@amoree-code/ocean 0.0.0-stage → 1.2.0

package/node_modules/@ocean/market/dist/mcp/mcp-gateway.js

@@ -0,0 +1,317 @@
+import { mkdir, readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { marketplaceIndexSchema } from "@ocean/core/domain/capabilities/capability-manifest.js";
+import { engineRoot } from "@ocean/core/shared/paths.js";
+import { scanText } from "../security/description-scan.js";
+import { engineIndexFile } from "./mcp-connection.js";
+import { literalArguments, planMcpLaunch, } from "./mcp-launch.js";
+export const GATEWAY_CAPABILITY = "dev.ocean/mcp-gateway";
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+function namespaceFor(capability, taken) {
+    const clean = (value) => value.toLowerCase().replace(/[^a-z0-9_-]+/g, "_");
+    const short = clean(capability.split("/").at(-1) ?? capability);
+    let prefix = taken.has(short) ? clean(capability) : short;
+    for (let suffix = 2; taken.has(prefix); suffix++)
+        prefix = `${clean(capability)}-${suffix}`;
+    taken.add(prefix);
+    return prefix;
+}
+// The servers the gateway routes: the engine's first-party ones, then every MCP server installed
+// from the marketplace, each planned by the same launcher as `ocean market exec` — declared
+// permissions, declared environment only. A third-party server joins only by
+// being installed; anything that cannot be launched here is reported, not fatal.
+export async function gatewayMembers(options) {
+    const members = [];
+    const skipped = [];
+    const taken = new Set();
+    const notFirstParty = [];
+    const index = marketplaceIndexSchema.parse(JSON.parse(await readFile(options.indexFile ?? engineIndexFile(), "utf8")));
+    for (const manifest of index.capabilities) {
+        if (manifest.kind !== "mcp" || manifest.name === GATEWAY_CAPABILITY)
+            continue;
+        const item = manifest.spec.packages?.[0];
+        if (item?.registryType !== "ocean-engine") {
+            notFirstParty.push(manifest.name);
+            continue;
+        }
+        members.push({
+            capability: manifest.name,
+            prefix: namespaceFor(manifest.name, taken),
+            command: process.execPath,
+            args: [
+                path.join(engineRoot(), "dist", "main.js"),
+                ...literalArguments(item.packageArguments, `${manifest.name} packageArguments`),
+            ],
+            cwd: engineRoot(),
+            env: {},
+            inheritEnv: true,
+        });
+    }
+    let files = [];
+    try {
+        files = (await readdir(options.serversRoot))
+            .filter((file) => file.endsWith(".json"))
+            .sort();
+    }
+    catch {
+        // Nothing installed yet.
+    }
+    for (const file of files) {
+        let installed;
+        try {
+            installed = JSON.parse(await readFile(path.join(options.serversRoot, file), "utf8"));
+        }
+        catch (error) {
+            skipped.push({ capability: file, reason: errorMessage(error) });
+            continue;
+        }
+        const name = installed.capability;
+        // An installed copy of an engine server runs the same code as the member already routed.
+        if (name === GATEWAY_CAPABILITY ||
+            members.some((member) => member.capability === name))
+            continue;
+        const stateDir = path.join(options.stateRoot, path.basename(file, ".json"));
+        try {
+            const launch = planMcpLaunch(installed, {
+                stateDir,
+                env: options.env,
+            });
+            if (launch.transport === "remote") {
+                skipped.push({
+                    capability: name,
+                    reason: `remote server (${launch.type} ${launch.url}); connect the client to it directly`,
+                });
+                continue;
+            }
+            await mkdir(stateDir, { recursive: true });
+            members.push({
+                capability: name,
+                prefix: namespaceFor(name, taken),
+                command: launch.command,
+                args: launch.args,
+                cwd: launch.cwd,
+                env: launch.env,
+                inheritEnv: false,
+            });
+        }
+        catch (error) {
+            skipped.push({ capability: name, reason: errorMessage(error) });
+        }
+    }
+    for (const name of notFirstParty)
+        if (!members.some((member) => member.capability === name))
+            skipped.push({
+                capability: name,
+                reason: "not first-party; install it from the marketplace to route it through the gateway",
+            });
+    return { members, skipped };
+}
+// Every text a model reads for a tool: its name, its description and each key and string inside
+// its input schema (property names, titles, enums and defaults included).
+function toolTexts(tool) {
+    const texts = [];
+    const walk = (value, at) => {
+        if (typeof value === "string")
+            texts.push({ at, text: value });
+        else if (Array.isArray(value))
+            value.forEach((item, index) => {
+                walk(item, `${at}[${index}]`);
+            });
+        else if (value && typeof value === "object")
+            for (const [key, item] of Object.entries(value)) {
+                texts.push({ at: `${at} key`, text: key });
+                walk(item, `${at}.${key}`);
+            }
+    };
+    walk(tool.name, "name");
+    walk(tool.description, "description");
+    walk(tool.inputSchema, "inputSchema");
+    return texts;
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function withTimeout(promise, ms, what) {
+    let timer;
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`${what} within ${ms} ms`)), ms);
+        }),
+    ]).finally(() => clearTimeout(timer));
+}
+class GatewayError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+// One MCP endpoint in front of many servers. Tools are exposed as `<prefix>__<tool>`; a tool
+// whose texts carry injected instructions is hidden, since clients read them as prompt. The
+// gateway adds no authority and removes none: a call reaches its server with the arguments the
+// client sent, so the server's own checks (an approval fingerprint, say) decide as they would
+// on a direct connection, and the client's permission prompt stays the human gate.
+export class McpGateway {
+    members;
+    options;
+    #routes = new Map();
+    #tools = [];
+    #clients = [];
+    #started;
+    constructor(members, options) {
+        this.members = members;
+        this.options = options;
+    }
+    // Starts every member at once; one that fails or hangs is left out, never the whole gateway.
+    start() {
+        this.#started ??= this.#connectAll();
+        return this.#started;
+    }
+    async #connectAll() {
+        const timeoutMs = this.options.timeoutMs ?? 15_000;
+        const clients = this.members.map((member) => this.options.client(member));
+        this.#clients.push(...clients);
+        const results = await Promise.allSettled(this.members.map(async (member, index) => {
+            await withTimeout(clients[index].connect(), timeoutMs, `${member.capability} did not start`);
+            return withTimeout(clients[index].listTools(), timeoutMs, `${member.capability} did not list its tools`);
+        }));
+        results.forEach((result, index) => {
+            const member = this.members[index];
+            if (result.status === "rejected") {
+                this.#log(`${member.capability} left out: ${errorMessage(result.reason)}`);
+                clients[index].close();
+                return;
+            }
+            for (const tool of result.value)
+                this.#expose(member, clients[index], tool);
+        });
+    }
+    #expose(member, client, tool) {
+        const findings = toolTexts(tool).flatMap(({ at, text }) => scanText(at, text));
+        if (findings.length) {
+            this.#log(`${member.capability} tool ${tool.name} hidden: ${findings.map((finding) => `${finding.rule} in ${finding.source} ("${finding.excerpt}")`).join("; ")}`);
+            return;
+        }
+        const name = `${member.prefix}__${tool.name}`;
+        if (this.#routes.has(name)) {
+            this.#log(`${member.capability} lists ${tool.name} twice; kept the first`);
+            return;
+        }
+        this.#routes.set(name, { client, tool: tool.name });
+        this.#tools.push({ ...tool, name });
+    }
+    async tools() {
+        await this.start();
+        return [...this.#tools];
+    }
+    async call(name, args) {
+        await this.start();
+        const route = this.#routes.get(name);
+        if (!route)
+            throw new GatewayError(-32602, `Unknown MCP tool: ${name}`);
+        return route.client.forwardToolCall(route.tool, args);
+    }
+    async handle(request) {
+        // MCP 2025-06-18 has no batches; anything but one request object is invalid.
+        if (!isRecord(request))
+            return {
+                jsonrpc: "2.0",
+                id: null,
+                error: { code: -32600, message: "Invalid Request" },
+            };
+        // Notifications get no answer.
+        if (request.id === undefined)
+            return null;
+        const id = typeof request.id === "string" || typeof request.id === "number"
+            ? request.id
+            : null;
+        return this.#respond(request, id);
+    }
+    async #respond(request, id) {
+        try {
+            return { jsonrpc: "2.0", id, result: await this.#answer(request) };
+        }
+        catch (error) {
+            return {
+                jsonrpc: "2.0",
+                id,
+                error: {
+                    code: error instanceof GatewayError ? error.code : -32000,
+                    message: errorMessage(error),
+                },
+            };
+        }
+    }
+    async #answer(request) {
+        switch (request.method) {
+            case "initialize":
+                // Members start while the client finishes its handshake.
+                void this.start();
+                return {
+                    protocolVersion: "2025-06-18",
+                    capabilities: { tools: {} },
+                    serverInfo: {
+                        name: this.options.serverName ?? "ocean-gateway",
+                        version: this.options.version ?? "0.0.0",
+                    },
+                    ...(this.options.instructions
+                        ? { instructions: this.options.instructions }
+                        : {}),
+                };
+            case "ping":
+                return {};
+            case "tools/list":
+                return { tools: await this.tools() };
+            case "tools/call": {
+                const params = isRecord(request.params) ? request.params : {};
+                const args = params.arguments ?? {};
+                if (typeof params.name !== "string" || !isRecord(args))
+                    throw new GatewayError(-32602, "tools/call needs a tool name and an arguments object");
+                return this.call(params.name, args);
+            }
+            default:
+                throw new GatewayError(-32601, `Unsupported MCP method: ${request.method ?? ""}`);
+        }
+    }
+    close() {
+        for (const client of this.#clients)
+            client.close();
+    }
+    #log(line) {
+        this.options.log?.(line);
+    }
+}
+// Newline-delimited JSON-RPC over stdio. Requests run concurrently, so a slow tool on one server
+// does not hold up another; members are stopped when the client closes the stream.
+export async function serveMcpGateway(gateway, input = process.stdin, output = process.stdout) {
+    let buffer = "";
+    const write = (response) => {
+        if (response)
+            output.write(`${JSON.stringify(response)}\n`);
+    };
+    input.setEncoding("utf8");
+    input.on("data", (chunk) => {
+        buffer += chunk;
+        for (let newline = buffer.indexOf("\n"); newline >= 0; newline = buffer.indexOf("\n")) {
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            if (!line)
+                continue;
+            let request;
+            try {
+                request = JSON.parse(line);
+            }
+            catch {
+                write({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: { code: -32700, message: "Parse error" },
+                });
+                continue;
+            }
+            void gateway.handle(request).then(write);
+        }
+    });
+    await new Promise((resolve) => input.once("end", resolve));
+    gateway.close();
+}
+//# sourceMappingURL=mcp-gateway.js.map

package/node_modules/@ocean/market/dist/mcp/mcp-launch.js

@@ -0,0 +1,102 @@
+import os from "node:os";
+import { PermissionPolicy } from "../security/permissions.js";
+// Where each runner takes its own (runtime) arguments: before the package for npx and uvx,
+// after `run` for docker, so container flags such as `-e` or `-v` reach `docker run`.
+const runners = {
+    npm: (identifier, version, runtime) => ({
+        command: "npx",
+        args: [...runtime, "-y", version ? `${identifier}@${version}` : identifier],
+    }),
+    pypi: (identifier, version, runtime) => ({
+        command: "uvx",
+        args: [...runtime, version ? `${identifier}==${version}` : identifier],
+    }),
+    oci: (identifier, version, runtime) => ({
+        command: "docker",
+        args: [
+            "run",
+            "-i",
+            "--rm",
+            ...runtime,
+            version ? `${identifier}:${version}` : identifier,
+        ],
+    }),
+};
+export function literalArguments(list, where) {
+    if (list === undefined)
+        return [];
+    if (!Array.isArray(list))
+        throw new Error(`${where} must be an array`);
+    return list.flatMap((argument) => {
+        if (typeof argument?.value !== "string")
+            throw new Error(`${where}: only arguments with a literal value are supported`);
+        if (argument.type === "named") {
+            if (typeof argument.name !== "string")
+                throw new Error(`${where}: a named argument needs a name`);
+            return [argument.name, argument.value];
+        }
+        return [argument.value];
+    });
+}
+// Turns an installed server into the exact process (or endpoint) to connect to, checking every
+// step against what the capability declared: the runner must be a declared `exec`, every
+// environment variable a declared `env`, a remote's host a declared `network`. The process gets
+// only those variables (plus PATH so the runner resolves).
+export function planMcpLaunch(installed, options) {
+    const home = options.home ?? os.homedir();
+    const hostEnv = options.env ?? process.env;
+    const policy = new PermissionPolicy(installed.capability, installed.permissions, home);
+    const { server } = installed;
+    const stdio = server.packages?.find((item) => {
+        const transport = item.transport?.type;
+        return transport === undefined || transport === "stdio";
+    });
+    if (!stdio) {
+        const remote = server.remotes?.[0];
+        if (!remote)
+            throw new Error(`${installed.capability} has no stdio package or remote endpoint`);
+        const url = new URL(String(remote.url));
+        policy.require({ type: "network", target: url.hostname });
+        return {
+            transport: "remote",
+            type: String(remote.type ?? "streamable-http"),
+            url: url.href,
+        };
+    }
+    const registryType = String(stdio.registryType);
+    const runner = runners[registryType];
+    if (!runner)
+        throw new Error(`${installed.capability}: registry type ${registryType} is not supported`);
+    const base = runner(String(stdio.identifier), typeof stdio.version === "string" ? stdio.version : undefined, literalArguments(stdio.runtimeArguments, "runtimeArguments"));
+    policy.require({ type: "exec", target: base.command });
+    const env = {
+        PATH: hostEnv.PATH ?? "/usr/bin:/bin",
+        HOME: home,
+    };
+    const declaredVariables = Array.isArray(stdio.environmentVariables)
+        ? stdio.environmentVariables
+        : [];
+    for (const variable of declaredVariables) {
+        if (typeof variable?.name !== "string")
+            throw new Error(`${installed.capability}: environment variable without a name`);
+        policy.require({ type: "env", target: variable.name });
+        const value = hostEnv[variable.name] ??
+            (typeof variable.default === "string" ? variable.default : undefined);
+        if (value !== undefined)
+            env[variable.name] = value;
+        else if (variable.isRequired === true)
+            throw new Error(`${installed.capability} needs ${variable.name} set in the environment`);
+    }
+    const args = [
+        ...base.args,
+        ...literalArguments(stdio.packageArguments, "packageArguments"),
+    ];
+    return {
+        transport: "stdio",
+        command: base.command,
+        args,
+        env,
+        cwd: options.stateDir,
+    };
+}
+//# sourceMappingURL=mcp-launch.js.map

package/node_modules/@ocean/market/dist/mcp/mcp-runner.js

@@ -0,0 +1,32 @@
+import { spawn } from "node:child_process";
+import { mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { mcpServerFile } from "../adapters/mcp-adapter.js";
+import { planMcpLaunch } from "./mcp-launch.js";
+// The one way an installed MCP server is started: planned against its declared permissions,
+// then run with stdio passed through, so a client can point at
+// `ocean market exec <name>` as its stdio command.
+export async function runInstalledMcp(name, options) {
+    let installed;
+    try {
+        installed = JSON.parse(await readFile(mcpServerFile(options.serversRoot, name), "utf8"));
+    }
+    catch {
+        throw new Error(`${name} is not an installed MCP server`);
+    }
+    const stateDir = path.join(options.stateRoot, path.basename(mcpServerFile(options.serversRoot, name), ".json"));
+    await mkdir(stateDir, { recursive: true });
+    const launch = planMcpLaunch(installed, { stateDir });
+    if (launch.transport === "remote")
+        throw new Error(`${name} is a remote server (${launch.type} ${launch.url}); connect the client to it directly`);
+    const child = spawn(launch.command, launch.args, {
+        cwd: launch.cwd,
+        env: launch.env,
+        stdio: "inherit",
+    });
+    return new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("exit", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+    });
+}
+//# sourceMappingURL=mcp-runner.js.map

package/node_modules/@ocean/market/dist/security/description-scan.js

@@ -0,0 +1,45 @@
+const rules = [
+    {
+        rule: "override-instructions",
+        pattern: /\b(ignore|disregard|forget|override)\b[^.\n]{0,40}\b(previous|prior|above|earlier|system|all)\b[^.\n]{0,20}\b(instructions?|prompts?|rules?|messages?)\b/i,
+    },
+    {
+        rule: "conceal-from-user",
+        pattern: /\b(do not|don't|never)\b[^.\n]{0,30}\b(tell|inform|mention|reveal|show|notify)\b[^.\n]{0,30}\b(the )?(user|owner|human)\b/i,
+    },
+    {
+        rule: "exfiltrate-secrets",
+        pattern: /\b(send|post|upload|forward|exfiltrate|transmit)\b[^.\n]{0,60}\b(secrets?|tokens?|api[ _-]?keys?|passwords?|credentials?|ssh keys?|\.env)\b/i,
+    },
+    {
+        rule: "read-secrets",
+        pattern: /(~\/\.ssh\/|id_rsa|id_ed25519|\.aws\/credentials|\/\.env\b)/i,
+    },
+    {
+        rule: "fake-system-tag",
+        pattern: /<\s*\/?\s*(system|important|instructions?|admin)\s*>/i,
+    },
+    {
+        // Zero-width, bidi-override and Unicode tag characters hide text from a human reviewer.
+        rule: "hidden-unicode",
+        pattern: /[​-‏‪-‮⁠-⁤⁦-⁩]|[\u{E0000}-\u{E007F}]/u,
+    },
+];
+export function scanText(source, text) {
+    const findings = [];
+    for (const { rule, pattern } of rules) {
+        const match = pattern.exec(text);
+        if (!match)
+            continue;
+        const start = Math.max(0, match.index - 20);
+        const excerpt = text
+            .slice(start, match.index + match[0].length + 20)
+            .replace(/[​-‏‪-‮⁠-⁤⁦-⁩]/g, "␣")
+            .replace(/[\u{E0000}-\u{E007F}]/gu, "␣")
+            .replace(/\s+/g, " ")
+            .trim();
+        findings.push({ source, rule, excerpt });
+    }
+    return findings;
+}
+//# sourceMappingURL=description-scan.js.map

package/node_modules/@ocean/market/dist/security/permissions.js

@@ -0,0 +1,57 @@
+import os from "node:os";
+import path from "node:path";
+export class PermissionDeniedError extends Error {
+    capability;
+    request;
+    constructor(capability, request) {
+        super(`${capability} did not declare permission ${request.type} "${request.target}"`);
+        this.capability = capability;
+        this.request = request;
+        this.name = "PermissionDeniedError";
+    }
+}
+export function expandHome(value, home = os.homedir()) {
+    return path.resolve(value === "~"
+        ? home
+        : value.startsWith("~/")
+            ? path.join(home, value.slice(2))
+            : value);
+}
+const within = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path.sep}`);
+// What a capability declared, as the runtime checks it. Anything not declared is refused.
+// - env / exec: exact name (exec also matches a command's basename)
+// - network: exact host, `*.domain` for subdomains, or `*` for any host
+// - fs.read / fs.write: the path or anything below it (`~` expands); write implies read
+export class PermissionPolicy {
+    capability;
+    permissions;
+    home;
+    constructor(capability, permissions, home = os.homedir()) {
+        this.capability = capability;
+        this.permissions = permissions;
+        this.home = home;
+    }
+    allows({ type, target }) {
+        const { filesystem, network, env, exec } = this.permissions;
+        if (type === "env")
+            return env.includes(target);
+        if (type === "exec")
+            return exec.includes(target) || exec.includes(path.basename(target));
+        if (type === "network") {
+            const host = target.toLowerCase();
+            return network.some((entry) => entry === "*" ||
+                entry === host ||
+                (entry.startsWith("*.") && host.endsWith(entry.slice(1))));
+        }
+        const candidate = expandHome(target, this.home);
+        const roots = type === "fs.write"
+            ? filesystem.write
+            : [...filesystem.read, ...filesystem.write];
+        return roots.some((root) => within(expandHome(root, this.home), candidate));
+    }
+    require(request) {
+        if (!this.allows(request))
+            throw new PermissionDeniedError(this.capability, request);
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/node_modules/@ocean/market/dist/skills/core-skill-sync.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { cp, lstat, mkdir, readdir, readFile, rm, stat, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { enginePath } from "@ocean/core/shared/paths.js";
+export const clientSkillRoots = {
+    claude: (home) => path.join(home, ".claude", "skills"),
+    codex: (home) => path.join(home, ".codex", "skills"),
+    gemini: (home) => path.join(home, ".gemini", "skills"),
+    hermes: (home) => path.join(home, ".hermes", "skills"),
+    cursor: (home) => path.join(home, ".cursor", "skills"),
+    antigravity: (home) => path.join(home, ".config", "antigravity", "skills"),
+};
+async function coreSkillNames() {
+    const core = path.join(enginePath("skills"), "core");
+    return (await readdir(core, { withFileTypes: true }))
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort();
+}
+export async function coreSkillReports(home = os.homedir()) {
+    const names = await coreSkillNames();
+    return Promise.all(Object.keys(clientSkillRoots).map(async (client) => {
+        const root = clientSkillRoots[client](home);
+        try {
+            await stat(root);
+        }
+        catch {
+            return {
+                client,
+                root,
+                status: "unavailable",
+                missing: names,
+                drifted: [],
+            };
+        }
+        const missing = [];
+        const drifted = [];
+        for (const name of names) {
+            const source = await readFile(path.join(enginePath("skills"), "core", name, "SKILL.md"));
+            const targetPath = path.join(root, name, "SKILL.md");
+            try {
+                const target = await readFile(targetPath);
+                if (!same(source, target))
+                    drifted.push(name);
+            }
+            catch {
+                missing.push(name);
+            }
+        }
+        return {
+            client,
+            root,
+            status: missing.length
+                ? "missing"
+                : drifted.length
+                    ? "drifted"
+                    : "synchronized",
+            missing,
+            drifted,
+        };
+    }));
+}
+export async function syncCoreSkills(home = os.homedir()) {
+    const names = await coreSkillNames();
+    const results = [];
+    for (const report of await coreSkillReports(home)) {
+        if (report.status === "unavailable") {
+            results.push({
+                client: report.client,
+                root: report.root,
+                copied: [],
+                status: report.status,
+            });
+            continue;
+        }
+        const copied = [];
+        for (const name of names) {
+            const source = path.join(enginePath("skills"), "core", name, "SKILL.md");
+            const target = path.join(report.root, name, "SKILL.md");
+            // A link left behind by a moved source makes mkdir throw ENOENT; it holds nothing.
+            const skillDir = path.dirname(target);
+            if ((await lstat(skillDir).catch(() => null))?.isSymbolicLink() &&
+                !(await stat(skillDir).catch(() => null)))
+                await rm(skillDir);
+            await mkdir(skillDir, { recursive: true });
+            const sourceBytes = await readFile(source);
+            let current = null;
+            try {
+                current = await readFile(target);
+            }
+            catch {
+                /* new client skill */
+            }
+            if (!current || !same(sourceBytes, current)) {
+                await cp(source, target);
+                copied.push(name);
+            }
+        }
+        results.push({
+            client: report.client,
+            root: report.root,
+            copied,
+            status: "synchronized",
+        });
+    }
+    return results;
+}
+function same(left, right) {
+    return (createHash("sha256").update(left).digest("hex") ===
+        createHash("sha256").update(right).digest("hex"));
+}
+//# sourceMappingURL=core-skill-sync.js.map