@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/mcp/oauth-provider.js

@@ -0,0 +1,149 @@
+import { randomBytes } from "node:crypto";
+import { VERSION } from "../../config.js";
+function randomState() {
+    return randomBytes(24).toString("base64url");
+}
+function assertHttpsEndpoint(value, label) {
+    if (!value) {
+        throw new Error(`MCP OAuth ${label} is missing`);
+    }
+    const url = new URL(value);
+    if (url.protocol !== "https:") {
+        throw new Error(`MCP OAuth ${label} must use HTTPS`);
+    }
+    if (url.username || url.password || url.hash) {
+        throw new Error(`MCP OAuth ${label} must not include userinfo or fragments`);
+    }
+}
+function getDeviceAuthorizationEndpoint(metadata) {
+    const value = metadata.device_authorization_endpoint;
+    return typeof value === "string" ? value : undefined;
+}
+function assertSafeDiscoveryState(state) {
+    assertHttpsEndpoint(state.authorizationServerUrl, "authorization server URL");
+    if (!state.authorizationServerMetadata) {
+        throw new Error("MCP OAuth authorization server metadata is required");
+    }
+    assertHttpsEndpoint(state.authorizationServerMetadata.authorization_endpoint, "authorization endpoint");
+    assertHttpsEndpoint(state.authorizationServerMetadata.token_endpoint, "token endpoint");
+    if (state.authorizationServerMetadata.registration_endpoint) {
+        assertHttpsEndpoint(state.authorizationServerMetadata.registration_endpoint, "registration endpoint");
+    }
+    const deviceEndpoint = getDeviceAuthorizationEndpoint(state.authorizationServerMetadata);
+    if (deviceEndpoint) {
+        assertHttpsEndpoint(deviceEndpoint, "device authorization endpoint");
+    }
+    if (state.resourceMetadataUrl) {
+        assertHttpsEndpoint(state.resourceMetadataUrl, "resource metadata URL");
+    }
+    for (const authorizationServer of state.resourceMetadata?.authorization_servers ?? []) {
+        assertHttpsEndpoint(authorizationServer, "protected-resource authorization server");
+    }
+}
+function staticClientInformation(server) {
+    const clientId = server.auth?.clientId?.trim();
+    if (!clientId) {
+        return undefined;
+    }
+    return {
+        client_id: clientId,
+        ...(server.auth?.clientSecret ? { client_secret: server.auth.clientSecret } : {}),
+        ...(server.auth?.tokenEndpointAuthMethod
+            ? { token_endpoint_auth_method: server.auth.tokenEndpointAuthMethod }
+            : {}),
+    };
+}
+function clientMetadata(options) {
+    const redirectUrl = String(options.redirectUrl ?? "http://127.0.0.1/mcp/oauth/callback");
+    const auth = options.server.auth;
+    return {
+        redirect_uris: [redirectUrl],
+        token_endpoint_auth_method: auth?.tokenEndpointAuthMethod ?? (auth?.clientSecret ? "client_secret_basic" : "none"),
+        grant_types: ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
+        response_types: ["code"],
+        client_name: options.clientName ?? "Volt",
+        software_version: options.clientVersion ?? VERSION,
+        ...(auth?.scope ? { scope: auth.scope } : {}),
+    };
+}
+export class VoltMcpOAuthProvider {
+    server;
+    store;
+    redirectUrlValue;
+    metadata;
+    authorizationUrlValue;
+    stateValue;
+    onAuthorizationUrl;
+    constructor(options) {
+        this.server = options.server;
+        this.store = options.store;
+        this.redirectUrlValue = options.redirectUrl;
+        this.metadata = clientMetadata(options);
+        this.stateValue = randomState();
+        this.onAuthorizationUrl = options.onAuthorizationUrl;
+    }
+    get redirectUrl() {
+        return this.redirectUrlValue;
+    }
+    get clientMetadataUrl() {
+        return this.server.auth?.clientMetadataUrl;
+    }
+    get clientMetadata() {
+        return this.metadata;
+    }
+    get authorizationUrl() {
+        return this.authorizationUrlValue;
+    }
+    get expectedState() {
+        return this.stateValue;
+    }
+    async state() {
+        this.store.patchRecord(this.server, { state: this.stateValue });
+        return this.stateValue;
+    }
+    clientInformation() {
+        return (staticClientInformation(this.server) ?? this.store.getClientInformation(this.server, this.redirectUrlValue));
+    }
+    saveClientInformation(clientInformation) {
+        if (staticClientInformation(this.server)) {
+            return;
+        }
+        this.store.patchRecord(this.server, { clientInformation });
+    }
+    tokens() {
+        return this.store.getRecord(this.server)?.tokens;
+    }
+    saveTokens(tokens) {
+        this.store.patchRecord(this.server, { tokens });
+    }
+    async redirectToAuthorization(authorizationUrl) {
+        assertHttpsEndpoint(authorizationUrl.toString(), "authorization URL");
+        this.authorizationUrlValue = authorizationUrl;
+        await this.onAuthorizationUrl?.(authorizationUrl);
+    }
+    saveCodeVerifier(codeVerifier) {
+        this.store.patchRecord(this.server, { codeVerifier });
+    }
+    codeVerifier() {
+        const verifier = this.store.getRecord(this.server)?.codeVerifier;
+        if (!verifier) {
+            throw new Error(`Missing MCP OAuth code verifier for ${this.server.id}`);
+        }
+        return verifier;
+    }
+    invalidateCredentials(scope) {
+        this.store.clear(this.server, scope);
+    }
+    saveDiscoveryState(state) {
+        assertSafeDiscoveryState(state);
+        this.store.patchRecord(this.server, { discoveryState: state });
+    }
+    discoveryState() {
+        const state = this.store.getRecord(this.server)?.discoveryState;
+        if (state) {
+            assertSafeDiscoveryState(state);
+        }
+        return state;
+    }
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/core/mcp/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../../src/core/mcp/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAa1C,SAAS,WAAW,GAAW;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAAA,CAC7C;AAED,SAAS,mBAAmB,CAAC,KAAyB,EAAE,KAAa,EAAQ;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,yCAAyC,CAAC,CAAC;IAC9E,CAAC;AAAA,CACD;AAED,SAAS,8BAA8B,CAAC,QAAqC,EAAsB;IAClG,MAAM,KAAK,GAAI,QAAwD,CAAC,6BAA6B,CAAC;IACtG,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,wBAAwB,CAAC,KAA0B,EAAQ;IACnE,mBAAmB,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,mBAAmB,CAAC,KAAK,CAAC,2BAA2B,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IACxG,mBAAmB,CAAC,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;QAC7D,mBAAmB,CAAC,KAAK,CAAC,2BAA2B,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACzF,IAAI,cAAc,EAAE,CAAC;QACpB,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,mBAAmB,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,mBAAmB,IAAI,KAAK,CAAC,gBAAgB,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC;QACvF,mBAAmB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;AAAA,CACD;AAED,SAAS,uBAAuB,CAAC,MAA+B,EAA2C;IAC1G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,SAAS,EAAE,QAAQ;QACnB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB;YACvC,CAAC,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AAAA,CACF;AAED,SAAS,cAAc,CAAC,OAAoC,EAAuB;IAClF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;IACjC,OAAO;QACN,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,0BAA0B,EACzB,IAAI,EAAE,uBAAuB,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;QACvF,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,8CAA8C,CAAC;QACpG,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM;QACzC,gBAAgB,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO;QAClD,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AAAA,CACF;AAED,MAAM,OAAO,oBAAoB;IACxB,MAAM,CAA0B;IAChC,KAAK,CAAgB;IACrB,gBAAgB,CAA2B;IAC3C,QAAQ,CAAsB;IAC9B,qBAAqB,CAAkB;IACvC,UAAU,CAAS;IACnB,kBAAkB,CAAmD;IAE7E,YAAY,OAAoC,EAAE;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAAA,CACrD;IAED,IAAI,WAAW,GAA6B;QAC3C,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAAA,CAC7B;IAED,IAAI,iBAAiB,GAAuB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAA,CAC3C;IAED,IAAI,cAAc,GAAwB;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC;IAAA,CACrB;IAED,IAAI,gBAAgB,GAAoB;QACvC,OAAO,IAAI,CAAC,qBAAqB,CAAC;IAAA,CAClC;IAED,IAAI,aAAa,GAAW;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC;IAAA,CACvB;IAED,KAAK,CAAC,KAAK,GAAoB;QAC9B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,UAAU,CAAC;IAAA,CACvB;IAED,iBAAiB,GAA4C;QAC5D,OAAO,CACN,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAC3G,CAAC;IAAA,CACF;IAED,qBAAqB,CAAC,iBAA8C,EAAQ;QAC3E,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAAA,CAC3D;IAED,MAAM,GAA4B;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAA,CACjD;IAED,UAAU,CAAC,MAAmB,EAAQ;QACrC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAAA,CAChD;IAED,KAAK,CAAC,uBAAuB,CAAC,gBAAqB,EAAiB;QACnE,mBAAmB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;QAC9C,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAAA,CAClD;IAED,gBAAgB,CAAC,YAAoB,EAAQ;QAC5C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAAA,CACtD;IAED,YAAY,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,QAAQ,CAAC;IAAA,CAChB;IAED,qBAAqB,CAAC,KAA6D,EAAQ;QAC1F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAA,CACrC;IAED,kBAAkB,CAAC,KAA0B,EAAQ;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAAA,CAC/D;IAED,cAAc,GAAoC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QAChE,IAAI,KAAK,EAAE,CAAC;YACX,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IAAA,CACb;CACD","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport type { OAuthClientProvider, OAuthDiscoveryState } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type {\n\tAuthorizationServerMetadata,\n\tOAuthClientInformationMixed,\n\tOAuthClientMetadata,\n\tOAuthTokens,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { VERSION } from \"../../config.ts\";\nimport type { McpOAuthStore } from \"./oauth-store.ts\";\nimport type { McpResolvedServerConfig } from \"./types.ts\";\n\nexport interface VoltMcpOAuthProviderOptions {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tredirectUrl?: string | URL;\n\tclientName?: string;\n\tclientVersion?: string;\n\tonAuthorizationUrl?: (url: URL) => void | Promise<void>;\n}\n\nfunction randomState(): string {\n\treturn randomBytes(24).toString(\"base64url\");\n}\n\nfunction assertHttpsEndpoint(value: string | undefined, label: string): void {\n\tif (!value) {\n\t\tthrow new Error(`MCP OAuth ${label} is missing`);\n\t}\n\tconst url = new URL(value);\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(`MCP OAuth ${label} must use HTTPS`);\n\t}\n\tif (url.username || url.password || url.hash) {\n\t\tthrow new Error(`MCP OAuth ${label} must not include userinfo or fragments`);\n\t}\n}\n\nfunction getDeviceAuthorizationEndpoint(metadata: AuthorizationServerMetadata): string | undefined {\n\tconst value = (metadata as { device_authorization_endpoint?: unknown }).device_authorization_endpoint;\n\treturn typeof value === \"string\" ? value : undefined;\n}\n\nfunction assertSafeDiscoveryState(state: OAuthDiscoveryState): void {\n\tassertHttpsEndpoint(state.authorizationServerUrl, \"authorization server URL\");\n\tif (!state.authorizationServerMetadata) {\n\t\tthrow new Error(\"MCP OAuth authorization server metadata is required\");\n\t}\n\tassertHttpsEndpoint(state.authorizationServerMetadata.authorization_endpoint, \"authorization endpoint\");\n\tassertHttpsEndpoint(state.authorizationServerMetadata.token_endpoint, \"token endpoint\");\n\tif (state.authorizationServerMetadata.registration_endpoint) {\n\t\tassertHttpsEndpoint(state.authorizationServerMetadata.registration_endpoint, \"registration endpoint\");\n\t}\n\tconst deviceEndpoint = getDeviceAuthorizationEndpoint(state.authorizationServerMetadata);\n\tif (deviceEndpoint) {\n\t\tassertHttpsEndpoint(deviceEndpoint, \"device authorization endpoint\");\n\t}\n\tif (state.resourceMetadataUrl) {\n\t\tassertHttpsEndpoint(state.resourceMetadataUrl, \"resource metadata URL\");\n\t}\n\tfor (const authorizationServer of state.resourceMetadata?.authorization_servers ?? []) {\n\t\tassertHttpsEndpoint(authorizationServer, \"protected-resource authorization server\");\n\t}\n}\n\nfunction staticClientInformation(server: McpResolvedServerConfig): OAuthClientInformationMixed | undefined {\n\tconst clientId = server.auth?.clientId?.trim();\n\tif (!clientId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tclient_id: clientId,\n\t\t...(server.auth?.clientSecret ? { client_secret: server.auth.clientSecret } : {}),\n\t\t...(server.auth?.tokenEndpointAuthMethod\n\t\t\t? { token_endpoint_auth_method: server.auth.tokenEndpointAuthMethod }\n\t\t\t: {}),\n\t};\n}\n\nfunction clientMetadata(options: VoltMcpOAuthProviderOptions): OAuthClientMetadata {\n\tconst redirectUrl = String(options.redirectUrl ?? \"http://127.0.0.1/mcp/oauth/callback\");\n\tconst auth = options.server.auth;\n\treturn {\n\t\tredirect_uris: [redirectUrl],\n\t\ttoken_endpoint_auth_method:\n\t\t\tauth?.tokenEndpointAuthMethod ?? (auth?.clientSecret ? \"client_secret_basic\" : \"none\"),\n\t\tgrant_types: [\"authorization_code\", \"refresh_token\", \"urn:ietf:params:oauth:grant-type:device_code\"],\n\t\tresponse_types: [\"code\"],\n\t\tclient_name: options.clientName ?? \"Volt\",\n\t\tsoftware_version: options.clientVersion ?? VERSION,\n\t\t...(auth?.scope ? { scope: auth.scope } : {}),\n\t};\n}\n\nexport class VoltMcpOAuthProvider implements OAuthClientProvider {\n\tprivate server: McpResolvedServerConfig;\n\tprivate store: McpOAuthStore;\n\tprivate redirectUrlValue: string | URL | undefined;\n\tprivate metadata: OAuthClientMetadata;\n\tprivate authorizationUrlValue: URL | undefined;\n\tprivate stateValue: string;\n\tprivate onAuthorizationUrl: ((url: URL) => void | Promise<void>) | undefined;\n\n\tconstructor(options: VoltMcpOAuthProviderOptions) {\n\t\tthis.server = options.server;\n\t\tthis.store = options.store;\n\t\tthis.redirectUrlValue = options.redirectUrl;\n\t\tthis.metadata = clientMetadata(options);\n\t\tthis.stateValue = randomState();\n\t\tthis.onAuthorizationUrl = options.onAuthorizationUrl;\n\t}\n\n\tget redirectUrl(): string | URL | undefined {\n\t\treturn this.redirectUrlValue;\n\t}\n\n\tget clientMetadataUrl(): string | undefined {\n\t\treturn this.server.auth?.clientMetadataUrl;\n\t}\n\n\tget clientMetadata(): OAuthClientMetadata {\n\t\treturn this.metadata;\n\t}\n\n\tget authorizationUrl(): URL | undefined {\n\t\treturn this.authorizationUrlValue;\n\t}\n\n\tget expectedState(): string {\n\t\treturn this.stateValue;\n\t}\n\n\tasync state(): Promise<string> {\n\t\tthis.store.patchRecord(this.server, { state: this.stateValue });\n\t\treturn this.stateValue;\n\t}\n\n\tclientInformation(): OAuthClientInformationMixed | undefined {\n\t\treturn (\n\t\t\tstaticClientInformation(this.server) ?? this.store.getClientInformation(this.server, this.redirectUrlValue)\n\t\t);\n\t}\n\n\tsaveClientInformation(clientInformation: OAuthClientInformationMixed): void {\n\t\tif (staticClientInformation(this.server)) {\n\t\t\treturn;\n\t\t}\n\t\tthis.store.patchRecord(this.server, { clientInformation });\n\t}\n\n\ttokens(): OAuthTokens | undefined {\n\t\treturn this.store.getRecord(this.server)?.tokens;\n\t}\n\n\tsaveTokens(tokens: OAuthTokens): void {\n\t\tthis.store.patchRecord(this.server, { tokens });\n\t}\n\n\tasync redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n\t\tassertHttpsEndpoint(authorizationUrl.toString(), \"authorization URL\");\n\t\tthis.authorizationUrlValue = authorizationUrl;\n\t\tawait this.onAuthorizationUrl?.(authorizationUrl);\n\t}\n\n\tsaveCodeVerifier(codeVerifier: string): void {\n\t\tthis.store.patchRecord(this.server, { codeVerifier });\n\t}\n\n\tcodeVerifier(): string {\n\t\tconst verifier = this.store.getRecord(this.server)?.codeVerifier;\n\t\tif (!verifier) {\n\t\t\tthrow new Error(`Missing MCP OAuth code verifier for ${this.server.id}`);\n\t\t}\n\t\treturn verifier;\n\t}\n\n\tinvalidateCredentials(scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"): void {\n\t\tthis.store.clear(this.server, scope);\n\t}\n\n\tsaveDiscoveryState(state: OAuthDiscoveryState): void {\n\t\tassertSafeDiscoveryState(state);\n\t\tthis.store.patchRecord(this.server, { discoveryState: state });\n\t}\n\n\tdiscoveryState(): OAuthDiscoveryState | undefined {\n\t\tconst state = this.store.getRecord(this.server)?.discoveryState;\n\t\tif (state) {\n\t\t\tassertSafeDiscoveryState(state);\n\t\t}\n\t\treturn state;\n\t}\n}\n"]}

package/dist/core/mcp/oauth-store.d.ts

@@ -0,0 +1,27 @@
+import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformationMixed, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { type AuthStorageBackend } from "../auth-storage.ts";
+import type { McpResolvedServerConfig } from "./types.ts";
+export interface McpOAuthStoredRecord {
+    serverId: string;
+    serverUrl: string;
+    clientInformation?: OAuthClientInformationMixed;
+    tokens?: OAuthTokens;
+    codeVerifier?: string;
+    state?: string;
+    discoveryState?: OAuthDiscoveryState;
+    updatedAt: string;
+}
+export declare class McpOAuthStore {
+    private storage;
+    constructor(storage?: AuthStorageBackend);
+    static create(agentDir?: string): McpOAuthStore;
+    static fromStorage(storage: AuthStorageBackend): McpOAuthStore;
+    getRecord(server: McpResolvedServerConfig): McpOAuthStoredRecord | undefined;
+    hasUsableTokens(server: McpResolvedServerConfig): boolean;
+    getClientInformation(server: McpResolvedServerConfig, redirectUrl?: string | URL): OAuthClientInformationMixed | undefined;
+    updateRecord(server: McpResolvedServerConfig, update: (record: McpOAuthStoredRecord | undefined) => McpOAuthStoredRecord | undefined): McpOAuthStoredRecord | undefined;
+    patchRecord(server: McpResolvedServerConfig, patch: Partial<Omit<McpOAuthStoredRecord, "serverId" | "serverUrl" | "updatedAt">>): McpOAuthStoredRecord;
+    clear(server: McpResolvedServerConfig, scope?: "all" | "client" | "tokens" | "verifier" | "discovery"): void;
+}
+//# sourceMappingURL=oauth-store.d.ts.map

package/dist/core/mcp/oauth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/oauth-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAEzG,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;CAClB;AAoDD,qBAAa,aAAa;IACzB,OAAO,CAAC,OAAO,CAAqB;IAEpC,YAAY,OAAO,GAAE,kBAAqF,EAEzG;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAsB,GAAG,aAAa,CAE7D;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,aAAa,CAE7D;IAED,SAAS,CAAC,MAAM,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,SAAS,CAK3E;IAED,eAAe,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAGxD;IAED,oBAAoB,CACnB,MAAM,EAAE,uBAAuB,EAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GACxB,2BAA2B,GAAG,SAAS,CAGzC;IAED,YAAY,CACX,MAAM,EAAE,uBAAuB,EAC/B,MAAM,EAAE,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,KAAK,oBAAoB,GAAG,SAAS,GACpF,oBAAoB,GAAG,SAAS,CAYlC;IAED,WAAW,CACV,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,GAChF,oBAAoB,CAOtB;IAED,KAAK,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,GAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAmB,GAAG,IAAI,CAqBlH;CACD","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport type { OAuthDiscoveryState } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type { OAuthClientInformationMixed, OAuthTokens } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { getAgentDir } from \"../../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend } from \"../auth-storage.ts\";\nimport type { McpResolvedServerConfig } from \"./types.ts\";\n\nexport interface McpOAuthStoredRecord {\n\tserverId: string;\n\tserverUrl: string;\n\tclientInformation?: OAuthClientInformationMixed;\n\ttokens?: OAuthTokens;\n\tcodeVerifier?: string;\n\tstate?: string;\n\tdiscoveryState?: OAuthDiscoveryState;\n\tupdatedAt: string;\n}\n\ninterface McpOAuthStorageData {\n\tversion: 1;\n\tservers: Record<string, McpOAuthStoredRecord>;\n}\n\nfunction emptyStorage(): McpOAuthStorageData {\n\treturn { version: 1, servers: {} };\n}\n\nfunction parseStorage(content: string | undefined): McpOAuthStorageData {\n\tif (!content?.trim()) {\n\t\treturn emptyStorage();\n\t}\n\tconst parsed = JSON.parse(content) as Partial<McpOAuthStorageData>;\n\treturn {\n\t\tversion: 1,\n\t\tservers: typeof parsed.servers === \"object\" && parsed.servers !== null ? parsed.servers : {},\n\t};\n}\n\nfunction serializeStorage(data: McpOAuthStorageData): string {\n\treturn `${JSON.stringify(data, null, 2)}\\n`;\n}\n\nfunction canonicalServerUrl(server: McpResolvedServerConfig): string {\n\tif (!server.url) {\n\t\treturn server.id;\n\t}\n\tconst url = new URL(server.url);\n\turl.hash = \"\";\n\treturn url.toString();\n}\n\nfunction recordKey(server: McpResolvedServerConfig): string {\n\treturn createHash(\"sha256\")\n\t\t.update(`${server.id}\\0${canonicalServerUrl(server)}`)\n\t\t.digest(\"base64url\");\n}\n\nfunction clientInformationMatchesRedirect(\n\tclientInformation: OAuthClientInformationMixed | undefined,\n\tredirectUrl: string | URL | undefined,\n): boolean {\n\tif (!clientInformation || !redirectUrl || !(\"redirect_uris\" in clientInformation)) {\n\t\treturn true;\n\t}\n\tconst redirect = String(redirectUrl);\n\treturn clientInformation.redirect_uris.includes(redirect);\n}\n\nexport class McpOAuthStore {\n\tprivate storage: AuthStorageBackend;\n\n\tconstructor(storage: AuthStorageBackend = new FileAuthStorageBackend(join(getAgentDir(), \"mcp-auth.json\"))) {\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(agentDir: string = getAgentDir()): McpOAuthStore {\n\t\treturn new McpOAuthStore(new FileAuthStorageBackend(join(agentDir, \"mcp-auth.json\")));\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): McpOAuthStore {\n\t\treturn new McpOAuthStore(storage);\n\t}\n\n\tgetRecord(server: McpResolvedServerConfig): McpOAuthStoredRecord | undefined {\n\t\treturn this.storage.withLock((current) => {\n\t\t\tconst data = parseStorage(current);\n\t\t\treturn { result: data.servers[recordKey(server)] };\n\t\t});\n\t}\n\n\thasUsableTokens(server: McpResolvedServerConfig): boolean {\n\t\tconst tokens = this.getRecord(server)?.tokens;\n\t\treturn typeof tokens?.access_token === \"string\" && tokens.access_token.length > 0;\n\t}\n\n\tgetClientInformation(\n\t\tserver: McpResolvedServerConfig,\n\t\tredirectUrl?: string | URL,\n\t): OAuthClientInformationMixed | undefined {\n\t\tconst clientInformation = this.getRecord(server)?.clientInformation;\n\t\treturn clientInformationMatchesRedirect(clientInformation, redirectUrl) ? clientInformation : undefined;\n\t}\n\n\tupdateRecord(\n\t\tserver: McpResolvedServerConfig,\n\t\tupdate: (record: McpOAuthStoredRecord | undefined) => McpOAuthStoredRecord | undefined,\n\t): McpOAuthStoredRecord | undefined {\n\t\treturn this.storage.withLock((current) => {\n\t\t\tconst data = parseStorage(current);\n\t\t\tconst key = recordKey(server);\n\t\t\tconst nextRecord = update(data.servers[key]);\n\t\t\tif (nextRecord) {\n\t\t\t\tdata.servers[key] = { ...nextRecord, updatedAt: new Date().toISOString() };\n\t\t\t} else {\n\t\t\t\tdelete data.servers[key];\n\t\t\t}\n\t\t\treturn { result: nextRecord, next: serializeStorage(data) };\n\t\t});\n\t}\n\n\tpatchRecord(\n\t\tserver: McpResolvedServerConfig,\n\t\tpatch: Partial<Omit<McpOAuthStoredRecord, \"serverId\" | \"serverUrl\" | \"updatedAt\">>,\n\t): McpOAuthStoredRecord {\n\t\tconst base = (): McpOAuthStoredRecord => ({\n\t\t\tserverId: server.id,\n\t\t\tserverUrl: canonicalServerUrl(server),\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t});\n\t\treturn this.updateRecord(server, (record) => ({ ...base(), ...record, ...patch })) ?? base();\n\t}\n\n\tclear(server: McpResolvedServerConfig, scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\" = \"all\"): void {\n\t\tthis.updateRecord(server, (record) => {\n\t\t\tif (!record || scope === \"all\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tconst next: McpOAuthStoredRecord = { ...record };\n\t\t\tif (scope === \"client\") {\n\t\t\t\tdelete next.clientInformation;\n\t\t\t}\n\t\t\tif (scope === \"tokens\") {\n\t\t\t\tdelete next.tokens;\n\t\t\t}\n\t\t\tif (scope === \"verifier\") {\n\t\t\t\tdelete next.codeVerifier;\n\t\t\t\tdelete next.state;\n\t\t\t}\n\t\t\tif (scope === \"discovery\") {\n\t\t\t\tdelete next.discoveryState;\n\t\t\t}\n\t\t\treturn next;\n\t\t});\n\t}\n}\n"]}

package/dist/core/mcp/oauth-store.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { getAgentDir } from "../../config.js";
+import { FileAuthStorageBackend } from "../auth-storage.js";
+function emptyStorage() {
+    return { version: 1, servers: {} };
+}
+function parseStorage(content) {
+    if (!content?.trim()) {
+        return emptyStorage();
+    }
+    const parsed = JSON.parse(content);
+    return {
+        version: 1,
+        servers: typeof parsed.servers === "object" && parsed.servers !== null ? parsed.servers : {},
+    };
+}
+function serializeStorage(data) {
+    return `${JSON.stringify(data, null, 2)}\n`;
+}
+function canonicalServerUrl(server) {
+    if (!server.url) {
+        return server.id;
+    }
+    const url = new URL(server.url);
+    url.hash = "";
+    return url.toString();
+}
+function recordKey(server) {
+    return createHash("sha256")
+        .update(`${server.id}\0${canonicalServerUrl(server)}`)
+        .digest("base64url");
+}
+function clientInformationMatchesRedirect(clientInformation, redirectUrl) {
+    if (!clientInformation || !redirectUrl || !("redirect_uris" in clientInformation)) {
+        return true;
+    }
+    const redirect = String(redirectUrl);
+    return clientInformation.redirect_uris.includes(redirect);
+}
+export class McpOAuthStore {
+    storage;
+    constructor(storage = new FileAuthStorageBackend(join(getAgentDir(), "mcp-auth.json"))) {
+        this.storage = storage;
+    }
+    static create(agentDir = getAgentDir()) {
+        return new McpOAuthStore(new FileAuthStorageBackend(join(agentDir, "mcp-auth.json")));
+    }
+    static fromStorage(storage) {
+        return new McpOAuthStore(storage);
+    }
+    getRecord(server) {
+        return this.storage.withLock((current) => {
+            const data = parseStorage(current);
+            return { result: data.servers[recordKey(server)] };
+        });
+    }
+    hasUsableTokens(server) {
+        const tokens = this.getRecord(server)?.tokens;
+        return typeof tokens?.access_token === "string" && tokens.access_token.length > 0;
+    }
+    getClientInformation(server, redirectUrl) {
+        const clientInformation = this.getRecord(server)?.clientInformation;
+        return clientInformationMatchesRedirect(clientInformation, redirectUrl) ? clientInformation : undefined;
+    }
+    updateRecord(server, update) {
+        return this.storage.withLock((current) => {
+            const data = parseStorage(current);
+            const key = recordKey(server);
+            const nextRecord = update(data.servers[key]);
+            if (nextRecord) {
+                data.servers[key] = { ...nextRecord, updatedAt: new Date().toISOString() };
+            }
+            else {
+                delete data.servers[key];
+            }
+            return { result: nextRecord, next: serializeStorage(data) };
+        });
+    }
+    patchRecord(server, patch) {
+        const base = () => ({
+            serverId: server.id,
+            serverUrl: canonicalServerUrl(server),
+            updatedAt: new Date().toISOString(),
+        });
+        return this.updateRecord(server, (record) => ({ ...base(), ...record, ...patch })) ?? base();
+    }
+    clear(server, scope = "all") {
+        this.updateRecord(server, (record) => {
+            if (!record || scope === "all") {
+                return undefined;
+            }
+            const next = { ...record };
+            if (scope === "client") {
+                delete next.clientInformation;
+            }
+            if (scope === "tokens") {
+                delete next.tokens;
+            }
+            if (scope === "verifier") {
+                delete next.codeVerifier;
+                delete next.state;
+            }
+            if (scope === "discovery") {
+                delete next.discoveryState;
+            }
+            return next;
+        });
+    }
+}
+//# sourceMappingURL=oauth-store.js.map

package/dist/core/mcp/oauth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../../../src/core/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAA2B,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAmBrF,SAAS,YAAY,GAAwB;IAC5C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAAA,CACnC;AAED,SAAS,YAAY,CAAC,OAA2B,EAAuB;IACvE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACtB,OAAO,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiC,CAAC;IACnE,OAAO;QACN,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KAC5F,CAAC;AAAA,CACF;AAED,SAAS,gBAAgB,CAAC,IAAyB,EAAU;IAC5D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAAA,CAC5C;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAU;IACpE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAAA,CACtB;AAED,SAAS,SAAS,CAAC,MAA+B,EAAU;IAC3D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;SACrD,MAAM,CAAC,WAAW,CAAC,CAAC;AAAA,CACtB;AAED,SAAS,gCAAgC,CACxC,iBAA0D,EAC1D,WAAqC,EAC3B;IACV,IAAI,CAAC,iBAAiB,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,eAAe,IAAI,iBAAiB,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAAA,CAC1D;AAED,MAAM,OAAO,aAAa;IACjB,OAAO,CAAqB;IAEpC,YAAY,OAAO,GAAuB,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE;QAC3G,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,WAAW,EAAE,EAAiB;QAC9D,OAAO,IAAI,aAAa,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAAA,CACtF;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B,EAAiB;QAC9D,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAAA,CAClC;IAED,SAAS,CAAC,MAA+B,EAAoC;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAAA,CACnD,CAAC,CAAC;IAAA,CACH;IAED,eAAe,CAAC,MAA+B,EAAW;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC9C,OAAO,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAClF;IAED,oBAAoB,CACnB,MAA+B,EAC/B,WAA0B,EACgB;QAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;QACpE,OAAO,gCAAgC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACxG;IAED,YAAY,CACX,MAA+B,EAC/B,MAAsF,EACnD;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAA,CAC5D,CAAC,CAAC;IAAA,CACH;IAED,WAAW,CACV,MAA+B,EAC/B,KAAkF,EAC3D;QACvB,MAAM,IAAI,GAAG,GAAyB,EAAE,CAAC,CAAC;YACzC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAAA,CAC7F;IAED,KAAK,CAAC,MAA+B,EAAE,KAAK,GAA2D,KAAK,EAAQ;QACnH,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,GAAyB,EAAE,GAAG,MAAM,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC/B,CAAC;YACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC;YACD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;gBACzB,OAAO,IAAI,CAAC,KAAK,CAAC;YACnB,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,cAAc,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QAAA,CACZ,CAAC,CAAC;IAAA,CACH;CACD","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport type { OAuthDiscoveryState } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type { OAuthClientInformationMixed, OAuthTokens } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { getAgentDir } from \"../../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend } from \"../auth-storage.ts\";\nimport type { McpResolvedServerConfig } from \"./types.ts\";\n\nexport interface McpOAuthStoredRecord {\n\tserverId: string;\n\tserverUrl: string;\n\tclientInformation?: OAuthClientInformationMixed;\n\ttokens?: OAuthTokens;\n\tcodeVerifier?: string;\n\tstate?: string;\n\tdiscoveryState?: OAuthDiscoveryState;\n\tupdatedAt: string;\n}\n\ninterface McpOAuthStorageData {\n\tversion: 1;\n\tservers: Record<string, McpOAuthStoredRecord>;\n}\n\nfunction emptyStorage(): McpOAuthStorageData {\n\treturn { version: 1, servers: {} };\n}\n\nfunction parseStorage(content: string | undefined): McpOAuthStorageData {\n\tif (!content?.trim()) {\n\t\treturn emptyStorage();\n\t}\n\tconst parsed = JSON.parse(content) as Partial<McpOAuthStorageData>;\n\treturn {\n\t\tversion: 1,\n\t\tservers: typeof parsed.servers === \"object\" && parsed.servers !== null ? parsed.servers : {},\n\t};\n}\n\nfunction serializeStorage(data: McpOAuthStorageData): string {\n\treturn `${JSON.stringify(data, null, 2)}\\n`;\n}\n\nfunction canonicalServerUrl(server: McpResolvedServerConfig): string {\n\tif (!server.url) {\n\t\treturn server.id;\n\t}\n\tconst url = new URL(server.url);\n\turl.hash = \"\";\n\treturn url.toString();\n}\n\nfunction recordKey(server: McpResolvedServerConfig): string {\n\treturn createHash(\"sha256\")\n\t\t.update(`${server.id}\\0${canonicalServerUrl(server)}`)\n\t\t.digest(\"base64url\");\n}\n\nfunction clientInformationMatchesRedirect(\n\tclientInformation: OAuthClientInformationMixed | undefined,\n\tredirectUrl: string | URL | undefined,\n): boolean {\n\tif (!clientInformation || !redirectUrl || !(\"redirect_uris\" in clientInformation)) {\n\t\treturn true;\n\t}\n\tconst redirect = String(redirectUrl);\n\treturn clientInformation.redirect_uris.includes(redirect);\n}\n\nexport class McpOAuthStore {\n\tprivate storage: AuthStorageBackend;\n\n\tconstructor(storage: AuthStorageBackend = new FileAuthStorageBackend(join(getAgentDir(), \"mcp-auth.json\"))) {\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(agentDir: string = getAgentDir()): McpOAuthStore {\n\t\treturn new McpOAuthStore(new FileAuthStorageBackend(join(agentDir, \"mcp-auth.json\")));\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): McpOAuthStore {\n\t\treturn new McpOAuthStore(storage);\n\t}\n\n\tgetRecord(server: McpResolvedServerConfig): McpOAuthStoredRecord | undefined {\n\t\treturn this.storage.withLock((current) => {\n\t\t\tconst data = parseStorage(current);\n\t\t\treturn { result: data.servers[recordKey(server)] };\n\t\t});\n\t}\n\n\thasUsableTokens(server: McpResolvedServerConfig): boolean {\n\t\tconst tokens = this.getRecord(server)?.tokens;\n\t\treturn typeof tokens?.access_token === \"string\" && tokens.access_token.length > 0;\n\t}\n\n\tgetClientInformation(\n\t\tserver: McpResolvedServerConfig,\n\t\tredirectUrl?: string | URL,\n\t): OAuthClientInformationMixed | undefined {\n\t\tconst clientInformation = this.getRecord(server)?.clientInformation;\n\t\treturn clientInformationMatchesRedirect(clientInformation, redirectUrl) ? clientInformation : undefined;\n\t}\n\n\tupdateRecord(\n\t\tserver: McpResolvedServerConfig,\n\t\tupdate: (record: McpOAuthStoredRecord | undefined) => McpOAuthStoredRecord | undefined,\n\t): McpOAuthStoredRecord | undefined {\n\t\treturn this.storage.withLock((current) => {\n\t\t\tconst data = parseStorage(current);\n\t\t\tconst key = recordKey(server);\n\t\t\tconst nextRecord = update(data.servers[key]);\n\t\t\tif (nextRecord) {\n\t\t\t\tdata.servers[key] = { ...nextRecord, updatedAt: new Date().toISOString() };\n\t\t\t} else {\n\t\t\t\tdelete data.servers[key];\n\t\t\t}\n\t\t\treturn { result: nextRecord, next: serializeStorage(data) };\n\t\t});\n\t}\n\n\tpatchRecord(\n\t\tserver: McpResolvedServerConfig,\n\t\tpatch: Partial<Omit<McpOAuthStoredRecord, \"serverId\" | \"serverUrl\" | \"updatedAt\">>,\n\t): McpOAuthStoredRecord {\n\t\tconst base = (): McpOAuthStoredRecord => ({\n\t\t\tserverId: server.id,\n\t\t\tserverUrl: canonicalServerUrl(server),\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t});\n\t\treturn this.updateRecord(server, (record) => ({ ...base(), ...record, ...patch })) ?? base();\n\t}\n\n\tclear(server: McpResolvedServerConfig, scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\" = \"all\"): void {\n\t\tthis.updateRecord(server, (record) => {\n\t\t\tif (!record || scope === \"all\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tconst next: McpOAuthStoredRecord = { ...record };\n\t\t\tif (scope === \"client\") {\n\t\t\t\tdelete next.clientInformation;\n\t\t\t}\n\t\t\tif (scope === \"tokens\") {\n\t\t\t\tdelete next.tokens;\n\t\t\t}\n\t\t\tif (scope === \"verifier\") {\n\t\t\t\tdelete next.codeVerifier;\n\t\t\t\tdelete next.state;\n\t\t\t}\n\t\t\tif (scope === \"discovery\") {\n\t\t\t\tdelete next.discoveryState;\n\t\t\t}\n\t\t\treturn next;\n\t\t});\n\t}\n}\n"]}

package/dist/core/mcp/output-store.d.ts

@@ -0,0 +1,55 @@
+import type { McpCacheReference, McpOutputTruncation } from "./types.ts";
+export interface McpOutputStoreOptions {
+    agentDir: string;
+    maxOutputBytes?: number;
+    maxOutputLines?: number;
+    maxCacheEntryBytes?: number;
+    maxCacheEntries?: number;
+    maxCacheTotalBytes?: number;
+    maxCacheAgeMs?: number;
+    now?: () => number;
+    sessionId?: string;
+    workspaceId?: string;
+}
+export interface McpStoredOutput {
+    id: string;
+    createdAt: string;
+    sessionId?: string;
+    workspaceId?: string;
+    text: string;
+    bytes: number;
+    lines: number;
+}
+export interface McpStoredOutputChunk {
+    cacheId: string;
+    content: string;
+    startByte: number;
+    nextCursor?: string;
+    totalBytes: number;
+}
+export interface McpStoredOutputResult {
+    content: string;
+    truncation?: McpOutputTruncation;
+    cache?: McpCacheReference;
+}
+export declare class McpOutputStore {
+    private dir;
+    private maxOutputBytes;
+    private maxOutputLines;
+    private maxCacheEntryBytes;
+    private maxCacheEntries;
+    private maxCacheTotalBytes;
+    private maxCacheAgeMs;
+    private now;
+    private sessionId;
+    private workspaceId;
+    constructor(options: McpOutputStoreOptions);
+    shapeOutput(text: string): McpStoredOutputResult;
+    write(text: string): string | undefined;
+    read(cacheId: string, options?: {
+        cursor?: string;
+        limit?: number;
+    }): McpStoredOutputChunk;
+    private prune;
+}
+//# sourceMappingURL=output-store.d.ts.map

package/dist/core/mcp/output-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-store.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/output-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQzE,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAuCD,qBAAa,cAAc;IAC1B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,GAAG,CAAe;IAC1B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,WAAW,CAAqB;IAExC,YAAY,OAAO,EAAE,qBAAqB,EAWzC;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAwB/C;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAyBtC;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,oBAAoB,CA8CzF;IAED,OAAO,CAAC,KAAK;CA4Cb","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { existsSync, lstatSync, readdirSync, readFileSync, unlinkSync, utimesSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n\tensurePrivateDirectorySync,\n\thardenPrivateRegularFileSync,\n\twritePrivateNewFileSync,\n} from \"../../utils/private-files.ts\";\nimport { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, truncateHead } from \"../tools/truncate.ts\";\nimport type { McpCacheReference, McpOutputTruncation } from \"./types.ts\";\n\nconst DEFAULT_MAX_CACHE_ENTRY_BYTES = 16 * 1024 * 1024;\nconst DEFAULT_MAX_CACHE_ENTRIES = 64;\nconst DEFAULT_MAX_CACHE_TOTAL_BYTES = 128 * 1024 * 1024;\nconst DEFAULT_MAX_CACHE_AGE_MS = 7 * 24 * 60 * 60 * 1000;\nconst CACHE_FILE_PATTERN = /^mcpout_[a-f0-9]{32}\\.json$/;\n\nexport interface McpOutputStoreOptions {\n\tagentDir: string;\n\tmaxOutputBytes?: number;\n\tmaxOutputLines?: number;\n\tmaxCacheEntryBytes?: number;\n\tmaxCacheEntries?: number;\n\tmaxCacheTotalBytes?: number;\n\tmaxCacheAgeMs?: number;\n\tnow?: () => number;\n\tsessionId?: string;\n\tworkspaceId?: string;\n}\n\nexport interface McpStoredOutput {\n\tid: string;\n\tcreatedAt: string;\n\tsessionId?: string;\n\tworkspaceId?: string;\n\ttext: string;\n\tbytes: number;\n\tlines: number;\n}\n\nexport interface McpStoredOutputChunk {\n\tcacheId: string;\n\tcontent: string;\n\tstartByte: number;\n\tnextCursor?: string;\n\ttotalBytes: number;\n}\n\nexport interface McpStoredOutputResult {\n\tcontent: string;\n\ttruncation?: McpOutputTruncation;\n\tcache?: McpCacheReference;\n}\n\nfunction byteLength(value: string): number {\n\treturn Buffer.byteLength(value, \"utf-8\");\n}\n\nfunction lineCount(value: string): number {\n\tif (value.length === 0) {\n\t\treturn 0;\n\t}\n\tconst lines = value.split(\"\\n\");\n\tif (value.endsWith(\"\\n\")) {\n\t\tlines.pop();\n\t}\n\treturn lines.length;\n}\n\nfunction createCacheId(): string {\n\treturn `mcpout_${randomUUID().replace(/-/g, \"\")}`;\n}\n\nfunction safeCacheId(cacheId: string): string {\n\tif (!/^mcpout_[a-f0-9]{32}$/.test(cacheId)) {\n\t\tthrow new Error(\"Invalid MCP cache id\");\n\t}\n\treturn cacheId;\n}\n\nfunction sliceByUtf8Bytes(text: string, startByte: number, maxBytes: number): { content: string; nextCursor?: string } {\n\tconst buffer = Buffer.from(text, \"utf-8\");\n\tconst start = Math.max(0, Math.min(startByte, buffer.length));\n\tlet end = Math.max(start, Math.min(buffer.length, start + maxBytes));\n\twhile (end > start && (buffer[end] & 0xc0) === 0x80) {\n\t\tend--;\n\t}\n\tconst content = buffer.slice(start, end).toString(\"utf-8\");\n\treturn end < buffer.length ? { content, nextCursor: String(end) } : { content };\n}\n\nexport class McpOutputStore {\n\tprivate dir: string;\n\tprivate maxOutputBytes: number;\n\tprivate maxOutputLines: number;\n\tprivate maxCacheEntryBytes: number;\n\tprivate maxCacheEntries: number;\n\tprivate maxCacheTotalBytes: number;\n\tprivate maxCacheAgeMs: number;\n\tprivate now: () => number;\n\tprivate sessionId: string | undefined;\n\tprivate workspaceId: string | undefined;\n\n\tconstructor(options: McpOutputStoreOptions) {\n\t\tthis.dir = join(options.agentDir, \"mcp\", \"output\");\n\t\tthis.maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_BYTES;\n\t\tthis.maxOutputLines = options.maxOutputLines ?? DEFAULT_MAX_LINES;\n\t\tthis.maxCacheEntryBytes = Math.max(1, options.maxCacheEntryBytes ?? DEFAULT_MAX_CACHE_ENTRY_BYTES);\n\t\tthis.maxCacheEntries = Math.max(1, options.maxCacheEntries ?? DEFAULT_MAX_CACHE_ENTRIES);\n\t\tthis.maxCacheTotalBytes = Math.max(1, options.maxCacheTotalBytes ?? DEFAULT_MAX_CACHE_TOTAL_BYTES);\n\t\tthis.maxCacheAgeMs = Math.max(1, options.maxCacheAgeMs ?? DEFAULT_MAX_CACHE_AGE_MS);\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.sessionId = options.sessionId;\n\t\tthis.workspaceId = options.workspaceId;\n\t}\n\n\tshapeOutput(text: string): McpStoredOutputResult {\n\t\tconst truncation = truncateHead(text, { maxBytes: this.maxOutputBytes, maxLines: this.maxOutputLines });\n\t\tif (!truncation.truncated) {\n\t\t\treturn { content: text };\n\t\t}\n\t\tconst cacheId = this.write(text);\n\t\treturn {\n\t\t\tcontent: truncation.content,\n\t\t\ttruncation: {\n\t\t\t\ttruncated: true,\n\t\t\t\treturnedBytes: truncation.outputBytes,\n\t\t\t\ttotalBytes: truncation.totalBytes,\n\t\t\t\treturnedLines: truncation.outputLines,\n\t\t\t\ttotalLines: truncation.totalLines,\n\t\t\t},\n\t\t\t...(cacheId\n\t\t\t\t? {\n\t\t\t\t\t\tcache: {\n\t\t\t\t\t\t\tid: cacheId,\n\t\t\t\t\t\t\tread: `mcp({\"action\":\"read_cache\",\"cacheId\":\"${cacheId}\"})`,\n\t\t\t\t\t\t},\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\twrite(text: string): string | undefined {\n\t\tconst id = createCacheId();\n\t\tconst record: McpStoredOutput = {\n\t\t\tid,\n\t\t\tcreatedAt: new Date(this.now()).toISOString(),\n\t\t\t...(this.sessionId ? { sessionId: this.sessionId } : {}),\n\t\t\t...(this.workspaceId ? { workspaceId: this.workspaceId } : {}),\n\t\t\ttext,\n\t\t\tbytes: byteLength(text),\n\t\t\tlines: lineCount(text),\n\t\t};\n\t\tconst serialized = `${JSON.stringify(record)}\\n`;\n\t\tconst serializedBytes = byteLength(serialized);\n\t\tif (serializedBytes > this.maxCacheEntryBytes || serializedBytes > this.maxCacheTotalBytes) {\n\t\t\treturn undefined;\n\t\t}\n\t\tensurePrivateDirectorySync(this.dir);\n\t\tif (!this.prune(serializedBytes, 1)) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst filePath = join(this.dir, `${id}.json`);\n\t\twritePrivateNewFileSync(filePath, serialized);\n\t\tconst timestamp = new Date(this.now());\n\t\tutimesSync(filePath, timestamp, timestamp);\n\t\treturn id;\n\t}\n\n\tread(cacheId: string, options?: { cursor?: string; limit?: number }): McpStoredOutputChunk {\n\t\tconst id = safeCacheId(cacheId);\n\t\tconst filePath = join(this.dir, `${id}.json`);\n\t\tif (!existsSync(filePath)) {\n\t\t\tthrow new Error(`MCP cache entry not found: ${cacheId}`);\n\t\t}\n\t\thardenPrivateRegularFileSync(filePath);\n\t\tconst stat = lstatSync(filePath);\n\t\tif (stat.size > this.maxCacheEntryBytes || stat.mtimeMs < this.now() - this.maxCacheAgeMs) {\n\t\t\tthrow new Error(`MCP cache entry is expired or exceeds the configured size limit: ${cacheId}`);\n\t\t}\n\t\tconst parsed = JSON.parse(readFileSync(filePath, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(`Invalid MCP cache entry: ${cacheId}`);\n\t\t}\n\t\tconst record = parsed as Partial<McpStoredOutput>;\n\t\tif (\n\t\t\trecord.id !== id ||\n\t\t\ttypeof record.text !== \"string\" ||\n\t\t\ttypeof record.bytes !== \"number\" ||\n\t\t\trecord.bytes !== byteLength(record.text)\n\t\t) {\n\t\t\tthrow new Error(`Invalid MCP cache entry: ${cacheId}`);\n\t\t}\n\t\tif (record.sessionId !== this.sessionId) {\n\t\t\tthrow new Error(`MCP cache entry is not available in this session: ${cacheId}`);\n\t\t}\n\t\tif (record.workspaceId !== this.workspaceId) {\n\t\t\tthrow new Error(`MCP cache entry is not available in this workspace: ${cacheId}`);\n\t\t}\n\t\tif (options?.cursor !== undefined && !/^\\d+$/.test(options.cursor)) {\n\t\t\tthrow new Error(\"Invalid MCP cache cursor\");\n\t\t}\n\t\tconst startByte = options?.cursor ? Number.parseInt(options.cursor, 10) : 0;\n\t\tif (!Number.isSafeInteger(startByte) || startByte < 0 || startByte > record.bytes) {\n\t\t\tthrow new Error(\"Invalid MCP cache cursor\");\n\t\t}\n\t\tconst maxBytes = Math.max(1, Math.min(options?.limit ?? this.maxOutputBytes, this.maxOutputBytes));\n\t\tconst chunk = sliceByUtf8Bytes(record.text, startByte, maxBytes);\n\t\treturn {\n\t\t\tcacheId,\n\t\t\tcontent: chunk.content,\n\t\t\tstartByte,\n\t\t\t...(chunk.nextCursor ? { nextCursor: chunk.nextCursor } : {}),\n\t\t\ttotalBytes: record.bytes,\n\t\t};\n\t}\n\n\tprivate prune(reservedBytes = 0, reservedEntries = 0): boolean {\n\t\tif (!existsSync(this.dir)) return true;\n\t\tconst cutoff = this.now() - this.maxCacheAgeMs;\n\t\tconst entries = readdirSync(this.dir)\n\t\t\t.filter((name) => CACHE_FILE_PATTERN.test(name))\n\t\t\t.flatMap((name) => {\n\t\t\t\tconst path = join(this.dir, name);\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = lstatSync(path);\n\t\t\t\t\tif (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {\n\t\t\t\t\t\tunlinkSync(path);\n\t\t\t\t\t\treturn [];\n\t\t\t\t\t}\n\t\t\t\t\tif (stat.mtimeMs < cutoff || stat.size > this.maxCacheEntryBytes) {\n\t\t\t\t\t\tunlinkSync(path);\n\t\t\t\t\t\treturn [];\n\t\t\t\t\t}\n\t\t\t\t\treturn [{ path, size: stat.size, mtimeMs: stat.mtimeMs }];\n\t\t\t\t} catch {\n\t\t\t\t\treturn [];\n\t\t\t\t}\n\t\t\t})\n\t\t\t.sort((left, right) => left.mtimeMs - right.mtimeMs);\n\t\tlet totalBytes = entries.reduce((total, entry) => total + entry.size, 0);\n\t\tlet totalEntries = entries.length;\n\t\tfor (const entry of entries) {\n\t\t\tif (\n\t\t\t\ttotalBytes + reservedBytes <= this.maxCacheTotalBytes &&\n\t\t\t\ttotalEntries + reservedEntries <= this.maxCacheEntries\n\t\t\t) {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tunlinkSync(entry.path);\n\t\t\t\ttotalBytes -= entry.size;\n\t\t\t\ttotalEntries--;\n\t\t\t} catch {\n\t\t\t\t// Capacity is checked below; a failed eviction prevents the new write.\n\t\t\t}\n\t\t}\n\t\treturn (\n\t\t\ttotalBytes + reservedBytes <= this.maxCacheTotalBytes && totalEntries + reservedEntries <= this.maxCacheEntries\n\t\t);\n\t}\n}\n"]}

package/dist/core/mcp/output-store.js

@@ -0,0 +1,206 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, readdirSync, readFileSync, unlinkSync, utimesSync } from "node:fs";
+import { join } from "node:path";
+import { ensurePrivateDirectorySync, hardenPrivateRegularFileSync, writePrivateNewFileSync, } from "../../utils/private-files.js";
+import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, truncateHead } from "../tools/truncate.js";
+const DEFAULT_MAX_CACHE_ENTRY_BYTES = 16 * 1024 * 1024;
+const DEFAULT_MAX_CACHE_ENTRIES = 64;
+const DEFAULT_MAX_CACHE_TOTAL_BYTES = 128 * 1024 * 1024;
+const DEFAULT_MAX_CACHE_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const CACHE_FILE_PATTERN = /^mcpout_[a-f0-9]{32}\.json$/;
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf-8");
+}
+function lineCount(value) {
+    if (value.length === 0) {
+        return 0;
+    }
+    const lines = value.split("\n");
+    if (value.endsWith("\n")) {
+        lines.pop();
+    }
+    return lines.length;
+}
+function createCacheId() {
+    return `mcpout_${randomUUID().replace(/-/g, "")}`;
+}
+function safeCacheId(cacheId) {
+    if (!/^mcpout_[a-f0-9]{32}$/.test(cacheId)) {
+        throw new Error("Invalid MCP cache id");
+    }
+    return cacheId;
+}
+function sliceByUtf8Bytes(text, startByte, maxBytes) {
+    const buffer = Buffer.from(text, "utf-8");
+    const start = Math.max(0, Math.min(startByte, buffer.length));
+    let end = Math.max(start, Math.min(buffer.length, start + maxBytes));
+    while (end > start && (buffer[end] & 0xc0) === 0x80) {
+        end--;
+    }
+    const content = buffer.slice(start, end).toString("utf-8");
+    return end < buffer.length ? { content, nextCursor: String(end) } : { content };
+}
+export class McpOutputStore {
+    dir;
+    maxOutputBytes;
+    maxOutputLines;
+    maxCacheEntryBytes;
+    maxCacheEntries;
+    maxCacheTotalBytes;
+    maxCacheAgeMs;
+    now;
+    sessionId;
+    workspaceId;
+    constructor(options) {
+        this.dir = join(options.agentDir, "mcp", "output");
+        this.maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_BYTES;
+        this.maxOutputLines = options.maxOutputLines ?? DEFAULT_MAX_LINES;
+        this.maxCacheEntryBytes = Math.max(1, options.maxCacheEntryBytes ?? DEFAULT_MAX_CACHE_ENTRY_BYTES);
+        this.maxCacheEntries = Math.max(1, options.maxCacheEntries ?? DEFAULT_MAX_CACHE_ENTRIES);
+        this.maxCacheTotalBytes = Math.max(1, options.maxCacheTotalBytes ?? DEFAULT_MAX_CACHE_TOTAL_BYTES);
+        this.maxCacheAgeMs = Math.max(1, options.maxCacheAgeMs ?? DEFAULT_MAX_CACHE_AGE_MS);
+        this.now = options.now ?? Date.now;
+        this.sessionId = options.sessionId;
+        this.workspaceId = options.workspaceId;
+    }
+    shapeOutput(text) {
+        const truncation = truncateHead(text, { maxBytes: this.maxOutputBytes, maxLines: this.maxOutputLines });
+        if (!truncation.truncated) {
+            return { content: text };
+        }
+        const cacheId = this.write(text);
+        return {
+            content: truncation.content,
+            truncation: {
+                truncated: true,
+                returnedBytes: truncation.outputBytes,
+                totalBytes: truncation.totalBytes,
+                returnedLines: truncation.outputLines,
+                totalLines: truncation.totalLines,
+            },
+            ...(cacheId
+                ? {
+                    cache: {
+                        id: cacheId,
+                        read: `mcp({"action":"read_cache","cacheId":"${cacheId}"})`,
+                    },
+                }
+                : {}),
+        };
+    }
+    write(text) {
+        const id = createCacheId();
+        const record = {
+            id,
+            createdAt: new Date(this.now()).toISOString(),
+            ...(this.sessionId ? { sessionId: this.sessionId } : {}),
+            ...(this.workspaceId ? { workspaceId: this.workspaceId } : {}),
+            text,
+            bytes: byteLength(text),
+            lines: lineCount(text),
+        };
+        const serialized = `${JSON.stringify(record)}\n`;
+        const serializedBytes = byteLength(serialized);
+        if (serializedBytes > this.maxCacheEntryBytes || serializedBytes > this.maxCacheTotalBytes) {
+            return undefined;
+        }
+        ensurePrivateDirectorySync(this.dir);
+        if (!this.prune(serializedBytes, 1)) {
+            return undefined;
+        }
+        const filePath = join(this.dir, `${id}.json`);
+        writePrivateNewFileSync(filePath, serialized);
+        const timestamp = new Date(this.now());
+        utimesSync(filePath, timestamp, timestamp);
+        return id;
+    }
+    read(cacheId, options) {
+        const id = safeCacheId(cacheId);
+        const filePath = join(this.dir, `${id}.json`);
+        if (!existsSync(filePath)) {
+            throw new Error(`MCP cache entry not found: ${cacheId}`);
+        }
+        hardenPrivateRegularFileSync(filePath);
+        const stat = lstatSync(filePath);
+        if (stat.size > this.maxCacheEntryBytes || stat.mtimeMs < this.now() - this.maxCacheAgeMs) {
+            throw new Error(`MCP cache entry is expired or exceeds the configured size limit: ${cacheId}`);
+        }
+        const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error(`Invalid MCP cache entry: ${cacheId}`);
+        }
+        const record = parsed;
+        if (record.id !== id ||
+            typeof record.text !== "string" ||
+            typeof record.bytes !== "number" ||
+            record.bytes !== byteLength(record.text)) {
+            throw new Error(`Invalid MCP cache entry: ${cacheId}`);
+        }
+        if (record.sessionId !== this.sessionId) {
+            throw new Error(`MCP cache entry is not available in this session: ${cacheId}`);
+        }
+        if (record.workspaceId !== this.workspaceId) {
+            throw new Error(`MCP cache entry is not available in this workspace: ${cacheId}`);
+        }
+        if (options?.cursor !== undefined && !/^\d+$/.test(options.cursor)) {
+            throw new Error("Invalid MCP cache cursor");
+        }
+        const startByte = options?.cursor ? Number.parseInt(options.cursor, 10) : 0;
+        if (!Number.isSafeInteger(startByte) || startByte < 0 || startByte > record.bytes) {
+            throw new Error("Invalid MCP cache cursor");
+        }
+        const maxBytes = Math.max(1, Math.min(options?.limit ?? this.maxOutputBytes, this.maxOutputBytes));
+        const chunk = sliceByUtf8Bytes(record.text, startByte, maxBytes);
+        return {
+            cacheId,
+            content: chunk.content,
+            startByte,
+            ...(chunk.nextCursor ? { nextCursor: chunk.nextCursor } : {}),
+            totalBytes: record.bytes,
+        };
+    }
+    prune(reservedBytes = 0, reservedEntries = 0) {
+        if (!existsSync(this.dir))
+            return true;
+        const cutoff = this.now() - this.maxCacheAgeMs;
+        const entries = readdirSync(this.dir)
+            .filter((name) => CACHE_FILE_PATTERN.test(name))
+            .flatMap((name) => {
+            const path = join(this.dir, name);
+            try {
+                const stat = lstatSync(path);
+                if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {
+                    unlinkSync(path);
+                    return [];
+                }
+                if (stat.mtimeMs < cutoff || stat.size > this.maxCacheEntryBytes) {
+                    unlinkSync(path);
+                    return [];
+                }
+                return [{ path, size: stat.size, mtimeMs: stat.mtimeMs }];
+            }
+            catch {
+                return [];
+            }
+        })
+            .sort((left, right) => left.mtimeMs - right.mtimeMs);
+        let totalBytes = entries.reduce((total, entry) => total + entry.size, 0);
+        let totalEntries = entries.length;
+        for (const entry of entries) {
+            if (totalBytes + reservedBytes <= this.maxCacheTotalBytes &&
+                totalEntries + reservedEntries <= this.maxCacheEntries) {
+                break;
+            }
+            try {
+                unlinkSync(entry.path);
+                totalBytes -= entry.size;
+                totalEntries--;
+            }
+            catch {
+                // Capacity is checked below; a failed eviction prevents the new write.
+            }
+        }
+        return (totalBytes + reservedBytes <= this.maxCacheTotalBytes && totalEntries + reservedEntries <= this.maxCacheEntries);
+    }
+}
+//# sourceMappingURL=output-store.js.map