw_device, raw_inode = sys.argv[1:]
+action, raw_root, raw_pid, raw_device, raw_inode, raw_wait = sys.argv[1:]
 root = Path(os.path.abspath(raw_root))
 pid = int(raw_pid)
 lock = root / ".install-lock"
+PREPARED_LOCK_WAIT_SECONDS = 30.0
+wait_for_prepared = action == "acquire" and raw_wait == "true"
 
 root_info = root.lstat()
 if (
@@ -3145,7 +3161,56 @@ def read_owner(directory_descriptor: int) -> tuple[int, tuple[int, int]]:
     return int(value), (int(info.st_dev), int(info.st_ino))
 
 
+def check_wait_root() -> None:
+    current = root.lstat()
+    if ((current.st_dev, current.st_ino) != (root_info.st_dev, root_info.st_ino)
+            or not stat.S_ISDIR(current.st_mode) or current.st_uid != os.geteuid()
+            or stat.S_IMODE(current.st_mode) & 0o022):
+        raise PermissionError("AgentsServer install root changed while waiting")
+
+
+def same_wait_owner(directory_descriptor, directory_info, owner_pid, owner_identity) -> bool:
+    check_wait_root()
+    current = lock.lstat()
+    if ((current.st_dev, current.st_ino) != (directory_info.st_dev, directory_info.st_ino)):
+        return False
+    if (not stat.S_ISDIR(current.st_mode) or current.st_uid != os.geteuid()
+            or stat.S_IMODE(current.st_mode) & 0o077):
+        raise PermissionError("AgentsServer install lock directory is unsafe")
+    return read_owner(directory_descriptor) == (owner_pid, owner_identity)
+
+
+def cleanup_wait_candidate(path, expected) -> None:
+    # Cancellation while waiting may remove only our still-unpublished draft.
+    # An acquired-but-unreported lock is left for ordinary dead-owner reaping.
+    try:
+        check_wait_root()
+        descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_DIRECTORY)
+        try:
+            current = os.fstat(descriptor)
+            linked = path.lstat()
+            identity = (expected.st_dev, expected.st_ino)
+            if ((current.st_dev, current.st_ino) != identity
+                    or (linked.st_dev, linked.st_ino) != identity):
+                return
+            owner, owner_identity = read_owner(descriptor)
+            if owner != pid or read_owner(descriptor) != (owner, owner_identity):
+                return
+            os.unlink("pid", dir_fd=descriptor)
+            os.fsync(descriptor)
+            linked = path.lstat()
+            if (linked.st_dev, linked.st_ino) == identity:
+                path.rmdir()
+        finally:
+            os.close(descriptor)
+    except (OSError, RuntimeError):
+        pass  # Preserve the original cancellation/failure; never guess ownership.
+
+
 if action == "acquire":
+    # One budget includes owner/namespace changes. Waiting only observes an
+    # existing safe lock; all authority checks still follow atomic acquisition.
+    deadline = time.monotonic() + PREPARED_LOCK_WAIT_SECONDS
     candidate = root / f".install-lock.{pid}.{secrets.token_hex(12)}.tmp"
     os.mkdir(candidate, 0o700)
     os.chmod(candidate, 0o700)
@@ -3165,21 +3230,44 @@ if action == "acquire":
         finally:
             os.close(descriptor)
         fsync_directory(candidate)
-        for _attempt in range(32):
+        if wait_for_prepared:
+            def cancelled(signum, _frame):
+                raise SystemExit(128 + signum)
+            for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
+                signal.signal(signum, cancelled)
+        namespace_attempts = 0
+        while namespace_attempts < 32:
+            if wait_for_prepared:
+                check_wait_root()
+                if time.monotonic() >= deadline:
+                    raise RuntimeError("AgentsServer prepared update timed out waiting for the installation lock")
             try:
                 os.rename(candidate, lock)
             except OSError as exc:
                 if exc.errno not in {errno.EEXIST, errno.ENOTEMPTY}:
                     raise
-                directory_descriptor, directory_info = open_lock_directory()
                 try:
+                    directory_descriptor, directory_info = open_lock_directory()
+                except FileNotFoundError:
+                    if not wait_for_prepared:
+                        raise
+                    # The incumbent retired after rename observed its lock.
+                    namespace_attempts += 1
+                    continue
+                try:
+                    if wait_for_prepared and any(
+                        name != "pid" for name in os.listdir(directory_descriptor)
+                    ):
+                        raise PermissionError("AgentsServer install lock contains unknown files")
                     try:
                         owner_pid, owner_identity = read_owner(directory_descriptor)
                     except FileNotFoundError:
                         # An old installer may have crashed in mkdir->pid. The
                         # next atomic directory rename replaces only that
                         # exact empty namespace; a populated replacement wins.
+                        namespace_attempts += 1
                         continue
+                    alive = False
                     try:
                         os.kill(owner_pid, 0)
                     except ProcessLookupError:
@@ -3189,6 +3277,22 @@ if action == "acquire":
                             f"another AgentsServer installation is active ({owner_pid})"
                         )
                     else:
+                        alive = True
+                    if alive:
+                        if wait_for_prepared:
+                            try:
+                                unchanged = same_wait_owner(directory_descriptor, directory_info,
+                                                            owner_pid, owner_identity)
+                            except FileNotFoundError:
+                                unchanged = False
+                            if not unchanged:
+                                namespace_attempts += 1
+                                continue
+                            remaining = deadline - time.monotonic()
+                            if remaining <= 0:
+                                raise RuntimeError("AgentsServer prepared update timed out waiting for the installation lock")
+                            time.sleep(min(0.1, remaining))
+                            continue
                         raise RuntimeError(
                             f"another AgentsServer installation is active ({owner_pid})"
                         )
@@ -3200,19 +3304,25 @@ if action == "acquire":
                             directory_descriptor
                         )
                     except FileNotFoundError:
+                        namespace_attempts += 1
                         continue
                     if current_owner != owner_pid or current_identity != owner_identity:
+                        namespace_attempts += 1
                         continue
                     try:
                         os.unlink("pid", dir_fd=directory_descriptor)
                     except FileNotFoundError:
+                        namespace_attempts += 1
                         continue
                     os.fsync(directory_descriptor)
                 finally:
                     os.close(directory_descriptor)
+                namespace_attempts += 1
                 continue
             else:
                 owned = True
+                if wait_for_prepared:
+                    check_wait_root()
                 for _ in range(3):
                     try:
                         fsync_directory(root)
@@ -3232,7 +3342,9 @@ if action == "acquire":
                 raise SystemExit(0)
         raise RuntimeError("AgentsServer install lock ownership kept changing")
     finally:
-        if not owned:
+        if not owned and wait_for_prepared:
+            cleanup_wait_candidate(candidate, candidate_info)
+        elif not owned:
             try:
                 (candidate / "pid").unlink()
             except FileNotFoundError:
@@ -3640,6 +3752,7 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/codex_app_server.py" \
     "$STAGE_DIR/codex_auth.py" \
     "$STAGE_DIR/codex_provider.py" \
+    "$STAGE_DIR/provider_connections.py" "$STAGE_DIR/cursor_api_key.py" \
     "$STAGE_DIR/side_questions.py" \
     "$STAGE_DIR/workspace_git.py" \
     "$STAGE_DIR/codex_side_question.py" \
@@ -3667,7 +3780,7 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/update_runner.py"
   "$STAGE_DIR/.venv/bin/python" -m py_compile "$STAGE_DIR/server_instances.py"
   "$STAGE_DIR/.venv/bin/python" -m compileall -q "$STAGE_DIR/agentsdock_team_hub"
-  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, side_questions, title_generation, codex_side_question, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
+  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, provider_connections, cursor_api_key, side_questions, title_generation, codex_side_question, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
 )
 
 abort_unclaimed_team_hub_reactivation() {

package/server/opencode_agent_client.py

@@ -486,6 +486,38 @@ def build_opencode_env_overrides(
     }
 
 
+def build_opencode_mcp_overrides(
+    existing_config: str | None, *, name: str, command: list[str],
+    environment: dict[str, str], enforced_agent_name: str | None = None,
+) -> dict[str, str]:
+    """Add one unpredictable, run-bound tool without granting shell/MCP wildcards.
+
+    Merge after the endpoint and permission configuration. Never persist this
+    configuration, credentials, or permission to the user's OpenCode files.
+    Default mode keeps the native agent and any higher-priority managed rules.
+    """
+    if not re.fullmatch(r"agentsdock_[0-9a-f]{32}", name):
+        raise ValueError("invalid OpenCode provider tool name")
+    config = json.loads(existing_config) if existing_config else {}
+    if not isinstance(config, dict):
+        raise ValueError("OpenCode inline config must be an object")
+    mcp = config.setdefault("mcp", {})
+    if not isinstance(mcp, dict) or name in mcp:
+        raise ValueError("OpenCode provider MCP configuration conflicts")
+    mcp[name] = {"type": "local", "command": command,
+                 "environment": environment, "enabled": True}
+    permissions = config.get("permission", {})
+    if isinstance(permissions, str):
+        permissions = {"*": permissions}
+    if not isinstance(permissions, dict):
+        raise ValueError("OpenCode permissions must be an object or action")
+    config["permission"] = {**permissions, name + "_run": "allow"}
+    if enforced_agent_name:
+        agent = config["agent"][enforced_agent_name]
+        agent["permission"][name + "_run"] = "allow"
+    return {"OPENCODE_CONFIG_CONTENT": json.dumps(config, separators=(",", ":"))}
+
+
 def build_opencode_cmd(
     sess: dict[str, Any],
     prompt: str,