npm - @duckmind/dm-windows-x64 - Versions diffs - 0.63.4 → 0.63.9 - Mend

@duckmind/dm-windows-x64 0.63.4 → 0.63.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (121) hide show

package/extensions/dm-mcp-adapter/sandbox-proxy-template.js ADDED Viewed

@@ -0,0 +1,190 @@
+export const SANDBOX_PROXY_SANDBOX = "allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin";
+export const SANDBOX_INNER_SANDBOX = SANDBOX_PROXY_SANDBOX;
+export const SANDBOX_PROXY_PATH = "/sandbox";
+export function buildSandboxProxyHtml(input) {
+  const parentOrigin = safeInlineJSON(input.parentOrigin);
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>MCP App Sandbox</title>
+  <style>
+    html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: transparent; }
+    iframe { display: block; width: 100%; height: 100%; border: 0; }
+  </style>
+</head>
+<body>
+  <iframe id="mcp-app" title="MCP App" sandbox="${SANDBOX_INNER_SANDBOX}" referrerpolicy="no-referrer"></iframe>
+  <script>
+    const EXPECTED_PARENT_ORIGIN = ${parentOrigin};
+    const SANDBOX_PROXY_READY_METHOD = "ui/notifications/sandbox-proxy-ready";
+    const SANDBOX_RESOURCE_READY_METHOD = "ui/notifications/sandbox-resource-ready";
+    const INNER_SANDBOX = ${safeInlineJSON(SANDBOX_INNER_SANDBOX)};
+    const MAX_PENDING_MESSAGES = 64;
+    const innerFrame = document.getElementById("mcp-app");
+    const pendingToInner = [];
+    let innerReady = false;
+    const isObject = (value) => value !== null && typeof value === "object";
+    const isMessageFromParent = (event) =>
+      event.source === window.parent && event.origin === EXPECTED_PARENT_ORIGIN;
+    const isMessageFromInner = (event) =>
+      event.source === innerFrame.contentWindow && event.origin === window.location.origin;
+    const postToParent = (data) => {
+      window.parent.postMessage(data, EXPECTED_PARENT_ORIGIN);
+    };
+    const postToInner = (data) => {
+      if (!innerReady || !innerFrame.contentWindow) {
+        if (pendingToInner.length < MAX_PENDING_MESSAGES) pendingToInner.push(data);
+        return;
+      }
+      innerFrame.contentWindow.postMessage(data, window.location.origin);
+    };
+    const flushPendingMessages = () => {
+      if (!innerFrame.contentWindow) return;
+      innerReady = true;
+      for (const data of pendingToInner.splice(0)) {
+        innerFrame.contentWindow.postMessage(data, window.location.origin);
+      }
+    };
+    const sanitizeDomains = (domains) => {
+      if (!Array.isArray(domains)) return [];
+      return [...new Set(domains.filter((domain) =>
+        typeof domain === "string" &&
+        domain.length > 0 &&
+        /^[\\x21-\\x7E]+$/.test(domain) &&
+        !/[;'"]/.test(domain),
+      ))];
+    };
+    const toDirective = (name, trustedSources, domains) =>
+      name + " " + [...new Set([...trustedSources, ...domains])].join(" ");
+    const buildResourceCsp = (csp) => {
+      const resourceDomains = sanitizeDomains(csp?.resourceDomains);
+      const connectDomains = sanitizeDomains(csp?.connectDomains);
+      const frameDomains = sanitizeDomains(csp?.frameDomains);
+      const baseUriDomains = sanitizeDomains(csp?.baseUriDomains);
+      return [
+        "default-src 'none'",
+        "sandbox " + INNER_SANDBOX,
+        toDirective("script-src", ["'self'", "'unsafe-inline'"], resourceDomains),
+        toDirective("style-src", ["'self'", "'unsafe-inline'"], resourceDomains),
+        toDirective("font-src", ["'self'"], resourceDomains),
+        toDirective("img-src", ["'self'", "data:"], resourceDomains),
+        toDirective("media-src", ["'self'", "data:"], resourceDomains),
+        connectDomains.length > 0 ? "connect-src " + connectDomains.join(" ") : "connect-src 'none'",
+        frameDomains.length > 0 ? "frame-src " + frameDomains.join(" ") : "frame-src 'none'",
+        "worker-src 'none'",
+        "object-src 'none'",
+        baseUriDomains.length > 0 ? "base-uri " + baseUriDomains.join(" ") : "base-uri 'self'",
+      ].join("; ");
+    };
+    const escapeAttribute = (value) => value
+      .replace(/&/g, "&amp;")
+      .replace(/"/g, "&quot;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;");
+    const injectCsp = (html, csp) => {
+      const meta = '<meta http-equiv="Content-Security-Policy" content="' + escapeAttribute(csp) + '">';
+      const head = html.match(/<head(?:\\s[^>]*)?>/i);
+      if (head && head.index !== undefined) {
+        const end = head.index + head[0].length;
+        return html.slice(0, end) + meta + html.slice(end);
+      }
+      return meta + html;
+    };
+    const safeSandbox = (requested) => {
+      const requestedTokens = typeof requested === "string" ? requested.split(/\\s+/) : [];
+      const allowedTokens = new Set(INNER_SANDBOX.split(" "));
+      const tokens = requestedTokens.filter((token) => allowedTokens.has(token));
+      // Provider HTML needs both script execution and a real proxy-origin
+      // storage context. Never accept popup escape or top-navigation tokens.
+      return [...new Set([
+        "allow-scripts",
+        "allow-same-origin",
+        ...tokens,
+      ])].filter((token) => allowedTokens.has(token)).join(" ");
+    };
+    const buildAllowAttribute = (permissions) => {
+      if (!isObject(permissions) || Array.isArray(permissions)) return "";
+      const allowed = [];
+      if (permissions.camera) allowed.push("camera");
+      if (permissions.microphone) allowed.push("microphone");
+      if (permissions.geolocation) allowed.push("geolocation");
+      if (permissions.clipboardWrite) allowed.push("clipboard-write");
+      return allowed.join("; ");
+    };
+    const loadResource = (params) => {
+      if (!isObject(params) || typeof params.html !== "string" || !innerFrame.contentDocument) return;
+      innerFrame.setAttribute("sandbox", safeSandbox(params.sandbox));
+      const allow = buildAllowAttribute(params.permissions);
+      if (allow) innerFrame.setAttribute("allow", allow);
+      else innerFrame.removeAttribute("allow");
+      innerReady = false;
+      const document = innerFrame.contentDocument;
+      document.open();
+      document.write(injectCsp(params.html, buildResourceCsp(params.csp)));
+      document.close();
+      flushPendingMessages();
+    };
+    window.addEventListener("message", (event) => {
+      if (isMessageFromParent(event)) {
+        const data = event.data;
+        if (!isObject(data)) return;
+        if (data.method === SANDBOX_RESOURCE_READY_METHOD) {
+          loadResource(data.params);
+          return;
+        }
+        if (data.method === SANDBOX_PROXY_READY_METHOD) return;
+        if (typeof data.method === "string" && data.method.startsWith("ui/notifications/sandbox-")) return;
+        postToInner(data);
+        return;
+      }
+      if (!isMessageFromInner(event)) return;
+      const data = event.data;
+      if (!isObject(data)) return;
+      if (typeof data.method === "string" && data.method.startsWith("ui/notifications/sandbox-")) return;
+      postToParent(data);
+    });
+    postToParent({
+      jsonrpc: "2.0",
+      method: SANDBOX_PROXY_READY_METHOD,
+      params: {},
+    });
+  </script>
+</body>
+</html>`;
+}
+export function buildSandboxProxyCsp() {
+  return [
+    "default-src 'none'",
+    "script-src 'unsafe-inline'",
+    "style-src 'unsafe-inline'",
+    "frame-src 'self'",
+    "connect-src 'none'",
+    "worker-src 'none'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    `sandbox ${SANDBOX_PROXY_SANDBOX}`
+  ].join("; ");
+}
+function safeInlineJSON(value) {
+  const json = JSON.stringify(value);
+  if (json === undefined)
+    return "undefined";
+  return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}

package/extensions/dm-mcp-adapter/search-ranking.js ADDED Viewed

@@ -0,0 +1,198 @@
+import { getServerPrefix, getToolNameCandidates, isServerDisabled, matchesToolPattern, resolveToolPrefix } from "./types.js";
+import { isServerInActiveFailureBackoff } from "./failure-backoff.js";
+const MIN_STEM_LENGTH = 4;
+const FIELD_WEIGHTS = {
+  name: 12,
+  originalName: 10,
+  server: 8,
+  description: 5,
+  keywords: 5
+};
+const searchCache = new WeakMap;
+export function resolveSearchKeywords(definition, toolOriginalName, serverName, globalPrefix) {
+  const map = definition?.searchKeywords;
+  if (!map || typeof map !== "object" || Array.isArray(map))
+    return [];
+  const candidates = getToolNameCandidates(toolOriginalName, serverName, resolveToolPrefix(definition, globalPrefix));
+  const keywords = [];
+  const seen = new Set;
+  for (const [pattern, values] of Object.entries(map)) {
+    if (!Array.isArray(values))
+      continue;
+    if (!matchesToolPattern(candidates, [pattern]))
+      continue;
+    for (const value of values) {
+      if (typeof value !== "string")
+        continue;
+      const trimmed = value.trim();
+      if (!trimmed || seen.has(trimmed))
+        continue;
+      seen.add(trimmed);
+      keywords.push(trimmed);
+    }
+  }
+  return keywords;
+}
+export function normalizeSearchText(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_./:-]+/g, " ").toLowerCase();
+}
+export function tokenize(value) {
+  return normalizeSearchText(value).split(/[^a-z0-9]+/).filter(Boolean);
+}
+function prepareToolSearch(tool, server, keywords) {
+  const fields = {
+    name: normalizeSearchText(tool.name),
+    originalName: normalizeSearchText(tool.originalName),
+    server: normalizeSearchText(server),
+    description: normalizeSearchText(tool.description)
+  };
+  const preparedFields = Object.entries(fields).map(([field, value]) => [field, value, tokenize(value)]);
+  const keywordPhrases = keywords?.map((keyword) => normalizeSearchText(keyword).trim()).filter(Boolean) ?? [];
+  return {
+    tool,
+    fields: preparedFields,
+    nameTokens: preparedFields[0][2],
+    keywordPhrases,
+    keywordTokens: keywordPhrases.flatMap(tokenize)
+  };
+}
+function scorePreparedToolMatch(prepared, normalizedQuery, queryTokens) {
+  let score = 0;
+  let phraseMatched = false;
+  let wholeFieldExact = false;
+  const matchedTokens = new Set;
+  for (const [field, value, fieldTokens] of prepared.fields) {
+    const weight = FIELD_WEIGHTS[field];
+    if (value === normalizedQuery) {
+      score += weight * 14;
+      phraseMatched = true;
+      wholeFieldExact = true;
+    } else if (value.startsWith(normalizedQuery)) {
+      score += weight * 9;
+      phraseMatched = true;
+    } else if (value.includes(normalizedQuery)) {
+      score += weight * 6;
+      phraseMatched = true;
+    }
+    for (const token of queryTokens) {
+      if (fieldTokens.includes(token)) {
+        score += weight * 4;
+        matchedTokens.add(token);
+      } else if (fieldTokens.some((fieldToken) => fieldToken.startsWith(token) || fieldToken.length >= MIN_STEM_LENGTH && token.startsWith(fieldToken))) {
+        score += weight * 2;
+        matchedTokens.add(token);
+      } else if (value.includes(token)) {
+        score += weight;
+        matchedTokens.add(token);
+      }
+    }
+  }
+  if (prepared.keywordPhrases.length > 0) {
+    const weight = FIELD_WEIGHTS.keywords;
+    let phraseScore = 0;
+    for (const phrase of prepared.keywordPhrases) {
+      if (phrase === normalizedQuery) {
+        phraseScore = Math.max(phraseScore, weight * 14);
+        phraseMatched = true;
+        wholeFieldExact = true;
+      } else if (phrase.startsWith(normalizedQuery)) {
+        phraseScore = Math.max(phraseScore, weight * 9);
+        phraseMatched = true;
+      } else if (phrase.includes(normalizedQuery)) {
+        phraseScore = Math.max(phraseScore, weight * 6);
+        phraseMatched = true;
+      }
+    }
+    score += phraseScore;
+    for (const token of queryTokens) {
+      if (prepared.keywordTokens.includes(token)) {
+        score += weight * 4;
+        matchedTokens.add(token);
+      } else if (prepared.keywordTokens.some((keywordToken) => keywordToken.startsWith(token) || keywordToken.length >= MIN_STEM_LENGTH && token.startsWith(keywordToken))) {
+        score += weight * 2;
+        matchedTokens.add(token);
+      } else if (prepared.keywordPhrases.some((phrase) => phrase.includes(token))) {
+        score += weight;
+        matchedTokens.add(token);
+      }
+    }
+  }
+  const coverage = matchedTokens.size / queryTokens.length;
+  if (!phraseMatched && (queryTokens.length <= 2 ? coverage !== 1 : coverage < 0.6))
+    return null;
+  score += coverage === 1 ? 25 : Math.round(coverage * 10);
+  const firstQueryToken = queryTokens[0];
+  if (firstQueryToken !== undefined && prepared.nameTokens.includes(firstQueryToken))
+    score += 8;
+  if (wholeFieldExact)
+    score += 20;
+  return score;
+}
+export function scoreToolMatch(tool, server, query, keywords) {
+  const normalizedQuery = normalizeSearchText(query).trim();
+  const queryTokens = tokenize(query);
+  if (queryTokens.length === 0)
+    return null;
+  return scorePreparedToolMatch(prepareToolSearch(tool, server, keywords), normalizedQuery, queryTokens);
+}
+function getPreparedTools(state, serverName, metadata, definition, globalPrefix, includeKeywords) {
+  let stateCache = searchCache.get(state);
+  if (!stateCache) {
+    stateCache = new Map;
+    searchCache.set(state, stateCache);
+  }
+  const toolPrefix = resolveToolPrefix(definition, globalPrefix);
+  let cached = stateCache.get(serverName);
+  if (cached?.metadata !== metadata || cached.searchKeywords !== definition?.searchKeywords || cached.toolPrefix !== toolPrefix) {
+    cached = { metadata, searchKeywords: definition?.searchKeywords, toolPrefix };
+    stateCache.set(serverName, cached);
+  }
+  const cacheKey = includeKeywords ? "withKeywords" : "withoutKeywords";
+  let prepared = cached[cacheKey];
+  if (!prepared) {
+    prepared = metadata.map((tool) => prepareToolSearch(tool, serverName, includeKeywords && definition?.searchKeywords !== undefined ? resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix) : undefined));
+    cached[cacheKey] = prepared;
+  }
+  return prepared;
+}
+export function rankToolMatches(state, query, server, includeKeywords = true) {
+  const matches = [];
+  const normalizedQuery = normalizeSearchText(query).trim();
+  const queryTokens = tokenize(query);
+  if (queryTokens.length === 0)
+    return matches;
+  const globalPrefix = state.config.settings?.toolPrefix ?? "server";
+  for (const [serverName, metadata] of state.toolMetadata.entries()) {
+    if (server && serverName !== server)
+      continue;
+    const definition = state.config.mcpServers[serverName];
+    if (isServerDisabled(definition))
+      continue;
+    if (isServerInActiveFailureBackoff(state, serverName))
+      continue;
+    for (const prepared of getPreparedTools(state, serverName, metadata, definition, globalPrefix, includeKeywords)) {
+      const score = scorePreparedToolMatch(prepared, normalizedQuery, queryTokens);
+      if (score !== null)
+        matches.push({ server: serverName, tool: prepared.tool, score });
+    }
+  }
+  return matches.sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name));
+}
+export function paginate(items, offset, limit) {
+  const safeOffset = Number.isFinite(offset) ? Math.max(0, Math.trunc(offset)) : 0;
+  const safeLimit = Number.isFinite(limit) ? Math.max(1, Math.trunc(limit)) : 1;
+  const total = items.length;
+  const page = items.slice(safeOffset, safeOffset + safeLimit);
+  const nextOffset = safeOffset + page.length;
+  return {
+    items: page,
+    total,
+    hasMore: nextOffset < total,
+    nextOffset: nextOffset < total ? nextOffset : null
+  };
+}
+export function rankSuggestions(state, name, limit) {
+  const stripped = Object.keys(state.config.mcpServers).flatMap((server) => ["server", "short", "mcp"].map((prefix) => getServerPrefix(server, prefix))).filter((candidate) => Boolean(candidate) && name.startsWith(`${candidate}_`)).sort((a, b) => b.length - a.length).map((candidate) => name.slice(candidate.length + 1));
+  const query = stripped[0] ?? name;
+  return rankToolMatches(state, query, undefined, false).slice(0, limit).map((match) => match.tool.name);
+}