@cjhyy/code-shell-core 0.7.0-beta.1 → 0.7.1

package/dist/tool-system/mcp-manager.js

@@ -8,8 +8,10 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { logger } from "../logging/logger.js";
 import { getCredentialAccess } from "../credentials/access.js";
+import { buildOAuthRefreshRequest, oauthCredentialStatus, parseOAuthCredentialSecret, } from "../credentials/oauth.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
 import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
 import { codeShellHome } from "../session/session-manager.js";
@@ -73,14 +75,14 @@ export function buildStdioEnv(serverName, config) {
  * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
  * and win on conflict. Pure + exported for unit testing.
  */
-export function buildHttpHeaders(serverName, config, resolveCredential) {
+export function buildHttpHeaders(serverName, config, resolveCredential, options = {}) {
     const headers = { ...(config.headers ?? {}) };
     if (config.credentialRef) {
-        const secret = resolveCredential?.(config.credentialRef);
-        if (secret === undefined || secret === "") {
+        const credential = normalizeResolvedMcpCredential(resolveCredential?.(config.credentialRef));
+        if (!credential || credential.secret === "") {
             throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
         }
-        headers["Authorization"] = `Bearer ${secret}`;
+        headers["Authorization"] = `Bearer ${bearerTokenFromMcpCredential(serverName, config.credentialRef, credential, options)}`;
     }
     else if (config.bearerTokenEnvVar) {
         headers["Authorization"] = `Bearer ${readRequiredEnv(serverName, "bearerTokenEnvVar", config.bearerTokenEnvVar)}`;
@@ -90,19 +92,116 @@ export function buildHttpHeaders(serverName, config, resolveCredential) {
     }
     return headers;
 }
-export async function buildHttpHeadersWithCredentialAccess(serverName, config, access = getCredentialAccess()) {
+function normalizeResolvedMcpCredential(value) {
+    if (typeof value === "string")
+        return { secret: value };
+    if (!value)
+        return undefined;
+    return value;
+}
+export function bearerTokenFromMcpCredential(serverName, credentialId, credential, options = {}) {
+    if (credential.type === undefined)
+        return credential.secret;
+    if (credential.type !== "oauth") {
+        if (credential.type !== "token" && credential.type !== "link") {
+            throw new Error(`MCP server "${serverName}": credential "${credentialId}" type "${credential.type}" cannot be used as a bearer token`);
+        }
+        try {
+            const parsed = JSON.parse(credential.secret);
+            if (parsed !== null && typeof parsed === "object") {
+                throw new Error(`MCP server "${serverName}": credential "${credentialId}" resolved to a structured secret that does not match token metadata; refusing bearer injection`);
+            }
+        }
+        catch (err) {
+            if (err instanceof SyntaxError)
+                return credential.secret;
+            throw err;
+        }
+        return credential.secret;
+    }
+    const secret = parseOAuthCredentialSecret(credential.secret);
+    const status = oauthCredentialStatus(secret, {
+        now: options.now,
+        skewMs: options.oauthRefreshSkewMs,
+    });
+    if (status.state === "expired") {
+        const refresh = buildOAuthRefreshRequest(credentialId, secret);
+        const refreshHint = refresh
+            ? "refresh data is present, but automatic OAuth refresh is reserved and not wired yet"
+            : "missing refreshToken or tokenEndpoint for automatic refresh";
+        throw new Error(`MCP server "${serverName}": oauth credential "${credentialId}" access token expired; ${refreshHint}`);
+    }
+    return secret.accessToken;
+}
+export async function buildHttpHeadersWithCredentialAccess(serverName, config, access = getCredentialAccess(), options = {}) {
     if (!config.credentialRef)
-        return buildHttpHeaders(serverName, config);
+        return buildHttpHeaders(serverName, config, undefined, options);
     if (!access.resolveValue) {
         throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
     }
+    const meta = access.resolveMeta?.(undefined, config.credentialRef, "full");
+    if (!meta) {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" metadata is unavailable; refusing bearer injection`);
+    }
+    if (meta.type !== "token" && meta.type !== "link" && meta.type !== "oauth") {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" type "${meta.type}" cannot be used as a bearer token`);
+    }
     const secret = await access.resolveValue({
         cwd: undefined,
         id: config.credentialRef,
         scope: "full",
         purpose: "mcp",
     });
-    return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? secret : undefined);
+    return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? { secret, type: meta?.type, label: meta?.label } : undefined, options);
+}
+/**
+ * Fetch adapter for long-lived HTTP MCP transports. OAuth access tokens are
+ * resolved for every request, refreshed by the host inside the skew window,
+ * and force-refreshed once after a replayable 401.
+ */
+export function createMcpAuthenticatedFetch(serverName, config, access = getCredentialAccess(), baseFetch = fetch) {
+    return (async (input, init) => {
+        const credentialId = config.credentialRef;
+        const meta = credentialId ? access.resolveMeta(undefined, credentialId, "full") : undefined;
+        const isOAuth = meta?.type === "oauth";
+        const headers = isOAuth
+            ? buildHttpHeaders(serverName, { ...config, credentialRef: undefined })
+            : await buildHttpHeadersWithCredentialAccess(serverName, config, access);
+        let token;
+        if (isOAuth) {
+            if (!access.resolveOAuthAccess) {
+                throw new Error(`MCP server "${serverName}": oauth credential "${credentialId}" requires host OAuth access`);
+            }
+            token = (await access.resolveOAuthAccess({ id: credentialId, scope: "full" })).accessToken;
+        }
+        const source = new Request(input, init);
+        let replayable = true;
+        try {
+            source.clone();
+        }
+        catch {
+            replayable = false;
+        }
+        const send = async (accessToken) => {
+            const request = replayable ? source.clone() : source;
+            const requestHeaders = new Headers(request.headers);
+            for (const [name, value] of Object.entries(headers))
+                requestHeaders.set(name, value);
+            if (accessToken)
+                requestHeaders.set("Authorization", `Bearer ${accessToken}`);
+            return baseFetch(new Request(request, { headers: requestHeaders }));
+        };
+        const first = await send(token);
+        if (first.status !== 401 || !isOAuth || !credentialId || !replayable || source.signal.aborted) {
+            return first;
+        }
+        const refreshed = await access.resolveOAuthAccess({
+            id: credentialId,
+            scope: "full",
+            forceRefresh: true,
+        });
+        return send(refreshed.accessToken);
+    });
 }
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
@@ -137,9 +236,7 @@ const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
 function spillTimestamp(filename, prefix) {
     const suffix = filename.slice(prefix.length);
-    const dot = suffix.lastIndexOf(".");
-    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
-    const timestamp = Number(raw);
+    const timestamp = Number(/^\d+/.exec(suffix)?.[0]);
     return Number.isFinite(timestamp) ? timestamp : 0;
 }
 async function pruneMcpImageSpills(baseDir, prefix) {
@@ -183,7 +280,7 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
     const prefix = `${safeServer}-${safeTool}-`;
-    const filename = `${prefix}${now()}.${ext}`;
+    const filename = `${prefix}${now()}-${randomUUID().slice(0, 8)}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
@@ -423,9 +520,11 @@ export class MCPManager {
             // credentialRef resolves against user-scope credential access. The shared
             // MCPManager pool has no per-session cwd, and MCP-referenced credentials
             // (e.g. a Figma token) remain user-global by design.
-            const headers = await buildHttpHeadersWithCredentialAccess(name, config);
+            const access = getCredentialAccess();
+            const headers = buildHttpHeaders(name, { ...config, credentialRef: undefined });
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
                 requestInit: Object.keys(headers).length ? { headers } : undefined,
+                fetch: createMcpAuthenticatedFetch(name, config, access),
             });
         }
         else {

package/dist/tool-system/path-policy.d.ts

@@ -49,11 +49,30 @@ export interface ClassifyOptions {
     /** "read" or "write" — different defaults for sensitive paths. */
     operation: PathOperation;
 }
+export interface FinalWritePathSnapshot {
+    resolvedPath: string;
+    workspacePath: string;
+    insideWorkspace: boolean;
+}
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
 export declare function openSessionPathApprovals(sessionId: string): void;
 export declare function clearSessionPathApprovals(sessionId: string): void;
+/**
+ * Capture the concrete target approved by the executor's first path-policy
+ * pass. The snapshot is carried on the internal args object via a symbol, so
+ * it cannot collide with an LLM-supplied schema property or leak into logs.
+ */
+export declare function attachFinalWritePathSnapshot(args: Record<string, unknown>, filePath: string, workspaceRoot: string): Record<string, unknown>;
+export declare function getFinalWritePathSnapshot(args: Record<string, unknown>, filePath: string, workspaceRoot: string): FinalWritePathSnapshot;
+export declare function revalidateFinalWritePath(filePath: string, workspaceRoot: string, approved: FinalWritePathSnapshot): {
+    resolvedPath: string;
+} | {
+    error: string;
+};
+/** Open the already-revalidated final path without following its last segment. */
+export declare function writeFileNoFollow(filePath: string, content: string): Promise<void>;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -29,10 +29,12 @@
  * approval round-trip; it is not an authority to write anywhere on disk.
  * Callers must consult classifyPath before honoring acceptEdits.
  */
-import { realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { open } from "node:fs/promises";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { dirname, isAbsolute, join, resolve as resolvePath, sep } from "node:path";
+const FINAL_WRITE_PATH_SNAPSHOT = Symbol("codeshell.finalWritePathSnapshot");
 /**
  * Default sensitive path patterns. These are evaluated AFTER home-expansion
  * and resolution, so a literal "$HOME/.ssh" and a symlink at /tmp/x → ~/.ssh
@@ -325,6 +327,65 @@ function safeRealpath(p) {
     }
     return abs;
 }
+/**
+ * Capture the concrete target approved by the executor's first path-policy
+ * pass. The snapshot is carried on the internal args object via a symbol, so
+ * it cannot collide with an LLM-supplied schema property or leak into logs.
+ */
+export function attachFinalWritePathSnapshot(args, filePath, workspaceRoot) {
+    const resolvedPath = safeRealpath(filePath);
+    const workspacePath = safeRealpath(workspaceRoot);
+    const snapshot = {
+        resolvedPath,
+        workspacePath,
+        insideWorkspace: isInsideDir(resolvedPath, workspacePath),
+    };
+    return { ...args, [FINAL_WRITE_PATH_SNAPSHOT]: snapshot };
+}
+export function getFinalWritePathSnapshot(args, filePath, workspaceRoot) {
+    const carried = args[FINAL_WRITE_PATH_SNAPSHOT];
+    if (carried && typeof carried === "object") {
+        return carried;
+    }
+    // Direct tool calls do not pass through ToolExecutor. Preserve that API by
+    // taking the baseline at handler entry, while still protecting Edit's
+    // read-to-write interval with a second check before its writeFile.
+    const resolvedPath = safeRealpath(filePath);
+    const workspacePath = safeRealpath(workspaceRoot);
+    return {
+        resolvedPath,
+        workspacePath,
+        insideWorkspace: isInsideDir(resolvedPath, workspacePath),
+    };
+}
+export function revalidateFinalWritePath(filePath, workspaceRoot, approved) {
+    const currentPath = safeRealpath(filePath);
+    const currentWorkspace = safeRealpath(workspaceRoot);
+    const sameTarget = normPath(currentPath) === normPath(approved.resolvedPath);
+    const sameWorkspace = normPath(currentWorkspace) === normPath(approved.workspacePath);
+    const crossedWorkspaceBoundary = approved.insideWorkspace && !isInsideDir(currentPath, currentWorkspace);
+    if (crossedWorkspaceBoundary || !sameTarget || !sameWorkspace) {
+        const reason = crossedWorkspaceBoundary
+            ? "final write path resolved outside the workspace after approval"
+            : "final write path changed after approval";
+        return {
+            error: `Error: ${reason}; refusing to write. ` +
+                `Approved target: ${approved.resolvedPath}. Current target: ${currentPath}`,
+        };
+    }
+    return { resolvedPath: currentPath };
+}
+/** Open the already-revalidated final path without following its last segment. */
+export async function writeFileNoFollow(filePath, content) {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
+    const handle = await open(filePath, flags, 0o666);
+    try {
+        await handle.writeFile(content, "utf-8");
+    }
+    finally {
+        await handle.close();
+    }
+}
 function isInsideDir(child, parent) {
     const c = normPath(child);
     const par = normPath(parent);

package/dist/tool-system/permission.d.ts

@@ -6,6 +6,42 @@ import { logger as rootPermLogger } from "../logging/logger.js";
 export interface ApprovalBackend {
     requestApproval(request: ApprovalRequest): Promise<ApprovalResult>;
 }
+export interface ApprovalRouteTarget {
+    connectionId: string;
+    sessionId: string;
+    generation: number;
+}
+export interface ApprovalConnectionHandler {
+    requestApproval(request: ApprovalRequest, target: ApprovalRouteTarget): Promise<ApprovalResult>;
+    ownershipLost?(targets: ApprovalRouteTarget[], reason: string): void;
+}
+export type ApprovalRegistrationResult = {
+    ok: true;
+    target: ApprovalRouteTarget;
+} | {
+    ok: false;
+    conflict: ApprovalRouteTarget;
+};
+/**
+ * Process-local connection owner router. Handlers are connection-scoped while
+ * session ownership is an explicit binding with a monotonic generation.
+ */
+export declare class ApprovalRouter {
+    private readonly handlers;
+    private readonly owners;
+    private readonly fallbackConnections;
+    private nextGeneration;
+    addConnection(connectionId: string, handler: ApprovalConnectionHandler, options?: {
+        claimUnownedSessions?: boolean;
+    }): () => void;
+    register(sessionId: string, connectionId: string): ApprovalRegistrationResult;
+    resolve(request: ApprovalRequest): Promise<ApprovalResult> | null;
+    matches(target: ApprovalRouteTarget): boolean;
+    current(sessionId: string): ApprovalRouteTarget | null;
+    release(sessionId: string, connectionId: string, reason?: string): void;
+    deregister(connectionId: string, reason?: string): void;
+    hasConnections(): boolean;
+}
 export declare class HeadlessApprovalBackend implements ApprovalBackend {
     private readonly mode;
     constructor(mode: "approve-all" | "deny-all" | "approve-read-only");
@@ -45,18 +81,22 @@ export declare const CLOSED_SESSION_TOMBSTONE_LIMIT = 4096;
  * the next time the user opens the project.
  */
 export declare class InteractiveApprovalBackend implements ApprovalBackend {
+    private readonly approvalRouter;
     private sessionStateById;
     private closedSessionIds;
     private promptFn;
     private legacyPromptTurn;
     private legacyContext;
+    constructor(approvalRouter?: ApprovalRouter);
     setPromptFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
+    clearPromptFn(): void;
     /**
      * Has someone installed a real prompt callback? Engine consults this
      * to decide whether to use the interactive backend (= talk to a UI)
      * or fall back to HeadlessApprovalBackend (= deny-all). Without it,
-     * the agent-server-stdio entry — which wires setInteractiveApprovalFn
-     * during server boot — would still fall through to deny-all because
+     * a protocol host registers its connection with ApprovalRouter during boot
+     * but before the first session is bound — without this check Engine would
+     * still fall through to deny-all because
      * the engine couldn't tell the difference. */
     hasPromptFn(): boolean;
     /** Inject the project root so persistence writes to the right settings file. */
@@ -107,10 +147,10 @@ export declare function pathRuleArgsPattern(absPath: string, scope: "file" | "di
  * JSON round-trip where a persisted RegExp comes back as a string.
  */
 export declare function ruleMatches(rule: PermissionRule, toolName: string, args: Record<string, unknown>): boolean;
+export declare function getApprovalRouter(): ApprovalRouter;
 export declare function getInteractiveApprovalBackend(): InteractiveApprovalBackend;
 export declare function openInteractiveApprovalSession(sessionId: string): void;
 export declare function clearInteractiveApprovalSession(sessionId: string): void;
-export declare function setInteractiveApprovalFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
 type BashSafetyLevel = "safe-read" | "safe-write" | "unsafe" | "dangerous";
 /**
  * True when an otherwise-safe-read shell segment must be downgraded to `unsafe`