@ashx-j/lunr 0.1.0

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js

@@ -0,0 +1,302 @@
+// @ts-nocheck
+/**
+ * MCP OAuth Provider
+ *
+ * Implementation of the MCP SDK's OAuthClientProvider interface.
+ * Handles OAuth client registration, token storage, and authorization redirection.
+ */
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { getAuthForUrl, updateTokens, updateClientInfo, updateCodeVerifier, updateOAuthState, clearAllCredentials, clearClientInfo, clearTokens, } from "./mcp-auth.js";
+// Callback server configuration
+const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
+const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
+let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+    const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+    if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {
+        configuredOAuthCallbackPort = parsedPort;
+    }
+}
+let oauthCallbackPort = configuredOAuthCallbackPort;
+let oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+export function getConfiguredOAuthCallbackPort() {
+    return configuredOAuthCallbackPort;
+}
+export function getOAuthCallbackPort() {
+    return oauthCallbackPort;
+}
+export function setOAuthCallbackPort(port) {
+    oauthCallbackPort = port;
+}
+export function getOAuthCallbackPath() {
+    return oauthCallbackPath;
+}
+export function setOAuthCallbackPath(path) {
+    oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+/**
+ * OAuth provider implementation for MCP servers.
+ * Implements the OAuthClientProvider interface from the MCP SDK.
+ */
+export class McpOAuthProvider {
+    serverName;
+    serverUrl;
+    config;
+    callbacks;
+    redirectUrlSnapshot;
+    constructor(serverName, serverUrl, config, callbacks) {
+        this.serverName = serverName;
+        this.serverUrl = serverUrl;
+        this.config = config;
+        this.callbacks = callbacks;
+        this.redirectUrlSnapshot = config.grantType === "client_credentials"
+            ? undefined
+            : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+    }
+    get usesClientCredentials() {
+        return this.config.grantType === "client_credentials";
+    }
+    /**
+     * The redirect URL for OAuth callbacks.
+     * This must match the redirect_uri in client metadata.
+     */
+    get redirectUrl() {
+        return this.redirectUrlSnapshot;
+    }
+    /**
+     * Client metadata for dynamic registration.
+     * Describes this client to the OAuth authorization server.
+     */
+    get clientMetadata() {
+        if (this.usesClientCredentials) {
+            return {
+                client_name: this.config.clientName ?? "Pi Coding Agent",
+                client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+                redirect_uris: [],
+                grant_types: ["client_credentials"],
+                token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+            };
+        }
+        const redirectUrl = this.redirectUrl;
+        if (!redirectUrl) {
+            throw new Error("redirectUrl is required for authorization_code flow");
+        }
+        return {
+            redirect_uris: [redirectUrl],
+            client_name: this.config.clientName ?? "Pi Coding Agent",
+            client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+            ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),
+        };
+    }
+    /**
+     * Get client information (for pre-registered or dynamically registered clients).
+     * Returns undefined if no client info exists or if the server URL has changed.
+     */
+    async clientInformation() {
+        // Check config first (pre-registered client)
+        if (this.config.clientId) {
+            return {
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+            };
+        }
+        // Check stored client info (from dynamic registration)
+        // Use getAuthForUrl to validate credentials are for the current server URL
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+        if (entry?.clientInfo) {
+            // Check if client secret has expired
+            if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
+                return undefined;
+            }
+            return {
+                client_id: entry.clientInfo.clientId,
+                client_secret: entry.clientInfo.clientSecret,
+            };
+        }
+        // No client info or URL changed - will trigger dynamic registration
+        return undefined;
+    }
+    /**
+     * Save client information from dynamic registration.
+     */
+    async saveClientInformation(info) {
+        const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined);
+        const clientInfo = {
+            clientId: info.client_id,
+            clientSecret: info.client_secret,
+            clientIdIssuedAt: info.client_id_issued_at,
+            clientSecretExpiresAt: info.client_secret_expires_at,
+            redirectUris,
+        };
+        updateClientInfo(this.serverName, clientInfo, this.serverUrl);
+    }
+    /**
+     * Get stored OAuth tokens.
+     * Returns undefined if no tokens exist or if the server URL has changed.
+     */
+    async tokens() {
+        // Use getAuthForUrl to validate tokens are for the current server URL
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+        if (!entry?.tokens)
+            return undefined;
+        return {
+            access_token: entry.tokens.accessToken,
+            token_type: "Bearer",
+            refresh_token: entry.tokens.refreshToken,
+            expires_in: entry.tokens.expiresAt
+                ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))
+                : undefined,
+            scope: entry.tokens.scope,
+        };
+    }
+    /**
+     * Save OAuth tokens.
+     */
+    async saveTokens(tokens) {
+        const storedTokens = {
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token,
+            expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,
+            scope: tokens.scope,
+        };
+        updateTokens(this.serverName, storedTokens, this.serverUrl);
+    }
+    /**
+     * Redirect the user to the authorization URL.
+     * This opens the browser for the user to authenticate.
+     *
+     * Throws UnauthorizedError when called outside of a user-initiated flow
+     * (no oauthState saved by startAuth). That path is reached when the SDK
+     * falls through from a failed refresh into a fresh authorization_code
+     * flow, which library hosts cannot complete in-process.
+     */
+    async redirectToAuthorization(authorizationUrl) {
+        if (this.usesClientCredentials) {
+            throw new Error("redirectToAuthorization is not used for client_credentials flow");
+        }
+        // No saved oauthState means we're on the post-refresh authorize fallback.
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+        if (!entry?.oauthState) {
+            throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+        }
+        // URL is passed to callback, not logged (may contain sensitive params)
+        await this.callbacks.onRedirect(authorizationUrl);
+    }
+    /**
+     * Save the PKCE code verifier.
+     */
+    async saveCodeVerifier(codeVerifier) {
+        updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
+    }
+    /**
+     * Get the stored PKCE code verifier.
+     * @throws Error if no code verifier is stored
+     */
+    async codeVerifier() {
+        if (this.usesClientCredentials) {
+            throw new Error("codeVerifier is not used for client_credentials flow");
+        }
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+        if (!entry?.codeVerifier) {
+            throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+        }
+        return entry.codeVerifier;
+    }
+    /**
+     * Save the OAuth state parameter for CSRF protection.
+     */
+    async saveState(state) {
+        updateOAuthState(this.serverName, state, this.serverUrl);
+    }
+    /**
+     * Get the stored OAuth state parameter.
+     * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+     */
+    async state() {
+        if (this.usesClientCredentials) {
+            throw new Error("state is not used for client_credentials flow");
+        }
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl);
+        if (!entry?.oauthState) {
+            throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+        }
+        return entry.oauthState;
+    }
+    /**
+     * Invalidate credentials when authentication fails.
+     * Clears tokens, client info, or all credentials based on the type.
+     */
+    async invalidateCredentials(type) {
+        switch (type) {
+            case "all":
+                clearAllCredentials(this.serverName);
+                break;
+            case "client":
+                clearClientInfo(this.serverName);
+                break;
+            case "tokens":
+                clearTokens(this.serverName);
+                break;
+        }
+    }
+    /**
+     * Adds configured authorization-code scope without replacing the SDK's
+     * default token endpoint authentication behavior.
+     */
+    addClientAuthentication = async (headers, params, _url, metadata) => {
+        if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
+            params.set("scope", this.config.scope);
+        }
+        const clientInfo = await this.clientInformation();
+        if (!clientInfo) {
+            return;
+        }
+        const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
+        const hasClientSecret = clientInfo.client_secret !== undefined;
+        let authMethod;
+        if (supportedMethods.length === 0) {
+            authMethod = hasClientSecret ? "client_secret_post" : "none";
+        }
+        else if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+            authMethod = "client_secret_basic";
+        }
+        else if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+            authMethod = "client_secret_post";
+        }
+        else if (supportedMethods.includes("none")) {
+            authMethod = "none";
+        }
+        else {
+            authMethod = hasClientSecret ? "client_secret_post" : "none";
+        }
+        if (authMethod === "client_secret_basic") {
+            if (!clientInfo.client_secret) {
+                throw new Error("client_secret_basic authentication requires a client_secret");
+            }
+            headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+            return;
+        }
+        if (!params.has("client_id")) {
+            params.set("client_id", clientInfo.client_id);
+        }
+        if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
+            params.set("client_secret", clientInfo.client_secret);
+        }
+    };
+    prepareTokenRequest(scope) {
+        if (!this.usesClientCredentials) {
+            return undefined;
+        }
+        const params = new URLSearchParams({ grant_type: "client_credentials" });
+        const requestedScope = scope ?? this.config.scope;
+        if (requestedScope) {
+            params.set("scope", requestedScope);
+        }
+        return params;
+    }
+}
+export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };
+//# sourceMappingURL=mcp-oauth-provider.js.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-provider.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAO5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,WAAW,GAGZ,MAAM,eAAe,CAAA;AAEtB,gCAAgC;AAChC,MAAM,2BAA2B,GAAG,KAAK,CAAA;AACzC,MAAM,2BAA2B,GAAG,WAAW,CAAA;AAE/C,IAAI,2BAA2B,GAAG,2BAA2B,CAAA;AAE7D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC1E,2BAA2B,GAAG,UAAU,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AACnD,IAAI,iBAAiB,GAAG,2BAA2B,CAAA;AAEnD,MAAM,UAAU,8BAA8B,GAAW;IACvD,OAAO,2BAA2B,CAAA;AAAA,CACnC;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC7C,OAAO,iBAAiB,CAAA;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACvD,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;AAAA,CAC7D;AAkBD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAIjB,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS;IANF,mBAAmB,CAAoB;IAExD,YACU,UAAkB,EAClB,SAAiB,EACjB,MAAsB,EACtB,SAA4B,EACpC;0BAJQ,UAAU;yBACV,SAAS;sBACT,MAAM;yBACN,SAAS;QAEjB,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,oBAAoB;YAClE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,oBAAoB,EAAE,GAAG,oBAAoB,EAAE,EAAE,CAAA;IAAA,CAChG;IAED,IAAY,qBAAqB,GAAY;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAA;IAAA,CACtD;IAED;;;OAGG;IACH,IAAI,WAAW,GAAuB;QACpC,OAAO,IAAI,CAAC,mBAAmB,CAAA;IAAA,CAChC;IAED;;;OAGG;IACH,IAAI,cAAc,GAAwB;QACxC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB;gBACxD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,8CAA8C;gBACnF,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;aACrF,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QAED,OAAO;YACL,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB;YACxD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,8CAA8C;YACnF,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAA;IAAA,CACF;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,GAAgD;QACrE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACxC,CAAA;QACH,CAAC;QAED,uDAAuD;QACvD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;YACtB,qCAAqC;YACrC,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACzG,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACpC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY;aAC7C,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,OAAO,SAAS,CAAA;IAAA,CACjB;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAgC,EAAiB;QAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9F,MAAM,UAAU,GAAqB;YACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;YAC1C,qBAAqB,EAAE,IAAI,CAAC,wBAAwB;YACpD,YAAY;SACb,CAAA;QACD,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC9D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,GAAqC;QAC/C,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAA;QAEpC,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACtC,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAC1B,CAAA;IAAA,CACF;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB,EAAiB;QACnD,MAAM,YAAY,GAAiB;YACjC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa;YAClC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAChF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAA;QACD,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAC5D;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB,EAAiB;QAClE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAAA,CAClD;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAiB;QAC1D,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CAClE;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,GAAoB;QACpC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAA;IAAA,CAC1B;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAiB;QAC5C,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAAA,CACzD;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,GAAoB;QAC7B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,UAAU,CAAA;IAAA,CACxB;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAiC,EAAiB;QAC5E,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK;gBACR,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACpC,MAAK;YACP,KAAK,QAAQ;gBACX,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAChC,MAAK;YACP,KAAK,QAAQ;gBACX,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5B,MAAK;QACT,CAAC;IAAA,CACF;IAED;;;OAGG;IACH,uBAAuB,GAA4B,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC5F,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAM;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,EAAE,qCAAqC,IAAI,EAAE,CAAA;QAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,aAAa,KAAK,SAAS,CAAA;QAC9D,IAAI,UAAiE,CAAA;QAErE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/E,UAAU,GAAG,qBAAqB,CAAA;QACpC,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9E,UAAU,GAAG,oBAAoB,CAAA;QACnC,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,UAAU,GAAG,MAAM,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9D,CAAC;QAED,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC9H,OAAM;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,UAAU,KAAK,oBAAoB,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAAA;QACvD,CAAC;IAAA,CACF,CAAA;IAED,mBAAmB,CAAC,KAAc,EAA+B;QAC/D,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAA;QACjD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,MAAM,CAAA;IAAA,CACd;CACF;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAA","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Provider\n * \n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { AddClientAuthentication, OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { UnauthorizedError } from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport type {\n  OAuthClientMetadata,\n  OAuthTokens,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\"\nimport {\n  getAuthForUrl,\n  updateTokens,\n  updateClientInfo,\n  updateCodeVerifier,\n  updateOAuthState,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  type StoredTokens,\n  type StoredClientInfo,\n} from \"./mcp-auth.ts\"\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\"\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10)\n  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n    configuredOAuthCallbackPort = parsedPort\n  }\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH\n\nexport function getConfiguredOAuthCallbackPort(): number {\n  return configuredOAuthCallbackPort\n}\n\nexport function getOAuthCallbackPort(): number {\n  return oauthCallbackPort\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n  oauthCallbackPort = port\n}\n\nexport function getOAuthCallbackPath(): string {\n  return oauthCallbackPath\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n  oauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n  grantType?: \"authorization_code\" | \"client_credentials\"\n  clientId?: string\n  clientSecret?: string\n  scope?: string\n  redirectUri?: string\n  clientName?: string\n  clientUri?: string\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n  onRedirect: (url: URL) => void | Promise<void>\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n  private readonly redirectUrlSnapshot: string | undefined\n\n  constructor(\n    private serverName: string,\n    private serverUrl: string,\n    private config: McpOAuthConfig,\n    private callbacks: McpOAuthCallbacks,\n  ) {\n    this.redirectUrlSnapshot = config.grantType === \"client_credentials\"\n      ? undefined\n      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`\n  }\n\n  private get usesClientCredentials(): boolean {\n    return this.config.grantType === \"client_credentials\"\n  }\n\n  /**\n   * The redirect URL for OAuth callbacks.\n   * This must match the redirect_uri in client metadata.\n   */\n  get redirectUrl(): string | undefined {\n    return this.redirectUrlSnapshot\n  }\n\n  /**\n   * Client metadata for dynamic registration.\n   * Describes this client to the OAuth authorization server.\n   */\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.usesClientCredentials) {\n      return {\n        client_name: this.config.clientName ?? \"Pi Coding Agent\",\n        client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n        redirect_uris: [],\n        grant_types: [\"client_credentials\"],\n        token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      }\n    }\n\n    const redirectUrl = this.redirectUrl\n    if (!redirectUrl) {\n      throw new Error(\"redirectUrl is required for authorization_code flow\")\n    }\n\n    return {\n      redirect_uris: [redirectUrl],\n      client_name: this.config.clientName ?? \"Pi Coding Agent\",\n      client_uri: this.config.clientUri ?? \"https://github.com/nicobailon/pi-mcp-adapter\",\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n    }\n  }\n\n  /**\n   * Get client information (for pre-registered or dynamically registered clients).\n   * Returns undefined if no client info exists or if the server URL has changed.\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    // Check config first (pre-registered client)\n    if (this.config.clientId) {\n      return {\n        client_id: this.config.clientId,\n        client_secret: this.config.clientSecret,\n      }\n    }\n\n    // Check stored client info (from dynamic registration)\n    // Use getAuthForUrl to validate credentials are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (entry?.clientInfo) {\n      // Check if client secret has expired\n      if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {\n        return undefined\n      }\n      return {\n        client_id: entry.clientInfo.clientId,\n        client_secret: entry.clientInfo.clientSecret,\n      }\n    }\n\n    // No client info or URL changed - will trigger dynamic registration\n    return undefined\n  }\n\n  /**\n   * Save client information from dynamic registration.\n   */\n  async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {\n    const redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : undefined)\n    const clientInfo: StoredClientInfo = {\n      clientId: info.client_id,\n      clientSecret: info.client_secret,\n      clientIdIssuedAt: info.client_id_issued_at,\n      clientSecretExpiresAt: info.client_secret_expires_at,\n      redirectUris,\n    }\n    updateClientInfo(this.serverName, clientInfo, this.serverUrl)\n  }\n\n  /**\n   * Get stored OAuth tokens.\n   * Returns undefined if no tokens exist or if the server URL has changed.\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    // Use getAuthForUrl to validate tokens are for the current server URL\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.tokens) return undefined\n\n    return {\n      access_token: entry.tokens.accessToken,\n      token_type: \"Bearer\",\n      refresh_token: entry.tokens.refreshToken,\n      expires_in: entry.tokens.expiresAt\n        ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n        : undefined,\n      scope: entry.tokens.scope,\n    }\n  }\n\n  /**\n   * Save OAuth tokens.\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    const storedTokens: StoredTokens = {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token,\n      expiresAt: tokens.expires_in ? Date.now() / 1000 + tokens.expires_in : undefined,\n      scope: tokens.scope,\n    }\n    updateTokens(this.serverName, storedTokens, this.serverUrl)\n  }\n\n  /**\n   * Redirect the user to the authorization URL.\n   * This opens the browser for the user to authenticate.\n   *\n   * Throws UnauthorizedError when called outside of a user-initiated flow\n   * (no oauthState saved by startAuth). That path is reached when the SDK\n   * falls through from a failed refresh into a fresh authorization_code\n   * flow, which library hosts cannot complete in-process.\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"redirectToAuthorization is not used for client_credentials flow\")\n    }\n    // No saved oauthState means we're on the post-refresh authorize fallback.\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    // URL is passed to callback, not logged (may contain sensitive params)\n    await this.callbacks.onRedirect(authorizationUrl)\n  }\n\n  /**\n   * Save the PKCE code verifier.\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)\n  }\n\n  /**\n   * Get the stored PKCE code verifier.\n   * @throws Error if no code verifier is stored\n   */\n  async codeVerifier(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.codeVerifier) {\n      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)\n    }\n    return entry.codeVerifier\n  }\n\n  /**\n   * Save the OAuth state parameter for CSRF protection.\n   */\n  async saveState(state: string): Promise<void> {\n    updateOAuthState(this.serverName, state, this.serverUrl)\n  }\n\n  /**\n   * Get the stored OAuth state parameter.\n   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n   */\n  async state(): Promise<string> {\n    if (this.usesClientCredentials) {\n      throw new Error(\"state is not used for client_credentials flow\")\n    }\n    const entry = await getAuthForUrl(this.serverName, this.serverUrl)\n    if (!entry?.oauthState) {\n      throw new UnauthorizedError(\n        `Re-authentication required for MCP server: ${this.serverName}`,\n      )\n    }\n    return entry.oauthState\n  }\n\n  /**\n   * Invalidate credentials when authentication fails.\n   * Clears tokens, client info, or all credentials based on the type.\n   */\n  async invalidateCredentials(type: \"all\" | \"client\" | \"tokens\"): Promise<void> {\n    switch (type) {\n      case \"all\":\n        clearAllCredentials(this.serverName)\n        break\n      case \"client\":\n        clearClientInfo(this.serverName)\n        break\n      case \"tokens\":\n        clearTokens(this.serverName)\n        break\n    }\n  }\n\n  /**\n   * Adds configured authorization-code scope without replacing the SDK's\n   * default token endpoint authentication behavior.\n   */\n  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n    if (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n      params.set(\"scope\", this.config.scope)\n    }\n\n    const clientInfo = await this.clientInformation()\n    if (!clientInfo) {\n      return\n    }\n\n    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []\n    const hasClientSecret = clientInfo.client_secret !== undefined\n    let authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\"\n\n    if (supportedMethods.length === 0) {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n      authMethod = \"client_secret_basic\"\n    } else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n      authMethod = \"client_secret_post\"\n    } else if (supportedMethods.includes(\"none\")) {\n      authMethod = \"none\"\n    } else {\n      authMethod = hasClientSecret ? \"client_secret_post\" : \"none\"\n    }\n\n    if (authMethod === \"client_secret_basic\") {\n      if (!clientInfo.client_secret) {\n        throw new Error(\"client_secret_basic authentication requires a client_secret\")\n      }\n      headers.set(\"Authorization\", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`)\n      return\n    }\n\n    if (!params.has(\"client_id\")) {\n      params.set(\"client_id\", clientInfo.client_id)\n    }\n    if (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n      params.set(\"client_secret\", clientInfo.client_secret)\n    }\n  }\n\n  prepareTokenRequest(scope?: string): URLSearchParams | undefined {\n    if (!this.usesClientCredentials) {\n      return undefined\n    }\n\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" })\n    const requestedScope = scope ?? this.config.scope\n    if (requestedScope) {\n      params.set(\"scope\", requestedScope)\n    }\n    return params\n  }\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-output-guard.d.ts

@@ -0,0 +1,59 @@
+import type { ContentBlock, McpSettings } from "./types.ts";
+export declare const DEFAULT_MCP_OUTPUT_MAX_BYTES: number;
+export declare const DEFAULT_MCP_OUTPUT_MAX_LINES = 2000;
+export declare const DEFAULT_MCP_DETAILS_MAX_BYTES: number;
+export interface McpOutputGuardDetails {
+    truncated: true;
+    originalBytes: number;
+    returnedBytes: number;
+    originalLines: number;
+    returnedLines: number;
+    /** Number of image content blocks returned untouched alongside the truncated text. */
+    imageBlocksPassedThrough?: number;
+    fullOutputPath?: string;
+    writeError?: string;
+}
+export interface McpResultSummary {
+    omitted: true;
+    reason: string;
+    isError: boolean;
+    contentBlocks: number;
+    contentSummary: Array<Record<string, unknown>>;
+    structuredContent?: Record<string, unknown>;
+    meta?: Record<string, unknown>;
+    extraFields?: Array<Record<string, unknown>>;
+    rawResultBytes: number;
+    fullResultPath?: string;
+    resultWriteError?: string;
+}
+export interface McpOutputGuardOptions {
+    enabled?: boolean;
+    prefix?: string;
+    suffix?: string;
+    emptyTextFallback?: string;
+    maxBytes?: number;
+    maxLines?: number;
+    detailsMaxBytes?: number;
+    /**
+     * Raw MCP result to expose as details.mcpResult. Kept raw when its JSON
+     * fits detailsMaxBytes (or when the guard is disabled); otherwise replaced
+     * with a compact summary and spilled to a temp file. Omit for call sites
+     * whose details never carried the raw result (e.g. direct tools).
+     */
+    rawMcpResult?: unknown;
+}
+export interface GuardedMcpOutput {
+    content: ContentBlock[];
+    outputGuard?: McpOutputGuardDetails;
+    mcpResult?: unknown;
+}
+export declare function resolveMcpOutputGuardOptions(settings?: McpSettings): Pick<McpOutputGuardOptions, "enabled" | "maxBytes" | "maxLines" | "detailsMaxBytes">;
+/** Spread helper for tool-result details: includes mcpResult/outputGuard only when present. */
+export declare function guardedMcpDetails(guarded: GuardedMcpOutput): Record<string, unknown>;
+/**
+ * Bound model-facing MCP output. Text output is capped at maxBytes/maxLines and
+ * spilled to a temp file when oversized. Image blocks pass through untouched —
+ * they are delivered to the provider as native image content, not text context.
+ */
+export declare function guardMcpOutput(content: ContentBlock[], options?: McpOutputGuardOptions): Promise<GuardedMcpOutput>;
+//# sourceMappingURL=mcp-output-guard.d.ts.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-output-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-output-guard.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-output-guard.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,4BAA4B,QAAY,CAAC;AACtD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAQvD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,iBAAiB,CAAC,CASzJ;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKpF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA0D3B","sourcesContent":["// @ts-nocheck\nimport { randomBytes } from \"node:crypto\";\nimport { mkdtemp, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { ContentBlock, McpSettings } from \"./types.ts\";\n\nexport const DEFAULT_MCP_OUTPUT_MAX_BYTES = 50 * 1024;\nexport const DEFAULT_MCP_OUTPUT_MAX_LINES = 2000;\nexport const DEFAULT_MCP_DETAILS_MAX_BYTES = 16 * 1024;\n\nconst CONTENT_SUMMARY_LIMIT = 20;\nconst KEY_PREVIEW_LIMIT = 20;\nconst KEY_MAX_CHARS = 120;\n\ntype Recordish = Record<string, unknown>;\n\nexport interface McpOutputGuardDetails {\n  truncated: true;\n  originalBytes: number;\n  returnedBytes: number;\n  originalLines: number;\n  returnedLines: number;\n  /** Number of image content blocks returned untouched alongside the truncated text. */\n  imageBlocksPassedThrough?: number;\n  fullOutputPath?: string;\n  writeError?: string;\n}\n\nexport interface McpResultSummary {\n  omitted: true;\n  reason: string;\n  isError: boolean;\n  contentBlocks: number;\n  contentSummary: Array<Record<string, unknown>>;\n  structuredContent?: Record<string, unknown>;\n  meta?: Record<string, unknown>;\n  extraFields?: Array<Record<string, unknown>>;\n  rawResultBytes: number;\n  fullResultPath?: string;\n  resultWriteError?: string;\n}\n\nexport interface McpOutputGuardOptions {\n  enabled?: boolean;\n  prefix?: string;\n  suffix?: string;\n  emptyTextFallback?: string;\n  maxBytes?: number;\n  maxLines?: number;\n  detailsMaxBytes?: number;\n  /**\n   * Raw MCP result to expose as details.mcpResult. Kept raw when its JSON\n   * fits detailsMaxBytes (or when the guard is disabled); otherwise replaced\n   * with a compact summary and spilled to a temp file. Omit for call sites\n   * whose details never carried the raw result (e.g. direct tools).\n   */\n  rawMcpResult?: unknown;\n}\n\nexport interface GuardedMcpOutput {\n  content: ContentBlock[];\n  outputGuard?: McpOutputGuardDetails;\n  mcpResult?: unknown;\n}\n\nexport function resolveMcpOutputGuardOptions(settings?: McpSettings): Pick<McpOutputGuardOptions, \"enabled\" | \"maxBytes\" | \"maxLines\" | \"detailsMaxBytes\"> {\n  const configured = settings?.outputGuard;\n  const tuning = typeof configured === \"object\" && configured !== null ? configured : undefined;\n  return {\n    enabled: envKillSwitch(\"MCP_OUTPUT_GUARD\") ?? configured !== false,\n    maxBytes: positiveInt(tuning?.maxBytes) ?? DEFAULT_MCP_OUTPUT_MAX_BYTES,\n    maxLines: positiveInt(tuning?.maxLines) ?? DEFAULT_MCP_OUTPUT_MAX_LINES,\n    detailsMaxBytes: positiveInt(tuning?.detailsMaxBytes) ?? DEFAULT_MCP_DETAILS_MAX_BYTES,\n  };\n}\n\n/** Spread helper for tool-result details: includes mcpResult/outputGuard only when present. */\nexport function guardedMcpDetails(guarded: GuardedMcpOutput): Record<string, unknown> {\n  return {\n    ...(guarded.mcpResult !== undefined ? { mcpResult: guarded.mcpResult } : {}),\n    ...(guarded.outputGuard ? { outputGuard: guarded.outputGuard } : {}),\n  };\n}\n\n/**\n * Bound model-facing MCP output. Text output is capped at maxBytes/maxLines and\n * spilled to a temp file when oversized. Image blocks pass through untouched —\n * they are delivered to the provider as native image content, not text context.\n */\nexport async function guardMcpOutput(\n  content: ContentBlock[],\n  options: McpOutputGuardOptions = {},\n): Promise<GuardedMcpOutput> {\n  const maxBytes = options.maxBytes ?? DEFAULT_MCP_OUTPUT_MAX_BYTES;\n  const maxLines = options.maxLines ?? DEFAULT_MCP_OUTPUT_MAX_LINES;\n  const detailsMaxBytes = options.detailsMaxBytes ?? DEFAULT_MCP_DETAILS_MAX_BYTES;\n  const prefix = options.prefix ?? \"\";\n  const suffix = options.suffix ?? \"\";\n\n  const normalizedContent = withEmptyTextFallback(\n    content.length > 0\n      ? sanitizeContent(content)\n      : [{ type: \"text\" as const, text: options.emptyTextFallback ?? \"(empty result)\" }],\n    options.emptyTextFallback,\n  );\n\n  if (options.enabled === false) {\n    return {\n      content: addAffixes(normalizedContent, prefix, suffix),\n      mcpResult: options.rawMcpResult,\n    };\n  }\n\n  const imageBlocks = normalizedContent.filter((block) => block.type === \"image\");\n  const textOutput = normalizedContent\n    .filter((block) => block.type === \"text\")\n    .map((block) => (block as { text: string }).text)\n    .join(\"\\n\");\n  const composedOutput = `${prefix}${textOutput}${suffix}`;\n  const stats = textStats(composedOutput);\n\n  let guardedContent: ContentBlock[] = addAffixes(normalizedContent, prefix, suffix);\n  let outputGuard: McpOutputGuardDetails | undefined;\n\n  if (stats.bytes > maxBytes || stats.lines > maxLines) {\n    const { path: fullOutputPath, error: writeError } = await saveArtifact(\"output\", composedOutput);\n    const notice = formatTruncationNotice(stats, fullOutputPath, writeError);\n    const previewBudget = reserveBudget(maxBytes, maxLines, notice);\n    const preview = truncateHead(composedOutput, previewBudget.maxBytes, previewBudget.maxLines);\n    const finalText = `${preview.content}\\n\\n${notice}`;\n    const finalStats = textStats(finalText);\n\n    guardedContent = [{ type: \"text\" as const, text: finalText }, ...imageBlocks];\n    outputGuard = {\n      truncated: true,\n      originalBytes: stats.bytes,\n      returnedBytes: finalStats.bytes,\n      originalLines: stats.lines,\n      returnedLines: finalStats.lines,\n      ...(imageBlocks.length > 0 ? { imageBlocksPassedThrough: imageBlocks.length } : {}),\n      fullOutputPath,\n      writeError,\n    };\n  }\n\n  const mcpResult = options.rawMcpResult === undefined\n    ? undefined\n    : await boundMcpResult(options.rawMcpResult, detailsMaxBytes);\n\n  return { content: guardedContent, outputGuard, mcpResult };\n}\n\nfunction sanitizeContent(content: ContentBlock[]): ContentBlock[] {\n  return content.map((block) => {\n    if (block.type !== \"image\") return block;\n    const mimeType = typeof block.mimeType === \"string\" && block.mimeType.trim()\n      ? block.mimeType.trim().slice(0, 100)\n      : \"image/png\";\n    return { ...block, mimeType };\n  });\n}\n\nfunction withEmptyTextFallback(content: ContentBlock[], fallback: string | undefined): ContentBlock[] {\n  if (!fallback) return content;\n  const textOutput = content\n    .filter((block) => block.type === \"text\")\n    .map((block) => (block as { text: string }).text)\n    .join(\"\\n\");\n  if (textOutput) return content;\n  return [{ type: \"text\", text: fallback }, ...content.filter((block) => block.type === \"image\")];\n}\n\nfunction addAffixes(content: ContentBlock[], prefix: string, suffix: string): ContentBlock[] {\n  if (!prefix && !suffix) return content;\n  const next: ContentBlock[] = [...content];\n\n  if (prefix) {\n    const index = next.findIndex((block) => block.type === \"text\");\n    const block = next[index];\n    if (index >= 0 && block.type === \"text\") {\n      next[index] = { ...block, text: `${prefix}${block.text}` };\n    } else {\n      next.unshift({ type: \"text\", text: prefix });\n    }\n  }\n\n  if (suffix) {\n    let index = -1;\n    for (let i = next.length - 1; i >= 0; i--) {\n      if (next[i].type === \"text\") {\n        index = i;\n        break;\n      }\n    }\n    const block = next[index];\n    if (index >= 0 && block.type === \"text\") {\n      next[index] = { ...block, text: `${block.text}${suffix}` };\n    } else {\n      next.push({ type: \"text\", text: suffix });\n    }\n  }\n\n  return next;\n}\n\nfunction reserveBudget(maxBytes: number, maxLines: number, notice: string): { maxBytes: number; maxLines: number } {\n  const noticeStats = textStats(`\\n\\n${notice}`);\n  return {\n    maxBytes: Math.max(0, maxBytes - noticeStats.bytes),\n    maxLines: Math.max(0, maxLines - noticeStats.lines),\n  };\n}\n\nfunction truncateHead(text: string, maxBytes: number, maxLines: number): { content: string; bytes: number; lines: number } {\n  const lines = text.split(\"\\n\");\n  const output: string[] = [];\n  let bytes = 0;\n\n  for (const line of lines) {\n    if (output.length >= maxLines) break;\n    const separatorBytes = output.length > 0 ? 1 : 0;\n    const lineBytes = byteLength(line);\n    if (bytes + separatorBytes + lineBytes > maxBytes) {\n      const remaining = maxBytes - bytes - separatorBytes;\n      if (remaining > 0) {\n        output.push(truncateStringToBytes(line, remaining));\n      }\n      break;\n    }\n    output.push(line);\n    bytes += separatorBytes + lineBytes;\n  }\n\n  const content = output.join(\"\\n\");\n  const stats = textStats(content);\n  return { content, bytes: stats.bytes, lines: stats.lines };\n}\n\nfunction truncateStringToBytes(value: string, maxBytes: number): string {\n  if (byteLength(value) <= maxBytes) return value;\n  const buffer = Buffer.from(value, \"utf8\");\n  let end = Math.max(0, maxBytes);\n  while (end > 0 && (buffer[end] & 0xc0) === 0x80) end--;\n  return buffer.subarray(0, end).toString(\"utf8\");\n}\n\nfunction formatTruncationNotice(\n  stats: { bytes: number; lines: number },\n  fullOutputPath: string | undefined,\n  writeError: string | undefined,\n): string {\n  const base = `[MCP text output truncated: original ${stats.lines.toLocaleString()} lines / ${formatSize(stats.bytes)}.`;\n  if (fullOutputPath) {\n    return `${base} Full text saved to: ${fullOutputPath} — use read with offset/limit or grep to inspect.]`;\n  }\n  return `${base} Full output could not be saved: ${writeError ?? \"unknown error\"}]`;\n}\n\n/**\n * Bound details.mcpResult: keep the raw result when its JSON fits within\n * detailsMaxBytes; otherwise replace it with a compact summary and spill the\n * raw JSON to a temp file.\n */\nasync function boundMcpResult(result: unknown, detailsMaxBytes: number): Promise<unknown> {\n  const raw = safeStringify(result);\n  const rawBytes = byteLength(raw);\n  if (rawBytes <= detailsMaxBytes) return result;\n  return summarizeMcpResult(result, raw, rawBytes);\n}\n\nasync function summarizeMcpResult(result: unknown, raw: string, rawBytes: number): Promise<McpResultSummary> {\n  const { path: fullResultPath, error: resultWriteError } = await saveArtifact(\"mcp-result\", raw);\n\n  const record = asRecord(result);\n  const content = Array.isArray(record?.content) ? record.content : [];\n  const summary: McpResultSummary = {\n    omitted: true,\n    reason: \"Raw MCP result exceeded the details size limit and was replaced with this summary to keep session context bounded.\",\n    isError: record?.isError === true,\n    contentBlocks: content.length,\n    contentSummary: summarizeContent(content),\n    rawResultBytes: rawBytes,\n    fullResultPath,\n    resultWriteError,\n  };\n\n  if (record && \"structuredContent\" in record) {\n    summary.structuredContent = summarizeValue(record.structuredContent);\n  }\n  if (record && \"_meta\" in record) {\n    summary.meta = summarizeValue(record._meta);\n  }\n  if (record) {\n    const standard = new Set([\"content\", \"isError\", \"structuredContent\", \"_meta\"]);\n    const extraFields = Object.keys(record)\n      .filter((key) => !standard.has(key))\n      .slice(0, KEY_PREVIEW_LIMIT)\n      .map((key) => ({ key: truncateKey(key), type: typeof record[key], estimatedBytes: estimateValueBytes(record[key]), omitted: true }));\n    if (extraFields.length > 0) summary.extraFields = extraFields;\n  }\n\n  return summary;\n}\n\nfunction summarizeContent(content: unknown[]): Array<Record<string, unknown>> {\n  const summaries: Array<Record<string, unknown>> = content.slice(0, CONTENT_SUMMARY_LIMIT).map((block) => {\n    const record = asRecord(block);\n    if (!record) return { type: typeof block, omitted: true };\n    if (record.type === \"text\") {\n      const text = typeof record.text === \"string\" ? record.text : \"\";\n      return { type: \"text\", bytes: byteLength(text), lines: textStats(text).lines, textOmitted: true };\n    }\n    if (record.type === \"image\") {\n      const data = typeof record.data === \"string\" ? record.data : \"\";\n      return { type: \"image\", mimeType: typeof record.mimeType === \"string\" ? record.mimeType : undefined, dataBytes: byteLength(data), dataOmitted: true };\n    }\n    return { type: typeof record.type === \"string\" ? record.type : \"unknown\", estimatedBytes: estimateValueBytes(record), omitted: true };\n  });\n  if (content.length > CONTENT_SUMMARY_LIMIT) {\n    summaries.push({ type: \"omitted\", count: content.length - CONTENT_SUMMARY_LIMIT });\n  }\n  return summaries;\n}\n\nfunction summarizeValue(value: unknown): Record<string, unknown> {\n  const record = asRecord(value);\n  if (!record) {\n    return { type: value === null ? \"null\" : typeof value, estimatedBytes: estimateValueBytes(value), omitted: true };\n  }\n  const keys = Object.keys(record);\n  return {\n    type: Array.isArray(value) ? \"array\" : \"object\",\n    estimatedBytes: estimateValueBytes(value),\n    keyCount: keys.length,\n    keysPreview: keys.slice(0, KEY_PREVIEW_LIMIT).map(truncateKey),\n    omitted: true,\n  };\n}\n\nfunction estimateValueBytes(value: unknown, depth = 0): number {\n  if (value === null || value === undefined) return 0;\n  if (typeof value === \"string\") return byteLength(value);\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") return byteLength(String(value));\n  const record = asRecord(value);\n  if (!record || depth >= 2) return 0;\n  const values = Array.isArray(value) ? value.slice(0, KEY_PREVIEW_LIMIT) : Object.values(record).slice(0, KEY_PREVIEW_LIMIT);\n  return values.reduce((total, item) => total + estimateValueBytes(item, depth + 1), 0);\n}\n\nfunction truncateKey(key: string): string {\n  return key.length <= KEY_MAX_CHARS ? key : `${key.slice(0, KEY_MAX_CHARS - 1)}…`;\n}\n\nasync function saveArtifact(kind: string, text: string): Promise<{ path?: string; error?: string }> {\n  try {\n    const dir = await mkdtemp(join(tmpdir(), \"pi-mcp-output-\"));\n    const path = join(dir, `${kind}-${randomBytes(4).toString(\"hex\")}.txt`);\n    await writeFile(path, text, { encoding: \"utf8\", mode: 0o600 });\n    return { path };\n  } catch (error) {\n    return { error: error instanceof Error ? error.message : String(error) };\n  }\n}\n\nfunction asRecord(value: unknown): Recordish | undefined {\n  return typeof value === \"object\" && value !== null ? value as Recordish : undefined;\n}\n\nfunction safeStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value, null, 2);\n  } catch {\n    return String(value);\n  }\n}\n\nfunction textStats(text: string): { bytes: number; lines: number } {\n  return { bytes: byteLength(text), lines: text.length === 0 ? 0 : text.split(\"\\n\").length };\n}\n\nfunction byteLength(text: string): number {\n  return Buffer.byteLength(text, \"utf8\");\n}\n\nfunction positiveInt(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return undefined;\n  const integer = Math.floor(value);\n  return integer > 0 ? integer : undefined;\n}\n\nfunction envKillSwitch(name: string): boolean | undefined {\n  const value = process.env[name]?.trim().toLowerCase();\n  if (!value) return undefined;\n  if ([\"0\", \"false\", \"no\", \"off\"].includes(value)) return false;\n  if ([\"1\", \"true\", \"yes\", \"on\"].includes(value)) return true;\n  return undefined;\n}\n\nfunction formatSize(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`;\n  return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;\n}\n"]}