@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.10

package/dist/tool-system/mcp-manager.js

@@ -7,8 +7,98 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { logger } from "../logging/logger.js";
+import { CredentialStore } from "../credentials/index.js";
+import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
 import { writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
+import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
+/**
+ * Read a required secret from `process.env` by NAME (Codex-style env-secret
+ * handling — the value is never persisted in MCP config). A referenced env var
+ * that is undefined OR empty string is treated as missing so the connection
+ * fails with a clear, actionable error naming the server, the config field,
+ * and the env var.
+ */
+export function readRequiredEnv(serverName, field, envName) {
+    const v = process.env[envName];
+    if (v === undefined || v === "") {
+        throw new Error(`MCP server "${serverName}": env var "${envName}" (from ${field}) is not set`);
+    }
+    return v;
+}
+/**
+ * Minimal set of host env vars a spawned stdio MCP server inherits by default.
+ * Allowlist, not blacklist — aligned with CC/Codex's env-secret-by-name model:
+ * a server gets only the runtime basics (PATH/HOME/LANG/…), and ANYTHING else
+ * it needs (an API key, a custom config dir) must be declared explicitly via
+ * `envVars` (forward by name) or `config.env` (literal). This avoids the
+ * fragile "guess which key looks like a secret" regex and its two failure
+ * modes (a bespoke key name leaks; a benign `FOO_TOKENIZER` gets stripped).
+ *
+ * Reuses the sandboxed-shell {@link ENV_ALLOWLIST} so the two spawn paths share
+ * one source of truth for "what's safe to forward".
+ */
+function inheritAllowlistedEnv(source) {
+    const out = {};
+    for (const name of ENV_ALLOWLIST) {
+        const v = source[name];
+        if (v !== undefined)
+            out[name] = v;
+    }
+    return out;
+}
+/**
+ * Build the spawned stdio server's environment. Priority (lowest → highest):
+ * a minimal inherited allowlist < forwarded `envVars` (read from process.env by
+ * name) < explicit plaintext `config.env`. Returns `undefined` when neither
+ * `env` nor `envVars` is present, preserving the old "inherit nothing extra"
+ * behavior (transport gets `env: undefined`). Pure + exported for unit testing.
+ */
+export function buildStdioEnv(serverName, config) {
+    if (!config.env && !config.envVars?.length)
+        return undefined;
+    const forwarded = {};
+    for (const en of config.envVars ?? []) {
+        forwarded[en] = readRequiredEnv(serverName, "envVars", en);
+    }
+    return {
+        ...inheritAllowlistedEnv(process.env),
+        ...forwarded,
+        ...(config.env ?? {}),
+    };
+}
+/**
+ * Build the HTTP transport's request headers. Static `config.headers` form the
+ * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
+ * and win on conflict. Pure + exported for unit testing.
+ */
+export function buildHttpHeaders(serverName, config, resolveCredential) {
+    const headers = { ...(config.headers ?? {}) };
+    if (config.credentialRef) {
+        const secret = resolveCredential?.(config.credentialRef);
+        if (secret === undefined || secret === "") {
+            throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
+        }
+        headers["Authorization"] = `Bearer ${secret}`;
+    }
+    else if (config.bearerTokenEnvVar) {
+        headers["Authorization"] = `Bearer ${readRequiredEnv(serverName, "bearerTokenEnvVar", config.bearerTokenEnvVar)}`;
+    }
+    for (const [hName, envName] of Object.entries(config.envHeaders ?? {})) {
+        headers[hName] = readRequiredEnv(serverName, "envHeaders", envName);
+    }
+    return headers;
+}
+/**
+ * Infer the transport when the config doesn't name one: a url-only entry is
+ * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
+ * plugin-bundled servers commonly write just `{ "url": "..." }`, and the old
+ * blind `?? "stdio"` default then failed them with "command is required for
+ * stdio transport" despite a perfectly good url. Pure + exported for testing.
+ */
+export function inferTransportType(config) {
+    return config.transport ?? (config.url && !config.command ? "streamable-http" : "stdio");
+}
 /**
  * Wrap raw MCP server output with an explicit untrusted-content marker
  * before it reaches the LLM. The wrapper does two things:
@@ -87,7 +177,9 @@ export function wrapMcpOutput(serverName, toolName, body) {
     ].join("\n");
 }
 export function stripInternalToolArgs(args) {
-    const { __signal: _signal, ...toolArgs } = args;
+    // Drop executor-injected internal fields so they never reach the MCP server as
+    // tool arguments: __signal (abort) and __allowedMcpServers (auth allowlist).
+    const { __signal: _signal, __allowedMcpServers: _allowed, ...toolArgs } = args;
     return toolArgs;
 }
 /**
@@ -125,6 +217,8 @@ export class MCPManager {
     toolRegistry;
     static instance = null;
     connections = new Map();
+    registeredToolsByServer = new Map();
+    desiredServerNames = null;
     /**
      * In-flight connect()s keyed by server name. When the broadcast config
      * reload (server.ts forEachSession → every session's refreshRuntimeConfig)
@@ -137,6 +231,8 @@ export class MCPManager {
      * connect can be retried later.
      */
     connecting = new Map();
+    /** Per-owner (engine) desired server sets — see reconcile()'s shared-pool note. */
+    desiredByOwner = new Map();
     constructor(toolRegistry) {
         this.toolRegistry = toolRegistry;
         MCPManager.instance = this;
@@ -150,7 +246,15 @@ export class MCPManager {
     /**
      * Connect to all configured MCP servers and register their tools.
      */
-    async connectAll(servers) {
+    async connectAll(servers, owner) {
+        // Register this owner's desired set up front (see reconcile's shared-pool
+        // note) so a later reconcile from ANOTHER session can't disconnect servers
+        // this session connected at run start.
+        if (owner !== undefined) {
+            this.desiredByOwner.set(owner, new Set(Object.entries(servers)
+                .filter(([, c]) => c.enabled !== false)
+                .map(([n]) => n)));
+        }
         // Codex-style toggle: skip servers explicitly disabled in settings.
         // Only the literal `false` disables — absent / true / any other value
         // stays connected, matching the schema default semantics.
@@ -174,6 +278,37 @@ export class MCPManager {
             }
         }
     }
+    async reconcile(servers, owner) {
+        const enabledNames = new Set(Object.entries(servers)
+            .filter(([, config]) => config.enabled !== false)
+            .map(([name]) => name));
+        this.desiredServerNames = enabledNames;
+        // Shared-pool semantics: this ONE pool serves every session in the worker,
+        // and sessions in different projects legitimately want DIFFERENT server
+        // sets (per-project capabilityOverrides). Disconnect only servers that NO
+        // registered owner wants — otherwise the per-session hot-reload patches
+        // would thrash each other's connections (last reconcile wins, killing a
+        // server another project's session is using). Owners are engines; a
+        // closed session's desires linger (no engine-teardown hook), which merely
+        // over-RETAINS idle connections — per-session tool visibility keeps
+        // correctness regardless.
+        if (owner !== undefined)
+            this.desiredByOwner.set(owner, enabledNames);
+        const union = this.unionDesired() ?? enabledNames;
+        const stale = this.listServers().filter((name) => !union.has(name));
+        await Promise.all(stale.map((name) => this.disconnect(name)));
+        await this.connectAll(servers, owner);
+    }
+    /** Union of every registered owner's desired set; null when none registered. */
+    unionDesired() {
+        if (this.desiredByOwner.size === 0)
+            return null;
+        const u = new Set();
+        for (const names of this.desiredByOwner.values())
+            for (const n of names)
+                u.add(n);
+        return u;
+    }
     /**
      * Connect to a single MCP server.
      *
@@ -208,10 +343,10 @@ export class MCPManager {
             logger.info("mcp.already_connected", { server: name });
             return;
         }
-        logger.info("mcp.connecting", { server: name, transport: config.transport ?? "stdio" });
+        const transportType = inferTransportType(config);
+        logger.info("mcp.connecting", { server: name, transport: transportType });
         const client = new Client({ name: "code-shell", version: "0.1.0" }, { capabilities: {} });
         let transport;
-        const transportType = config.transport ?? "stdio";
         if (transportType === "stdio") {
             if (!config.command) {
                 throw new Error(`MCP server "${name}": command is required for stdio transport`);
@@ -219,15 +354,21 @@ export class MCPManager {
             transport = new StdioClientTransport({
                 command: config.command,
                 args: config.args,
-                env: config.env ? { ...process.env, ...config.env } : undefined,
+                env: buildStdioEnv(name, config),
             });
         }
         else if (transportType === "streamable-http" || transportType === "sse") {
             if (!config.url) {
                 throw new Error(`MCP server "${name}": url is required for ${transportType} transport`);
             }
+            // credentialRef resolves against the user-scope CredentialStore. The
+            // shared MCPManager pool has no per-session cwd (see desiredByOwner note),
+            // and MCP-referenced credentials (e.g. a Figma token) are user-global by
+            // nature, so user scope is the right resolution surface here.
+            const credStore = new CredentialStore(undefined);
+            const headers = buildHttpHeaders(name, config, (id) => credStore.resolve(id)?.secret);
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
-                requestInit: config.headers ? { headers: config.headers } : undefined,
+                requestInit: Object.keys(headers).length ? { headers } : undefined,
             });
         }
         else {
@@ -253,6 +394,22 @@ export class MCPManager {
             catch {
                 // ignore cleanup errors
             }
+            if (transportType === "stdio" && config.command) {
+                const diagnostic = await diagnoseMcpStdioMissingCommand(config.command, err);
+                if (diagnostic) {
+                    logger.warn("mcp.stdio_command_missing", {
+                        server: name,
+                        command: config.command,
+                        foundPaths: diagnostic.foundPaths,
+                        path: previewPath(),
+                        message: diagnostic.message,
+                    });
+                    const original = err instanceof Error ? err.message : String(err);
+                    const enhanced = new Error(`${original}\n${diagnostic.message}`);
+                    enhanced.cause = err;
+                    throw enhanced;
+                }
+            }
             throw err;
         }
         finally {
@@ -262,6 +419,10 @@ export class MCPManager {
         this.connections.set(name, { client, serverName: name, transport });
         // Discover and register tools
         await this.discoverTools(name, client);
+        if (this.desiredServerNames && !this.desiredServerNames.has(name)) {
+            await this.disconnect(name);
+            return;
+        }
         logger.info("mcp.connected", { server: name });
     }
     /**
@@ -317,6 +478,9 @@ export class MCPManager {
                 // strings can't fake their way out.
                 return wrapMcpOutput(serverName, tool.name, body);
             });
+            const set = this.registeredToolsByServer.get(serverName) ?? new Set();
+            set.add(registered.name);
+            this.registeredToolsByServer.set(serverName, set);
             logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
         }
     }
@@ -324,16 +488,27 @@ export class MCPManager {
      * Disconnect all MCP servers.
      */
     async disconnectAll() {
-        for (const [name, conn] of this.connections) {
-            try {
-                await conn.client.close();
-                logger.info("mcp.disconnected", { server: name });
-            }
-            catch (err) {
-                logger.warn("mcp.disconnect_error", { server: name, error: err.message });
+        await Promise.all([...this.connections.keys()].map((name) => this.disconnect(name)));
+    }
+    async disconnect(name) {
+        const conn = this.connections.get(name);
+        if (!conn)
+            return;
+        try {
+            await conn.client.close();
+            logger.info("mcp.disconnected", { server: name });
+        }
+        catch (err) {
+            logger.warn("mcp.disconnect_error", { server: name, error: err.message });
+        }
+        finally {
+            this.connections.delete(name);
+            for (const toolName of this.registeredToolsByServer.get(name) ?? []) {
+                this.toolRegistry.unregisterTool(toolName);
+                logger.info("mcp.tool_unregistered", { server: name, tool: toolName });
             }
+            this.registeredToolsByServer.delete(name);
         }
-        this.connections.clear();
     }
     /**
      * List connected servers.
@@ -344,12 +519,15 @@ export class MCPManager {
     /**
      * Call a tool on a specific MCP server.
      */
-    async callTool(serverName, toolName, args) {
+    async callTool(serverName, toolName, args, signal) {
         const conn = this.connections.get(serverName);
         if (!conn) {
             throw new Error(`MCP server "${serverName}" is not connected.`);
         }
-        const result = await conn.client.callTool({ name: toolName, arguments: stripInternalToolArgs(args) });
+        // Forward the run's abort signal so a user Stop cancels an in-flight MCP
+        // call promptly instead of blocking until the SDK's default request timeout.
+        // (The SDK still enforces its default timeout when no signal is provided.)
+        const result = await conn.client.callTool({ name: toolName, arguments: stripInternalToolArgs(args) }, undefined, signal ? { signal } : undefined);
         const parts = [];
         if (Array.isArray(result.content)) {
             for (const item of result.content) {
@@ -367,7 +545,7 @@ export class MCPManager {
     /**
      * List resources from MCP servers.
      */
-    async listResources(serverName) {
+    async listResources(serverName, signal) {
         const results = [];
         const servers = serverName ? [serverName] : [...this.connections.keys()];
         for (const name of servers) {
@@ -375,7 +553,10 @@ export class MCPManager {
             if (!conn)
                 continue;
             try {
-                const res = await conn.client.listResources();
+                // Forward the run's abort signal so a user Stop cancels promptly
+                // instead of waiting out the SDK's default request timeout (same as
+                // callTool). The SDK still enforces its default timeout when no signal.
+                const res = await conn.client.listResources(undefined, signal ? { signal } : undefined);
                 for (const r of res.resources) {
                     results.push({
                         uri: r.uri,
@@ -393,12 +574,14 @@ export class MCPManager {
     /**
      * Read a resource from an MCP server.
      */
-    async readResource(serverName, uri) {
+    async readResource(serverName, uri, signal) {
         const conn = this.connections.get(serverName);
         if (!conn) {
             throw new Error(`MCP server "${serverName}" is not connected.`);
         }
-        const result = await conn.client.readResource({ uri });
+        // Forward the run's abort signal so a user Stop cancels promptly (same as
+        // callTool); the SDK still enforces its default timeout when no signal.
+        const result = await conn.client.readResource({ uri }, signal ? { signal } : undefined);
         const parts = [];
         if (Array.isArray(result.contents)) {
             for (const item of result.contents) {

package/dist/tool-system/mcp-stdio-diagnostics.d.ts

@@ -0,0 +1,9 @@
+export declare function isBareCommand(command: string): boolean;
+export declare function isMissingCommandError(error: unknown): boolean;
+export declare function probeCommonExecutableLocations(command: string, env?: NodeJS.ProcessEnv): Promise<string[]>;
+export declare function classifyMcpStdioMissingCommand(command: string, foundPaths: readonly string[]): string;
+export declare function diagnoseMcpStdioMissingCommand(command: string, error: unknown, env?: NodeJS.ProcessEnv): Promise<{
+    message: string;
+    foundPaths: string[];
+} | null>;
+export declare function previewPath(env?: NodeJS.ProcessEnv): string;

package/dist/tool-system/mcp-stdio-diagnostics.js

@@ -0,0 +1,93 @@
+import { constants } from "node:fs";
+import { access } from "node:fs/promises";
+import { delimiter, isAbsolute, join } from "node:path";
+const COMMON_POSIX_BIN_DIRS = [
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/home/linuxbrew/.linuxbrew/bin",
+    "/usr/bin",
+    "/bin",
+];
+function unique(entries) {
+    const seen = new Set();
+    const out = [];
+    for (const entry of entries) {
+        const trimmed = entry.trim();
+        if (!trimmed || seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        out.push(trimmed);
+    }
+    return out;
+}
+function commonExecutableDirs(env = process.env) {
+    const home = env.HOME?.trim();
+    return unique([
+        ...COMMON_POSIX_BIN_DIRS,
+        ...(home
+            ? [join(home, ".bun", "bin"), join(home, ".local", "bin"), join(home, ".npm-global", "bin")]
+            : []),
+    ]);
+}
+export function isBareCommand(command) {
+    const trimmed = command.trim();
+    return !!trimmed && !trimmed.includes("/") && !trimmed.includes("\\") && !isAbsolute(trimmed);
+}
+export function isMissingCommandError(error) {
+    const err = error;
+    const message = typeof err.message === "string" ? err.message : String(error);
+    return err.code === "ENOENT" || /\bENOENT\b/i.test(message) || /command not found/i.test(message);
+}
+async function isExecutable(filePath) {
+    try {
+        await access(filePath, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function probeCommonExecutableLocations(command, env = process.env) {
+    if (!isBareCommand(command) || process.platform === "win32")
+        return [];
+    const found = [];
+    for (const dir of commonExecutableDirs(env)) {
+        const candidate = join(dir, command);
+        if (await isExecutable(candidate))
+            found.push(candidate);
+    }
+    return found;
+}
+function installGuidance(command) {
+    if (command === "node" || command === "npx")
+        return "Please install Node.js and restart CodeShell.";
+    if (command === "bun" || command === "bunx")
+        return "Please install Bun and restart CodeShell.";
+    return `Please install "${command}" and restart CodeShell.`;
+}
+export function classifyMcpStdioMissingCommand(command, foundPaths) {
+    const trimmed = command.trim();
+    if (foundPaths.length > 0) {
+        return [
+            `MCP stdio command "${trimmed}" failed to start: detected ${trimmed} at ${foundPaths[0]},`,
+            "but that directory was not available on PATH.",
+            "Login-shell PATH injection may have failed; restart CodeShell or configure this MCP command as an absolute path.",
+        ].join(" ");
+    }
+    return [
+        `MCP stdio command "${trimmed}" failed to start: ${trimmed} was not found on PATH or in common install locations.`,
+        installGuidance(trimmed),
+    ].join(" ");
+}
+export async function diagnoseMcpStdioMissingCommand(command, error, env = process.env) {
+    if (!isBareCommand(command) || !isMissingCommandError(error))
+        return null;
+    const foundPaths = await probeCommonExecutableLocations(command, env);
+    return {
+        message: classifyMcpStdioMissingCommand(command, foundPaths),
+        foundPaths,
+    };
+}
+export function previewPath(env = process.env) {
+    return (env.PATH ?? "").split(delimiter).filter(Boolean).join(delimiter);
+}

package/dist/tool-system/path-policy.d.ts

@@ -29,6 +29,7 @@
  * approval round-trip; it is not an authority to write anywhere on disk.
  * Callers must consult classifyPath before honoring acceptEdits.
  */
+import type { ToolContext } from "./context.js";
 export type PathDecision = "allow" | "ask" | "deny";
 export type PathOperation = "read" | "write";
 export interface PathClassification {
@@ -48,6 +49,9 @@ export interface ClassifyOptions {
     /** "read" or "write" — different defaults for sensitive paths. */
     operation: PathOperation;
 }
+export type PathApprovalScope = "once" | "session" | "project";
+/** Test seam: clear the in-memory session grants. */
+export declare function _resetSessionPathGrants(): void;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *
@@ -86,6 +90,7 @@ export declare function classifyPath(rawPath: string, opts: ClassifyOptions): Pa
  * remains the rollback knob for the LLM-driven path.
  */
 export declare function enforcePathPolicy(filePath: string, operation: PathOperation, workspaceRoot?: string): string | null;
+export declare function enforcePathPolicyWithApproval(filePath: string, operation: PathOperation, ctx?: ToolContext): Promise<string | null>;
 /**
  * Internal: reset the "disabled warning" latch. Tests flip the env var
  * between cases and need each one to be able to re-trigger the warning.