@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-mcp-adapter/dist/mcp-bearer-store.js

@@ -1,182 +0,0 @@
-import { createHash } from "node:crypto";
-import { createSecureKeyringStore, getTestSecureKeyringEntries, getTestSecureKeyringReadCount, removeTestSecureKeyringEntry, resetTestSecureKeyring, setTestSecureKeyringEntry } from "./secure-keyring.js";
-const BEARER_SECRET_SERVICE = "dm-mcp-adapter.bearer";
-const BEARER_SECRET_CHUNK_SIZE = 1000;
-
-export class BearerCredentialStoreError extends Error {
-  code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
-  operation;
-  constructor(message, operation, cause) {
-    super(message, { cause });
-    this.name = "BearerCredentialStoreError";
-    this.operation = operation;
-  }
-}
-function getBearerSecretStore() {
-  return createSecureKeyringStore(BEARER_SECRET_SERVICE);
-}
-function getBearerAccount(serverName) {
-  if (typeof serverName !== "string") {
-    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
-  }
-  return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
-}
-function parseBearerPayload(serverName, payload) {
-  const parsed = parseStoredBearerJson(serverName, payload);
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
-  }
-  const record = parsed;
-  if (typeof record.token !== "string" || typeof record.serverUrl !== "string") {
-    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
-  }
-  return { token: record.token, serverUrl: record.serverUrl };
-}
-function parseStoredBearerJson(serverName, payload) {
-  try {
-    return JSON.parse(payload);
-  } catch {
-    throw new Error(`Failed to parse stored bearer token record for ${serverName}`);
-  }
-}
-function isBearerChunkManifest(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const manifest = value;
-  return manifest.__piMcpAdapterBearerChunked === 1 && typeof manifest.chunkCount === "number" && Number.isInteger(manifest.chunkCount) && manifest.chunkCount > 0 && typeof manifest.chunkDigest === "string" && /^[a-f0-9]{16}$/.test(manifest.chunkDigest);
-}
-function readManifest(serverName, payload) {
-  const parsed = parseStoredBearerJson(serverName, payload);
-  return isBearerChunkManifest(parsed) ? parsed : undefined;
-}
-function chunkAccount(account, manifest, index) {
-  return `${account}.chunk.${manifest.chunkDigest}.${index}`;
-}
-function chunkAccounts(account, manifest) {
-  return Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));
-}
-function createManifest(payload) {
-  return {
-    __piMcpAdapterBearerChunked: 1,
-    chunkCount: Math.ceil(payload.length / BEARER_SECRET_CHUNK_SIZE),
-    chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16)
-  };
-}
-function readExistingManifest(store, serverName, account) {
-  try {
-    const payload = store.read(account);
-    return payload === undefined ? undefined : readManifest(serverName, payload);
-  } catch {
-    return;
-  }
-}
-function removeChunks(store, account, manifest) {
-  if (!manifest)
-    return;
-  for (const accountName of chunkAccounts(account, manifest))
-    store.remove(accountName);
-}
-function tryRemoveChunks(store, account, manifest) {
-  try {
-    removeChunks(store, account, manifest);
-  } catch {}
-}
-function readBearerRecordFromStore(store, serverName) {
-  const account = getBearerAccount(serverName);
-  let payload;
-  try {
-    payload = store.read(account);
-  } catch (error) {
-    throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
-  }
-  if (payload === undefined)
-    return;
-  try {
-    const manifest = readManifest(serverName, payload);
-    const recordPayload = manifest ? chunkAccounts(account, manifest).map((chunkName) => {
-      const chunk = store.read(chunkName);
-      if (chunk === undefined)
-        throw new Error(`Missing bearer token chunk for ${serverName}`);
-      return chunk;
-    }).join("") : payload;
-    return parseBearerPayload(serverName, recordPayload);
-  } catch (error) {
-    throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
-  }
-}
-function writeBearerRecordToStore(store, serverName, record) {
-  const account = getBearerAccount(serverName);
-  const payload = JSON.stringify(record);
-  const previousManifest = readExistingManifest(store, serverName, account);
-  const manifest = payload.length > BEARER_SECRET_CHUNK_SIZE ? createManifest(payload) : undefined;
-  try {
-    if (manifest) {
-      for (let index = 0;index < manifest.chunkCount; index++) {
-        store.write(chunkAccount(account, manifest, index), payload.slice(index * BEARER_SECRET_CHUNK_SIZE, (index + 1) * BEARER_SECRET_CHUNK_SIZE));
-      }
-      store.write(account, JSON.stringify(manifest));
-    } else {
-      store.write(account, payload);
-    }
-    if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
-      tryRemoveChunks(store, account, previousManifest);
-    }
-  } catch (error) {
-    if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
-      tryRemoveChunks(store, account, manifest);
-    }
-    throw new BearerCredentialStoreError(`Failed to write bearer token for ${serverName} to the OS secure credential store`, "write", error);
-  }
-}
-function removeBearerRecordFromStore(store, serverName) {
-  const account = getBearerAccount(serverName);
-  try {
-    const payload = store.read(account);
-    const manifest = payload === undefined ? undefined : readManifest(serverName, payload);
-    removeChunks(store, account, manifest);
-    store.remove(account);
-  } catch (error) {
-    throw new BearerCredentialStoreError(`Failed to remove bearer token for ${serverName} from the OS secure credential store`, "remove", error);
-  }
-}
-export function getBearerTokenForUrl(serverName, serverUrl) {
-  const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
-  if (!record)
-    return;
-  return record.serverUrl === serverUrl ? record.token : undefined;
-}
-export function saveBearerTokenForUrl(serverName, token, serverUrl) {
-  writeBearerRecordToStore(getBearerSecretStore(), serverName, { token, serverUrl });
-}
-export function removeBearerToken(serverName) {
-  removeBearerRecordFromStore(getBearerSecretStore(), serverName);
-}
-export function inspectBearerTokenForUrl(serverName, serverUrl) {
-  try {
-    const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
-    if (!record)
-      return { status: "missing" };
-    if (record.serverUrl !== serverUrl)
-      return { status: "url-mismatch" };
-    return { status: "present" };
-  } catch (error) {
-    if (!(error instanceof BearerCredentialStoreError))
-      throw error;
-    return { status: "unavailable", message: "Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry." };
-  }
-}
-export function resetTestBearerTokenStore() {
-  resetTestSecureKeyring();
-}
-export function getTestBearerTokenStoreEntries() {
-  return getTestSecureKeyringEntries().filter(([key]) => key.startsWith(`${BEARER_SECRET_SERVICE}\x00`)).map(([key, value]) => [key.slice(BEARER_SECRET_SERVICE.length + 1), value]);
-}
-export function removeTestBearerTokenStoreEntry(account) {
-  removeTestSecureKeyringEntry(BEARER_SECRET_SERVICE, account);
-}
-export function setTestBearerTokenStoreEntry(account, payload) {
-  setTestSecureKeyringEntry(BEARER_SECRET_SERVICE, account, payload);
-}
-export function getTestBearerTokenStoreReadCount() {
-  return getTestSecureKeyringReadCount();
-}

package/extensions/dm-mcp-adapter/dist/mcp-callback-server.js

@@ -1,381 +0,0 @@
-import { createServer } from "http";
-import { getAppName } from "./agent-dir.js";
-import { DEFAULT_OAUTH_CALLBACK_PATH, getConfiguredOAuthCallbackPort, getOAuthCallbackPath, getOAuthCallbackPort, setOAuthCallbackPath, setOAuthCallbackPort } from "./mcp-oauth-provider.js";
-const PAGE_STYLE = `
-    :root { color-scheme: light dark; }
-    * { box-sizing: border-box; }
-    body {
-      margin: 0;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      padding: 24px;
-      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
-      background: #0f1117;
-      color: #e6e8ee;
-    }
-    .card {
-      width: 100%;
-      max-width: 26rem;
-      padding: 2.5rem 2rem;
-      text-align: center;
-      background: #161922;
-      border: 1px solid #242938;
-      border-radius: 14px;
-      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);
-    }
-    .badge {
-      width: 3rem; height: 3rem;
-      margin: 0 auto 1.25rem;
-      display: grid; place-items: center;
-      border-radius: 50%;
-    }
-    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }
-    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }
-    .bad  { background: rgba(248,113,113,.12); color: #f87171; }
-    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }
-    p  { margin: 0; color: #9aa1b1; }
-    .app { color: #e6e8ee; font-weight: 500; }
-    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }
-    code {
-      display: block;
-      margin-top: 1.25rem;
-      padding: .75rem .875rem;
-      text-align: left;
-      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
-      color: #fca5a5;
-      background: rgba(248,113,113,.08);
-      border: 1px solid rgba(248,113,113,.2);
-      border-radius: 8px;
-      overflow-wrap: anywhere;
-    }
-    @media (prefers-color-scheme: light) {
-      body { background: #f6f7f9; color: #121620; }
-      .card { background: #fff; border-color: #e4e7ee; }
-      p { color: #5b6474; }
-      .app { color: #121620; }
-      .hint { color: #8b93a3; }
-    }`;
-const CHECK_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
-const CROSS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>';
-function page(options) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${options.title}</title>
-  <style>${PAGE_STYLE}
-  </style>
-</head>
-<body>
-  <main class="card">
-    <div class="badge ${options.tone}">${options.icon}</div>
-    <h1>${options.heading}</h1>
-    <p>${options.body}</p>
-    ${options.extra ?? ""}
-  </main>
-${options.autoClose ? `  <script>setTimeout(() => window.close(), 2000);</script>
-` : ""}</body>
-</html>`;
-}
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function htmlSuccess() {
-  const app = escapeHtml(getAppName());
-  return page({
-    title: `${app} — Authorization Successful`,
-    heading: "Authorization Successful",
-    body: `You can close this window and return to <span class="app">${app}</span>.`,
-    icon: CHECK_ICON,
-    tone: "ok",
-    autoClose: true
-  });
-}
-function htmlManualSuccess() {
-  const app = escapeHtml(getAppName());
-  return page({
-    title: `${app} — Authorization Received`,
-    heading: "Authorization Received",
-    body: `Copy the full callback URL from your browser address bar and paste it back into <span class="app">${app}</span> with auth-complete.`,
-    icon: CHECK_ICON,
-    tone: "ok"
-  });
-}
-function htmlError(error) {
-  const app = escapeHtml(getAppName());
-  return page({
-    title: `${app} — Authorization Failed`,
-    heading: "Authorization Failed",
-    body: `Something went wrong during authorization. You can close this window and try again from <span class="app">${app}</span>.`,
-    icon: CROSS_ICON,
-    tone: "bad",
-    extra: `<code>${escapeHtml(error)}</code>`
-  });
-}
-let server;
-let bindingPromise;
-let stoppingPromise;
-let restartableStoppingPromise;
-let callbackGeneration = 0;
-const pendingAuths = new Map;
-const reservedAuthStates = new Set;
-const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
-const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
-let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
-function handleRequest(req, res) {
-  const url = new URL(req.url || "/", `http://${req.headers.host}`);
-  if (url.pathname !== getOAuthCallbackPath()) {
-    res.writeHead(404, { "Content-Type": "text/plain" });
-    res.end("Not found");
-    return;
-  }
-  const code = url.searchParams.get("code");
-  const iss = url.searchParams.get("iss");
-  const state = url.searchParams.get("state");
-  const error = url.searchParams.get("error");
-  const errorDescription = url.searchParams.get("error_description");
-  if (!state) {
-    const errorMsg = "Missing required state parameter - potential CSRF attack";
-    res.writeHead(400, { "Content-Type": "text/html" });
-    res.end(htmlError(errorMsg));
-    return;
-  }
-  const pending = pendingAuths.get(state);
-  const isReserved = reservedAuthStates.has(state);
-  if (error) {
-    if (!pending && !isReserved) {
-      const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(htmlError(errorMsg));
-      return;
-    }
-    const errorMsg = errorDescription || error;
-    res.writeHead(200, { "Content-Type": "text/html" });
-    res.end(htmlError(errorMsg));
-    if (pending) {
-      reservedAuthStates.delete(state);
-      clearTimeout(pending.timeout);
-      pendingAuths.delete(state);
-      setTimeout(() => pending.reject(new Error(errorMsg)), 0);
-    }
-    return;
-  }
-  if (!pending && !isReserved) {
-    const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
-    res.writeHead(400, { "Content-Type": "text/html" });
-    res.end(htmlError(errorMsg));
-    return;
-  }
-  if (!code) {
-    res.writeHead(400, { "Content-Type": "text/html" });
-    res.end(htmlError("No authorization code provided"));
-    return;
-  }
-  if (!pending) {
-    res.writeHead(200, { "Content-Type": "text/html" });
-    res.end(htmlManualSuccess());
-    return;
-  }
-  clearTimeout(pending.timeout);
-  pendingAuths.delete(state);
-  pending.resolve({ code, ...iss !== null ? { iss } : {} });
-  res.writeHead(200, { "Content-Type": "text/html" });
-  res.end(htmlSuccess());
-}
-export async function ensureCallbackServer(options = {}) {
-  const generation = callbackGeneration;
-  if (stoppingPromise) {
-    if (!restartableStoppingPromise) {
-      throw new Error("OAuth callback server stopped");
-    }
-    await restartableStoppingPromise;
-    if (generation !== callbackGeneration) {
-      throw new Error("OAuth callback server stopped");
-    }
-  }
-  while (bindingPromise) {
-    await bindingPromise;
-    if (generation !== callbackGeneration) {
-      throw new Error("OAuth callback server stopped");
-    }
-  }
-  if (generation !== callbackGeneration) {
-    throw new Error("OAuth callback server stopped");
-  }
-  const operation = ensureCallbackServerLocked(options);
-  bindingPromise = operation;
-  try {
-    await operation;
-  } finally {
-    if (bindingPromise === operation) {
-      bindingPromise = undefined;
-    }
-  }
-}
-async function ensureCallbackServerLocked(options = {}) {
-  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort();
-  const strictPort = options.strictPort === true;
-  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST;
-  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH;
-  const requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
-  if (options.reserveState && !options.oauthState) {
-    throw new Error("OAuth callback reservation requires an oauthState");
-  }
-  let reservedState;
-  const previousServer = server;
-  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort);
-  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost);
-  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath);
-  if (previousServer) {
-    if (!needsStrictRebind && !needsHostSwitch) {
-      if (needsPathSwitch) {
-        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
-          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
-        }
-        setOAuthCallbackPath(requestedPath);
-      }
-      if (options.reserveState && options.oauthState) {
-        reservedAuthStates.add(options.oauthState);
-        reservedState = options.oauthState;
-      }
-      return;
-    }
-    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
-      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
-    }
-  }
-  const candidateServer = createServer(handleRequest);
-  const listenPort = strictPort ? requiredPort : 0;
-  try {
-    await new Promise((resolve, reject) => {
-      candidateServer.once("error", (err) => {
-        reject(err);
-      });
-      candidateServer.listen(listenPort, requestedHost, () => {
-        resolve();
-      });
-    });
-    if (strictPort) {
-      setOAuthCallbackPort(requiredPort);
-    } else {
-      const address = candidateServer.address();
-      if (!address || typeof address === "string" || typeof address.port !== "number") {
-        throw new Error("OAuth callback server did not report an assigned port");
-      }
-      setOAuthCallbackPort(address.port);
-    }
-    if (previousServer && (needsStrictRebind || needsHostSwitch)) {
-      await new Promise((resolve) => {
-        previousServer.close(() => resolve());
-      });
-    }
-    callbackServerHost = requestedHost;
-    setOAuthCallbackPath(requestedPath);
-    server = candidateServer;
-    if (options.reserveState && options.oauthState) {
-      reservedAuthStates.add(options.oauthState);
-      reservedState = options.oauthState;
-    }
-    server.unref();
-  } catch (error) {
-    if (reservedState) {
-      reservedAuthStates.delete(reservedState);
-    }
-    const nodeError = error;
-    await new Promise((resolve) => {
-      candidateServer.close(() => resolve());
-    });
-    if (strictPort && nodeError.code === "EADDRINUSE") {
-      throw new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error });
-    }
-    throw error;
-  }
-}
-export function reserveCallbackServer(oauthState) {
-  reservedAuthStates.add(oauthState);
-}
-export function releaseCallbackServer(oauthState) {
-  reservedAuthStates.delete(oauthState);
-}
-export function waitForCallback(oauthState) {
-  reservedAuthStates.delete(oauthState);
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      if (pendingAuths.has(oauthState)) {
-        pendingAuths.delete(oauthState);
-        reject(new Error("OAuth callback timeout - authorization took too long"));
-      }
-    }, CALLBACK_TIMEOUT_MS);
-    pendingAuths.set(oauthState, { resolve, reject, timeout });
-  });
-}
-export function cancelPendingCallback(oauthState) {
-  reservedAuthStates.delete(oauthState);
-  const pending = pendingAuths.get(oauthState);
-  if (pending) {
-    clearTimeout(pending.timeout);
-    pendingAuths.delete(oauthState);
-    pending.reject(new Error("Authorization cancelled"));
-  }
-}
-export function stopCallbackServer() {
-  if (stoppingPromise) {
-    restartableStoppingPromise = undefined;
-    callbackGeneration += 1;
-    return stoppingPromise;
-  }
-  callbackGeneration += 1;
-  const cleanup = (async () => {
-    while (bindingPromise) {
-      await bindingPromise.catch(() => {});
-    }
-    if (server) {
-      await new Promise((resolve) => {
-        server.close(() => {
-          resolve();
-        });
-      });
-      server = undefined;
-    }
-    setOAuthCallbackPort(getConfiguredOAuthCallbackPort());
-    callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
-    setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
-    const pendingList = Array.from(pendingAuths.entries());
-    pendingAuths.clear();
-    reservedAuthStates.clear();
-    setTimeout(() => {
-      for (const [, pending] of pendingList) {
-        clearTimeout(pending.timeout);
-        pending.reject(new Error("OAuth callback server stopped"));
-      }
-    }, 0);
-  })();
-  const operation = cleanup.finally(() => {
-    if (stoppingPromise === operation)
-      stoppingPromise = undefined;
-  });
-  stoppingPromise = operation;
-  return operation;
-}
-export function stopCallbackServerIfIdle() {
-  if (stoppingPromise)
-    return stoppingPromise;
-  if (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {
-    return Promise.resolve();
-  }
-  const operation = stopCallbackServer().finally(() => {
-    if (restartableStoppingPromise === operation)
-      restartableStoppingPromise = undefined;
-  });
-  restartableStoppingPromise = operation;
-  return operation;
-}
-export function isCallbackServerRunning() {
-  return server !== undefined;
-}
-export function getPendingAuthCount() {
-  return pendingAuths.size;
-}