@bibobonking/opensol 3.0.3 → 3.1.1

package/dist/index.html

@@ -6,9 +6,9 @@
     <meta name="theme-color" content="#ffffff" />
     <meta
       name="description"
-      content="OpenSol by OpenSoft is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
+      content="OpenSol by OpenSoftX is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
     />
-    <title>OpenSol — Local coding agent by OpenSoft</title>
+    <title>OpenSol — Local coding agent by OpenSoftX</title>
     <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
@@ -31,8 +31,8 @@
         if (DARK.includes(theme)) root.classList.add('dark')
       } catch {}
     </script>
-    <script type="module" crossorigin src="./assets/index-DgNDjkOz.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-BmN7pBji.css">
+    <script type="module" crossorigin src="./assets/index-fhIO9a7_.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-CeN54A2N.css">
   </head>
   <body>
     <div id="root"><div class="splash" id="boot-splash" aria-hidden="true">

package/index.html

@@ -6,9 +6,9 @@
     <meta name="theme-color" content="#ffffff" />
     <meta
       name="description"
-      content="OpenSol by OpenSoft is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
+      content="OpenSol by OpenSoftX is a local-first coding agent. Work in a real folder, run commands, edit files and deploy with your own model keys. Keys stay encrypted on your machine."
     />
-    <title>OpenSol — Local coding agent by OpenSoft</title>
+    <title>OpenSol — Local coding agent by OpenSoftX</title>
     <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bibobonking/opensol",
   "private": false,
-  "version": "3.0.3",
+  "version": "3.1.1",
   "type": "module",
   "bin": {
     "opensol": "./server/opensol.mjs"
@@ -9,6 +9,7 @@
   "scripts": {
     "dev": "node server/opensol.mjs start && vite",
     "build": "tsc -b && vite build",
+    "artifacts": "node scripts/pull-artifacts.mjs",
     "preview": "vite preview",
     "typecheck": "tsc -b --pretty",
     "test": "node --test",

package/server/README.md

@@ -1,6 +1,6 @@
 # OpenSol
 
-A local-first AI coding agent by OpenSoft. OpenSol pairs a warm React chat interface with a zero-dependency Node daemon that owns the real workspace, shell, git, search, deploy and provider credentials on your machine.
+A local-first AI coding agent by OpenSoftX. OpenSol pairs a warm React chat interface with a zero-dependency Node daemon that owns the real workspace, shell, git, search, deploy and provider credentials on your machine.
 
 The daemon binds to `127.0.0.1` only. It serves the prebuilt app from `dist/` and stores everything under `~/.maxcode`. API keys and hosting tokens are encrypted with AES-256-GCM using a local `master.key`; the browser only ever receives a masked hint.
 
@@ -61,7 +61,7 @@ OpenCode free-tier models only work inside OpenCode itself, so they are hidden h
 - `secrets.enc` and `master.key` are created with mode `600`.
 - All API routes require the local session cookie and a CSRF header; Host and Origin are checked.
 - The daemon rejects code execution outside the selected workspace except for an explicit, existing deploy folder.
-- No telemetry or OpenSoft-hosted proxy. Provider requests go directly from the daemon to the provider you configured.
+- No telemetry or OpenSoftX-hosted proxy. Provider requests go directly from the daemon to the provider you configured.
 
 ## Stack
 

package/server/daemon.mjs

@@ -18,16 +18,20 @@ import {
   streamFile,
 } from './lib/http.mjs'
 import {
+  saveSecrets,
   addWorkspace,
   DATA_DIR,
   dataPaths,
   forgetWorkspace,
+  getMcpServers,
   loadSecretsSafe,
   loadState,
   migrateLegacy,
   resetAll,
+  removeWorkspace,
   resetSecrets,
   saveChats,
+  saveMcpServers,
   saveSettings,
   saveState,
   secretSummary,
@@ -75,10 +79,11 @@ import {
   setPluginSafe,
   uninstallPlugin,
 } from './lib/plugins.mjs'
+import { mcp, sanitizeServerConfig } from './lib/mcp.mjs'
 
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const DIST = path.resolve(HERE, '..', 'dist')
-const VERSION = '1.0.0'
+const VERSION = '3.1.0'
 const SESSION_COOKIE = 'maxcode_session'
 const CSRF_HEADER = 'x-maxcode-csrf'
 const SESSION_TTL = 14 * 24 * 60 * 60 * 1000
@@ -220,6 +225,12 @@ function sanitizeSettings(patch, current = {}) {
   // Plugin themes are named by their plugin, so accept any bounded theme slug.
   if (typeof source.theme === 'string' && /^[a-z0-9-]{1,64}$/.test(source.theme)) next.theme = source.theme
   if (source.mode === 'build' || source.mode === 'plan') next.mode = source.mode
+  if (typeof source.aiSessionTitles === 'boolean') next.aiSessionTitles = source.aiSessionTitles
+  if (typeof source.autoCollapseWork === 'boolean') next.autoCollapseWork = source.autoCollapseWork
+  if (source.workDetail === 'concise' || source.workDetail === 'detailed') next.workDetail = source.workDetail
+  if (typeof source.chatFontSize === 'number' && Number.isFinite(source.chatFontSize)) {
+    next.chatFontSize = Math.max(12, Math.min(20, Math.round(source.chatFontSize)))
+  }
 
   if (source.providers && typeof source.providers === 'object') {
     const providers = { ...(current.providers ?? {}) }
@@ -535,12 +546,53 @@ async function handlePreview(req, res, rawPath) {
   streamFile(req, res, target.absolute, info.size, { 'Cache-Control': 'no-store' })
 }
 
+function oauthResultPage(ok, message) {
+  const safe = String(message).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>OpenSol · MCP sign-in</title><style>body{margin:0;min-height:100dvh;display:grid;place-items:center;font:15px system-ui,sans-serif;background:#faf9f5;color:#1f1e1d}main{max-width:360px;padding:32px;text-align:center}h1{font-size:20px;margin:0 0 8px}p{margin:0;color:#6b6a68;line-height:1.5}.dot{width:44px;height:44px;border-radius:50%;margin:0 auto 16px;display:grid;place-items:center;color:#fff;font-size:22px;background:${ok ? '#2f9e6b' : '#c4443a'}}@media(prefers-color-scheme:dark){body{background:#141413;color:#f2f1ee}p{color:#a5a39e}}</style></head><body><main><div class="dot">${ok ? '✓' : '!'}</div><h1>${ok ? 'Signed in' : 'Sign-in failed'}</h1><p>${safe}</p></main><script>try{var c=new BroadcastChannel('opensol-mcp-oauth');c.postMessage({ok:${ok ? 'true' : 'false'}});c.close()}catch(e){}${ok ? 'setTimeout(function(){window.close()},900)' : ''}</script></body></html>`
+}
+
+async function handleMcpOAuthCallback(req, res, url) {
+  const hostHeader = String(req.headers.host ?? '').toLowerCase()
+  if (!hostHeader || !allowedHosts().has(hostHeader)) {
+    throw new HttpError(403, 'OpenSol only answers requests addressed to localhost.', 'bad_host')
+  }
+  const send = (status, ok, message) => {
+    const body = Buffer.from(oauthResultPage(ok, message))
+    res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Length': body.length, 'Cache-Control': 'no-store' })
+    res.end(body)
+  }
+  const state = url.searchParams.get('state') ?? ''
+  const providerError = url.searchParams.get('error')
+  if (providerError) {
+    mcp.pendingAuth.take(state)
+    send(400, false, url.searchParams.get('error_description') || providerError)
+    return
+  }
+  const code = url.searchParams.get('code') ?? ''
+  if (!state || !code) {
+    send(400, false, 'The authorization server did not return a code.')
+    return
+  }
+  try {
+    const config = await mcp.finishAuth(state, code)
+    send(200, true, `${config.name} is connected. You can close this window.`)
+  } catch (error) {
+    send(error instanceof HttpError ? error.status : 500, false, error instanceof Error ? error.message : 'Sign-in failed.')
+  }
+}
+
 async function route(req, res) {
   const rawPath = (req.url ?? '/').split('?')[0]
   if (rawPath.startsWith('/preview/')) {
     await handlePreview(req, res, rawPath)
     return
   }
+  if (rawPath === '/oauth/mcp/callback' && req.method === 'GET') {
+    // The browser arrives here from the authorization server, so Sec-Fetch-Site is cross-site.
+    // The one-time `state` created by an authenticated request is the CSRF protection.
+    await handleMcpOAuthCallback(req, res, new URL(req.url ?? '/', `http://${req.headers.host}`))
+    return
+  }
   guardRequest(req)
   const url = new URL(req.url ?? '/', `http://${req.headers.host}`)
   const pathname = url.pathname
@@ -747,13 +799,79 @@ async function route(req, res) {
         return
       }
       if (method === 'DELETE') {
-        await forgetWorkspace()
+        const target = url.searchParams.get('path')
+        if (target) await removeWorkspace(target)
+        else await forgetWorkspace()
         json(res, 200, await workspacePayload())
         return
       }
       throw new HttpError(405, 'Method not allowed.', 'method_not_allowed')
     }
 
+    if (pathname === '/api/mcp' && method === 'GET') {
+      json(res, 200, { servers: mcp.list() })
+      return
+    }
+
+    if (pathname === '/api/mcp' && method === 'PUT') {
+      const body = await readJson(req, 512 * 1024)
+      const incoming = Array.isArray(body.servers) ? body.servers.slice(0, 30) : []
+      const previous = new Map((await getMcpServers()).map((item) => [item.id, item]))
+      const seen = new Set()
+      const configs = incoming.map((item) => {
+        let config = sanitizeServerConfig(item, previous.get(item?.id))
+        let suffix = 2
+        const base = config.id
+        while (seen.has(config.id)) config = { ...config, id: `${base}-${suffix++}` }
+        seen.add(config.id)
+        return config
+      })
+      await saveMcpServers(configs)
+      // Tokens belong to one server URL: drop them when the server is removed, moved, or OAuth is turned off.
+      for (const [id, old] of previous) {
+        const next = configs.find((config) => config.id === id)
+        if (!next || next.url !== old.url || !next.oauth?.enabled) await mcp.authStore.delete(id).catch(() => undefined)
+      }
+      await mcp.setConfigs(configs)
+      for (const config of configs) {
+        const runtime = mcp.runtime.get(config.id)
+        if (config.enabled && (!runtime || runtime.status === 'disconnected')) void mcp.connect(config.id)
+        if (!config.enabled && runtime?.status === 'connected') await mcp.disconnect(config.id)
+      }
+      json(res, 200, { servers: mcp.list() })
+      return
+    }
+
+    const mcpRoute = /^\/api\/mcp\/([a-z0-9][a-z0-9-]{0,39})\/(connect|disconnect|refresh)$/.exec(pathname)
+    if (mcpRoute && method === 'POST') {
+      const [, id, action] = mcpRoute
+      if (action === 'connect') await mcp.connect(id)
+      else if (action === 'disconnect') await mcp.disconnect(id)
+      else await mcp.refresh(id)
+      json(res, 200, { servers: mcp.list() })
+      return
+    }
+
+    const mcpAuthRoute = /^\/api\/mcp\/([a-z0-9][a-z0-9-]{0,39})\/(authorize|logout)$/.exec(pathname)
+    if (mcpAuthRoute && method === 'POST') {
+      const [, id, action] = mcpAuthRoute
+      if (action === 'authorize') {
+        const redirectUri = `http://${req.headers.host}/oauth/mcp/callback`
+        json(res, 200, await mcp.startAuth(id, redirectUri))
+      } else {
+        await mcp.signOut(id)
+        json(res, 200, { servers: mcp.list() })
+      }
+      return
+    }
+
+    if (pathname === '/api/mcp/call' && method === 'POST') {
+      const body = await readJson(req, 4 * 1024 * 1024)
+      const result = await mcp.callTool(String(body.server ?? ''), String(body.tool ?? ''), body.args ?? {})
+      json(res, 200, { result })
+      return
+    }
+
     if (pathname === '/api/workspaces/browse') {
       if (method === 'GET') {
         json(res, 200, await browseDirectories(url.searchParams.get('path') ?? ''))
@@ -988,6 +1106,23 @@ async function findPort(start) {
 
 export async function startServer({ port: requested = 4174, open = false } = {}) {
   await mkdir(DATA_DIR, { recursive: true, mode: 0o700 })
+  mcp.getCwd = async () => (await workspaceRoot().catch(() => '')) || os.homedir()
+  // OAuth clients and tokens live in the encrypted secrets file, never in state.json.
+  mcp.authStore = {
+    get: async (id) => (await loadSecrets()).mcpOAuth?.[id] ?? null,
+    set: async (id, value) => {
+      const secrets = await loadSecrets()
+      await saveSecrets({ ...secrets, mcpOAuth: { ...(secrets.mcpOAuth ?? {}), [id]: value } })
+    },
+    delete: async (id) => {
+      const secrets = await loadSecrets()
+      if (!secrets.mcpOAuth?.[id]) return
+      const { [id]: _removed, ...rest } = secrets.mcpOAuth
+      await saveSecrets({ ...secrets, mcpOAuth: rest })
+    },
+  }
+  await mcp.setConfigs(await getMcpServers())
+  void mcp.connectAll().catch(() => undefined)
   port = requested === 0 ? await findPort(4174) : requested
   const server = http.createServer((req, res) => {
     handler(req, res)
@@ -1008,6 +1143,7 @@ export async function startServer({ port: requested = 4174, open = false } = {})
   const shutdown = async (signal) => {
     console.log(`[opensol] ${signal} received, shutting down.`)
     server.close()
+    await mcp.shutdown().catch(() => undefined)
     await rm(pidFile, { force: true }).catch(() => undefined)
     process.exit(0)
   }

package/server/lib/mcp-oauth.mjs

@@ -0,0 +1,219 @@
+// OAuth 2.1 for remote MCP servers: protected-resource + authorization-server discovery,
+// dynamic client registration (RFC 7591), PKCE (S256) and token refresh. Zero dependencies.
+// Tokens never reach the browser; the daemon keeps them in the encrypted secrets file.
+import { createHash, randomBytes } from 'node:crypto'
+
+const FETCH_TIMEOUT_MS = 15_000
+const PENDING_TTL_MS = 10 * 60_000
+
+export class AuthRequiredError extends Error {
+  constructor(wwwAuthenticate = '') {
+    super('This MCP server needs you to sign in.')
+    this.name = 'AuthRequiredError'
+    this.wwwAuthenticate = wwwAuthenticate
+  }
+}
+
+const b64url = (buffer) => buffer.toString('base64url')
+
+async function fetchJson(url, init = {}) {
+  const response = await fetch(url, {
+    ...init,
+    headers: { Accept: 'application/json', ...(init.headers ?? {}) },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  })
+  const text = await response.text()
+  let body = null
+  try {
+    body = text ? JSON.parse(text) : null
+  } catch {
+    body = null
+  }
+  return { response, body, text }
+}
+
+function assertHttp(value, label) {
+  let parsed
+  try {
+    parsed = new URL(value)
+  } catch {
+    throw new Error(`${label} is not a valid URL.`)
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error(`${label} must use http or https.`)
+  return parsed
+}
+
+/** Reads `resource_metadata="…"` from a WWW-Authenticate header. */
+export function parseResourceMetadataUrl(header) {
+  const match = /resource_metadata="?([^",\s]+)"?/i.exec(header ?? '')
+  return match ? match[1] : ''
+}
+
+function wellKnownCandidates(base, name) {
+  const parsed = new URL(base)
+  const out = []
+  const pathPart = parsed.pathname.replace(/\/+$/, '')
+  if (pathPart) out.push(`${parsed.origin}/.well-known/${name}${pathPart}`)
+  out.push(`${parsed.origin}/.well-known/${name}`)
+  return out
+}
+
+async function firstJson(urls, accept = (body) => body && typeof body === 'object') {
+  for (const url of urls) {
+    try {
+      const { response, body } = await fetchJson(url)
+      if (response.ok && accept(body)) return body
+    } catch {
+      // Try the next candidate.
+    }
+  }
+  return null
+}
+
+/** Finds the authorization server metadata that protects an MCP server URL. */
+export async function discover(serverUrl, wwwAuthenticate = '') {
+  assertHttp(serverUrl, 'The MCP server URL')
+  const hinted = parseResourceMetadataUrl(wwwAuthenticate)
+  const resourceUrls = [...(hinted ? [hinted] : []), ...wellKnownCandidates(serverUrl, 'oauth-protected-resource')]
+  const resource = await firstJson(resourceUrls, (body) => body && Array.isArray(body.authorization_servers))
+  const issuer = resource?.authorization_servers?.[0] || new URL(serverUrl).origin
+  assertHttp(issuer, 'The authorization server')
+  const metadata =
+    (await firstJson(
+      [
+        ...wellKnownCandidates(issuer, 'oauth-authorization-server'),
+        ...wellKnownCandidates(issuer, 'openid-configuration'),
+        `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`,
+      ],
+      (body) => body && typeof body.authorization_endpoint === 'string' && typeof body.token_endpoint === 'string',
+    )) ?? null
+  if (metadata) return { ...metadata, resource: resource?.resource || serverUrl }
+  // Servers without metadata fall back to the conventional endpoints on the issuer origin.
+  const origin = new URL(issuer).origin
+  return {
+    issuer: origin,
+    authorization_endpoint: `${origin}/authorize`,
+    token_endpoint: `${origin}/token`,
+    registration_endpoint: `${origin}/register`,
+    resource: resource?.resource || serverUrl,
+    fallback: true,
+  }
+}
+
+export async function registerClient(metadata, redirectUri, clientName) {
+  if (!metadata.registration_endpoint) {
+    throw new Error('This server does not support automatic sign-in setup. Enter an OAuth client ID in the server settings.')
+  }
+  const { response, body, text } = await fetchJson(metadata.registration_endpoint, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      client_name: clientName,
+      redirect_uris: [redirectUri],
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    }),
+  })
+  if (!response.ok || !body?.client_id) {
+    throw new Error(`Client registration failed (${response.status}). ${(body?.error_description || text || '').slice(0, 200)}`.trim())
+  }
+  return { clientId: String(body.client_id), clientSecret: body.client_secret ? String(body.client_secret) : '' }
+}
+
+export function createPkce() {
+  const verifier = b64url(randomBytes(48))
+  const challenge = b64url(createHash('sha256').update(verifier).digest())
+  return { verifier, challenge }
+}
+
+export function buildAuthorizationUrl({ metadata, clientId, redirectUri, state, challenge, scope, resource }) {
+  const url = new URL(metadata.authorization_endpoint)
+  url.searchParams.set('response_type', 'code')
+  url.searchParams.set('client_id', clientId)
+  url.searchParams.set('redirect_uri', redirectUri)
+  url.searchParams.set('state', state)
+  url.searchParams.set('code_challenge', challenge)
+  url.searchParams.set('code_challenge_method', 'S256')
+  if (scope) url.searchParams.set('scope', scope)
+  if (resource) url.searchParams.set('resource', resource)
+  return url.toString()
+}
+
+async function tokenRequest(metadata, client, params, resource) {
+  const form = new URLSearchParams({ ...params, client_id: client.clientId })
+  if (resource) form.set('resource', resource)
+  const headers = { 'Content-Type': 'application/x-www-form-urlencoded' }
+  if (client.clientSecret) {
+    const methods = metadata.token_endpoint_auth_methods_supported
+    if (Array.isArray(methods) && !methods.includes('client_secret_post') && methods.includes('client_secret_basic')) {
+      headers.Authorization = `Basic ${Buffer.from(`${client.clientId}:${client.clientSecret}`).toString('base64')}`
+    } else {
+      form.set('client_secret', client.clientSecret)
+    }
+  }
+  const { response, body, text } = await fetchJson(metadata.token_endpoint, { method: 'POST', headers, body: form.toString() })
+  if (!response.ok || !body?.access_token) {
+    const detail = body?.error_description || body?.error || text || ''
+    const error = new Error(`Token request failed (${response.status}). ${String(detail).slice(0, 200)}`.trim())
+    error.status = response.status
+    error.oauthError = body?.error
+    throw error
+  }
+  return normalizeTokens(body)
+}
+
+function normalizeTokens(body, previous) {
+  const expiresIn = Number(body.expires_in)
+  return {
+    accessToken: String(body.access_token),
+    refreshToken: body.refresh_token ? String(body.refresh_token) : previous?.refreshToken || '',
+    tokenType: body.token_type ? String(body.token_type) : 'Bearer',
+    scope: typeof body.scope === 'string' ? body.scope : previous?.scope || '',
+    expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? Date.now() + expiresIn * 1000 : 0,
+  }
+}
+
+export function exchangeCode({ metadata, client, code, verifier, redirectUri, resource }) {
+  return tokenRequest(metadata, client, {
+    grant_type: 'authorization_code',
+    code,
+    code_verifier: verifier,
+    redirect_uri: redirectUri,
+  }, resource)
+}
+
+export async function refreshTokens({ metadata, client, tokens, resource }) {
+  if (!tokens?.refreshToken) throw new Error('No refresh token; sign in again.')
+  const next = await tokenRequest(metadata, client, { grant_type: 'refresh_token', refresh_token: tokens.refreshToken }, resource)
+  return { ...next, refreshToken: next.refreshToken || tokens.refreshToken }
+}
+
+export const tokenIsFresh = (tokens, skewMs = 60_000) =>
+  Boolean(tokens?.accessToken) && (!tokens.expiresAt || tokens.expiresAt - skewMs > Date.now())
+
+/** In-flight authorization requests keyed by the OAuth `state` value. */
+export class PendingAuthorizations {
+  constructor() {
+    this.map = new Map()
+  }
+
+  create(entry) {
+    this.#purge()
+    const state = b64url(randomBytes(24))
+    this.map.set(state, { ...entry, createdAt: Date.now() })
+    return state
+  }
+
+  take(state) {
+    this.#purge()
+    const entry = this.map.get(state)
+    if (entry) this.map.delete(state)
+    return entry ?? null
+  }
+
+  #purge() {
+    const cutoff = Date.now() - PENDING_TTL_MS
+    for (const [key, value] of this.map) if (value.createdAt < cutoff) this.map.delete(key)
+  }
+}