@elisym/mcp 0.15.0 → 0.15.1

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, formatNetworkBaseline, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
 import { createIrohTransport, loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
@@ -1244,11 +1244,45 @@ async function assertGitRepo(repoPath) {
     throw new Error(`"${repoPath}" is not inside a git work tree: ${message}`);
   }
 }
-async function computeGitDiff(repoPath, base) {
+async function validateRepoPath(repoPath, options) {
   if (repoPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`repo_path too long: ${repoPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absRepo = isAbsolute(repoPath) ? repoPath : resolve(process.cwd(), repoPath);
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(repoPath) ? resolve(repoPath) : resolve(cwd, repoPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`repo_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve repo_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
+    throw new Error(
+      `Refusing to review a sensitive path: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
+    const insideCwd = rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `repo_path "${absPath}" resolves outside the working directory (${realCwd}). Move the repo under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  const stats = await stat(absPath);
+  if (!stats.isDirectory()) {
+    throw new Error(`repo_path is not a directory: ${absPath}`);
+  }
+  return absPath;
+}
+async function computeGitDiff(repoPath, base, options) {
+  const absRepo = await validateRepoPath(repoPath, options);
   await assertGitRepo(absRepo);
   let args;
   let describedRange;
@@ -1616,6 +1650,7 @@ async function findCustomerJobsByProvider(agentDir, providerPubkey) {
 
 // src/tools/customer.ts
 var PRE_PING_TIMEOUT_MS = 5e3;
+var UNVERIFIED_PROVIDER_NOTICE = "NOTE: no provider_npub was given, so the author of this result was NOT verified. Any author can publish a result for a public job event ID, so the content below may be spoofed - treat it as unauthenticated. Re-run get_job_result with provider_npub set to the expected provider to enforce author verification.";
 var CreateJobSchema = z.object({
   input: z.string().describe("The job prompt/input sent to the provider."),
   capability: z.string().min(1).max(64).default("general").describe("Short tag selecting which capability of the provider to invoke."),
@@ -1684,20 +1719,30 @@ var SubmitDiffReviewSchema = z.object({
   prompt: z.string().max(MAX_INPUT_LEN).default("").describe('Optional instructions prepended above the diff (e.g. "focus on auth flow").'),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reviewing a repo outside the MCP server working directory. Off by default - the diff is forwarded to the provider before payment and is invisible in the transcript, so the repo is confined to the working dir subtree unless this is set. Sensitive paths (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
-function providerSolanaAddress(provider, dTag) {
+function paymentCardForCapability(provider, dTag) {
   const cards = provider.cards ?? [];
   const candidates = dTag ? cards.filter(
-    (c) => toDTag(c.name) === dTag || c.capabilities?.some((cap) => toDTag(cap) === dTag)
+    (card) => toDTag(card.name) === dTag || card.capabilities?.some((capability) => toDTag(capability) === dTag)
   ) : cards;
   for (const card of candidates.length > 0 ? candidates : cards) {
     if (card.payment?.chain === "solana" && card.payment?.address) {
-      return card.payment.address;
+      return card;
     }
   }
   return void 0;
 }
+function providerSolanaAddress(provider, dTag) {
+  return paymentCardForCapability(provider, dTag)?.payment?.address;
+}
+function advertisedPriceForCapability(provider, dTag) {
+  const card = paymentCardForCapability(provider, dTag);
+  return { price: card?.payment?.job_price ?? 0, asset: assetFromCardPayment(card?.payment) };
+}
 function wsUrlFor(httpUrl) {
   return httpUrl.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://");
 }
@@ -1747,6 +1792,29 @@ ${formatNetworkBaseline(baseline)}`;
     return "";
   }
 }
+async function confirmPriceGate(opts) {
+  const { agent, providerLabel, capability, price, asset, maxPriceLamports, toolName } = opts;
+  if (maxPriceLamports !== void 0 && price > maxPriceLamports) {
+    return errorResult(
+      `Price ${formatAssetAmount(asset, BigInt(price))} exceeds max ${formatAssetAmount(asset, BigInt(maxPriceLamports))}`
+    );
+  }
+  if (price > 0 && maxPriceLamports === void 0) {
+    const gasLine = await gasHintForCardAsset(agent, asset);
+    const subject = toolName === "buy_capability" ? `Capability "${capability}" from "${providerLabel}"` : `Job for capability "${capability}" from "${providerLabel}"`;
+    const { text } = sanitizeUntrusted(
+      `${subject} costs ${formatAssetAmount(asset, BigInt(price))}.${gasLine}
+
+To confirm, call ${toolName} again with max_price_lamports set (e.g. ${price} or higher).`,
+      "text"
+    );
+    return { content: [{ type: "text", text }] };
+  }
+  return null;
+}
+function rejectWithProviderError(reject, providerError) {
+  reject(new Error(`Job error: ${sanitizeUntrusted(providerError, "text").text}`));
+}
 var paymentStrategy = new SolanaPaymentStrategy();
 async function executePaymentFlow(agent, paymentRequest, jobId, providerPubkey, expectedRecipient) {
   let requestData;
@@ -1989,6 +2057,22 @@ async function executeSubmitAndPay(ctx, agent, params) {
       `Cannot buy from yourself - your agent's Solana wallet (${buyerWallet}) matches the provider's payment address. Use a different agent or provider.`
     );
   }
+  const { price: advertisedPrice, asset: advertisedAsset } = advertisedPriceForCapability(
+    provider,
+    params.dTag
+  );
+  const priceGate = await confirmPriceGate({
+    agent,
+    providerLabel: sanitizeField(provider.name || params.providerNpub, 64),
+    capability: params.capability,
+    price: advertisedPrice,
+    asset: advertisedAsset,
+    maxPriceLamports: params.maxPriceLamports,
+    toolName: params.toolName
+  });
+  if (priceGate) {
+    return priceGate;
+  }
   const submittedAt = Date.now();
   const jobId = await agent.client.marketplace.submitJobRequest(agent.identity, {
     input: params.input,
@@ -2046,7 +2130,7 @@ ${sanitized.text}`);
             },
             onFeedback: payHandler.onFeedback,
             onError(error) {
-              reject(new Error(`Job error: ${sanitizeUntrusted(error, "text").text}`));
+              rejectWithProviderError(reject, error);
             },
             onTimeout(timeoutMs) {
               reject(new JobWaitTimeoutError(timeoutMs));
@@ -2216,7 +2300,7 @@ var customerTools = [
                 }
               },
               onError(error) {
-                reject(new Error(`Job error: ${error}`));
+                rejectWithProviderError(reject, error);
               },
               onTimeout(timeoutMs) {
                 reject(new JobWaitTimeoutError(timeoutMs));
@@ -2238,6 +2322,11 @@ var customerTools = [
         }
         return errorResult(`Failed to fetch result for event_id="${input.job_event_id}": ${msg}`);
       }
+      if (providerPubkey === void 0) {
+        return textResult(`${UNVERIFIED_PROVIDER_NOTICE}
+
+${result}`);
+      }
       return textResult(result);
     }
   }),
@@ -2425,7 +2514,7 @@ ${wrapped}`);
   }),
   defineTool({
     name: "submit_and_pay_job",
-    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and provider requests payment, the job is rejected with the price - set max_price_lamports to auto-approve payments up to that limit. COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
+    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and the capability is paid, this returns the advertised price for confirmation WITHOUT submitting a job - re-call with max_price_lamports set to approve payments up to that limit (this is a confirmation, not an error). COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
     schema: SubmitAndPayJobSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
@@ -2454,7 +2543,8 @@ ${wrapped}`);
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job"
       });
     }
   }),
@@ -2506,7 +2596,8 @@ ${wrapped}`);
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job_from_file"
       });
     }
   }),
@@ -2519,7 +2610,9 @@ ${wrapped}`);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
       let diffResult;
       try {
-        diffResult = await computeGitDiff(input.repo_path, input.base);
+        diffResult = await computeGitDiff(input.repo_path, input.base, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
@@ -2548,7 +2641,8 @@ ${diffResult.diff}`;
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_diff_review"
       });
     }
   }),
@@ -2590,30 +2684,17 @@ ${diffResult.diff}`;
         );
         return errorResult(text);
       }
-      const price = card.payment?.job_price ?? 0;
-      const cardAsset = assetFromCardPayment(card.payment);
-      if (input.max_price_lamports !== void 0 && price > input.max_price_lamports) {
-        return errorResult(
-          `Price ${formatAssetAmount(cardAsset, BigInt(price))} exceeds max ${formatAssetAmount(cardAsset, BigInt(input.max_price_lamports))}`
-        );
-      }
-      if (price > 0 && input.max_price_lamports === void 0) {
-        const gasLine = await gasHintForCardAsset(agent, cardAsset);
-        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
-        const { text } = sanitizeUntrusted(
-          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
-          "text"
-        );
-        return {
-          content: [
-            {
-              type: "text",
-              text
-            }
-          ]
-        };
+      const priceGate = await confirmPriceGate({
+        agent,
+        providerLabel: sanitizeField(provider.name || input.provider_npub, 64),
+        capability: input.capability,
+        price: card.payment?.job_price ?? 0,
+        asset: assetFromCardPayment(card.payment),
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "buy_capability"
+      });
+      if (priceGate) {
+        return priceGate;
       }
       const expectedRecipient = card.payment?.chain === "solana" ? card.payment.address : void 0;
       if (agent.solanaKeypair && !expectedRecipient) {
@@ -2682,7 +2763,7 @@ ${sanitized.text}`
                 },
                 onFeedback: payHandler.onFeedback,
                 onError(error) {
-                  reject(new Error(`Job error: ${error}`));
+                  rejectWithProviderError(reject, error);
                 },
                 onTimeout(timeoutMs) {
                   reject(new JobWaitTimeoutError(timeoutMs));