@codingame/monaco-vscode-mcp-service-override 37.6.0 → 38.0.0

package/vscode/src/vs/workbench/api/browser/mainThreadMcp.js

@@ -16,11 +16,12 @@ import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/pl
 import { IDialogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/dialogs/common/dialogs.service';
 import { ExtensionIdentifier } from '@codingame/monaco-vscode-api/vscode/vs/platform/extensions/common/extensions';
 import { LogLevel } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log';
+import { IAllowedMcpServersService } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service';
 import { ITelemetryService } from '@codingame/monaco-vscode-api/vscode/vs/platform/telemetry/common/telemetry.service';
 import { ISecretStorageService } from '@codingame/monaco-vscode-api/vscode/vs/platform/secrets/common/secrets.service';
 import { IWorkbenchMcpGatewayService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpGatewayService.service';
 import { IMcpRegistry } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpRegistryTypes.service';
-import { McpServerLaunch, McpServerTransportType, McpServerDefinition, McpServerTrust, McpCollectionSortOrder, McpCollectionProvenance, extensionPrefixedIdentifier, McpConnectionState, mcpOAuthClientSecretStorageKey, UserInteractionRequiredError } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpTypes';
+import { McpConnectionState, McpServerTransportType, McpServerLaunch, McpServerDefinition, McpServerTrust, McpCollectionSortOrder, McpCollectionProvenance, extensionPrefixedIdentifier, mcpOAuthClientSecretStorageKey, UserInteractionRequiredError } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpTypes';
 import { mcpEnterpriseManagedAuthIdpSection } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpConfiguration';
 import { IAuthenticationMcpAccessService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpAccessService.service';
 import { IAuthenticationMcpService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpService.service';
@@ -49,7 +50,8 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
         _telemetryService,
         _mcpGatewayService,
         _configurationService,
-        _secretStorageService
+        _secretStorageService,
+        _allowedMcpServersService
     ) {
         super();
         this._extHostContext = _extHostContext;
@@ -66,9 +68,11 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
         this._mcpGatewayService = _mcpGatewayService;
         this._configurationService = _configurationService;
         this._secretStorageService = _secretStorageService;
+        this._allowedMcpServersService = _allowedMcpServersService;
         this._serverIdCounter = 0;
         this._servers = ( new Map());
         this._serverDefinitions = ( new Map());
+        this._serverRequestUrls = ( new Map());
         this._serverAuthTracking = ( new McpServerAuthTracker());
         this._collectionDefinitions = this._register(( new DisposableMap()));
         this._gateways = this._register(( new DisposableMap()));
@@ -76,6 +80,28 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             _authenticationService.onDidChangeSessions(e => this._onDidChangeAuthSessions(e.providerId, e.label))
         );
         const proxy = this._proxy = ( _extHostContext.getProxy(ExtHostContext.ExtHostMcp));
+        this._register(this._allowedMcpServersService.onDidChangeAllowedMcpServers(() => {
+            for (const [id, urls] of this._serverRequestUrls) {
+                const definition = this._serverDefinitions.get(id);
+                if (!definition) {
+                    continue;
+                }
+                for (const url of urls) {
+                    const allowed = this._allowedMcpServersService.isServerAllowed({
+                        name: definition.label,
+                        url
+                    });
+                    if (allowed !== true) {
+                        this.$onDidChangeState(id, {
+                            state: McpConnectionState.Kind.Error,
+                            message: allowed.value
+                        });
+                        proxy.$stopMcp(id);
+                        break;
+                    }
+                }
+            }
+        }));
         this._register(this._mcpRegistry.registerDelegate({
             priority: _extHostContext.extensionHostKind === ExtensionHostKind.LocalWebWorker ? 0 : 1,
             waitForInitialProviderPromises() {
@@ -97,6 +123,16 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
                 );
                 return McpServerLaunch.fromSerialized(ser);
             },
+            async expandEnvironmentVariables(serverDefinition, launch) {
+                if (!serverDefinition.environmentVariableExpansion) {
+                    return launch;
+                }
+                const ser = await proxy.$expandEnvironmentVariables(
+                    McpServerLaunch.toSerialized(launch),
+                    serverDefinition.environmentVariableExpansion
+                );
+                return McpServerLaunch.fromSerialized(ser);
+            },
             start: (_collection, serverDefiniton, resolveLaunch, options) => {
                 const id = ++this._serverIdCounter;
                 const launch = ( new ExtHostMcpServerLaunch(
@@ -106,6 +142,9 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
                 ));
                 this._servers.set(id, launch);
                 this._serverDefinitions.set(id, serverDefiniton);
+                if (resolveLaunch.type === McpServerTransportType.HTTP) {
+                    this._serverRequestUrls.set(id, ( new Set([( resolveLaunch.uri.toString(true))])));
+                }
                 proxy.$startMcp(id, {
                     launch: resolveLaunch,
                     defaultCwd: serverDefiniton.defaultCwd ?? serverDefiniton.variableReplacement?.folder?.uri,
@@ -189,6 +228,22 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
     $deleteMcpCollection(collectionId) {
         this._collectionDefinitions.deleteAndDispose(collectionId);
     }
+    async $checkMcpServerAllowed(id, url) {
+        const definition = this._serverDefinitions.get(id);
+        const urls = this._serverRequestUrls.get(id);
+        if (!definition || !urls) {
+            throw ( new CancellationError());
+        }
+        const allowed = this._allowedMcpServersService.isServerAllowed({
+            name: definition.label,
+            url
+        });
+        if (allowed !== true) {
+            return allowed.value;
+        }
+        urls.add(url);
+        return undefined;
+    }
     $onDidChangeState(id, update) {
         const server = this._servers.get(id);
         if (!server) {
@@ -199,6 +254,7 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             server.dispose();
             this._servers.delete(id);
             this._serverDefinitions.delete(id);
+            this._serverRequestUrls.delete(id);
             this._serverAuthTracking.untrack(id);
         }
     }
@@ -217,15 +273,9 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
         if (!server) {
             return undefined;
         }
-        return this._getSessionForProvider(
-            id,
-            server,
-            providerId,
-            scopes,
-            undefined,
-            options.errorOnUserInteraction,
-            options.clientId
-        );
+        return this._getSessionForProvider(id, server, providerId, scopes, {
+            clientId: options.clientId
+        }, options.errorOnUserInteraction);
     }
     async $getTokenFromServerMetadata(
         id,
@@ -247,7 +297,7 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             const resource = authDetails.resourceMetadata?.resource;
             if (!resource) {
                 throw ( new Error(( localize(
-                    5107,
+                    6427,
                     "The enterprise-managed MCP server '{0}' did not advertise a protected-resource metadata document with a 'resource' identifier.",
                     server.label
                 ))));
@@ -256,7 +306,7 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             const audience = resourceAuthServers[0];
             if (!audience) {
                 throw ( new Error(( localize(
-                    5108,
+                    6428,
                     "The enterprise-managed MCP server '{0}' did not advertise an `authorization_servers` entry in its protected-resource metadata.",
                     server.label
                 ))));
@@ -268,33 +318,32 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
                 return undefined;
             }
             const resourceClientId = clientId ?? authDetails.clientId;
+            let clientSecretStorageKey;
             let resourceClientSecret;
             if (resourceClientId) {
+                clientSecretStorageKey = mcpOAuthClientSecretStorageKey(resource, resourceClientId);
                 try {
-                    resourceClientSecret = await this._secretStorageService.get(mcpOAuthClientSecretStorageKey(resource, resourceClientId));
+                    resourceClientSecret = await this._secretStorageService.get(clientSecretStorageKey);
                 } catch {}
             }
-            return this._getSessionForProvider(
-                id,
-                server,
-                xaaProviderId,
-                xaaScopes,
-                issuer,
-                errorOnUserInteraction,
-                resourceClientId,
+            return this._getSessionForProvider(id, server, xaaProviderId, xaaScopes, {
+                authorizationServer: issuer,
+                clientId: resourceClientId,
                 resource,
                 audience,
-                resourceClientSecret
-            );
+                clientSecretStorageKey
+            }, errorOnUserInteraction, resourceClientSecret);
         }
         let providerId = await this._authenticationService.getOrActivateProviderIdForServer(authorizationServer, resourceServer);
         const resolvedClientId = clientId ?? authDetails.clientId;
         const mcpServerUrl = server.launch.type === McpServerTransportType.HTTP ? ( server.launch.uri.toString(true)) : undefined;
+        let clientSecretStorageKey;
         let clientSecret;
         let didLookupClientSecret = false;
         if (resolvedClientId && mcpServerUrl) {
+            clientSecretStorageKey = mcpOAuthClientSecretStorageKey(mcpServerUrl, resolvedClientId);
             try {
-                clientSecret = await this._secretStorageService.get(mcpOAuthClientSecretStorageKey(mcpServerUrl, resolvedClientId));
+                clientSecret = await this._secretStorageService.get(clientSecretStorageKey);
                 didLookupClientSecret = true;
             } catch {}
         }
@@ -325,25 +374,19 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             }
             providerId = provider.id;
         }
-        return this._getSessionForProvider(
-            id,
-            server,
-            providerId,
-            resolvedScopes,
+        return this._getSessionForProvider(id, server, providerId, resolvedScopes, {
             authorizationServer,
-            errorOnUserInteraction,
-            resolvedClientId,
-            authDetails.resourceMetadata?.resource,
-             undefined,
-            clientSecret
-        );
+            clientId: resolvedClientId,
+            resource: authDetails.resourceMetadata?.resource,
+            clientSecretStorageKey
+        }, errorOnUserInteraction, clientSecret);
     }
     _ensureXaaIssuer() {
         const config = this._configurationService.getValue(mcpEnterpriseManagedAuthIdpSection) ?? {};
         const configuredIssuer = config.issuer?.trim();
         if (!configuredIssuer) {
             throw ( new Error(( localize(
-                5109,
+                6429,
                 "Enterprise-managed MCP authentication requires `mcp.enterpriseManagedAuth.idp.issuer` to be configured. Set it via enterprise policy (Windows Group Policy / macOS managed preferences / Linux `/etc/vscode/policy.json`) or, for local testing, by hand-editing `settings.json`."
             ))));
         }
@@ -352,14 +395,14 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             parsed = ( URI.parse(configuredIssuer));
         } catch {
             throw ( new Error(( localize(
-                5110,
+                6430,
                 "Enterprise-managed MCP authentication requires `mcp.enterpriseManagedAuth.idp.issuer` to be a valid URL; got '{0}'.",
                 configuredIssuer
             ))));
         }
         if (parsed.scheme !== "https" && parsed.scheme !== "http") {
             throw ( new Error(( localize(
-                5111,
+                6431,
                 "Enterprise-managed MCP authentication requires `mcp.enterpriseManagedAuth.idp.issuer` to use the `https` or `http` scheme; got '{0}'.",
                 configuredIssuer
             ))));
@@ -371,25 +414,26 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
         server,
         providerId,
         scopes,
-        authorizationServer,
+        authContext,
         errorOnUserInteraction = false,
-        clientId,
-        resource,
-        audience,
         clientSecret
     ) {
-        const authContext = {
+        const {
             authorizationServer,
             clientId,
             resource,
             audience
-        };
-        const sessions = await this._authenticationService.getSessions(providerId, scopes, {
+        } = authContext;
+        const providerOptions = {
             authorizationServer,
             clientId,
             clientSecret,
             resource,
             audience
+        };
+        const sessions = await this._authenticationService.getSessions(providerId, scopes, {
+            ...providerOptions,
+            silent: errorOnUserInteraction
         }, true);
         if (server.launch.type !== McpServerTransportType.HTTP) {
             return undefined;
@@ -436,7 +480,7 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             if (provider.supportsMultipleAccounts && errorOnUserInteraction) {
                 throw ( new UserInteractionRequiredError("authentication"));
             }
-            session = provider.supportsMultipleAccounts ? await this.authenticationMcpServersService.selectSession(providerId, server.id, server.label, scopes, sessions) : sessions[0];
+            session = provider.supportsMultipleAccounts ? await this.authenticationMcpServersService.selectSession(providerId, server.id, server.label, scopes, sessions, providerOptions) : sessions[0];
         } else {
             if (errorOnUserInteraction) {
                 throw ( new UserInteractionRequiredError("authentication"));
@@ -444,13 +488,9 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             const accountToCreate = matchingAccountPreferenceSession?.account;
             do {
                 session = await this._authenticationService.createSession(providerId, scopes, {
+                    ...providerOptions,
                     activateImmediate: true,
-                    account: accountToCreate,
-                    authorizationServer,
-                    clientId,
-                    clientSecret,
-                    resource,
-                    audience
+                    account: accountToCreate
                 });
             } while (accountToCreate && accountToCreate.label !== session.account.label && !(await this.continueWithIncorrectAccountPrompt(session.account.label, accountToCreate.label)));
         }
@@ -467,9 +507,9 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
     }
     async continueWithIncorrectAccountPrompt(chosenAccountLabel, requestedAccountLabel) {
         const result = await this.dialogService.prompt({
-            message: ( localize(5112, "Incorrect account detected")),
+            message: ( localize(6432, "Incorrect account detected")),
             detail: ( localize(
-                5113,
+                6433,
                 "The chosen account, {0}, does not match the requested account, {1}.",
                 chosenAccountLabel,
                 requestedAccountLabel
@@ -477,10 +517,10 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
             type: Severity.Warning,
             cancelButton: true,
             buttons: [{
-                label: ( localize(5114, "Keep {0}", chosenAccountLabel)),
+                label: ( localize(6434, "Keep {0}", chosenAccountLabel)),
                 run: () => chosenAccountLabel
             }, {
-                label: ( localize(5115, "Login with {0}", requestedAccountLabel)),
+                label: ( localize(6435, "Login with {0}", requestedAccountLabel)),
                 run: () => requestedAccountLabel
             }]
         });
@@ -509,25 +549,26 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
                 continue;
             }
             try {
+                const clientSecret = context.clientSecretStorageKey ? await this._secretStorageService.get(context.clientSecretStorageKey) : undefined;
                 await this._getSessionForProvider(
                     serverId,
                     serverDefinition,
                     providerId,
                     scopes,
-                    context.authorizationServer,
+                    context,
                     true,
-                    context.clientId,
-                    context.resource,
-                    context.audience
+                    clientSecret
                 );
             } catch (e) {
                 if (UserInteractionRequiredError.is(e)) {
                     server.pushLog(LogLevel.Warning, ( localize(
-                        5116,
+                        6436,
                         "Authentication session for {0} removed, stopping server",
                         providerLabel
                     )));
                     server.stop();
+                } else {
+                    server.pushLog(LogLevel.Warning, ( localize(6437, "Unable to revalidate authentication for {0}.", providerLabel)));
                 }
             }
         }
@@ -570,18 +611,18 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
     }
     async loginPrompt(mcpLabel, providerLabel, recreatingSession) {
         const message = recreatingSession ? ( localize(
-            5117,
+            6438,
             "The MCP Server Definition '{0}' wants you to authenticate to {1}.",
             mcpLabel,
             providerLabel
         )) : ( localize(
-            5118,
+            6439,
             "The MCP Server Definition '{0}' wants to authenticate to {1}.",
             mcpLabel,
             providerLabel
         ));
         const buttons = [{
-            label: ( localize(5119, "&&Allow")),
+            label: ( localize(6440, "&&Allow")),
             run() {
                 return true;
             }
@@ -602,11 +643,12 @@ let MainThreadMcp = class MainThreadMcp extends Disposable {
         }
         this._servers.clear();
         this._serverDefinitions.clear();
+        this._serverRequestUrls.clear();
         this._serverAuthTracking.clear();
         super.dispose();
     }
 };
-MainThreadMcp = __decorate([extHostNamedCustomer(MainContext.MainThreadMcp), ( __param(1, IMcpRegistry)), ( __param(2, IDialogService)), ( __param(3, IAuthenticationService)), ( __param(4, IAuthenticationMcpService)), ( __param(5, IAuthenticationMcpAccessService)), ( __param(6, IAuthenticationMcpUsageService)), ( __param(7, IDynamicAuthenticationProviderStorageService)), ( __param(8, IExtensionService)), ( __param(9, IContextKeyService)), ( __param(10, ITelemetryService)), ( __param(11, IWorkbenchMcpGatewayService)), ( __param(12, IConfigurationService)), ( __param(13, ISecretStorageService))], MainThreadMcp);
+MainThreadMcp = __decorate([extHostNamedCustomer(MainContext.MainThreadMcp), ( __param(1, IMcpRegistry)), ( __param(2, IDialogService)), ( __param(3, IAuthenticationService)), ( __param(4, IAuthenticationMcpService)), ( __param(5, IAuthenticationMcpAccessService)), ( __param(6, IAuthenticationMcpUsageService)), ( __param(7, IDynamicAuthenticationProviderStorageService)), ( __param(8, IExtensionService)), ( __param(9, IContextKeyService)), ( __param(10, ITelemetryService)), ( __param(11, IWorkbenchMcpGatewayService)), ( __param(12, IConfigurationService)), ( __param(13, ISecretStorageService)), ( __param(14, IAllowedMcpServersService))], MainThreadMcp);
 class ExtHostMcpServerLaunch extends Disposable {
     pushLog(level, message) {
         this._onDidLog.fire({

package/vscode/src/vs/workbench/contrib/mcp/browser/mcp.contribution.js

@@ -22,9 +22,10 @@ import { CursorWorkspaceMcpDiscoveryAdapter } from '../common/discovery/workspac
 import { WorkspaceDotMcpDiscovery } from '../common/discovery/workspaceDotMcpDiscovery.js';
 import { McpCommandIds } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpCommandIds';
 import { mcpServerSchema } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpConfiguration';
+import '../common/mcpCopilotGlobalConfigurationService.js';
+import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
 import { McpContextKeysController } from '../common/mcpContextKeys.js';
 import '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpDevMode';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
 import { McpLanguageModelToolContribution } from '../common/mcpLanguageModelToolContribution.js';
 import '../common/mcpRegistry.js';
 import '../common/mcpSandboxService.js';
@@ -40,10 +41,13 @@ import './mcpElicitationService.js';
 import { McpLanguageFeatures } from './mcpLanguageFeatures.js';
 import { McpConfigMigrationContribution } from './mcpMigration.js';
 import { McpResourceQuickAccess } from './mcpResourceQuickAccess.js';
+import { AccessibleViewRegistry } from '@codingame/monaco-vscode-api/vscode/vs/platform/accessibility/browser/accessibleViewRegistry';
+import { McpServerConfigurationFormAccessibilityHelp } from './mcpServerConfigurationFormAccessibility.js';
 import { McpServerEditor } from './mcpServerEditor.js';
 import { McpServerEditorInput } from './mcpServerEditorInput.js';
 import { MCPContextsInitialisation } from './mcpWorkbenchService.js';
 
+AccessibleViewRegistry.register(( new McpServerConfigurationFormAccessibilityHelp()));
 mcpDiscoveryRegistry.register(( new SyncDescriptor(RemoteNativeMpcDiscovery)));
 mcpDiscoveryRegistry.register(( new SyncDescriptor(InstalledMcpServersDiscovery)));
 mcpDiscoveryRegistry.register(( new SyncDescriptor(ExtensionMcpDiscovery)));
@@ -113,16 +117,16 @@ registerWorkbenchContribution2(
 const jsonRegistry = ( Registry.as(Extensions.JSONContribution));
 jsonRegistry.registerSchema(mcpSchemaId, mcpServerSchema);
 ( Registry.as(EditorExtensions.EditorPane)).registerEditorPane(
-    EditorPaneDescriptor.create(McpServerEditor, McpServerEditor.ID, ( localize(15982, "MCP Server"))),
+    EditorPaneDescriptor.create(McpServerEditor, McpServerEditor.ID, ( localize(18395, "MCP Server"))),
     [( new SyncDescriptor(McpServerEditorInput))]
 );
 ( Registry.as(Extensions$1.Quickaccess)).registerQuickAccessProvider({
     ctor: McpResourceQuickAccess,
     prefix: McpResourceQuickAccess.PREFIX,
     when: ChatContextKeys.enabled,
-    placeholder: ( localize(15983, "Filter to an MCP resource")),
+    placeholder: ( localize(18396, "Filter to an MCP resource")),
     helpEntries: [{
-        description: ( localize(15984, "MCP Server Resources")),
+        description: ( localize(18397, "MCP Server Resources")),
         commandId: McpCommandIds.AddConfiguration
     }]
 });

package/vscode/src/vs/workbench/contrib/mcp/browser/mcpAddContextContribution.js

@@ -43,7 +43,7 @@ let McpAddContextContribution = class McpAddContextContribution extends Disposab
     _registerAddContextMenu() {
         this._addContextMenu.value = this._chatContextPickService.registerChatContextItem({
             type: "pickerPick",
-            label: ( localize(15985, "MCP Resources...")),
+            label: ( localize(18398, "MCP Resources...")),
             icon: Codicon.mcp,
             isEnabled(widget) {
                 return !!widget.attachmentCapabilities.supportsMCPAttachments;
@@ -51,7 +51,7 @@ let McpAddContextContribution = class McpAddContextContribution extends Disposab
             asPicker: () => {
                 const helper = this._instantiationService.createInstance(McpResourcePickHelper);
                 return {
-                    placeholder: ( localize(15986, "Select MCP Resource...")),
+                    placeholder: ( localize(18399, "Select MCP Resource...")),
                     picks: (_query, token) => this._getResourcePicks(token, helper),
                     goBack: () => {
                         return helper.navigateBack();

package/vscode/src/vs/workbench/contrib/mcp/browser/mcpCommands.d.ts

@@ -48,7 +48,7 @@ export declare class ResetMcpCachedTools extends Action2 {
 }
 export declare class AddConfigurationAction extends Action2 {
     constructor();
-    run(accessor: ServicesAccessor, configUri?: string): Promise<void>;
+    run(accessor: ServicesAccessor, configUri?: URI | string): Promise<void>;
 }
 export declare class InstallFromManifestAction extends Action2 {
     constructor();