@fkom13/mcp-sftp-orchestrator 11.3.0 → 11.8.0

package/apis.js

@@ -1,105 +1,44 @@
-import fs from 'fs/promises';
 import path from 'path';
 import config from './config.js';
+import jsonStore from './atomicJsonStore.js';
 
 const APIS_FILE = path.join(config.dataDir, 'apis.json');
+const EMPTY = {};
 
-let apis = {};
-
-let isInitialized = false;
-let initPromise = null;
-
-// Charger les APIs au démarrage
 async function loadApis() {
-    try {
-        const data = await fs.readFile(APIS_FILE, 'utf-8');
-        apis = JSON.parse(data);
-    } catch (err) {
-        if (err.code === 'ENOENT') {
-            // Le fichier n'existe pas encore, c'est normal
-            apis = {};
-        } else {
-            console.error("Erreur lors du chargement de apis.json:", err);
-        }
-    }
-}
-
-async function ensureInitialized() {
-    if (isInitialized) return;
-    if (!initPromise) {
-        initPromise = loadApis().then(() => { isInitialized = true; });
-    }
-    return initPromise;
+    return jsonStore.readJson(APIS_FILE, EMPTY);
 }
 
-// Sauvegarder les APIs
-async function saveApis() {
-    await ensureInitialized();
-    try {
-        await fs.writeFile(APIS_FILE, JSON.stringify(apis, null, 2));
-    } catch (err) {
-        console.error("Erreur lors de la sauvegarde de apis.json:", err);
-    }
-}
-
-// Ajouter ou mettre à jour une API
 async function addApi(alias, apiConfig) {
-    await ensureInitialized();
-    
-    // Validation
-    if (!alias || typeof alias !== 'string') {
-        throw new Error("L'alias doit être une chaîne non vide.");
-    }
-    
-    if (!apiConfig.url) {
-        throw new Error("L'URL de l'API est obligatoire.");
-    }
-    
-    // Valider l'URL
-    try {
-        new URL(apiConfig.url);
-    } catch (e) {
-        throw new Error(`URL invalide: ${apiConfig.url}`);
-    }
-    
-    apis[alias] = apiConfig;
-    await saveApis();
+    if (!alias || typeof alias !== 'string') throw new Error("L'alias doit être une chaîne non vide.");
+    if (!apiConfig.url) throw new Error("L'URL de l'API est obligatoire.");
+    try { new URL(apiConfig.url); } catch { throw new Error(`URL invalide: ${apiConfig.url}`); }
+
+    await jsonStore.updateJson(APIS_FILE, EMPTY, (apis) => {
+        apis[alias] = apiConfig;
+        return apis;
+    });
     return { success: true, message: `API '${alias}' ajoutée/mise à jour avec succès.` };
 }
 
-// Lister toutes les APIs
 async function listApis() {
-    await ensureInitialized();
-    return apis;
+    return loadApis();
 }
 
-// Obtenir une API par son alias
 async function getApi(alias) {
-    await ensureInitialized();
+    const apis = await loadApis();
     const apiConfig = apis[alias];
-    if (!apiConfig) {
-        throw new Error(`L'alias d'API '${alias}' est inconnu.`);
-    }
+    if (!apiConfig) throw new Error(`L'alias d'API '${alias}' est inconnu.`);
     return apiConfig;
 }
 
-// Supprimer une API
 async function removeApi(alias) {
-    await ensureInitialized();
-    if (!apis[alias]) {
-        throw new Error(`L'alias d'API '${alias}' est inconnu.`);
-    }
-    delete apis[alias];
-    await saveApis();
+    await jsonStore.updateJson(APIS_FILE, EMPTY, (apis) => {
+        if (!apis[alias]) throw new Error(`L'alias d'API '${alias}' est inconnu.`);
+        delete apis[alias];
+        return apis;
+    });
     return { success: true, message: `API '${alias}' supprimée avec succès.` };
 }
 
-// Initialiser le module
-ensureInitialized();
-
-export default {
-    addApi,
-    listApis,
-    getApi,
-    removeApi
-};
+export default { addApi, listApis, getApi, removeApi };

package/atomicJsonStore.js

@@ -0,0 +1,117 @@
+import fs from 'fs/promises';
+import path from 'path';
+import crypto from 'crypto';
+
+/**
+ * AtomicJsonStore — primitive commune pour les petits registres JSON du MCP.
+ *
+ * Garanties intra-processus :
+ * - update(file) sérialise read -> mutate -> write par fichier ;
+ * - écriture via temp unique + fsync + rename atomique ;
+ * - backup .bak du dernier fichier valide avant remplacement ;
+ * - permissions du temp forcées à 0600 (les registres peuvent contenir des secrets) ;
+ * - un JSON corrompu n'est plus silencieusement remplacé par {} : tentative .bak,
+ *   puis erreur explicite si aucune copie valide n'existe.
+ *
+ * Ce verrou protège les appels concurrents du même process MCP. Pour le SaaS
+ * multi-instance, la persistance devra migrer vers DB/transaction ou un lock distribué.
+ */
+
+const tails = new Map();
+
+function clone(value) {
+    return value === undefined ? undefined : structuredClone(value);
+}
+
+async function withLock(file, fn) {
+    const key = path.resolve(file);
+    const prev = tails.get(key) || Promise.resolve();
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    const tail = prev.catch(() => {}).then(() => gate);
+    tails.set(key, tail);
+
+    await prev.catch(() => {});
+    try {
+        return await fn();
+    } finally {
+        release();
+        if (tails.get(key) === tail) tails.delete(key);
+    }
+}
+
+async function parseFile(file) {
+    const text = await fs.readFile(file, 'utf8');
+    return JSON.parse(text);
+}
+
+async function readJson(file, fallback, { createIfMissing = false } = {}) {
+    try {
+        return await parseFile(file);
+    } catch (err) {
+        if (err?.code === 'ENOENT') {
+            const value = clone(fallback);
+            if (createIfMissing) await writeJsonAtomic(file, value, { backup: false });
+            return value;
+        }
+
+        // Parse/I/O error : récupérer la dernière copie saine si possible.
+        try {
+            return await parseFile(`${file}.bak`);
+        } catch {
+            const wrapped = new Error(`JSON store illisible: ${file} (${err.message})`);
+            wrapped.code = 'JSON_STORE_CORRUPT';
+            wrapped.cause = err;
+            throw wrapped;
+        }
+    }
+}
+
+async function writeJsonAtomic(file, value, { backup = true } = {}) {
+    await fs.mkdir(path.dirname(file), { recursive: true });
+
+    if (backup) {
+        try { await fs.copyFile(file, `${file}.bak`); } catch (e) {
+            if (e?.code !== 'ENOENT') throw e;
+        }
+    }
+
+    const tmp = `${file}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    let handle = null;
+    try {
+        handle = await fs.open(tmp, 'w', 0o600);
+        await handle.writeFile(JSON.stringify(value, null, 2));
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await fs.rename(tmp, file);
+    } catch (err) {
+        if (handle) await handle.close().catch(() => {});
+        await fs.rm(tmp, { force: true }).catch(() => {});
+        throw err;
+    }
+}
+
+async function ensureJson(file, fallback) {
+    return withLock(file, async () => readJson(file, fallback, { createIfMissing: true }));
+}
+
+async function updateJson(file, fallback, mutator, options = {}) {
+    return withLock(file, async () => {
+        const current = await readJson(file, fallback, { createIfMissing: false });
+        const next = await mutator(current);
+        const value = next === undefined ? current : next;
+        await writeJsonAtomic(file, value, options);
+        return value;
+    });
+}
+
+export default {
+    withLock,
+    readJson,
+    writeJsonAtomic,
+    ensureJson,
+    updateJson
+};
+
+export { withLock, readJson, writeJsonAtomic, ensureJson, updateJson };

package/config.js

@@ -21,6 +21,7 @@ const args = process.argv.slice(2).reduce((acc, arg) => {
 }, {});
 
 const config = {
+    version: '11.8.0',
     dataDir: args['data-dir'] || process.env.MCP_DATA_DIR || path.join(os.homedir(), '.config', 'mcp-orchestrator'),
     
     // Timeouts en millisecondes (plus cohérent)
@@ -37,6 +38,10 @@ const config = {
     
     // Sécurité
     allowedRoots: (process.env.MCP_ALLOWED_ROOTS || '').split(',').map(s => s.trim()).filter(Boolean),
+    // Mode lecture seule : refuse écritures / exec mutantes (exploration safe)
+    readOnly: process.env.MCP_READONLY === 'true' || process.env.MCP_READONLY === '1',
+    // Réponses compactes (moins de tokens agent)
+    compact: process.env.MCP_COMPACT === 'true' || process.env.MCP_COMPACT === '1',
     
     // Configuration Queue
     maxQueueSize: parseInt(process.env.MAX_QUEUE_SIZE || '1000', 10),

package/fleet.js

@@ -0,0 +1,170 @@
+/**
+ * fleet.js — Diagnostic parallèle du parc (ping SSH + ressources légères).
+ */
+import queue from './queue.js';
+import servers from './servers.js';
+import sshPool from './sshPool.js';
+import utils from './utils.js';
+
+const PROBE_CMD = `echo OK; date -u +%Y-%m-%dT%H:%M:%SZ; uptime; free -h 2>/dev/null | head -2; df -h / 2>/dev/null | tail -1`;
+
+/**
+ * Probe un serveur : latence handshake + commande légère.
+ * Retourne { alias, ok, latencyMs, host, user, output?, error?, resources? }
+ */
+async function probeServer(alias, timeoutMs = 15000) {
+    const started = Date.now();
+    let connection = null;
+
+    try {
+        const serverConfig = await servers.getServer(alias);
+        // Vérifier que la clé existe (fail rapide)
+        if (serverConfig.keyPath) {
+            const fs = await import('fs/promises');
+            try {
+                await fs.access(serverConfig.keyPath);
+            } catch {
+                return {
+                    alias,
+                    ok: false,
+                    latencyMs: Date.now() - started,
+                    host: serverConfig.host,
+                    user: serverConfig.user,
+                    port: utils.resolveSshPort(serverConfig),
+                    error: `Clé SSH introuvable: ${serverConfig.keyPath}`
+                };
+            }
+        }
+
+        connection = await Promise.race([
+            sshPool.getConnection(alias, serverConfig),
+            new Promise((_, reject) =>
+                setTimeout(() => reject(new Error(`Timeout connexion ${timeoutMs}ms`)), timeoutMs)
+            )
+        ]);
+
+        const latencyMs = Date.now() - started;
+        const output = await execOnClient(connection.client, PROBE_CMD, Math.max(5000, timeoutMs - latencyMs));
+
+        return {
+            alias,
+            ok: true,
+            latencyMs,
+            host: serverConfig.host,
+            user: serverConfig.user,
+            port: utils.resolveSshPort(serverConfig),
+            output: (output || '').trim().slice(0, 800),
+            resources: parseLightResources(output)
+        };
+    } catch (err) {
+        let host = null, user = null, port = 22;
+        try {
+            const sc = await servers.getServer(alias);
+            host = sc.host; user = sc.user; port = utils.resolveSshPort(sc);
+        } catch { /* alias inconnu */ }
+
+        return {
+            alias,
+            ok: false,
+            latencyMs: Date.now() - started,
+            host,
+            user,
+            port,
+            error: err.message
+        };
+    } finally {
+        if (connection) {
+            try { sshPool.releaseConnection(connection.id); } catch { /* ignore */ }
+        }
+    }
+}
+
+function execOnClient(client, cmd, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                reject(new Error(`Timeout exec ${timeoutMs}ms`));
+            }
+        }, timeoutMs);
+
+        client.exec(cmd, (err, stream) => {
+            if (err) {
+                clearTimeout(timer);
+                if (!settled) { settled = true; reject(err); }
+                return;
+            }
+            let out = '';
+            stream.on('data', d => { out += d.toString(); });
+            stream.stderr.on('data', d => { out += d.toString(); });
+            stream.on('close', (code) => {
+                clearTimeout(timer);
+                if (settled) return;
+                settled = true;
+                if (code !== 0 && code !== null) {
+                    // Certaines distros n'ont pas free -h : on accepte quand même si OK en tête
+                    if (out.includes('OK')) resolve(out);
+                    else reject(new Error(`exit ${code}: ${out.slice(0, 200)}`));
+                } else {
+                    resolve(out);
+                }
+            });
+        });
+    });
+}
+
+function parseLightResources(output) {
+    if (!output) return null;
+    const resources = { load: null, disk_use: null, mem_line: null };
+    try {
+        const loadMatch = output.match(/load average:\s*([0-9.,\s]+)/i);
+        if (loadMatch) resources.load = loadMatch[1].trim();
+        const lines = output.split('\n');
+        const mem = lines.find(l => /^\s*Mem:/i.test(l));
+        if (mem) resources.mem_line = mem.trim();
+        const disk = lines.find(l => /\/\s*$/.test(l.trim()) || l.includes('%'));
+        // dernière ligne df souvent "… 42% /"
+        const df = [...lines].reverse().find(l => /\d+%/.test(l) && l.includes('/'));
+        if (df) {
+            const m = df.match(/(\d+%)/);
+            if (m) resources.disk_use = m[1];
+        }
+    } catch { /* ignore */ }
+    return resources;
+}
+
+/**
+ * Status de tout le parc (ou d'une liste d'alias).
+ * options = { aliases?: string[], timeoutMs?: number }
+ */
+async function fleetStatus(options = {}) {
+    const all = await servers.listServers();
+    let aliases = options.aliases;
+
+    if (!aliases || aliases.length === 0) {
+        aliases = Object.keys(all);
+    }
+
+    // Résolution group: / all déjà faite en amont idéalement
+    const timeoutMs = options.timeoutMs || 15000;
+    queue.log('info', `fleet_status: probe de ${aliases.length} serveur(s)...`);
+
+    const results = await Promise.all(
+        aliases.map(alias => probeServer(alias, timeoutMs))
+    );
+
+    const ok = results.filter(r => r.ok).length;
+    const failed = results.filter(r => !r.ok);
+
+    return {
+        total: results.length,
+        online: ok,
+        offline: failed.length,
+        results: results.sort((a, b) => a.alias.localeCompare(b.alias)),
+        failed_aliases: failed.map(r => r.alias),
+        timestamp: new Date().toISOString()
+    };
+}
+
+export default { probeServer, fleetStatus };

package/groups.js

@@ -0,0 +1,25 @@
+/** Groupes d'alias serveurs. Stockage atomique: <dataDir>/server_groups.json */
+import path from 'path';
+import config from './config.js';
+import servers from './servers.js';
+import jsonStore from './atomicJsonStore.js';
+const GROUPS_PATH = path.join(config.dataDir, 'server_groups.json');
+const DEFAULT_GROUPS = { oci:['fkomprodmini1_prod','fkomprodmini2_prod','fkomprodmini2_vpn'], contabo:['vps_contabo'], vpsparfait:['vpsparfait_fkomp','vpsparfait2_fkomp'], local:['pc1_tailscale'] };
+const loadGroups = () => jsonStore.readJson(GROUPS_PATH, DEFAULT_GROUPS);
+async function listGroups(){ return loadGroups(); }
+async function setGroup(name, aliases){
+ if(!name || !/^[a-zA-Z0-9_-]+$/.test(name)) throw new Error("Nom de groupe invalide (alphanumérique, _ ou -).");
+ if(!Array.isArray(aliases)||!aliases.length) throw new Error("aliases doit être un tableau non vide d'alias serveurs.");
+ const all=await servers.listServers(); const unknown=aliases.filter(a=>!all[a]); if(unknown.length) throw new Error(`Alias inconnus: ${unknown.join(', ')}. Utilisez server_list.`);
+ const unique=[...new Set(aliases)]; await jsonStore.updateJson(GROUPS_PATH,DEFAULT_GROUPS,g=>{g[name]=unique;return g;}); return {success:true,group:name,aliases:unique};
+}
+async function removeGroup(name){ await jsonStore.updateJson(GROUPS_PATH,DEFAULT_GROUPS,g=>{if(!g[name]) throw new Error(`Groupe '${name}' introuvable.`); delete g[name]; return g;}); return {success:true,message:`Groupe '${name}' supprimé.`}; }
+async function resolveAliases(aliasInput){
+ const allServers=await servers.listServers(), allKeys=Object.keys(allServers); if(aliasInput==null||aliasInput==='') throw new Error("Alias requis.");
+ if(Array.isArray(aliasInput)){ const expanded=[]; for(const a of aliasInput){ if(String(a).startsWith('group:')) expanded.push(...await expandGroup(String(a).slice(6))); else {if(!allServers[a]) throw new Error(`Alias inconnu: ${a}`); expanded.push(a);} } return [...new Set(expanded)]; }
+ if(aliasInput==='all') return allKeys; if(String(aliasInput).startsWith('group:')) return expandGroup(String(aliasInput).slice(6));
+ if(!allServers[aliasInput]){ const groups=await loadGroups(); if(groups[aliasInput]) return expandGroup(aliasInput); throw new Error(`Alias de serveur '${aliasInput}' est inconnu. Utilisez server_list ou group:<nom>.`); }
+ return [aliasInput];
+}
+async function expandGroup(name){ const groups=await loadGroups(); if(!groups[name]) throw new Error(`Groupe '${name}' introuvable. Groupes: ${Object.keys(groups).join(', ') || '(aucun)'}`); const all=await servers.listServers(); const aliases=groups[name].filter(a=>all[a]); if(!aliases.length) throw new Error(`Groupe '${name}' ne contient aucun alias valide actuellement.`); return aliases; }
+export default {listGroups,setGroup,removeGroup,resolveAliases,expandGroup};

package/history.js

@@ -1,51 +1,5 @@
-import fs from 'fs/promises';
-import path from 'path';
-import config from './config.js';
-const HISTORY_FILE_PATH = path.join(config.dataDir, 'history.json');
-
-async function readHistory() {
-    try {
-        await fs.access(HISTORY_FILE_PATH);
-        const data = await fs.readFile(HISTORY_FILE_PATH, 'utf-8');
-        return JSON.parse(data);
-    } catch (error) {
-        return [];
-    }
-}
-
-async function writeHistory(history) {
-    try {
-        await fs.writeFile(HISTORY_FILE_PATH, JSON.stringify(history, null, 2));
-    } catch (error) {
-        // Silently fail or log if possible, but don't crash
-        if (process.env.MCP_DEBUG === 'true') {
-            console.error(`[ERROR] Failed to write history: ${error.message}`);
-        }
-    }
-}
-
-async function logTask(jobDetails) {
-    const history = await readHistory();
-    const logEntry = {
-        jobId: jobDetails.id,
-        timestamp: new Date().toISOString(),
-        type: jobDetails.type,
-        alias: jobDetails.alias,
-        command: jobDetails.type === 'ssh' ? jobDetails.cmd : `${jobDetails.direction} ${jobDetails.local} -> ${jobDetails.remote}`
-    };
-    history.unshift(logEntry); // Ajoute au début
-    if (history.length > 500) { // Garde les 500 dernières commandes
-        history.pop();
-    }
-    await writeHistory(history);
-}
-
-async function getHistory(filters = {}) {
-    let history = await readHistory();
-    if (filters.alias) {
-        history = history.filter(log => log.alias === filters.alias);
-    }
-    return history;
-}
-
-export default { logTask, getHistory };
+import path from 'path'; import config from './config.js'; import jsonStore from './atomicJsonStore.js';
+const HISTORY_FILE_PATH=path.join(config.dataDir,'history.json');
+async function logTask(jobDetails){const logEntry={jobId:jobDetails.id,timestamp:new Date().toISOString(),type:jobDetails.type,alias:jobDetails.alias,command:jobDetails.type==='ssh'?jobDetails.cmd:`${jobDetails.direction} ${jobDetails.local} -> ${jobDetails.remote}`}; try{await jsonStore.updateJson(HISTORY_FILE_PATH,[],h=>{h.unshift(logEntry);if(h.length>500)h.length=500;return h;});}catch(error){if(process.env.MCP_DEBUG==='true')console.error(`[ERROR] Failed to write history: ${error.message}`);}}
+async function getHistory(filters={}){let h=await jsonStore.readJson(HISTORY_FILE_PATH,[]);if(filters.alias)h=h.filter(x=>x.alias===filters.alias);return h;}
+export default {logTask,getHistory};