@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/mcp/auth/agent-sign-ins.js

@@ -0,0 +1,174 @@
+/**
+ * The sign-ins the user's agents already hold for an MCP server.
+ *
+ * Putting the proxy in front of a server used to cost a second OAuth sign-in
+ * in the browser, for every server Claude Code or Codex was already signed in
+ * to. `vibedefend connect` now takes over the agent's sign-in first: once the
+ * entry is wrapped, the agent reaches that server through the proxy and no
+ * longer uses its own copy.
+ *
+ * What is read, and only for the EXACT server asked for (canonical URL, as
+ * the proxy's own store is keyed):
+ *
+ *  - Claude Code: the `mcpOAuth` map of the `Claude Code-credentials` macOS
+ *    keychain item, and of `~/.claude/.credentials.json` (where Claude Code
+ *    keeps it off macOS; `CLAUDE_CONFIG_DIR` moves it). Claude Code writes
+ *    that item with the `security` tool, so reading it asks nothing.
+ *  - Codex: its file store, `$CODEX_HOME/.credentials.json` (default
+ *    `~/.codex`). Never its keychain items: Codex writes them through the
+ *    native keychain API, so `security` cannot read them without macOS asking
+ *    the user, once per server (measured 2026-10-20: errSecUserCanceled).
+ *
+ * Cursor and Windsurf keep theirs in their own databases: not read.
+ *
+ * `VIBEDEFEND_AGENT_SIGN_INS=off` reads none of it (the test suite sets it:
+ * no test may read the developer's credentials). `vibedefend connect
+ * --no-reuse` does the same for one run.
+ *
+ * Never throws, never logs: an unreadable store is an empty one, and what is
+ * read is a credential.
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { canonicalMcpUrl } from './oauth.js';
+/** How each agent is named to the user. */
+export const AGENT_SIGN_IN_LABELS = {
+    'claude-code': 'Claude Code',
+    codex: 'Codex',
+};
+const CLAUDE_CODE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
+/** Every sign-in the agents hold for `serverUrl`, Claude Code first. */
+export function findAgentSignIns(serverUrl, deps = {}) {
+    const wanted = canonicalMcpUrl(serverUrl);
+    if (!wanted)
+        return [];
+    const env = deps.env ?? process.env;
+    if (env.VIBEDEFEND_AGENT_SIGN_INS === 'off')
+        return [];
+    const home = env.HOME ?? env.USERPROFILE ?? homedir();
+    const found = [];
+    const add = (signIn) => {
+        if (!signIn)
+            return;
+        const duplicate = found.some((known) => known.clientId === signIn.clientId &&
+            known.accessToken === signIn.accessToken &&
+            known.refreshToken === signIn.refreshToken);
+        if (!duplicate)
+            found.push(signIn);
+    };
+    if ((deps.platform ?? process.platform) === 'darwin') {
+        const read = deps.readKeychain ?? readMacOSKeychain;
+        const blob = quietly(() => read(CLAUDE_CODE_KEYCHAIN_SERVICE, deps.username ?? loginName()));
+        for (const signIn of claudeCodeSignIns(blob, wanted))
+            add(signIn);
+    }
+    const claudeDir = env.CLAUDE_CONFIG_DIR ?? join(home, '.claude');
+    for (const signIn of claudeCodeSignIns(readQuietly(join(claudeDir, '.credentials.json')), wanted))
+        add(signIn);
+    const codexDir = env.CODEX_HOME ?? join(home, '.codex');
+    for (const signIn of codexSignIns(readQuietly(join(codexDir, '.credentials.json')), wanted))
+        add(signIn);
+    return found;
+}
+function claudeCodeSignIns(blob, wanted) {
+    const data = parseObject(blob);
+    const entries = data && isObject(data.mcpOAuth) ? Object.values(data.mcpOAuth) : [];
+    return entries.flatMap((entry) => {
+        if (!isObject(entry) || !sameServer(entry.serverUrl, wanted))
+            return [];
+        const signIn = signInFrom('claude-code', {
+            accessToken: entry.accessToken,
+            refreshToken: entry.refreshToken,
+            expiresAt: entry.expiresAt,
+            clientId: entry.clientId,
+            clientSecret: entry.clientSecret,
+            issuer: entry.issuer,
+        });
+        return signIn ? [signIn] : [];
+    });
+}
+function codexSignIns(blob, wanted) {
+    const data = parseObject(blob);
+    return Object.values(data ?? {}).flatMap((entry) => {
+        if (!isObject(entry) || !sameServer(entry.server_url ?? entry.url, wanted))
+            return [];
+        const response = isObject(entry.token_response) ? entry.token_response : {};
+        const signIn = signInFrom('codex', {
+            accessToken: entry.access_token ?? response.access_token,
+            refreshToken: entry.refresh_token ?? response.refresh_token,
+            expiresAt: entry.expires_at,
+            clientId: entry.client_id,
+            clientSecret: entry.client_secret,
+            issuer: null,
+        });
+        return signIn ? [signIn] : [];
+    });
+}
+function signInFrom(source, raw) {
+    const clientId = text(raw.clientId);
+    const accessToken = text(raw.accessToken);
+    const refreshToken = text(raw.refreshToken);
+    if (!clientId || (!accessToken && !refreshToken))
+        return null;
+    return {
+        source,
+        accessToken,
+        refreshToken,
+        expiresAt: epochMs(raw.expiresAt),
+        clientId,
+        clientSecret: text(raw.clientSecret),
+        issuer: text(raw.issuer),
+    };
+}
+function sameServer(url, wanted) {
+    return typeof url === 'string' && canonicalMcpUrl(url) === wanted;
+}
+/** Claude Code and Codex record milliseconds; a value below 1e11 can only be seconds. */
+function epochMs(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
+        return null;
+    return value < 1e11 ? value * 1000 : value;
+}
+function text(value) {
+    return typeof value === 'string' && value !== '' ? value : null;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseObject(blob) {
+    if (!blob)
+        return null;
+    try {
+        const parsed = JSON.parse(blob);
+        return isObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function quietly(read) {
+    try {
+        return read();
+    }
+    catch {
+        return null;
+    }
+}
+function readQuietly(path) {
+    return quietly(() => readFileSync(path, 'utf8'));
+}
+function loginName() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readMacOSKeychain(service, account) {
+    const blob = execFileSync('security', ['find-generic-password', '-s', service, ...(account === undefined ? [] : ['-a', account]), '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 }).trim();
+    return blob === '' ? null : blob;
+}
+//# sourceMappingURL=agent-sign-ins.js.map

package/dist/mcp/auth/agent-sign-ins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sign-ins.js","sourceRoot":"","sources":["../../../src/mcp/auth/agent-sign-ins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAsC;IACrE,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;CACf,CAAC;AA4BF,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAwB,EAAE;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,GAAG,CAAC,yBAAyB,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IAEtD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAQ,EAAE;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC7C,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7F,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/G,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE;YACvC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,MAAc;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE;YACjC,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;YACxD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;YAC3D,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,MAAyB,EACzB,GAA2G;IAE3G,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO;QACL,MAAM;QACN,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,MAAc;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC;AACpE,CAAC;AAED,yFAAyF;AACzF,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,IAAmB;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAyB;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IAC1D,MAAM,IAAI,GAAG,YAAY,CACvB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EACjG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACzE,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC"}

package/dist/mcp/auth/callback.js

@@ -0,0 +1,200 @@
+/**
+ * The loopback callback server of the MCP authorization flow (RFC 8252).
+ *
+ * ─── Why `state` and `iss` are checked HERE ─────────────────────────────────
+ *
+ * `discovery.ts` binds the authorization server's metadata to the MCP server
+ * being asked. That check closes an INSTANCE of the mix-up, not the class:
+ * the attacker only has to host a 302 on THEIR OWN `authorization_endpoint`
+ * — an endpoint that opens in the BROWSER, never fetched by us, so
+ * structurally invisible to anything we could check on the metadata. The
+ * browser then lands on the REAL consent page of a genuine third party, with
+ * THEIR `client_id` and OUR `code_challenge`; that third party redirects to
+ * our loopback with a code that is VALID AT THEIR END. Without a further
+ * defence the exchange would send that code — and our `code_verifier` — to
+ * the attacker's SELF-DECLARED `token_endpoint`.
+ *
+ * Two standard defences answer that:
+ *
+ *   • `state` — random, single-use, bound to THIS attempt. A response
+ *     carrying an unknown or ALREADY CONSUMED state is rejected. It closes
+ *     the class UNCONDITIONALLY as an anti-CSRF measure, and depends on no
+ *     capability of the third party.
+ *   • `iss` (RFC 9207) — the issuer announced BY THE AUTHORIZATION RESPONSE
+ *     ITSELF, so by the REAL third party that handled it and never by a
+ *     document the attacker controls, must be exactly the one discovery kept
+ *     for this MCP server.
+ *
+ * `iss` only closes the class if the real third party actually sends `iss`,
+ * which nothing guarantees: most authorization servers deployed today do not
+ * implement RFC 9207. And `issParameterSupported` is itself read from the
+ * metadata of the authorization server the HOSTILE server designated — the
+ * attacker only has to OMIT the field for the guarantee never to arm, then
+ * aim at a genuine non-RFC-9207 third party. `state` does not cover that
+ * case either: the attacker's `authorization_endpoint` SEES our `state`
+ * before redirecting and can simply pass it along.
+ *
+ * There is therefore **no purely technical client-side check that closes this
+ * class when the AS does not emit `iss`** — which is precisely why RFC 9207
+ * exists. The decision is one of POLICY, taken in `connect.ts`: by default
+ * the flow warns and goes on when `issParameterSupported !== true` (RFC 9207
+ * is absent from nearly every public server measured, and the issuer is
+ * still the one discovery bound to the resource); `strictIssuer` — the
+ * `--strict-issuer` flag, or the organisation's policy (`strictIssuer`,
+ * served by the backend) — turns that into a refusal before any browser
+ * opens.
+ *
+ * Both checks live in this file, BEFORE the redirect promise resolves:
+ * `code` and `code_verifier` structurally CANNOT reach the exchange until
+ * they have passed. It is not a question of call order in the caller — the
+ * code does not exist anywhere else before that.
+ *
+ * Moved from `682d413:src/mcp/login.ts:194-396` and translated.
+ */
+import { createServer } from 'node:http';
+/**
+ * Raised by the loopback callback server. Never a free-form string: a closed
+ * `kind`, so the caller can tell `issuer-mismatch` — the heart of the RFC
+ * 9207 defence — from the rest without parsing a message.
+ */
+export class AuthorizationRedirectError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = 'AuthorizationRedirectError';
+    }
+}
+const CALLBACK_PATH = '/mcp-oauth-callback';
+/**
+ * Strips one or more trailing slashes. RFC 9207 and RFC 8414 both tolerate an
+ * issuer with or without a trailing `/` (the same normalisation `issuerId`
+ * applies in `discovery.ts`), and conforming third parties — Auth0 among
+ * others — commonly emit one. The CASE is left alone: RFC 9207 §2.4 mandates
+ * simple string comparison.
+ */
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+const SUCCESS_PAGE = '<!DOCTYPE html><html><head><meta charset="utf-8"><title>VibeDefend</title></head>' +
+    '<body style="font-family: system-ui, sans-serif; padding: 3rem; text-align: center">' +
+    '<h1>Authentication successful</h1>' +
+    '<p>VibeDefend has the token for this MCP server. You can close this tab.</p>' +
+    '</body></html>';
+/**
+ * The real implementation: a loopback HTTP server (127.0.0.1 only, never
+ * 0.0.0.0) on a port the OS assigns. RFC 8252 recommends a random port for a
+ * native client, and `registerMcpClient` registers THIS exact `redirect_uri`
+ * dynamically, so no fixed port is needed — unlike `vibedefend login`, which
+ * targets a client pre-registered with Logto.
+ *
+ * Single use: once the response has been consumed, any further request — even
+ * with the right `state` — is refused rather than replayed.
+ */
+export async function startMcpAuthorizationCallbackServer(expectedState, expectedIssuer, issParameterRequired, options = {}) {
+    let settled = false;
+    let resolveRedirect;
+    let rejectRedirect;
+    const redirectPromise = new Promise((res, rej) => {
+        resolveRedirect = res;
+        rejectRedirect = rej;
+    });
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404).end();
+            return;
+        }
+        if (settled) {
+            res
+                .writeHead(400, { 'Content-Type': 'text/plain' })
+                .end('This authorization response was already used.');
+            return;
+        }
+        // 1) `state` — anti-CSRF, single use. Checked BEFORE `error`: RFC 6749
+        // §4.1.2.1 requires `state` on an error response too, and a hostile MCP
+        // server could otherwise pass an anonymous `?error=access_denied` off as
+        // an EXPLICIT refusal by the user.
+        //
+        // What this ordering is NOT: protection against a third party denying a
+        // login in progress. Any page open in the browser that knows the port —
+        // and the port is in `redirect_uri` — burns the attempt identically with
+        // or without it; only the LABEL changes, and the real callback that
+        // follows gets a 400 "already used" either way. Continuing to listen
+        // after a suspicious request would widen the window rather than close it:
+        // an unknown `state` on this ephemeral port is already either a mistake
+        // or a probe, never something to give a second chance. What the ordering
+        // does buy is a CORRECT diagnosis (`state-mismatch`, not `denied`) when
+        // the request that burned the attempt never knew the state.
+        const state = url.searchParams.get('state');
+        if (!state || state !== expectedState) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Invalid or already-consumed state.');
+            rejectRedirect(new AuthorizationRedirectError('state-mismatch', 'authorization response carried an unknown or already-consumed state'));
+            return;
+        }
+        const error = url.searchParams.get('error');
+        if (error) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Authorization was not granted.');
+            rejectRedirect(new AuthorizationRedirectError('denied', 'the user denied authorization, or the authorization server refused'));
+            return;
+        }
+        // 2) `iss` (RFC 9207) — see the module header. An `iss` that is PRESENT
+        // and does not match is ALWAYS a rejection; an `iss` that is ABSENT is
+        // one only when the AS announced it would always send one. Compared on
+        // the NORMALISED form: a CONFORMING RFC 9207 issuer ending in `/` (the
+        // Auth0 pattern, `https://tenant.eu.auth0.com/`) was refused by an exact
+        // comparison, reproducing on this axis the flaw that condemned the origin
+        // check — refusing conforming deployments. The CASE stays compared as is:
+        // RFC 9207 §2.4 mandates simple string comparison, and `issuerId` in
+        // `discovery.ts` does not normalise it either.
+        const iss = url.searchParams.get('iss');
+        if (iss !== null) {
+            if (stripTrailingSlash(iss) !== stripTrailingSlash(expectedIssuer)) {
+                settled = true;
+                res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Issuer mismatch.');
+                rejectRedirect(new AuthorizationRedirectError('issuer-mismatch', 'authorization response `iss` does not match the issuer discovered for this MCP server'));
+                return;
+            }
+        }
+        else if (issParameterRequired) {
+            settled = true;
+            res
+                .writeHead(400, { 'Content-Type': 'text/plain' })
+                .end('Missing required issuer parameter.');
+            rejectRedirect(new AuthorizationRedirectError('issuer-mismatch', 'authorization server declares RFC 9207 support but the response is missing `iss`'));
+            return;
+        }
+        const code = url.searchParams.get('code');
+        if (!code) {
+            settled = true;
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Missing authorization code.');
+            rejectRedirect(new AuthorizationRedirectError('missing-code', 'authorization response is missing the authorization code'));
+            return;
+        }
+        settled = true;
+        res.writeHead(200, { 'Content-Type': 'text/html' }).end(SUCCESS_PAGE);
+        resolveRedirect({ code, iss });
+    });
+    const port = options.port ?? 0;
+    await new Promise((resolve, reject) => {
+        server.once('error', (error) => {
+            reject(port === 0
+                ? error
+                : new Error(`cannot listen on 127.0.0.1:${port} for the authorization callback: ${error.message}`));
+        });
+        server.listen(port, '127.0.0.1', resolve);
+    });
+    const addr = server.address();
+    const stop = () => new Promise((resolve) => {
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+    });
+    return { port: addr.port, redirectPromise, stop };
+}
+/** The `redirect_uri` for a callback server listening on `port`. */
+export function callbackRedirectUri(port) {
+    return `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+}
+//# sourceMappingURL=callback.js.map

package/dist/mcp/auth/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../src/mcp/auth/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAoCzC;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC;IADX,YACW,IAAsE,EAC/E,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAkE;QAI/E,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAChB,mFAAmF;IACnF,sFAAsF;IACtF,oCAAoC;IACpC,8EAA8E;IAC9E,gBAAgB,CAAC;AAEnB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,aAAqB,EACrB,cAAsB,EACtB,oBAA6B,EAC7B,UAAiC,EAAE;IAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,eAAoD,CAAC;IACzD,IAAI,cAAmC,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,eAAe,GAAG,GAAG,CAAC;QACtB,cAAc,GAAG,GAAG,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,+CAA+C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC/F,cAAc,CACZ,IAAI,0BAA0B,CAC5B,gBAAgB,EAChB,qEAAqE,CACtE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC3F,cAAc,CACZ,IAAI,0BAA0B,CAC5B,QAAQ,EACR,oEAAoE,CACrE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnE,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,cAAc,CACZ,IAAI,0BAA0B,CAC5B,iBAAiB,EACjB,uFAAuF,CACxF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,oBAAoB,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC7C,cAAc,CACZ,IAAI,0BAA0B,CAC5B,iBAAiB,EACjB,kFAAkF,CACnF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACxF,cAAc,CACZ,IAAI,0BAA0B,CAC5B,cAAc,EACd,0DAA0D,CAC3D,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACpC,MAAM,CACJ,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,IAAI,oCAAoC,KAAK,CAAC,OAAO,EAAE,CAAC,CACrG,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC;IAClD,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;AACpD,CAAC"}