@codingame/monaco-vscode-mcp-service-override 36.2.7 → 37.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codingame/monaco-vscode-mcp-service-override",
-  "version": "36.2.7",
+  "version": "37.1.0",
   "private": false,
   "description": "VSCode public API plugged on the monaco editor - mcp service-override",
   "keywords": [],
@@ -15,7 +15,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@codingame/monaco-vscode-api": "36.2.7"
+    "@codingame/monaco-vscode-api": "37.1.0"
   },
   "main": "index.js",
   "module": "index.js",

package/vscode/src/vs/base/common/jsonRpcProtocol.d.ts

@@ -35,8 +35,8 @@ export interface IJsonRpcProtocolHandlers {
 }
 export declare class JsonRpcError extends Error {
     readonly code: number;
-    readonly data?: unknown | undefined;
-    constructor(code: number, message: string, data?: unknown | undefined);
+    readonly data?: unknown;
+    constructor(code: number, message: string, data?: unknown);
 }
 /**
  * Generic JSON-RPC 2.0 protocol helper.

package/vscode/src/vs/platform/mcp/common/allowedMcpServers.d.ts

@@ -0,0 +1,52 @@
+/**
+ * A single entry in the `chat.mcp.allowedServers` allowlist. Identifies an MCP server by exactly
+ * one strategy: its configured name, a remote server URL pattern (supporting `*` wildcards), or a
+ * local stdio command invocation (matched as an ordered argument list). Delivered as JSON via user
+ * settings or enterprise managed settings and validated at match time, so only the field matching
+ * the intended strategy is meaningful.
+ */
+export interface IMcpServerMatcher {
+    readonly serverName?: string;
+    readonly serverUrl?: string;
+    readonly serverCommand?: readonly string[];
+}
+/**
+ * Normalized identity of an MCP server used for allowlist matching. Both the install-time and the
+ * runtime enforcement paths reduce their server representation to this shape: `url` is set for
+ * remote (HTTP/SSE) servers and `command` (the full `[command, ...args]` invocation) for local
+ * stdio servers.
+ */
+export interface IMcpServerIdentity {
+    readonly name: string;
+    readonly url?: string;
+    readonly command?: readonly string[];
+}
+/**
+ * The result of evaluating an MCP server against the allow/deny lists.
+ */
+export declare enum McpServerAllowResult {
+    /** Permitted: not denied, and either no allowlist is configured or it matches one. */
+    Allowed = 0,
+    /** Blocked because it matches a deny entry (deny always wins). */
+    Denied = 1,
+    /** Blocked because an allowlist is configured and it matches no entry. */
+    NotAllowed = 2
+}
+/**
+ * Coerces a resolved `chat.mcp.allowedServers` / `chat.mcp.deniedServers` configuration value into a
+ * list of matchers. Returns `undefined` (meaning "not configured") when the value is not an array —
+ * which is also how an unset setting surfaces (the registered `null` default). Malformed matcher
+ * entries (non-objects, or entries that do not carry exactly one valid matching field) are dropped
+ * so a bad payload degrades to "no match" rather than throwing during matching.
+ */
+export declare function getMcpServerMatchers(value: unknown): readonly IMcpServerMatcher[] | undefined;
+/**
+ * Whether the server identity matches at least one of the given matchers. A `undefined` or empty
+ * matcher list matches nothing.
+ */
+export declare function isMcpServerMatched(matchers: readonly IMcpServerMatcher[] | undefined, identity: IMcpServerIdentity): boolean;
+/**
+ * Evaluates an MCP server against the allow and deny lists. Deny always takes precedence; an unset
+ * (`undefined`) allowlist imposes no restriction, while a configured allowlist requires a match.
+ */
+export declare function checkMcpServerAllowed(allowlist: readonly IMcpServerMatcher[] | undefined, denylist: readonly IMcpServerMatcher[] | undefined, identity: IMcpServerIdentity): McpServerAllowResult;

package/vscode/src/vs/platform/mcp/common/allowedMcpServers.js

@@ -0,0 +1,180 @@
+
+import { equals } from '@codingame/monaco-vscode-api/vscode/vs/base/common/arrays';
+import { escapeRegExpCharacters } from '@codingame/monaco-vscode-api/vscode/vs/base/common/strings';
+import { isObject, isString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
+
+var McpServerAllowResult;
+(function(McpServerAllowResult) {
+    McpServerAllowResult[McpServerAllowResult["Allowed"] = 0] = "Allowed";
+    McpServerAllowResult[McpServerAllowResult["Denied"] = 1] = "Denied";
+    McpServerAllowResult[McpServerAllowResult["NotAllowed"] = 2] = "NotAllowed";
+})(McpServerAllowResult || (McpServerAllowResult = {}));
+function getMcpServerMatchers(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    return value.filter(isValidMatcher);
+}
+function isValidMatcher(entry) {
+    if (!isObject(entry)) {
+        return false;
+    }
+    const {
+        serverName,
+        serverUrl,
+        serverCommand
+    } = entry;
+    const hasName = isString(serverName) && serverName.length > 0;
+    const hasUrl = isString(serverUrl) && serverUrl.length > 0;
+    const hasCommand = Array.isArray(serverCommand) && serverCommand.length > 0 && serverCommand.every(isString);
+    return (hasName ? 1 : 0) + (hasUrl ? 1 : 0) + (hasCommand ? 1 : 0) === 1;
+}
+function isMcpServerMatched(matchers, identity) {
+    return !!matchers && ( matchers.some(matcher => matchesMatcher(matcher, identity)));
+}
+function checkMcpServerAllowed(allowlist, denylist, identity) {
+    if (isMcpServerMatched(denylist, identity)) {
+        return McpServerAllowResult.Denied;
+    }
+    if (allowlist !== undefined && !isMcpServerMatched(allowlist, identity)) {
+        return McpServerAllowResult.NotAllowed;
+    }
+    return McpServerAllowResult.Allowed;
+}
+function matchesMatcher(matcher, identity) {
+    if (isString(matcher.serverName)) {
+        return matcher.serverName === identity.name;
+    }
+    if (isString(matcher.serverUrl)) {
+        return identity.url !== undefined && matchesUrlPattern(matcher.serverUrl, identity.url);
+    }
+    if (Array.isArray(matcher.serverCommand)) {
+        return identity.command !== undefined && equals(matcher.serverCommand, identity.command);
+    }
+    return false;
+}
+function matchesUrlPattern(pattern, url) {
+    const destination = toNetworkDestinationUrl(url);
+    if (destination === undefined) {
+        return false;
+    }
+    if (!pattern.includes("*")) {
+        const expected = toNetworkDestinationUrl(pattern);
+        return expected !== undefined && expected.toLowerCase() === destination.toLowerCase();
+    }
+    const normalizedPattern = toNetworkDestinationPattern(pattern);
+    if (normalizedPattern === undefined) {
+        return false;
+    }
+    try {
+        return ( new RegExp(buildUrlPatternRegexSource(normalizedPattern), "i")).test(destination);
+    } catch {
+        return false;
+    }
+}
+function toNetworkDestinationUrl(url) {
+    try {
+        const parsed = ( new URL(url));
+        if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+            return parsed.origin + parsed.pathname + parsed.search;
+        }
+        return url;
+    } catch {
+        return undefined;
+    }
+}
+function toNetworkDestinationPattern(pattern) {
+    const schemeSeparator = pattern.indexOf("://");
+    if (schemeSeparator < 0) {
+        return pattern;
+    }
+    const scheme = pattern.slice(0, schemeSeparator).toLowerCase();
+    if (scheme !== "http" && scheme !== "https") {
+        return pattern;
+    }
+    const rest = pattern.slice(schemeSeparator + 3);
+    const authorityEnd = findAuthorityEnd(rest, 0);
+    let authority = rest.slice(0, authorityEnd);
+    const userinfoEnd = authority.lastIndexOf("@");
+    if (userinfoEnd >= 0) {
+        authority = authority.slice(userinfoEnd + 1);
+    }
+    const hostAndPort = splitHostAndPort(authority);
+    if (hostAndPort === undefined) {
+        return undefined;
+    }
+    const defaultPort = scheme === "https" ? "443" : "80";
+    const port = hostAndPort.port === defaultPort ? undefined : hostAndPort.port;
+    let afterAuthority = rest.slice(authorityEnd).replace(/\\/g, "/");
+    const hash = afterAuthority.indexOf("#");
+    if (hash >= 0) {
+        afterAuthority = afterAuthority.slice(0, hash);
+    }
+    if (!afterAuthority) {
+        afterAuthority = "/";
+    } else if (afterAuthority.startsWith("?")) {
+        afterAuthority = `/${afterAuthority}`;
+    }
+    return `${scheme}://${hostAndPort.host}${port !== undefined ? `:${port}` : ""}${afterAuthority}`;
+}
+function splitHostAndPort(authority) {
+    if (authority.startsWith("[")) {
+        const close = authority.indexOf("]");
+        if (close === -1) {
+            return undefined;
+        }
+        if (authority[close + 1] === ":") {
+            return {
+                host: authority.slice(0, close + 1),
+                port: authority.slice(close + 2)
+            };
+        }
+        if (close + 1 < authority.length) {
+            return undefined;
+        }
+        return {
+            host: authority,
+            port: undefined
+        };
+    }
+    const colon = authority.lastIndexOf(":");
+    if (colon >= 0) {
+        return {
+            host: authority.slice(0, colon),
+            port: authority.slice(colon + 1)
+        };
+    }
+    return authority ? {
+        host: authority,
+        port: undefined
+    } : undefined;
+}
+function buildUrlPatternRegexSource(pattern) {
+    const schemeSeparator = pattern.indexOf("://");
+    const authorityStart = schemeSeparator >= 0 ? schemeSeparator + 3 : 0;
+    const authorityEnd = findAuthorityEnd(pattern, authorityStart);
+    let source = "^";
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (i < authorityEnd && char === ":" && pattern[i + 1] === "*") {
+            source += "(:[^/@\\\\?#]*)?";
+            i++;
+        } else if (char === "*") {
+            source += i < authorityEnd ? "[^/@\\\\?#]*" : ".*";
+        } else {
+            source += escapeRegExpCharacters(char);
+        }
+    }
+    return source + "$";
+}
+function findAuthorityEnd(pattern, authorityStart) {
+    for (let i = authorityStart; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (char === "/" || char === "\\" || char === "?" || char === "#") {
+            return i;
+        }
+    }
+    return pattern.length;
+}
+
+export { McpServerAllowResult, checkMcpServerAllowed, getMcpServerMatchers, isMcpServerMatched };

package/vscode/src/vs/platform/mcp/common/allowedMcpServersService.d.ts

@@ -1,6 +1,7 @@
 import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
 import { IMarkdownString } from "@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent";
 import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
+import { IMcpServerIdentity } from "./allowedMcpServers.js";
 import { IGalleryMcpServer, IInstallableMcpServer, ILocalMcpServer } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement";
 import { IAllowedMcpServersService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service";
 export declare class AllowedMcpServersService extends Disposable implements IAllowedMcpServersService {
@@ -10,4 +11,7 @@ export declare class AllowedMcpServersService extends Disposable implements IAll
     readonly onDidChangeAllowedMcpServers: import("@codingame/monaco-vscode-api/vscode/vs/base/common/event").Event<void>;
     constructor(configurationService: IConfigurationService);
     isAllowed(mcpServer: IGalleryMcpServer | ILocalMcpServer | IInstallableMcpServer): true | IMarkdownString;
+    isServerAllowed(identity: IMcpServerIdentity): true | IMarkdownString;
+    private getAllConfiguredMatchers;
+    private toIdentity;
 }

package/vscode/src/vs/platform/mcp/common/allowedMcpServersService.js

@@ -5,7 +5,11 @@ import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
 import { createCommandUri, MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
 import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
 import { Emitter } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
-import { mcpAccessConfig, McpAccessValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement';
+import { hasKey } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
+import { getMcpServerMatchers, checkMcpServerAllowed, McpServerAllowResult } from './allowedMcpServers.js';
+import { mcpAccessConfig, mcpAllowedServersConfig, mcpDeniedServersConfig, McpAccessValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement';
+import { McpServerType } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpPlatformTypes';
+import { COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG } from '@codingame/monaco-vscode-api/vscode/vs/platform/policy/common/copilotManagedSettings';
 
 let AllowedMcpServersService = class AllowedMcpServersService extends Disposable {
     constructor(configurationService) {
@@ -14,23 +18,75 @@ let AllowedMcpServersService = class AllowedMcpServersService extends Disposable
         this._onDidChangeAllowedMcpServers = this._register(( new Emitter()));
         this.onDidChangeAllowedMcpServers = this._onDidChangeAllowedMcpServers.event;
         this._register(this.configurationService.onDidChangeConfiguration(e => {
-            if (e.affectsConfiguration(mcpAccessConfig)) {
+            if (e.affectsConfiguration(mcpAccessConfig) || e.affectsConfiguration(mcpAllowedServersConfig) || e.affectsConfiguration(mcpDeniedServersConfig) || e.affectsConfiguration(COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG)) {
                 this._onDidChangeAllowedMcpServers.fire();
             }
         }));
     }
     isAllowed(mcpServer) {
-        if (this.configurationService.getValue(mcpAccessConfig) !== McpAccessValue.None) {
-            return true;
+        return this.isServerAllowed(this.toIdentity(mcpServer));
+    }
+    isServerAllowed(identity) {
+        if (this.configurationService.getValue(mcpAccessConfig) === McpAccessValue.None) {
+            const settingsCommandLink = ( createCommandUri("workbench.action.openSettings", {
+                query: `@id:${mcpAccessConfig}`
+            }).toString());
+            return (new MarkdownString(localize(
+                2398,
+                "Model Context Protocol servers are disabled in the Editor. Please check your [settings]({0}).",
+                settingsCommandLink
+            )));
+        }
+        const managedOnly = this.configurationService.getValue(COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG) === true;
+        const allowlist = managedOnly ? getMcpServerMatchers(this.configurationService.inspect(mcpAllowedServersConfig).policyValue) ?? [] : getMcpServerMatchers(this.configurationService.getValue(mcpAllowedServersConfig));
+        const denylist = managedOnly ? this.getAllConfiguredMatchers(mcpDeniedServersConfig) : getMcpServerMatchers(this.configurationService.getValue(mcpDeniedServersConfig));
+        switch (checkMcpServerAllowed(allowlist, denylist, identity)) {
+        case McpServerAllowResult.Denied:
+            return (new MarkdownString(localize(
+                2399,
+                "This Model Context Protocol server is blocked by your organization's policy. Please contact your administrator for more information."
+            )));
+        case McpServerAllowResult.NotAllowed:
+            return (new MarkdownString(localize(
+                2400,
+                "This Model Context Protocol server is not in the list of servers allowed by your organization. Please contact your administrator for more information."
+            )));
+        }
+        return true;
+    }
+    getAllConfiguredMatchers(key) {
+        const inspected = this.configurationService.inspect(key);
+        return [
+            inspected.applicationValue,
+            inspected.userValue,
+            inspected.userLocalValue,
+            inspected.userRemoteValue,
+            inspected.workspaceValue,
+            inspected.workspaceFolderValue,
+            inspected.memoryValue,
+            inspected.policyValue
+        ].flatMap(value => getMcpServerMatchers(value) ?? []);
+    }
+    toIdentity(mcpServer) {
+        if (hasKey(mcpServer, {
+            config: true
+        })) {
+            const config = mcpServer.config;
+            if (config.type === McpServerType.REMOTE) {
+                return {
+                    name: mcpServer.name,
+                    url: config.url
+                };
+            }
+            return {
+                name: mcpServer.name,
+                command: [config.command, ...(config.args ?? [])]
+            };
         }
-        const settingsCommandLink = ( createCommandUri("workbench.action.openSettings", {
-            query: `@id:${mcpAccessConfig}`
-        }).toString());
-        return (new MarkdownString(localize(
-            2180,
-            "Model Context Protocol servers are disabled in the Editor. Please check your [settings]({0}).",
-            settingsCommandLink
-        )));
+        return {
+            name: mcpServer.name,
+            url: mcpServer.configuration.remotes?.[0]?.url
+        };
     }
 };
 AllowedMcpServersService = ( __decorate([( __param(0, IConfigurationService))], AllowedMcpServersService));

package/vscode/src/vs/platform/mcp/common/mcpGalleryService.d.ts

@@ -3,7 +3,7 @@ import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/l
 import { IFileService } from "@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service";
 import { ILogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service";
 import { IRequestService } from "@codingame/monaco-vscode-api/vscode/vs/platform/request/common/request.service";
-import { IGalleryMcpServer, IQueryOptions } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement";
+import { IGalleryMcpServer, IMcpGalleryServerResolveResult, IQueryOptions } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement";
 import { IMcpGalleryService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service";
 import { IMcpGalleryManifest } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest";
 import { IMcpGalleryManifestService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest.service";
@@ -22,6 +22,10 @@ export declare class McpGalleryService extends Disposable implements IMcpGallery
         name: string;
         id?: string;
     }[]): Promise<IGalleryMcpServer[]>;
+    resolveMcpServersFromGallery(infos: {
+        name: string;
+        id?: string;
+    }[]): Promise<Map<string, IMcpGalleryServerResolveResult>>;
     private getMcpServerByName;
     getReadme(gallery: IGalleryMcpServer, token: CancellationToken): Promise<string>;
     private toGalleryMcpServer;