@commonlyai/cli 0.1.74 → 0.1.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/declared-mcp-guard.js

@@ -20,10 +20,23 @@
  *           `npm_config_registry` fetches the package from an attacker, and
  *           with a literal `COMMONLY_API_URL=https://attacker…` posts the
  *           token there (sprint-review, Sharpen 69526/69534).
- *   http  — the url, with ONLY the two instance placeholders resolved and
- *           nothing else expanded, must parse to the instance's own origin
- *           (scheme + host + port). The grant broker declares
- *           `${COMMONLY_API_URL}/api/mcp/grants/…`, so it passes.
+ *   http  — the ENTRY, `name` aside, must BE the one http server the instance
+ *           ships: the grant broker (`grantBrokerServer`,
+ *           backend/services/grantBrokerProjectionService.ts). `transport`
+ *           exactly `http`; the url, with ONLY the two instance placeholders
+ *           resolved and nothing else expanded, of our own origin at
+ *           `/api/mcp/grants/<id>`, with no query, hash or userinfo; headers
+ *           exactly the single Bearer token placeholder; and no other field.
+ *           `sse` is not admitted at all: nothing ships it, and its GET is the
+ *           method every 3xx route in this repo answers. Pinning the ORIGIN
+ *           alone was not enough — a same-origin url whose path is a GET route
+ *           that redirects (`/api/auth/oauth/*`, both Slack and Discord
+ *           callbacks) passed the origin check and let the client leave the
+ *           instance on the hop, and an added header would have travelled with
+ *           it (TASK-150). Matched exactly rather than folded: the set this
+ *           guard ADMITS has to equal the set that is TESTED for the absence of
+ *           a redirect, and folding case or collapsing slashes widens what is
+ *           admitted while narrowing what is withheld.
  * The rule is origin-based, not placeholder-based, because the claude CLI
  * expands `${VAR}` and `${VAR:-default}` in url and headers from its own
  * environment: `?t=${COMMONLY_AGENT_TOKEN:-}` is not the literal placeholder
@@ -31,6 +44,9 @@
  * environment is the operator's, so `?k=${GITHUB_TOKEN}` leaks too (Vera,
  * Connectors 69519). So any `${` other than the three known placeholders,
  * anywhere in an entry — url, headers, command, env — is refused outright.
+ *
+ * The guarantee is instance-specific: a self-hosted proxy that redirects
+ * `/api/mcp/grants/…` breaks it in a way no test in this repo can see.
  */
 
 const URL_PLACEHOLDERS = ['${COMMONLY_API_URL}', '${COMMONLY_INSTANCE_URL}'];
@@ -76,6 +92,91 @@ export const isShippedCommonlyMcpEntry = (server) => {
 // True when a string still contains `${` after the known placeholders are
 // removed — a `${VAR}`, `${VAR:-default}` or any other expansion the CLI
 // would resolve from an environment this declaration does not own.
+// A field the guard cannot READ is not a field it can judge. `env` and
+// `headers` are spread by every reader (`{ ...server.env }`), so a STRING there
+// becomes single-character keys and the declaration is silently dropped rather
+// than honoured — the next consumer that parses the string instead would honour
+// it, and this guard would have admitted the entry on the strength of its other
+// fields (TASK-069: judge the whole entry, not selected fields). `args` is read
+// only through `Array.isArray`, and `cwd` through `typeof === 'string'` in
+// `executionShape`, so a value of the wrong type there is dropped the same way —
+// and for `cwd` that drop is load-bearing: the normalised shape then equals an
+// installed entry that declares NO cwd, so the entry is admitted as one the
+// operator already installed (Vera, hold on #1915).
+// Fail closed: an unreadable shape is a refusal, never an absence.
+// The one http entry the server ships: url and headers as `grantBrokerServer`
+// writes them (`GRANT_BROKER_URL` / `GRANT_BROKER_AUTHORIZATION`).
+const GRANT_BROKER_PATH = /^\/api\/mcp\/grants\/[A-Za-z0-9_-]+$/;
+const GRANT_BROKER_AUTHORIZATION = 'Bearer ${COMMONLY_AGENT_TOKEN}';
+
+const sameOriginAsInstance = (url, instanceUrl) => {
+  const origin = originOf(url, instanceUrl);
+  if (!origin) return false;
+  try {
+    return origin === new URL(instanceUrl).origin;
+  } catch {
+    return false;
+  }
+};
+
+// The url is judged by what a client would carry, not by the substring the
+// origin check happens to read: the path has to be the grants path with ONE id
+// segment, and a query, a hash or userinfo is a field the origin comparison
+// does not look at but the request does carry.
+const grantBrokerUrl = (url, instanceUrl) => {
+  if (!sameOriginAsInstance(url, instanceUrl)) return false;
+  let expanded = String(url);
+  for (const placeholder of URL_PLACEHOLDERS) expanded = expanded.split(placeholder).join(instanceUrl);
+  let parsed;
+  try {
+    parsed = new URL(expanded);
+  } catch {
+    return false;
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) return false;
+  return GRANT_BROKER_PATH.test(parsed.pathname);
+};
+
+/**
+ * The shipped grant broker, matched as a WHOLE entry (the http twin of
+ * `isShippedCommonlyMcpEntry`): `name` is identity — the projection suffixes it
+ * when one seat holds several grants — and every other field has to equal what
+ * `grantBrokerServer` writes, with no field added, because a field the client
+ * reads and this guard does not is exactly the shape the whole-entry rule
+ * exists to refuse (TASK-069).
+ */
+export const isShippedGrantBrokerEntry = (server, instanceUrl) => {
+  if (!server || typeof server !== 'object') return false;
+  if (server.transport !== 'http') return false;
+  const keys = Object.keys(server).filter((key) => key !== 'name').sort();
+  if (keys.join(',') !== 'headers,transport,url') return false;
+  const headers = server.headers;
+  if (!headers || typeof headers !== 'object' || Array.isArray(headers)) return false;
+  const headerKeys = Object.keys(headers);
+  if (headerKeys.length !== 1 || headerKeys[0] !== 'Authorization') return false;
+  if (headers.Authorization !== GRANT_BROKER_AUTHORIZATION) return false;
+  return grantBrokerUrl(server.url, instanceUrl);
+};
+
+const unreadableField = (server) => {
+  for (const key of ['env', 'headers']) {
+    const value = server[key];
+    if (value === undefined || value === null) continue;
+    if (typeof value !== 'object' || Array.isArray(value)) {
+      return `${key} is of type ${typeof value}, not an object`;
+    }
+    const badValue = Object.entries(value).find(([, v]) => typeof v !== 'string');
+    if (badValue) return `${key}.${badValue[0]} is not a string`;
+  }
+  if (server.cwd !== undefined && server.cwd !== null && typeof server.cwd !== 'string') {
+    return `cwd is of type ${typeof server.cwd}, not a string`;
+  }
+  if (server.args === undefined || server.args === null) return null;
+  if (!Array.isArray(server.args)) return `args is of type ${typeof server.args}, not an array`;
+  if (server.args.some((a) => typeof a !== 'string')) return 'args carries a non-string';
+  return null;
+};
+
 const hasForeignExpansion = (value) => {
   if (typeof value !== 'string') return false;
   let rest = value;
@@ -127,6 +228,11 @@ export const auditDeclaredMcp = (environment, { instanceUrl, allowedStdioEntries
     }
     const name = typeof server.name === 'string' && server.name ? server.name : `mcp[${index}]`;
     const transport = server.transport || 'stdio';
+    const unreadable = unreadableField(server);
+    if (unreadable) {
+      refusals.push(`'${name}': declares ${unreadable}, so this guard cannot judge what the entry would run; refusing it rather than reading the field as absent`);
+      return;
+    }
     // One shape per entry. The adapters classified by which field was present,
     // so `{transport:'http', url:<instance>, command:['sh','-c',…]}` passed an
     // origin check here and ran as stdio there with the token substituted
@@ -159,9 +265,8 @@ export const auditDeclaredMcp = (environment, { instanceUrl, allowedStdioEntries
       return;
     }
     if (transport === 'http' || transport === 'sse') {
-      const origin = originOf(server.url, instanceUrl);
-      if (origin && instanceOrigin && origin === instanceOrigin) return;
-      refusals.push(`'${name}': ${transport} server ${JSON.stringify(server.url)} resolves to origin ${origin || '(unparseable)'}, not this instance (${instanceOrigin || instanceUrl}); a declared http server may only be the instance itself`);
+      if (transport === 'http' && isShippedGrantBrokerEntry(server, instanceUrl)) return;
+      refusals.push(`'${name}': declared ${transport} entry ${JSON.stringify(server.url)} is not the one http server this instance ships; a declaration is admitted only as the grant broker (transport 'http', url ${instanceOrigin || instanceUrl}/api/mcp/grants/<id> with no query or fragment, headers exactly {'Authorization': 'Bearer \${COMMONLY_AGENT_TOKEN}'}, and no other field), and 'sse' is not admitted at all`);
       return;
     }
     refusals.push(`'${name}': unknown transport ${JSON.stringify(transport)}`);