@cloudgrid-io/mcp 0.21.0 → 0.21.2

package/README.md

@@ -197,16 +197,16 @@ recording whether the user agreed to share the conversation (`deploy.js:544`),
 and a `context` object the model supplies — which by its declared shape
 (`register.js:964-975`) can carry the failing inputs (for example the HTML or
 args) and the original request. The transcript itself is not sent by this tool.
-The report scrub is **key-name-only**: a value is redacted only when its *key*
-matches a secret-looking name (`password`, `token`, `api_key`, …), so a secret
-embedded in a value — for example an API key inside HTML sent under
-`context.inputs` — is not redacted, and the error summary (`message`) is not
-scrubbed at all. This same key-name filter is applied client-side
-(`deploy.js:439-448`); the platform's error endpoint applies a key-name filter
-too, not a value-based one, so neither layer catches a secret that sits in a
-value. To keep a secret out of a report, do not place it in the `message` or
-`context` you send, or set `CLOUDGRID_TELEMETRY=off` to disable reporting
-entirely.
+The report scrub is **two-layer**: values AND the `message` field are scanned
+for known secret shapes (API key prefixes such as `sk-ant-`, `sk-proj-`,
+`AKIA…`; JWTs; PEM private-key blocks; Bearer tokens; basic-auth URL
+credentials) and matches are replaced with `[REDACTED]`. Arbitrary or
+unknown-shape secrets that do not match a known pattern still transit
+unredacted. The client-side scrub (`scrubReportContext` + `scrubSecretValues`
+in deploy.js) runs before the POST; the server endpoint applies a server-side
+key-name filter on top. To keep a secret out of a report, do not place it in
+the `message` or `context` you send, or set `CLOUDGRID_TELEMETRY=off` to
+disable reporting entirely.
 
 **Version check.** At startup the local edition makes one request to
 `https://registry.npmjs.org/@cloudgrid-io/mcp/latest` to detect a stale `.mcpb`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -63,13 +63,15 @@
     "test:collab": "node test/collab.test.mjs",
     "test:url-shape": "node test/url-shape-guard.test.mjs",
     "test:pull-grid": "node test/pull-grid-param.test.mjs",
-    "test:pull-output-schema": "node test/pull-output-schema.test.mjs"
+    "test:pull-output-schema": "node test/pull-output-schema.test.mjs",
+    "test:web-identity": "node --test test/web-identity.test.mjs",
+    "test:web-auth-integration": "node --test test/web-auth-integration.test.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "express": "^4.22.2",
     "fflate": "^0.8.3",
-    "undici": "^6.28.0",
+    "undici": "^8.10.0",
     "zod": "^3.23.0"
   },
   "license": "Apache-2.0",

package/src/tools/deploy.js

@@ -43,14 +43,36 @@ function isProvisioningCode(code) {
   return PROVISIONING_CODES.has(code);
 }
 
+// Same org->grid rename, same dual-accept safety (cloudgrid-io/cloudgrid#2673).
+// These two codes gate the first-time-user "no grid" path and the wrong-grid
+// path — if the MCP recognizes only the old ORG_* spelling, the API renaming it
+// silently darks those paths (the account-has-no-grid guidance and the typo
+// hint stop firing). NO_ACTIVE_GRID is ALREADY emitted by the API alongside
+// NO_ACTIVE_ORG; GRID_NOT_ACCESSIBLE is the anticipated rename of
+// ORG_NOT_ACCESSIBLE. Accept both spellings so the API rename can land anytime.
+const NO_ACTIVE_GRID_CODES = new Set(["NO_ACTIVE_GRID", "NO_ACTIVE_ORG"]);
+function isNoActiveGridCode(code) {
+  return NO_ACTIVE_GRID_CODES.has(code);
+}
+const GRID_NOT_ACCESSIBLE_CODES = new Set(["GRID_NOT_ACCESSIBLE", "ORG_NOT_ACCESSIBLE"]);
+function isGridNotAccessibleCode(code) {
+  return GRID_NOT_ACCESSIBLE_CODES.has(code);
+}
+
 
-// ── Org listing (bearer-authed, web edition) ──────────────────────────────────
-// Fetches the signed-in user's orgs via GET /api/v2/orgs. The JWT does not
-// carry orgs (claims: sub, email, name, iat, exp), so the API is the canonical
+// ── Grid listing (bearer-authed, web edition) ─────────────────────────────────
+// Fetches the signed-in user's grids via GET /api/v2/grids. The JWT does not
+// carry them (claims: sub, email, name, iat, exp), so the API is the canonical
 // source. Returns [{slug, name, role, render_ready}].
+//
+// cloudgrid-io/cloudgrid#2550 — this used to call `/api/v2/orgs`. That mount is
+// being retired, and unlike a renamed FIELD a retired URL cannot be papered over
+// by any client-side compatibility shim: the request simply 404s. Both mounts
+// answer identically today, so moving now is a no-op that stops this tool
+// breaking when `/orgs` goes.
 export async function fetchUserOrgs(token) {
   try {
-    const res = await fetch(`${API_BASE}/api/v2/orgs`, {
+    const res = await fetch(`${API_BASE}/api/v2/grids`, {
       headers: { Authorization: `Bearer ${token}` },
     });
     if (!res.ok) return [];
@@ -480,13 +502,51 @@ const REPORT_SECRET_KEY_PATTERNS = [
   /access[_-]?key/i,
 ];
 
-// Light client-side scrub of obviously secret-looking values in the report
-// context. Redacts values under secret-looking KEYS; leaves everything else
-// intact (the server applies the same key-name filter, not a value-based one —
-// a secret embedded in a value transits unredacted). Bounded depth so a
-// pathological object can't loop.
+// Value-level secret patterns — must stay in sync with TEXT_SECRET_PATTERNS
+// in session-logger.js (which scrubs free text for session logs). The lists are
+// separate because this module operates on structured object values via
+// scrubReportContext, while session-logger operates on free text via scrubText.
+// Both scan string content for the same secret shapes; if you add a pattern to
+// one, add it to the other.
+const REPORT_SECRET_VALUE_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{0,}/g,
+  /sk-ant-[A-Za-z0-9_-]{16,}/g,
+  /sk-or-v1-[A-Za-z0-9]{16,}/g,
+  /sk-proj-[A-Za-z0-9_-]{16,}/g,
+  /\bsk-[A-Za-z0-9]{20,}/g,
+  /AIza[0-9A-Za-z_-]{30,}/g,
+  /ghp_[A-Za-z0-9]{30,}/g,
+  /github_pat_[A-Za-z0-9_]{30,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /\bsk_(?:live|test)_[0-9A-Za-z]{16,}\b/g,
+  /\bBearer\s+[A-Za-z0-9._-]{8,}/gi,
+];
+
+// Replace known secret shapes inside a string value with [REDACTED].
+// Complementary to the key-name check in scrubReportContext — this catches
+// secrets that live inside values (e.g. an API key pasted into HTML source).
+function scrubSecretValues(str) {
+  if (typeof str !== "string") return str;
+  let out = str;
+  for (const re of REPORT_SECRET_VALUE_PATTERNS) {
+    out = out.replace(re, "[REDACTED]");
+  }
+  out = out.replace(/([a-zA-Z][a-zA-Z0-9+.\-]*:\/\/)[^\s:@/]+:[^\s:@/]+@/g, "$1[REDACTED]@");
+  return out;
+}
+
+// Client-side scrub of the report context. Two layers:
+//   1. Key-name check: values under secret-looking KEYS are fully redacted.
+//   2. Value scan: string values in the tree (up to depth 5) are scanned for known
+//      secret shapes (API keys, Bearer tokens) and matches are replaced.
+// Bounded depth so a pathological object can't loop.
 export function scrubReportContext(obj, depth = 0) {
-  if (depth > 5 || obj === null || typeof obj !== "object") return obj;
+  if (depth > 5 || obj === null || typeof obj !== "object") {
+    // Leaf value — scrub known secret shapes from strings.
+    return typeof obj === "string" ? scrubSecretValues(obj) : obj;
+  }
   if (Array.isArray(obj)) return obj.map((item) => scrubReportContext(item, depth + 1));
   const out = {};
   for (const [key, value] of Object.entries(obj)) {
@@ -575,11 +635,11 @@ export async function runReport(
     // category: default "mcp" (or the failing tool name the agent passes).
     category: typeof category === "string" && category.trim() ? category.trim() : "mcp",
     app: "mcp",
-    message: summary.slice(0, 5000),
+    message: scrubSecretValues(summary).slice(0, 5000),
     context: safeContext,
     // Diagnostic pivots (match the CLI) — only when the agent forwards them.
     ...(typeof trace_id === "string" && trace_id ? { trace_id } : {}),
-    ...(typeof failed_step === "string" && failed_step ? { failed_step } : {}),
+    ...(typeof failed_step === "string" && failed_step ? { failed_step: scrubSecretValues(failed_step) } : {}),
     ...(typeof http_status === "number" && Number.isFinite(http_status) ? { http_status } : {}),
     // Attribution, ALSO top-level (persisted once the handler accepts these keys;
     // context.origin is the fallback until then).
@@ -750,22 +810,23 @@ export async function runPull(ctx, { claim_token, claim_url, entity_id, grid } =
       };
     }
     const code = data?.error?.code || null;
-    // ORG_NOT_ACCESSIBLE: the `grid` param has a typo or the user isn't a
-    // member of that grid. The server message already contains an "Available:"
-    // hint listing valid grid slugs — surface it so the agent can self-correct.
-    if (code === "ORG_NOT_ACCESSIBLE") {
+    // ORG_NOT_ACCESSIBLE / GRID_NOT_ACCESSIBLE: the `grid` param has a typo or
+    // the user isn't a member of that grid. The server message already contains
+    // an "Available:" hint listing valid grid slugs — surface it so the agent
+    // can self-correct.
+    if (isGridNotAccessibleCode(code)) {
       const serverMsg = data?.error?.message || "The specified grid is not accessible.";
       const hint = data?.error?.details?.[0]?.hint || "";
       return {
         text:
           `${serverMsg}${hint ? ` ${hint}` : ""} ` +
           `Check the grid slug for typos and retry grid_pull with the correct \`grid\` parameter.`,
-        structured: { error: { code: "ORG_NOT_ACCESSIBLE" } },
+        structured: { error: { code } },
       };
     }
-    // NO_ACTIVE_ORG: the account has no grid at all — route to in-flow grid
-    // creation instead of the misleading "no push access" advice.
-    if (code === "NO_ACTIVE_ORG") {
+    // NO_ACTIVE_ORG / NO_ACTIVE_GRID: the account has no grid at all — route to
+    // in-flow grid creation instead of the misleading "no push access" advice.
+    if (isNoActiveGridCode(code)) {
       return {
         text:
           "The account has no grid yet. Do not send the user to the console — create one from here: " +
@@ -1346,10 +1407,10 @@ export function errorGuidance({ status, code, edition, isEdit, isAnon, signedIn
       : "Your sign-in is missing or expired. Run grid_login, then retry the same grid_plug. Do not offer anonymous publishing as a fix for a failed sign-in; anonymous is only for a user who explicitly asks to publish without attribution.";
   }
   if (status === 403) {
-    // NO_ACTIVE_ORG is not a role problem — the account has no grid at all.
-    // The generic pull/pickup hint here sent a first-time user in circles
-    // (field bug 2026-07-27); route them to in-flow grid creation instead.
-    if (code === "NO_ACTIVE_ORG") {
+    // NO_ACTIVE_ORG / NO_ACTIVE_GRID is not a role problem — the account has no
+    // grid at all. The generic pull/pickup hint here sent a first-time user in
+    // circles (field bug 2026-07-27); route them to in-flow grid creation instead.
+    if (isNoActiveGridCode(code)) {
       return "The account has no grid yet. Do not send the user to the console — create one from here: suggest a short slug, confirm it with the user, call grid_create_grid, then re-call grid_plug with grid: <slug>.";
     }
     return "You lack the role to plug this target. To get push access to the SAME entity, use `grid_collab` — it grants permission only and fetches nothing, so run `grid_pull` again once it is granted (if the owner gates access, it becomes a request they approve). To make your own separate copy (a fork), use `grid_pickup`.";

package/src/web-identity.js

@@ -0,0 +1,54 @@
+import { decodeJwt } from "./auth.js";
+
+function isTokenExpired(jwt, now) {
+  if (!jwt) return false;
+  return decodeJwt(jwt).exp * 1000 <= now();
+}
+
+export function createWebIdentity({
+  initialTransportToken = null,
+  now = () => Date.now(),
+} = {}) {
+  let transportToken = initialTransportToken;
+  let explicitToken = null;
+  let hasExplicitLogin = false;
+
+  // An explicit login wins over transport-token refreshes for the same subject.
+  // A genuine transport subject change ends that override so credentials from
+  // the previous person cannot persist on a connection now owned by another.
+  function effectiveToken() {
+    return hasExplicitLogin ? explicitToken : transportToken;
+  }
+
+  return {
+    captureTransportToken(jwt) {
+      const previousSub = decodeJwt(transportToken).sub;
+      const nextSub = decodeJwt(jwt).sub;
+      const identityChanged = Boolean(previousSub && nextSub && previousSub !== nextSub);
+      transportToken = jwt;
+      if (identityChanged && hasExplicitLogin) {
+        explicitToken = null;
+        hasExplicitLogin = false;
+      }
+      return { identityChanged };
+    },
+
+    async getToken() {
+      const jwt = effectiveToken();
+      return isTokenExpired(jwt, now) ? null : jwt;
+    },
+
+    async getCredentialsStatus() {
+      const jwt = effectiveToken();
+      if (!jwt) return { creds: null, expired: false };
+      if (isTokenExpired(jwt, now)) return { creds: null, expired: true };
+      return { creds: { jwt }, expired: false };
+    },
+
+    async saveToken(jwt) {
+      explicitToken = jwt;
+      hasExplicitLogin = true;
+      return decodeJwt(jwt);
+    },
+  };
+}

package/src/web.js

@@ -23,12 +23,13 @@ import express from "express";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { registerTools, decodeJwt } from "./tools.js";
+import { registerTools } from "./tools.js";
 import { mountOAuth, bearerChallenge } from "./oauth.js";
 import { mountLanding } from "./landing.js";
 import { createSessionLogger } from "./session-logger.js";
 import { createSink } from "./log-sink.js";
 import { INSTRUCTIONS_WEB } from "./playbook.js";
+import { createWebIdentity } from "./web-identity.js";
 
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url)));
 
@@ -47,45 +48,24 @@ const REQUIRE_AUTH = process.env.MCP_REQUIRE_AUTH === "1";
 // server-side, so it is safe to leave unset.
 const TRUSTED_SERVER_SECRET = process.env.MCP_TRUSTED_SERVER_SECRET || null;
 
-// Transport-level identity per MCP session: a Bearer presented on /mcp requests
-// becomes the session's CloudGrid identity (takes precedence over in-tool login).
-const sessionAuth = Object.create(null); // sid -> jwt
-
 function bearerOf(req) {
   const h = req.headers.authorization;
   return h && /^Bearer\s+\S+/i.test(h) ? h.replace(/^Bearer\s+/i, "") : null;
 }
 
-function isTokenExpired(jwt) {
-  if (!jwt) return false;
-  const claims = decodeJwt(jwt);
-  return Boolean(claims.exp && claims.exp * 1000 <= Date.now());
-}
-
 // A web session: identity lives in memory for the session's lifetime only. The
 // session id doubles as the stable, opaque end-user id for the trusted-server cap.
-function makeWebContext(sessionId) {
-  let sessionToken = null;
+function makeWebContext(sessionId, initialTransportToken = null) {
+  const identity = createWebIdentity({ initialTransportToken });
   return {
     edition: "web",
     state: { pendingLoginCode: null, lastAnonClaim: null, lastDrop: null, anonCookie: null },
     canOpenBrowser: false,
-    getToken: async () => {
-      const jwt = sessionAuth[sessionId] ?? sessionToken;
-      if (jwt && isTokenExpired(jwt)) return null;
-      return jwt;
-    },
-    getCredentialsStatus: async () => {
-      const jwt = sessionAuth[sessionId] ?? sessionToken;
-      if (!jwt) return { creds: null, expired: false };
-      if (isTokenExpired(jwt)) return { creds: null, expired: true };
-      return { creds: { jwt }, expired: false };
-    },
+    identity,
+    getToken: identity.getToken,
+    getCredentialsStatus: identity.getCredentialsStatus,
     getActiveGrid: async () => null,
-    saveToken: async (jwt) => {
-      sessionToken = jwt;
-      return decodeJwt(jwt);
-    },
+    saveToken: identity.saveToken,
     savedLocationNote: () => "You are signed in for this session.",
     trustedServer: TRUSTED_SERVER_SECRET
       ? { secret: TRUSTED_SERVER_SECRET, endUserId: sessionId }
@@ -109,6 +89,18 @@ mountOAuth(app, PUBLIC_BASE, { requireAuth: REQUIRE_AUTH });
 const transports = Object.create(null);
 const sessionContexts = Object.create(null);
 
+function captureRequestIdentity(sessionId, jwt) {
+  if (!jwt) return;
+  const ctx = sessionContexts[sessionId];
+  if (!ctx) return;
+  const { identityChanged } = ctx.identity.captureTransportToken(jwt);
+  if (identityChanged) {
+    ctx.state.identityChanged = true;
+    ctx.state.pendingLoginCode = null;
+    ctx.state.authChoiceOffered = false;
+  }
+}
+
 app.post("/mcp", async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   let transport = sessionId ? transports[sessionId] : undefined;
@@ -125,22 +117,7 @@ app.post("/mcp", async (req, res) => {
   }
 
   if (transport) {
-    if (jwt) {
-      const prev = sessionAuth[sessionId];
-      if (prev) {
-        const prevSub = decodeJwt(prev).sub;
-        const newSub = decodeJwt(jwt).sub;
-        if (prevSub && newSub && prevSub !== newSub) {
-          const ctxForSession = sessionContexts[sessionId];
-          if (ctxForSession) {
-            ctxForSession.state.identityChanged = true;
-            ctxForSession.state.pendingLoginCode = null;
-            ctxForSession.state.authChoiceOffered = false;
-          }
-        }
-      }
-      sessionAuth[sessionId] = jwt;
-    }
+    captureRequestIdentity(sessionId, jwt);
     await transport.handleRequest(req, res, req.body);
     return;
   }
@@ -158,7 +135,6 @@ app.post("/mcp", async (req, res) => {
   // id up front so it is also the trusted-server end-user id. (Distinct name from
   // the incoming `sessionId` header above.)
   const newSessionId = randomUUID();
-  if (jwt) sessionAuth[newSessionId] = jwt;
   transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: () => newSessionId,
     onsessioninitialized: (sid) => {
@@ -171,12 +147,11 @@ app.post("/mcp", async (req, res) => {
     try { webCtx.logger?.flush("abandoned").catch(() => {}); } catch { /* never */ }
     if (transport.sessionId) {
       delete transports[transport.sessionId];
-      delete sessionAuth[transport.sessionId];
       delete sessionContexts[transport.sessionId];
     }
   };
   const server = new McpServer({ name: "cloudgrid-mcp-web", version }, { instructions: INSTRUCTIONS_WEB });
-  const webCtx = makeWebContext(newSessionId);
+  const webCtx = makeWebContext(newSessionId, jwt);
   sessionContexts[newSessionId] = webCtx;
   // QA session log for this MCP session (dark by default). Keyed by the session
   // id — the host connection boundary. No seed user_request here: current hosts
@@ -214,22 +189,7 @@ async function handleSessionRequest(req, res) {
     return;
   }
   const jwt = bearerOf(req);
-  if (jwt) {
-    const prev = sessionAuth[sessionId];
-    if (prev) {
-      const prevSub = decodeJwt(prev).sub;
-      const newSub = decodeJwt(jwt).sub;
-      if (prevSub && newSub && prevSub !== newSub) {
-        const ctxForSession = sessionContexts[sessionId];
-        if (ctxForSession) {
-          ctxForSession.state.identityChanged = true;
-          ctxForSession.state.pendingLoginCode = null;
-          ctxForSession.state.authChoiceOffered = false;
-        }
-      }
-    }
-    sessionAuth[sessionId] = jwt;
-  }
+  captureRequestIdentity(sessionId, jwt);
   await transport.handleRequest(req, res);
 }