@atlisp/mcp 1.8.20 → 1.8.23

package/dist/cad-worker.js

@@ -579,9 +579,12 @@ async function handleMessage(msg) {
     if (!parenCheck.valid) {
       return { success: false, error: `括号错误: ${parenCheck.error} (位置 ${parenCheck.pos})` };
     }
-    const injectionCheck = validateLispCodeWorker(msg.code);
-    if (!injectionCheck.valid) {
-      return { success: false, error: `安全限制: ${injectionCheck.error}` };
+    const securityLevel = process.env.SECURITY_LEVEL || 'strict';
+    if (securityLevel !== 'relaxed') {
+      const injectionCheck = validateLispCodeWorker(msg.code);
+      if (!injectionCheck.valid) {
+        return { success: false, error: `安全限制: ${injectionCheck.error}` };
+      }
     }
     if (msg.code.length > 255) {
       const cacheEnabled = process.env.LONG_CODE_CACHE === '1';

package/dist/config.js

@@ -38,6 +38,7 @@ const envSchema = z.object({
     LINT_CONFIG_PATH: z.string().optional().default(''),
     LINT_LEVEL: z.string().optional().default(''),
     NO_LINT: z.string().optional().default(''),
+    SECURITY_LEVEL: z.string().optional().default('strict'),
 });
 
 const configSchema = z.object({
@@ -81,6 +82,7 @@ const configSchema = z.object({
     lintConfigPath: z.string().optional(),
     lintLevel: z.string().optional(),
     noLint: z.boolean().optional(),
+    securityLevel: z.enum(['strict', 'standard', 'relaxed']).optional(),
 });
 
 function parseArgs() {
@@ -122,6 +124,9 @@ function parseArgs() {
             i++;
         } else if (args[i] === '--no-lint' || args[i] === '--lint-off') {
             result.noLint = true;
+        } else if (args[i] === '--security-level' && args[i + 1]) {
+            result.securityLevel = args[i + 1];
+            i++;
         }
     }
     return result;
@@ -197,6 +202,7 @@ const config = {
     lintConfigPath: fileConfig?.lintConfigPath || cliArgs.lintConfigPath || env.LINT_CONFIG_PATH || undefined,
     lintLevel: fileConfig?.lintLevel || cliArgs.lintLevel || env.LINT_LEVEL || undefined,
     noLint: fileConfig?.noLint ?? cliArgs.noLint ?? (env.NO_LINT === 'true'),
+    securityLevel: fileConfig?.securityLevel ?? cliArgs.securityLevel ?? (env.SECURITY_LEVEL || 'strict'),
 };
 
 if (config.lintConfigPath) process.env.LINT_CONFIG_PATH = config.lintConfigPath;

package/dist/handlers/debug-handlers.js

@@ -0,0 +1,126 @@
+import { withCadConnection, mcpSuccess, mcpError } from '../handler-utils.js';
+import {
+  createSession, getSession, closeSession, listSessions,
+  loadHelpers, fastForward, executeStep, continueExecution, evaluateExpression,
+} from '../debug-engine.js';
+
+export const debugStart = withCadConnection(async (args) => {
+  try {
+    const { code, chunks, encoding } = args || {};
+    if (!code) return mcpError('Missing required argument: code');
+    if (!chunks || !Array.isArray(chunks)) return mcpError('Missing required argument: chunks (must be an array)');
+
+    const sessionId = await createSession(code, chunks, encoding);
+    const session = getSession(sessionId);
+    if (!session) return mcpError('Failed to create debug session');
+
+    await loadHelpers(session);
+
+    const ffResult = await fastForward(session);
+
+    if (session.state === 'error') {
+      await closeSession(sessionId);
+      return mcpError(session.error);
+    }
+
+    return mcpSuccess(JSON.stringify({
+      sessionId,
+      totalChunks: session.totalChunks,
+      ...ffResult,
+    }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+});
+
+export const debugStep = withCadConnection(async (args) => {
+  try {
+    const { sessionId, action } = args || {};
+    if (!sessionId) return mcpError('Missing required argument: sessionId');
+    if (!action) return mcpError('Missing required argument: action');
+
+    const session = getSession(sessionId);
+    if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+
+    if (session.state !== 'paused' && session.state !== 'ready') {
+      return mcpError(`Invalid state: ${session.state} (expected paused or ready)`);
+    }
+
+    let result;
+    if (action === 'step') {
+      result = await executeStep(session);
+    } else if (action === 'continue') {
+      result = await continueExecution(session);
+    } else {
+      return mcpError(`Invalid action: ${action} (expected step or continue)`);
+    }
+
+    if (session.state === 'error') {
+      return mcpError(session.error);
+    }
+
+    return mcpSuccess(JSON.stringify(result));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+});
+
+export const debugEvaluate = withCadConnection(async (args) => {
+  try {
+    const { sessionId, expression } = args || {};
+    if (!sessionId) return mcpError('Missing required argument: sessionId');
+    if (!expression) return mcpError('Missing required argument: expression');
+
+    const session = getSession(sessionId);
+    if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+
+    if (session.state !== 'paused') {
+      return mcpError(`Invalid state: ${session.state} (expected paused)`);
+    }
+
+    const result = await evaluateExpression(session, expression);
+    if (result.error) return mcpError(result.error);
+
+    return mcpSuccess(JSON.stringify({ value: result.value }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+});
+
+export async function debugGetState(args) {
+  try {
+    const { sessionId } = args || {};
+    if (!sessionId) return mcpError('Missing required argument: sessionId');
+
+    const session = getSession(sessionId);
+    if (!session) return mcpError(`Debug session not found: ${sessionId}`);
+
+    const checkpoint = session.lastCheckpoint;
+    return mcpSuccess(JSON.stringify({
+      state: session.state,
+      currentIndex: session.currentIndex,
+      totalChunks: session.totalChunks,
+      currentCheckpoint: checkpoint || undefined,
+      error: session.error,
+    }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+}
+
+export async function debugStop(args) {
+  try {
+    const { sessionId } = args || {};
+    if (!sessionId) return mcpError('Missing required argument: sessionId');
+
+    const session = getSession(sessionId);
+    if (!session) {
+      return mcpError(`Debug session not found: ${sessionId}`);
+    }
+
+    const ok = await closeSession(sessionId);
+    return mcpSuccess(JSON.stringify({ success: ok }));
+  } catch (e) {
+    return mcpError(e.message);
+  }
+}

package/dist/lisp-security.js

@@ -1,36 +1,90 @@
 import { log, error as logError } from './logger.js';
+import config, { onConfigChange } from './config.js';
 
 export const THREAT_BLOCK = 'block';
 export const THREAT_WARN = 'warn';
 export const THREAT_ALLOW = 'allow';
 
+export const SECURITY_LEVELS = ['strict', 'standard', 'relaxed'];
+
+const CVT = {
+  strict: THREAT_BLOCK,
+  standard: THREAT_WARN,
+  relaxed: THREAT_ALLOW,
+};
+
+function getLevel() {
+  const level = config?.securityLevel || 'strict';
+  return CVT[level] || THREAT_BLOCK;
+}
+
 export const SECURITY_RULES = [
-  { re: /\bstartapp\s*[(\s]/i, severity: THREAT_BLOCK, msg: '禁止使用 startapp 函数' },
-  { re: /\bvl-bt\b/i, severity: THREAT_BLOCK, msg: '禁止使用 vl-bt 函数' },
-  { re: /\bvlax-import-type-library\b/i, severity: THREAT_BLOCK, msg: '禁止导入类型库' },
-  { re: /\bdos_command_string\s*[(\s]/i, severity: THREAT_BLOCK, msg: '禁止使用 dos_command_string' },
+  { re: /\bstartapp\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 startapp 函数' },
+  { re: /\bvl-bt\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 vl-bt 函数' },
+  { re: /\bvlax-import-type-library\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止导入类型库' },
+  { re: /\bdos_command_string\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 dos_command_string' },
+  { re: /\beval\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 eval 函数' },
+  { re: /\bcommand\s*["\s]*[_(]?\s*["']?\.?\s*_?(?:shell|quit|exit|close|open|new|recover|audit|purge|wblock|export)/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用危险 CAD 命令' },
+  { re: /\bload\s*[(\s"]/i, baseSeverity: THREAT_BLOCK, msg: 'load 函数可能加载外部代码' },
+  { re: /\b(?:read-line|read-char|write-line|write-char)\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '文件 I/O 操作可能影响系统' },
+  { re: /\bvl-file-copy\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止文件复制' },
+  { re: /\bvl-file-delete\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止文件删除' },
+  { re: /\bvl-file-rename\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止文件重命名' },
+  { re: /\bvl-registry-write[\s\)]/i, baseSeverity: THREAT_BLOCK, msg: 'vl-registry-write 会修改注册表' },
+  { re: /\bvl-exit-with-value\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 vl-exit-with-value' },
+  { re: /\bvl-exit-with-error\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 vl-exit-with-error' },
+  { re: /\bvlax-add-cmd\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止注册新命令' },
+  { re: /\bvla-Delete\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止直接删除 vla 对象' },
+  { re: /\bvla-Save\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止直接保存文档' },
+  { re: /\bdirectory\s*[(\s]/i, baseSeverity: THREAT_BLOCK, msg: '禁止使用 directory 函数' },
+  { re: /\bvla-deletefile\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止删除文件' },
+  { re: /\bvla-copyfile\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止复制文件' },
+  { re: /\bvla-movefile\b/i, baseSeverity: THREAT_BLOCK, msg: '禁止移动文件' },
 ];
 
-export function stripStringsAndComments(code) {
-  const withoutStrings = code.replace(/"([^"\\]*(?:\\.[^"\\]*)*)"/g, '');
-  return withoutStrings.replace(/;.*$/gm, '');
+let _cachedLevel = null;
+
+export function refreshConfig() {
+  _cachedLevel = null;
+}
+
+try {
+  onConfigChange(() => { _cachedLevel = null; });
+} catch (_) {}
+
+function resolveSeverity(rule) {
+  if (_cachedLevel) return _cachedLevel;
+  _cachedLevel = getLevel();
+  return _cachedLevel;
 }
 
 export function validateLispCodeWorker(code) {
   const clean = stripStringsAndComments(code);
-  for (const { re, severity, msg } of SECURITY_RULES) {
+  const effectiveSeverity = resolveSeverity();
+
+  for (const rule of SECURITY_RULES) {
+    const re = rule.re;
     if (re.test(clean)) {
-      if (severity === THREAT_BLOCK) {
-        return { valid: false, error: msg };
+      if (effectiveSeverity === THREAT_BLOCK) {
+        return { valid: false, error: rule.msg };
       }
-      if (severity === THREAT_WARN) {
-        log('WARN: ' + msg);
+      if (effectiveSeverity === THREAT_WARN) {
+        log('WARN: ' + rule.msg);
       }
     }
   }
   return { valid: true };
 }
 
+export function getEffectiveSeverity() {
+  return resolveSeverity();
+}
+
+export function stripStringsAndComments(code) {
+  const withoutStrings = code.replace(/"([^"\\]*(?:\\.[^"\\]*)*)"/g, '');
+  return withoutStrings.replace(/;.*$/gm, '');
+}
+
 export function checkParens(code) {
   let depth = 0;
   let inString = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlisp/mcp",
-  "version": "1.8.20",
+  "version": "1.8.23",
   "description": "MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP",
   "type": "module",
   "bin": {