@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-mcp-adapter/dist/mcp-bearer-store.js

@@ -1,14 +1,7 @@
 import { createHash } from "node:crypto";
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-const require = createRequire(import.meta.url);
+import { createSecureKeyringStore, getTestSecureKeyringEntries, getTestSecureKeyringReadCount, removeTestSecureKeyringEntry, resetTestSecureKeyring, setTestSecureKeyringEntry } from "./secure-keyring.js";
 const BEARER_SECRET_SERVICE = "dm-mcp-adapter.bearer";
-const TEST_AUTH_STORE_ENV = "DM_MCP_ADAPTER_TEST_AUTH_STORE";
 const BEARER_SECRET_CHUNK_SIZE = 1000;
-const BEARER_SECRET_VALUE_LIMIT = 1280;
-let KeyringEntryClass;
-const memoryBearerEntries = new Map;
-let testBearerSecretStoreReadCount = 0;
 
 export class BearerCredentialStoreError extends Error {
   code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
@@ -19,129 +12,8 @@ export class BearerCredentialStoreError extends Error {
     this.operation = operation;
   }
 }
-const memoryBearerSecretStore = {
-  read(account) {
-    testBearerSecretStoreReadCount++;
-    return memoryBearerEntries.get(account);
-  },
-  write(account, payload) {
-    memoryBearerEntries.set(account, payload);
-  },
-  remove(account) {
-    memoryBearerEntries.delete(account);
-  }
-};
-const sizeLimitedBearerSecretStore = {
-  read(account) {
-    testBearerSecretStoreReadCount++;
-    return memoryBearerEntries.get(account);
-  },
-  write(account, payload) {
-    if (payload.length > BEARER_SECRET_VALUE_LIMIT) {
-      throw new Error(`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`);
-    }
-    memoryBearerEntries.set(account, payload);
-  },
-  remove(account) {
-    memoryBearerEntries.delete(account);
-  }
-};
-const unavailableBearerSecretStore = {
-  read() {
-    testBearerSecretStoreReadCount++;
-    throw new Error("simulated secure credential store unavailable");
-  },
-  write() {
-    throw new Error("simulated secure credential store unavailable");
-  },
-  remove() {
-    throw new Error("simulated secure credential store unavailable");
-  }
-};
-const keyringBearerSecretStore = {
-  read(account) {
-    return getKeyringEntry(account).getPassword() ?? undefined;
-  },
-  write(account, payload) {
-    getKeyringEntry(account).setPassword(payload);
-  },
-  remove(account) {
-    getKeyringEntry(account).deleteCredential();
-  }
-};
 function getBearerSecretStore() {
-  if (process.env[TEST_AUTH_STORE_ENV] === "memory")
-    return memoryBearerSecretStore;
-  if (process.env[TEST_AUTH_STORE_ENV] === "sizelimited")
-    return sizeLimitedBearerSecretStore;
-  if (process.env[TEST_AUTH_STORE_ENV] === "unavailable")
-    return unavailableBearerSecretStore;
-  return keyringBearerSecretStore;
-}
-function getKeyringEntry(account) {
-  try {
-    KeyringEntryClass ??= loadKeyringEntryClass();
-    return new KeyringEntryClass(BEARER_SECRET_SERVICE, account);
-  } catch (error) {
-    throw new Error("Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.", { cause: error });
-  }
-}
-function loadKeyringEntryClass(keyringRequire = require, platform = process.platform, arch = process.arch) {
-  try {
-    return keyringRequire("@napi-rs/keyring").Entry;
-  } catch (loaderError) {
-    try {
-      return loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;
-    } catch (fallbackError) {
-      const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);
-      throw new Error(`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`, { cause: loaderError });
-    }
-  }
-}
-function loadKeyringNativeBindingFallback(keyringRequire, platform, arch) {
-  const targets = getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({
-    packageName: `@napi-rs/keyring-${suffix}`,
-    bindingFile: `keyring.${suffix}.node`
-  }));
-  let lastError;
-  for (const target of targets) {
-    try {
-      const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
-      return keyringRequire(join(dirname(packageJsonPath), target.bindingFile));
-    } catch (error) {
-      lastError = error;
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error(String(lastError));
-}
-function getKeyringNativeBindingSuffixes(platform, arch) {
-  if (platform === "darwin") {
-    if (arch === "arm64")
-      return ["darwin-arm64"];
-    if (arch === "x64")
-      return ["darwin-x64"];
-  }
-  if (platform === "win32") {
-    if (arch === "arm64")
-      return ["win32-arm64-msvc"];
-    if (arch === "x64")
-      return ["win32-x64-msvc"];
-    if (arch === "ia32")
-      return ["win32-ia32-msvc"];
-  }
-  if (platform === "linux") {
-    if (arch === "arm64")
-      return ["linux-arm64-gnu", "linux-arm64-musl"];
-    if (arch === "arm")
-      return ["linux-arm-gnueabihf"];
-    if (arch === "riscv64")
-      return ["linux-riscv64-gnu"];
-    if (arch === "x64")
-      return ["linux-x64-gnu", "linux-x64-musl"];
-  }
-  if (platform === "freebsd" && arch === "x64")
-    return ["freebsd-x64"];
-  return [];
+  return createSecureKeyringStore(BEARER_SECRET_SERVICE);
 }
 function getBearerAccount(serverName) {
   if (typeof serverName !== "string") {
@@ -294,18 +166,17 @@ export function inspectBearerTokenForUrl(serverName, serverUrl) {
   }
 }
 export function resetTestBearerTokenStore() {
-  memoryBearerEntries.clear();
-  testBearerSecretStoreReadCount = 0;
+  resetTestSecureKeyring();
 }
 export function getTestBearerTokenStoreEntries() {
-  return [...memoryBearerEntries.entries()];
+  return getTestSecureKeyringEntries().filter(([key]) => key.startsWith(`${BEARER_SECRET_SERVICE}\x00`)).map(([key, value]) => [key.slice(BEARER_SECRET_SERVICE.length + 1), value]);
 }
 export function removeTestBearerTokenStoreEntry(account) {
-  memoryBearerEntries.delete(account);
+  removeTestSecureKeyringEntry(BEARER_SECRET_SERVICE, account);
 }
 export function setTestBearerTokenStoreEntry(account, payload) {
-  memoryBearerEntries.set(account, payload);
+  setTestSecureKeyringEntry(BEARER_SECRET_SERVICE, account, payload);
 }
 export function getTestBearerTokenStoreReadCount() {
-  return testBearerSecretStoreReadCount;
+  return getTestSecureKeyringReadCount();
 }

package/extensions/dm-mcp-adapter/dist/mcp-callback-server.js

@@ -0,0 +1,381 @@
+import { createServer } from "http";
+import { getAppName } from "./agent-dir.js";
+import { DEFAULT_OAUTH_CALLBACK_PATH, getConfiguredOAuthCallbackPort, getOAuthCallbackPath, getOAuthCallbackPort, setOAuthCallbackPath, setOAuthCallbackPort } from "./mcp-oauth-provider.js";
+const PAGE_STYLE = `
+    :root { color-scheme: light dark; }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+      background: #0f1117;
+      color: #e6e8ee;
+    }
+    .card {
+      width: 100%;
+      max-width: 26rem;
+      padding: 2.5rem 2rem;
+      text-align: center;
+      background: #161922;
+      border: 1px solid #242938;
+      border-radius: 14px;
+      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);
+    }
+    .badge {
+      width: 3rem; height: 3rem;
+      margin: 0 auto 1.25rem;
+      display: grid; place-items: center;
+      border-radius: 50%;
+    }
+    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }
+    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }
+    .bad  { background: rgba(248,113,113,.12); color: #f87171; }
+    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }
+    p  { margin: 0; color: #9aa1b1; }
+    .app { color: #e6e8ee; font-weight: 500; }
+    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }
+    code {
+      display: block;
+      margin-top: 1.25rem;
+      padding: .75rem .875rem;
+      text-align: left;
+      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+      color: #fca5a5;
+      background: rgba(248,113,113,.08);
+      border: 1px solid rgba(248,113,113,.2);
+      border-radius: 8px;
+      overflow-wrap: anywhere;
+    }
+    @media (prefers-color-scheme: light) {
+      body { background: #f6f7f9; color: #121620; }
+      .card { background: #fff; border-color: #e4e7ee; }
+      p { color: #5b6474; }
+      .app { color: #121620; }
+      .hint { color: #8b93a3; }
+    }`;
+const CHECK_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
+const CROSS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>';
+function page(options) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${options.title}</title>
+  <style>${PAGE_STYLE}
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="badge ${options.tone}">${options.icon}</div>
+    <h1>${options.heading}</h1>
+    <p>${options.body}</p>
+    ${options.extra ?? ""}
+  </main>
+${options.autoClose ? `  <script>setTimeout(() => window.close(), 2000);</script>
+` : ""}</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function htmlSuccess() {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Successful`,
+    heading: "Authorization Successful",
+    body: `You can close this window and return to <span class="app">${app}</span>.`,
+    icon: CHECK_ICON,
+    tone: "ok",
+    autoClose: true
+  });
+}
+function htmlManualSuccess() {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Received`,
+    heading: "Authorization Received",
+    body: `Copy the full callback URL from your browser address bar and paste it back into <span class="app">${app}</span> with auth-complete.`,
+    icon: CHECK_ICON,
+    tone: "ok"
+  });
+}
+function htmlError(error) {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Failed`,
+    heading: "Authorization Failed",
+    body: `Something went wrong during authorization. You can close this window and try again from <span class="app">${app}</span>.`,
+    icon: CROSS_ICON,
+    tone: "bad",
+    extra: `<code>${escapeHtml(error)}</code>`
+  });
+}
+let server;
+let bindingPromise;
+let stoppingPromise;
+let restartableStoppingPromise;
+let callbackGeneration = 0;
+const pendingAuths = new Map;
+const reservedAuthStates = new Set;
+const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
+let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  const url = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not found");
+    return;
+  }
+  const code = url.searchParams.get("code");
+  const iss = url.searchParams.get("iss");
+  const state = url.searchParams.get("state");
+  const error = url.searchParams.get("error");
+  const errorDescription = url.searchParams.get("error_description");
+  if (!state) {
+    const errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    return;
+  }
+  const pending = pendingAuths.get(state);
+  const isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(htmlError(errorMsg));
+      return;
+    }
+    const errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    if (pending) {
+      reservedAuthStates.delete(state);
+      clearTimeout(pending.timeout);
+      pendingAuths.delete(state);
+      setTimeout(() => pending.reject(new Error(errorMsg)), 0);
+    }
+    return;
+  }
+  if (!pending && !isReserved) {
+    const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError("No authorization code provided"));
+    return;
+  }
+  if (!pending) {
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(htmlManualSuccess());
+    return;
+  }
+  clearTimeout(pending.timeout);
+  pendingAuths.delete(state);
+  pending.resolve({ code, ...iss !== null ? { iss } : {} });
+  res.writeHead(200, { "Content-Type": "text/html" });
+  res.end(htmlSuccess());
+}
+export async function ensureCallbackServer(options = {}) {
+  const generation = callbackGeneration;
+  if (stoppingPromise) {
+    if (!restartableStoppingPromise) {
+      throw new Error("OAuth callback server stopped");
+    }
+    await restartableStoppingPromise;
+    if (generation !== callbackGeneration) {
+      throw new Error("OAuth callback server stopped");
+    }
+  }
+  while (bindingPromise) {
+    await bindingPromise;
+    if (generation !== callbackGeneration) {
+      throw new Error("OAuth callback server stopped");
+    }
+  }
+  if (generation !== callbackGeneration) {
+    throw new Error("OAuth callback server stopped");
+  }
+  const operation = ensureCallbackServerLocked(options);
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    if (bindingPromise === operation) {
+      bindingPromise = undefined;
+    }
+  }
+}
+async function ensureCallbackServerLocked(options = {}) {
+  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort();
+  const strictPort = options.strictPort === true;
+  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST;
+  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH;
+  const requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState) {
+    throw new Error("OAuth callback reservation requires an oauthState");
+  }
+  let reservedState;
+  const previousServer = server;
+  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort);
+  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost);
+  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        }
+        setOAuthCallbackPath(requestedPath);
+      }
+      if (options.reserveState && options.oauthState) {
+        reservedAuthStates.add(options.oauthState);
+        reservedState = options.oauthState;
+      }
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+    }
+  }
+  const candidateServer = createServer(handleRequest);
+  const listenPort = strictPort ? requiredPort : 0;
+  try {
+    await new Promise((resolve, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      });
+      candidateServer.listen(listenPort, requestedHost, () => {
+        resolve();
+      });
+    });
+    if (strictPort) {
+      setOAuthCallbackPort(requiredPort);
+    } else {
+      const address = candidateServer.address();
+      if (!address || typeof address === "string" || typeof address.port !== "number") {
+        throw new Error("OAuth callback server did not report an assigned port");
+      }
+      setOAuthCallbackPort(address.port);
+    }
+    if (previousServer && (needsStrictRebind || needsHostSwitch)) {
+      await new Promise((resolve) => {
+        previousServer.close(() => resolve());
+      });
+    }
+    callbackServerHost = requestedHost;
+    setOAuthCallbackPath(requestedPath);
+    server = candidateServer;
+    if (options.reserveState && options.oauthState) {
+      reservedAuthStates.add(options.oauthState);
+      reservedState = options.oauthState;
+    }
+    server.unref();
+  } catch (error) {
+    if (reservedState) {
+      reservedAuthStates.delete(reservedState);
+    }
+    const nodeError = error;
+    await new Promise((resolve) => {
+      candidateServer.close(() => resolve());
+    });
+    if (strictPort && nodeError.code === "EADDRINUSE") {
+      throw new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error });
+    }
+    throw error;
+  }
+}
+export function reserveCallbackServer(oauthState) {
+  reservedAuthStates.add(oauthState);
+}
+export function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+export function waitForCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      if (pendingAuths.has(oauthState)) {
+        pendingAuths.delete(oauthState);
+        reject(new Error("OAuth callback timeout - authorization took too long"));
+      }
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve, reject, timeout });
+  });
+}
+export function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  const pending = pendingAuths.get(oauthState);
+  if (pending) {
+    clearTimeout(pending.timeout);
+    pendingAuths.delete(oauthState);
+    pending.reject(new Error("Authorization cancelled"));
+  }
+}
+export function stopCallbackServer() {
+  if (stoppingPromise) {
+    restartableStoppingPromise = undefined;
+    callbackGeneration += 1;
+    return stoppingPromise;
+  }
+  callbackGeneration += 1;
+  const cleanup = (async () => {
+    while (bindingPromise) {
+      await bindingPromise.catch(() => {});
+    }
+    if (server) {
+      await new Promise((resolve) => {
+        server.close(() => {
+          resolve();
+        });
+      });
+      server = undefined;
+    }
+    setOAuthCallbackPort(getConfiguredOAuthCallbackPort());
+    callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+    setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+    const pendingList = Array.from(pendingAuths.entries());
+    pendingAuths.clear();
+    reservedAuthStates.clear();
+    setTimeout(() => {
+      for (const [, pending] of pendingList) {
+        clearTimeout(pending.timeout);
+        pending.reject(new Error("OAuth callback server stopped"));
+      }
+    }, 0);
+  })();
+  const operation = cleanup.finally(() => {
+    if (stoppingPromise === operation)
+      stoppingPromise = undefined;
+  });
+  stoppingPromise = operation;
+  return operation;
+}
+export function stopCallbackServerIfIdle() {
+  if (stoppingPromise)
+    return stoppingPromise;
+  if (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+    return Promise.resolve();
+  }
+  const operation = stopCallbackServer().finally(() => {
+    if (restartableStoppingPromise === operation)
+      restartableStoppingPromise = undefined;
+  });
+  restartableStoppingPromise = operation;
+  return operation;
+}
+export function isCallbackServerRunning() {
+  return server !== undefined;
+}
+export function getPendingAuthCount() {
+  return pendingAuths.size;
+}