@alfe.ai/claude-code-host 0.1.16 → 0.1.17

package/dist/host-config.cjs

@@ -478,6 +478,64 @@ var CredentialStatusReporter = class {
 	}
 };
 //#endregion
+//#region src/mcp-allow-rules.ts
+/**
+* Allow rules for the MCP servers a bridged turn loads.
+*
+* Turns run under `--permission-mode dontAsk`, which DENIES any tool not in
+* `--allowedTools`. MCP tools are named `mcp__<server>__<tool>`, so without a
+* rule per server every MCP call (alfe-platform memory/voice/send/secrets and
+* every integration server) is refused (prod, 2026-10-17). Turns pass
+* `--strict-mcp-config --mcp-config <file>`, so the servers in that file are
+* exactly the Alfe-installed set; each gets a server-wide `mcp__<server>` rule.
+* No blanket `mcp__*` wildcard: the allow-list stays scoped to what Alfe wrote.
+*
+* The file is read on every spawn, so a newly installed integration server is
+* allowed on the next turn without restarting the host.
+*/
+const CLAUDE_AI_PREFIX = "claude.ai ";
+/**
+* Mirrors how claude (2.1.x) builds the `<server>` segment of an MCP tool id:
+* every character outside `[a-zA-Z0-9_-]` becomes `_` (hyphens are kept), and
+* `claude.ai ` connector names also collapse and trim underscores. Permission
+* rules match on this normalised name, so a rule must use it too.
+*/
+function normalizeMcpServerName(name) {
+	let normalized = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+	if (name.startsWith(CLAUDE_AI_PREFIX)) normalized = normalized.replace(/_+/g, "_").replace(/^_|_$/g, "");
+	return normalized;
+}
+/**
+* Server-wide allow rules (`mcp__<server>`) for every server in the
+* `--mcp-config` file. A missing or malformed file yields no rules and one
+* warning; the turn still runs, it just cannot call MCP tools.
+*/
+function mcpServerAllowRules(configPath, log) {
+	if (!configPath) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse((0, node_fs.readFileSync)(configPath, "utf8"));
+	} catch (err) {
+		log.warn(`[claude-host] could not read MCP config ${configPath}; MCP tools are not allowed this turn: ${err instanceof Error ? err.message : String(err)}`);
+		return [];
+	}
+	const servers = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.mcpServers : void 0;
+	if (servers === null || typeof servers !== "object" || Array.isArray(servers)) {
+		log.warn(`[claude-host] MCP config ${configPath} has no mcpServers map; MCP tools are not allowed this turn`);
+		return [];
+	}
+	const rules = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(servers)) {
+		const normalized = normalizeMcpServerName(name);
+		if (!normalized || normalized.includes("__")) {
+			log.warn(`[claude-host] MCP server "${name}" cannot be expressed as a server-wide allow rule; its tools stay denied`);
+			continue;
+		}
+		rules.add(`mcp__${normalized}`);
+	}
+	return [...rules];
+}
+//#endregion
 //#region src/stream-mapper.ts
 /**
 * Claude Code `--output-format stream-json` → Alfe chat-activity mapper.
@@ -970,7 +1028,7 @@ var SessionDriver = class {
 		return this.runPerTurn(params);
 	}
 	buildArgs(params) {
-		const allowed = (params.allowedTools ?? (this.managed ? MANAGED_ALLOWED_TOOLS : DEFAULT_ALLOWED_TOOLS)).join(",");
+		const allowed = [...params.allowedTools ?? (this.managed ? MANAGED_ALLOWED_TOOLS : DEFAULT_ALLOWED_TOOLS), ...mcpServerAllowRules(params.mcpConfigPath, this.log)].join(",");
 		const permissionMode = params.permissionMode ?? "dontAsk";
 		if (!CLAUDE_PERMISSION_MODES.includes(permissionMode)) throw new Error(`Unsupported Claude permission mode: ${permissionMode}`);
 		const args = [

package/dist/host-config.js

@@ -1,6 +1,6 @@
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
 import { ChatServiceClient, resolveAlfeChat } from "@alfe.ai/chat";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { mkdir, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
@@ -478,6 +478,64 @@ var CredentialStatusReporter = class {
 	}
 };
 //#endregion
+//#region src/mcp-allow-rules.ts
+/**
+* Allow rules for the MCP servers a bridged turn loads.
+*
+* Turns run under `--permission-mode dontAsk`, which DENIES any tool not in
+* `--allowedTools`. MCP tools are named `mcp__<server>__<tool>`, so without a
+* rule per server every MCP call (alfe-platform memory/voice/send/secrets and
+* every integration server) is refused (prod, 2026-10-17). Turns pass
+* `--strict-mcp-config --mcp-config <file>`, so the servers in that file are
+* exactly the Alfe-installed set; each gets a server-wide `mcp__<server>` rule.
+* No blanket `mcp__*` wildcard: the allow-list stays scoped to what Alfe wrote.
+*
+* The file is read on every spawn, so a newly installed integration server is
+* allowed on the next turn without restarting the host.
+*/
+const CLAUDE_AI_PREFIX = "claude.ai ";
+/**
+* Mirrors how claude (2.1.x) builds the `<server>` segment of an MCP tool id:
+* every character outside `[a-zA-Z0-9_-]` becomes `_` (hyphens are kept), and
+* `claude.ai ` connector names also collapse and trim underscores. Permission
+* rules match on this normalised name, so a rule must use it too.
+*/
+function normalizeMcpServerName(name) {
+	let normalized = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+	if (name.startsWith(CLAUDE_AI_PREFIX)) normalized = normalized.replace(/_+/g, "_").replace(/^_|_$/g, "");
+	return normalized;
+}
+/**
+* Server-wide allow rules (`mcp__<server>`) for every server in the
+* `--mcp-config` file. A missing or malformed file yields no rules and one
+* warning; the turn still runs, it just cannot call MCP tools.
+*/
+function mcpServerAllowRules(configPath, log) {
+	if (!configPath) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(configPath, "utf8"));
+	} catch (err) {
+		log.warn(`[claude-host] could not read MCP config ${configPath}; MCP tools are not allowed this turn: ${err instanceof Error ? err.message : String(err)}`);
+		return [];
+	}
+	const servers = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.mcpServers : void 0;
+	if (servers === null || typeof servers !== "object" || Array.isArray(servers)) {
+		log.warn(`[claude-host] MCP config ${configPath} has no mcpServers map; MCP tools are not allowed this turn`);
+		return [];
+	}
+	const rules = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(servers)) {
+		const normalized = normalizeMcpServerName(name);
+		if (!normalized || normalized.includes("__")) {
+			log.warn(`[claude-host] MCP server "${name}" cannot be expressed as a server-wide allow rule; its tools stay denied`);
+			continue;
+		}
+		rules.add(`mcp__${normalized}`);
+	}
+	return [...rules];
+}
+//#endregion
 //#region src/stream-mapper.ts
 /**
 * Claude Code `--output-format stream-json` → Alfe chat-activity mapper.
@@ -970,7 +1028,7 @@ var SessionDriver = class {
 		return this.runPerTurn(params);
 	}
 	buildArgs(params) {
-		const allowed = (params.allowedTools ?? (this.managed ? MANAGED_ALLOWED_TOOLS : DEFAULT_ALLOWED_TOOLS)).join(",");
+		const allowed = [...params.allowedTools ?? (this.managed ? MANAGED_ALLOWED_TOOLS : DEFAULT_ALLOWED_TOOLS), ...mcpServerAllowRules(params.mcpConfigPath, this.log)].join(",");
 		const permissionMode = params.permissionMode ?? "dontAsk";
 		if (!CLAUDE_PERMISSION_MODES.includes(permissionMode)) throw new Error(`Unsupported Claude permission mode: ${permissionMode}`);
 		const args = [

package/dist/index.d.cts

@@ -90,12 +90,19 @@ interface ConnectProviderAccounts {
 }
 /**
  * One AWS CLI profile an agent may use (`GET /agent/connect/aws/accounts`).
- * `roleArn` is null for a connection's Direct identity. Carries no secret
- * material; sessions are minted per call via `getAwsSession`.
+ * `roleArn` is null for a connection's Direct identity and for IAM Identity
+ * Center (SSO) profiles, which name their `permissionSet` instead. Carries no
+ * secret material; sessions are minted per call via `getAwsSession`.
  */
 interface AwsProfile {
   profile: string;
   roleArn: string | null;
+  /**
+   * IAM Identity Center permission set (role name) for an SSO profile; `null`
+   * for role, access-key and shared-session profiles. Older servers omit the
+   * field, which normalizes to `null`.
+   */
+  permissionSet: string | null;
   accountId: string;
   region: string;
   label: string | null;
@@ -2636,7 +2643,11 @@ interface RunTurnParams {
    * mode: the host always passes a registry id there).
    */
   model?: string;
-  /** Tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS). */
+  /**
+   * Built-in tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS, or
+   * MANAGED_ALLOWED_TOOLS on a managed VM). The `--mcp-config` servers' rules
+   * are always appended.
+   */
   allowedTools?: readonly string[];
   /** Permission mode (defaults to DEFAULT_PERMISSION_MODE — never bypass). */
   permissionMode?: ClaudePermissionMode;

package/dist/index.d.ts

@@ -90,12 +90,19 @@ interface ConnectProviderAccounts {
 }
 /**
  * One AWS CLI profile an agent may use (`GET /agent/connect/aws/accounts`).
- * `roleArn` is null for a connection's Direct identity. Carries no secret
- * material; sessions are minted per call via `getAwsSession`.
+ * `roleArn` is null for a connection's Direct identity and for IAM Identity
+ * Center (SSO) profiles, which name their `permissionSet` instead. Carries no
+ * secret material; sessions are minted per call via `getAwsSession`.
  */
 interface AwsProfile {
   profile: string;
   roleArn: string | null;
+  /**
+   * IAM Identity Center permission set (role name) for an SSO profile; `null`
+   * for role, access-key and shared-session profiles. Older servers omit the
+   * field, which normalizes to `null`.
+   */
+  permissionSet: string | null;
   accountId: string;
   region: string;
   label: string | null;
@@ -2636,7 +2643,11 @@ interface RunTurnParams {
    * mode: the host always passes a registry id there).
    */
   model?: string;
-  /** Tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS). */
+  /**
+   * Built-in tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS, or
+   * MANAGED_ALLOWED_TOOLS on a managed VM). The `--mcp-config` servers' rules
+   * are always appended.
+   */
   allowedTools?: readonly string[];
   /** Permission mode (defaults to DEFAULT_PERMISSION_MODE — never bypass). */
   permissionMode?: ClaudePermissionMode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/claude-code-host",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Chat bridge that makes a Claude Code agent reachable from Alfe chat, on its Claude credential, the local claude login, or Alfe AI credits",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,9 +19,9 @@
     "dist"
   ],
   "dependencies": {
-    "@alfe.ai/agent-api-client": "^0.21.1",
-    "@alfe.ai/chat": "^0.0.19",
-    "@alfe.ai/config": "^0.4.2"
+    "@alfe.ai/agent-api-client": "^0.21.2",
+    "@alfe.ai/config": "^0.4.2",
+    "@alfe.ai/chat": "^0.0.19"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",