@cairnkeep/cli 2.23.1 → 2.25.0

package/mcp-memory-server/dist/team-http.js

@@ -0,0 +1,193 @@
+import { createServer } from 'node:http';
+import { normalizeHostAuthority } from './http-security.js';
+import { TeamError, teamDigest } from './team-store.js';
+const MAX_BODY = 512 * 1024;
+const MAX_RESPONSE = 2 * 1024 * 1024;
+function reply(response, status, body) {
+    const bytes = Buffer.from(JSON.stringify(body));
+    if (bytes.byteLength > MAX_RESPONSE) {
+        reply(response, 503, { error: 'unavailable' });
+        return;
+    }
+    response.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Content-Length': bytes.byteLength, ...(status >= 400 ? { Connection: 'close' } : {}) });
+    response.end(bytes);
+}
+async function body(request) {
+    if (request.headers['content-type'] !== 'application/json')
+        throw new TeamError('invalid');
+    const chunks = [];
+    await new Promise((resolve, reject) => {
+        let size = 0;
+        const cleanup = () => { request.off('data', onData); request.off('end', onEnd); request.off('error', onError); request.off('aborted', onError); };
+        const onError = () => { cleanup(); reject(new TeamError('invalid')); };
+        const onEnd = () => { cleanup(); resolve(); };
+        const onData = (chunk) => {
+            size += chunk.byteLength;
+            if (size > MAX_BODY) {
+                cleanup();
+                request.pause();
+                reject(new RangeError('body-limit'));
+            }
+            else
+                chunks.push(chunk);
+        };
+        request.on('data', onData);
+        request.once('end', onEnd);
+        request.once('error', onError);
+        request.once('aborted', onError);
+    });
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+    }
+    catch {
+        throw new TeamError('invalid');
+    }
+}
+/** This is a token-first JSON API, not OAuth-authorized remote MCP. It only
+ * listens on loopback; use an authenticated encrypted tunnel for remote use. */
+export function createTeamHttpServer(store) {
+    if (process.env.CAIRN_TEAM !== '1' || process.env.CAIRN_TEAM_HTTP !== '1')
+        throw new TeamError('disabled');
+    const fixedWindow = (requests) => {
+        const limits = new Map();
+        return (key) => {
+            const now = Date.now();
+            for (const [id, state] of limits)
+                if (now - state.start >= 60000)
+                    limits.delete(id);
+            let state = limits.get(key);
+            if (!state) {
+                if (limits.size >= 512)
+                    return false;
+                limits.set(key, state = { start: now, count: 0 });
+            }
+            return ++state.count <= requests;
+        };
+    };
+    // Invalid authentication must remain bounded without consuming the scarce
+    // quota of an authenticated subject that happens to share loopback/tunnel.
+    const malformedAuthAdmitted = fixedWindow(120);
+    const invalidCredentialAdmitted = fixedWindow(10);
+    const subjectAdmitted = fixedWindow(120);
+    const server = createServer({ maxHeaderSize: 32 * 1024 }, (request, response) => {
+        void (async () => {
+            // Reject browser access and host rebinding before reading any body.
+            const authority = normalizeHostAuthority(request.headers.host);
+            const port = request.socket.localPort;
+            if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(request.socket.localAddress ?? '') || !authority || ![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(authority) || request.headers.origin !== undefined) {
+                reply(response, 403, { error: 'denied' });
+                return;
+            }
+            if (request.url !== '/v1/team/execute') {
+                reply(response, 404, { error: 'not-found' });
+                return;
+            }
+            if (request.method !== 'POST') {
+                reply(response, 405, { error: 'method' });
+                return;
+            }
+            const authHeaders = request.rawHeaders.filter((_, i) => i % 2 === 0 && request.rawHeaders[i].toLowerCase() === 'authorization');
+            const token = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization ?? '')?.[1];
+            if (!token || authHeaders.length !== 1) {
+                const key = teamDigest(`malformed:${request.socket.remoteAddress ?? ''}`);
+                const admitted = malformedAuthAdmitted(key);
+                reply(response, admitted ? 401 : 429, { error: admitted ? 'unauthorized' : 'rate-limit' });
+                return;
+            }
+            let identity;
+            try {
+                identity = await store.checkCredential(token);
+            }
+            catch (error) {
+                if (!(error instanceof TeamError) || error.code !== 'unauthorized')
+                    throw error;
+                const admitted = invalidCredentialAdmitted(teamDigest(`credential:${token}`));
+                reply(response, admitted ? 401 : 429, { error: admitted ? 'unauthorized' : 'rate-limit' });
+                return;
+            }
+            if (!subjectAdmitted(teamDigest(identity.subject))) {
+                reply(response, 429, { error: 'rate-limit' });
+                return;
+            }
+            const length = request.headers['content-length'];
+            if (length && (!/^[0-9]+$/.test(length) || Number(length) > MAX_BODY)) {
+                reply(response, 413, { error: 'body-limit' });
+                return;
+            }
+            request.setTimeout(10000, () => request.destroy());
+            const input = await body(request);
+            const result = await store.execute(token, input); // reauthorize after body receipt
+            reply(response, 200, { result });
+        })().catch(error => {
+            const status = error instanceof TeamError ? ({ unauthorized: 401, denied: 403, invalid: 400, conflict: 409, disabled: 503, integrity: 503 }[error.code]) : error instanceof RangeError ? 413 : 503;
+            if (!response.headersSent && !response.destroyed)
+                reply(response, status, { error: error instanceof TeamError ? error.code : status === 413 ? 'body-limit' : 'unavailable' });
+        });
+    });
+    server.headersTimeout = 10000;
+    server.requestTimeout = 30000;
+    server.keepAliveTimeout = 5000;
+    server.maxRequestsPerSocket = 100;
+    server.on('clientError', (_error, socket) => { if (socket.writable)
+        socket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n'); });
+    return server;
+}
+export function validateTeamUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new TeamError('invalid');
+    }
+    const loopback = ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname);
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/' || (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)))
+        throw new TeamError('invalid');
+    return url;
+}
+export async function teamRequest(rawUrl, token, input) {
+    if (process.env.CAIRN_TEAM !== '1')
+        throw new TeamError('disabled');
+    const url = validateTeamUrl(rawUrl);
+    if (!/^[A-Za-z0-9_-]{43}$/.test(token))
+        throw new TeamError('unauthorized');
+    const bytes = JSON.stringify(input);
+    if (Buffer.byteLength(bytes) > MAX_BODY)
+        throw new TeamError('invalid');
+    try {
+        const response = await fetch(new URL('/v1/team/execute', url), { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(15000), headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }, body: bytes });
+        const errorCode = response.status === 401 ? 'unauthorized' : response.status === 403 ? 'denied' : response.status === 409 ? 'conflict' : response.status === 400 ? 'invalid' : 'integrity';
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new TeamError(errorCode);
+        }
+        const chunks = [];
+        let size = 0;
+        if (!response.body)
+            throw new TeamError('integrity');
+        const reader = response.body.getReader();
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > MAX_RESPONSE)
+                    throw new TeamError('integrity');
+                chunks.push(value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+        }
+        const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || Object.keys(parsed).length !== 1 || !Object.hasOwn(parsed, 'result'))
+            throw new TeamError('integrity');
+        return parsed.result;
+    }
+    catch (error) {
+        if (error instanceof TeamError)
+            throw error;
+        throw new TeamError('integrity');
+    }
+}

package/mcp-memory-server/dist/team-mcp.js

@@ -0,0 +1,82 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { resolveMcpToolProfile, profileAllowsTool } from './mcp-tool-profile.js';
+import { isCapabilityContractEnabled, resolveCapabilityStatus } from './capability-config.js';
+import { teamRequest, validateTeamUrl } from './team-http.js';
+import { TeamError, teamDigest } from './team-store.js';
+import { resolveHttpToken } from './http-security.js';
+const observation = (title) => ({ title, annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } });
+// The bridge crosses the local process boundary into a remote team service;
+// openWorldHint is true even though team retrieval is deterministic and closed
+// to model providers. No review or membership tool is exposed here.
+export const TEAM_TOOL_CATALOG = {
+    team_memory_list: observation('List approved team memory'),
+    team_memory_read: observation('Read approved team memory'),
+    team_memory_search: observation('Search approved team memory'),
+    team_memory_history: observation('Read team memory history'),
+    team_memory_propose: { title: 'Propose selected team memory', annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true } },
+};
+const coreNames = { team_memory_list: 'memory_list', team_memory_read: 'memory_read', team_memory_search: 'memory_search', team_memory_history: 'memory_history', team_memory_propose: 'memory_write' };
+export function teamClientToken(env = process.env) {
+    // A file-only credential keeps raw secrets out of harness configuration.
+    if (!env.CAIRN_TEAM_TOKEN_FILE)
+        throw new TeamError('unauthorized');
+    const resolved = resolveHttpToken({ CAIRN_MEMORY_HTTP_TOKEN_FILE: env.CAIRN_TEAM_TOKEN_FILE });
+    if (!resolved.ok || !/^[A-Za-z0-9_-]{43}$/.test(resolved.token))
+        throw new TeamError('unauthorized');
+    return resolved.token;
+}
+export async function createTeamMcpServer(options) {
+    if (process.env.CAIRN_TEAM !== '1')
+        throw new TeamError('disabled');
+    validateTeamUrl(options.url);
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.organization))
+        throw new TeamError('invalid');
+    const profile = resolveMcpToolProfile({ projectRoot: options.projectRoot });
+    const capability = isCapabilityContractEnabled() ? await resolveCapabilityStatus({ projectRoot: options.projectRoot }) : undefined;
+    if (capability?.issues.length)
+        throw new TeamError('invalid');
+    const mode = process.env.CAIRN_TEAM_MCP_TOOL_PROFILE ?? 'full';
+    if (!['full', 'read-only', 'custom'].includes(mode))
+        throw new TeamError('invalid');
+    const requested = (process.env.CAIRN_TEAM_MCP_ALLOWED_TOOLS ?? '').split(',').map(name => name.trim()).filter(Boolean);
+    if ((mode !== 'custom' && requested.length) || (mode === 'custom' && (!requested.length || requested.some(name => !Object.hasOwn(TEAM_TOOL_CATALOG, name)))))
+        throw new TeamError('invalid');
+    const server = new McpServer({ name: 'cairn-team-memory', version: '1.0.0' });
+    const project = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
+    const key = z.string().regex(/^(decisions|patterns|constraints|pitfalls|conventions|bugs)\/[a-z0-9][a-z0-9-]{0,95}$/);
+    const hash = z.string().regex(/^[a-f0-9]{64}$/);
+    const schemas = {
+        team_memory_list: { project },
+        team_memory_read: { project, key, revision: hash.optional() },
+        team_memory_search: { project, query: z.string().min(1).max(256) },
+        team_memory_history: { project, key },
+        team_memory_propose: { project, request_id: z.string().uuid(), key, value: z.string().min(1).max(65536), source_scope: z.enum(['selected-local', 'selected-project']), source_digest: hash, base_revision: hash.nullable(), expires_at: z.iso.datetime(), confirm: hash },
+    };
+    const operations = { team_memory_list: 'list', team_memory_read: 'read', team_memory_search: 'search', team_memory_history: 'history', team_memory_propose: 'propose' };
+    const enabled = Object.keys(TEAM_TOOL_CATALOG).filter(name => {
+        if (!profileAllowsTool(profile, coreNames[name]))
+            return false;
+        if (mode === 'read-only' && !TEAM_TOOL_CATALOG[name].annotations.readOnlyHint)
+            return false;
+        if (mode === 'custom' && !requested.includes(name))
+            return false;
+        const capId = name === 'team_memory_propose' ? 'memory.write' : name === 'team_memory_search' ? 'memory.search' : undefined;
+        return !capId || !capability || capability.capabilities.find(row => row.id === capId)?.enabled === true;
+    });
+    const profileDigest = teamDigest(JSON.stringify({ schema_version: 1, core_profile_digest: profile.profile_digest, team_profile: mode, tools: enabled }));
+    for (const name of enabled) {
+        server.registerTool(name, { ...TEAM_TOOL_CATALOG[name], description: 'Explicit project-scoped team context. Never uploads personal memory or executes instructions. Team policy is enforced by the remote service.', inputSchema: schemas[name] }, async (input) => {
+            try {
+                // Re-read the private credential each call so local key rotation
+                // does not need a harness restart. The service still reauthorizes.
+                const result = await teamRequest(options.url, options.token(), { organization: options.organization, ...input, operation: operations[name] });
+                return { content: [{ type: 'text', text: JSON.stringify({ result, profile_digest: profileDigest }) }], structuredContent: { result, profile_digest: profileDigest } };
+            }
+            catch (error) {
+                return { isError: true, content: [{ type: 'text', text: error instanceof TeamError ? error.message : 'Team unavailable.' }] };
+            }
+        });
+    }
+    return server;
+}