@loicngr/kobo 2.1.26 → 2.1.29

package/dist/server/services/external-mcp-credentials-service.js

@@ -0,0 +1,110 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { EXTERNAL_MEMORY_TOOL_DEFINITIONS } from '../../shared/memory-tools.js';
+import { PROGRESS_BAR_TOOLS } from '../../shared/progress-bar-tools.js';
+import { WORKSPACE_CREATION_TOOLS } from '../../shared/workspace-creation-tools.js';
+import { EXTERNAL_MCP_TOOLS } from '../../shared/workspace-dialogue-tools.js';
+import { WORKSPACE_GROUP_MESSAGE_TOOLS } from '../../shared/workspace-group-message-tools.js';
+import { WORKSPACE_LIFECYCLE_TOOLS } from '../../shared/workspace-lifecycle-tools.js';
+import { ensureKoboHome, getKoboHome } from '../utils/paths.js';
+export const EXTERNAL_TOOL_CATALOGUE = [
+    ...EXTERNAL_MCP_TOOLS,
+    ...WORKSPACE_CREATION_TOOLS,
+    ...WORKSPACE_LIFECYCLE_TOOLS,
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS,
+    ...EXTERNAL_MEMORY_TOOL_DEFINITIONS,
+    ...PROGRESS_BAR_TOOLS,
+];
+const MAX_KEYS = 100;
+const filename = () => path.join(getKoboHome(), 'mcp-credentials.json');
+function load() {
+    try {
+        const data = JSON.parse(fs.readFileSync(filename(), 'utf8'));
+        if (!Array.isArray(data) || data.length > MAX_KEYS)
+            throw new Error('Invalid MCP credential store');
+        return data;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function save(keys) {
+    ensureKoboHome();
+    const tmp = `${filename()}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(tmp, JSON.stringify(keys), { mode: 0o600, flag: 'wx' });
+        fs.renameSync(tmp, filename());
+    }
+    finally {
+        if (fs.existsSync(tmp))
+            fs.unlinkSync(tmp);
+    }
+}
+function publicCredential({ hash: _hash, ...credential }) {
+    return credential;
+}
+export function listExternalMcpCredentials() {
+    return load().map(publicCredential);
+}
+export function createExternalMcpCredential(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('Invalid credential request');
+    const args = input;
+    if (Object.keys(args).some((key) => !['name', 'tools', 'allWorkspaces', 'workspaceIds', 'expiresAt'].includes(key)))
+        throw new Error('Unknown credential field');
+    if (typeof args.name !== 'string' || !args.name.trim() || args.name.length > 120)
+        throw new Error('Name must contain 1–120 characters');
+    if (args.allWorkspaces !== undefined && typeof args.allWorkspaces !== 'boolean')
+        throw new Error('Invalid workspace scope');
+    const allWorkspaces = args.allWorkspaces === true;
+    const workspaceIds = args.workspaceIds ?? [];
+    if (!Array.isArray(workspaceIds) ||
+        workspaceIds.length > 200 ||
+        workspaceIds.some((id) => typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,200}$/.test(id)) ||
+        (!allWorkspaces && workspaceIds.length === 0) ||
+        (allWorkspaces && workspaceIds.length > 0))
+        throw new Error('Select workspace IDs or explicitly grant all workspaces');
+    const tools = args.tools ??
+        EXTERNAL_TOOL_CATALOGUE.filter((tool) => tool.annotations?.readOnlyHint === true).map((tool) => tool.name);
+    if (!Array.isArray(tools) ||
+        !tools.length ||
+        tools.length > EXTERNAL_TOOL_CATALOGUE.length ||
+        tools.some((name) => !EXTERNAL_TOOL_CATALOGUE.some((tool) => tool.name === name)))
+        throw new Error('Invalid tool grant');
+    let expiresAt = null;
+    if (args.expiresAt !== undefined && args.expiresAt !== null) {
+        const time = typeof args.expiresAt === 'string' ? Date.parse(args.expiresAt) : NaN;
+        if (!Number.isFinite(time) || time <= Date.now() || time > Date.now() + 366 * 86400000)
+            throw new Error('Expiry must be within the next 366 days');
+        expiresAt = new Date(time).toISOString();
+    }
+    const keys = load();
+    if (keys.length >= MAX_KEYS)
+        throw new Error('Revoke an existing MCP key before creating another');
+    const token = `kobo_mcp_${randomBytes(32).toString('base64url')}`;
+    const key = {
+        id: randomUUID(),
+        name: args.name.trim(),
+        tools: [...new Set(tools)],
+        allWorkspaces,
+        workspaceIds: [...new Set(workspaceIds)],
+        createdAt: new Date().toISOString(),
+        expiresAt,
+        hash: createHash('sha256').update(token).digest('hex'),
+    };
+    save([...keys, key]);
+    return { token, credential: publicCredential(key) };
+}
+export function revokeExternalMcpCredential(id) {
+    save(load().filter((key) => key.id !== id));
+}
+export function authenticateExternalMcpToken(token) {
+    if (!/^kobo_mcp_[A-Za-z0-9_-]{43}$/.test(token))
+        return null;
+    const hash = createHash('sha256').update(token).digest('hex');
+    const key = load().find((candidate) => candidate.hash === hash);
+    return key && (!key.expiresAt || Date.parse(key.expiresAt) > Date.now()) ? publicCredential(key) : null;
+}

package/dist/server/services/forge/github/provider.js

@@ -3,7 +3,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { MERGE_METHODS } from '../../../../shared/forge-merge.js';
 import { parseCliJson } from '../parse-cli-json.js';
-import { deriveReadyToMerge, truncatePrBody } from '../types.js';
+import { deriveReadyToMerge, MergePolicyError, truncatePrBody } from '../types.js';
 const execFileAsync = promisify(execFile);
 const CLI_TIMEOUT_MS = 30_000;
 function cliOptions(repoPath) {
@@ -194,8 +194,20 @@ export const githubProvider = {
     async changePrBase(repoPath, base) {
         await execFileAsync('gh', ['pr', 'edit', '--base', base], cliOptions(repoPath));
     },
-    async mergeRequest(repoPath, number, method = 'merge') {
-        await execFileAsync('gh', ['pr', 'merge', String(number), `--${method}`], cliOptions(repoPath));
+    async mergeRequest(repoPath, number, method = 'merge', options) {
+        const args = ['pr', 'merge', String(number), `--${method}`];
+        if (options?.admin === true)
+            args.push('--admin');
+        try {
+            await execFileAsync('gh', args, cliOptions(repoPath));
+        }
+        catch (error) {
+            // Only known policy refusals offer an override, never network/auth/unknown failures.
+            const message = error instanceof Error ? error.message : '';
+            if (/the base branch policy prohibits the merge/i.test(message))
+                throw new MergePolicyError();
+            throw error;
+        }
     },
     async deleteRemoteBranch(repoPath, branch) {
         await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));

package/dist/server/services/forge/types.js

@@ -35,3 +35,11 @@ export class ForgeUnavailableError extends Error {
         this.name = 'ForgeUnavailableError';
     }
 }
+/** A policy refusal that can be presented as an explicit administrator choice. */
+export class MergePolicyError extends Error {
+    code = 'merge_policy_blocked';
+    constructor() {
+        super('GitHub branch protection rules prevent this merge.');
+        this.name = 'MergePolicyError';
+    }
+}

package/dist/server/services/internal-mcp-capability-service.js

@@ -0,0 +1,98 @@
+import { randomBytes } from 'node:crypto';
+import { isProgressBarTool } from '../../shared/progress-bar-tools.js';
+import { WORKSPACE_CREATION_TOOLS } from '../../shared/workspace-creation-tools.js';
+import { EXTERNAL_MCP_TOOLS } from '../../shared/workspace-dialogue-tools.js';
+import { WORKSPACE_GROUP_MESSAGE_TOOLS } from '../../shared/workspace-group-message-tools.js';
+import { WORKSPACE_LIFECYCLE_TOOLS } from '../../shared/workspace-lifecycle-tools.js';
+const capabilities = new Map();
+const readTools = new Set([
+    'list_tasks',
+    'get_settings',
+    'get_dev_server_status',
+    'get_workspace_info',
+    'cron_list',
+    'get_dev_server_logs',
+    'list_workspace_images',
+    'get_ticket',
+    'get_notion_ticket',
+    'get_git_info',
+    'list_documents',
+    'read_document',
+    'get_session_usage',
+    'read_workspace_events_csv',
+    'search_codebase',
+    'list_workspaces',
+    'list_memory_scopes',
+    'list_memories',
+    'read_memory',
+    'search_memories',
+    'list_memory_operations',
+    ...EXTERNAL_MCP_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+]);
+const writeTools = new Set([
+    'mark_task_done',
+    'mark_auto_loop_ready',
+    'create_task',
+    'update_task',
+    'delete_task',
+    'set_auto_loop',
+    'set_workspace_agent_description',
+    'set_workspace_name',
+    'cron_create',
+    'cron_delete',
+    'start_dev_server',
+    'stop_dev_server',
+    'set_workspace_status',
+    'log_thought',
+    'schedule_wakeup',
+    'cancel_wakeup',
+    'stop_workspace',
+    'remember',
+    ...EXTERNAL_MCP_TOOLS.map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.map((t) => t.name),
+    ...WORKSPACE_LIFECYCLE_TOOLS.map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.map((t) => t.name),
+]);
+const externalTools = new Set([
+    ...EXTERNAL_MCP_TOOLS.map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.map((t) => t.name),
+    ...WORKSPACE_LIFECYCLE_TOOLS.map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.map((t) => t.name),
+    'stop_workspace',
+]);
+export function createInternalMcpCapability(input) {
+    const capability = { ...input, env: { ...input.env }, token: randomBytes(32).toString('base64url') };
+    capabilities.set(capability.token, capability);
+    return capability;
+}
+export function revokeInternalMcpCapability(token) {
+    capabilities.delete(token);
+}
+export function resolveInternalMcpCapability(token) {
+    const capability = token ? capabilities.get(token) : undefined;
+    if (!capability)
+        throw new Error('Invalid or revoked managed MCP capability');
+    return capability;
+}
+export function authorizeInternalMcpTool(token, name, args) {
+    const capability = resolveInternalMcpCapability(token);
+    const report = (name === 'submit_final_review' &&
+        capability.env.KOBO_FINAL_REVIEW_TOKEN &&
+        capability.env.KOBO_FINAL_REVIEW_SESSION_ID === capability.sessionId) ||
+        (name === 'submit_session_handoff' && capability.env.KOBO_HANDOFF_TOKEN && capability.env.KOBO_HANDOFF_ID);
+    const progress = isProgressBarTool(name) && capability.env.KOBO_PROGRESS_SESSION_TOKEN;
+    if (!report && !progress && !readTools.has(name) && !writeTools.has(name))
+        throw new Error(`Unknown or unavailable tool: ${name}`);
+    if (capability.readOnly && !readTools.has(name) && !report && !progress)
+        throw new Error('This managed MCP launch is read-only');
+    if (!externalTools.has(name) && args.workspace_id !== undefined && args.workspace_id !== capability.workspaceId)
+        throw new Error('Tool is bound to its launch workspace');
+    if ((name === 'send_workspace_message' && args.workspace_id === capability.workspaceId) ||
+        (name === 'send_workspace_group_message' &&
+            Array.isArray(args.workspace_ids) &&
+            args.workspace_ids.includes(capability.workspaceId)))
+        throw new Error('Use the normal conversation in your own workspace');
+    return capability;
+}

package/dist/server/services/mcp-connection-info-service.js

@@ -29,7 +29,7 @@ export function buildMcpConnectionInfo(input) {
         networkEnabled: input.networkEnabled,
         behindProxy: input.behindProxy,
         proxyHostname: input.proxyHostname,
-        localRequiresToken: input.behindProxy,
+        localRequiresToken: true,
         stdio: args
             ? {
                 command: input.command,

package/dist/server/services/memory-mcp-service.js

@@ -2,7 +2,7 @@ import { deriveMemoryActor } from '../../shared/memory.js';
 import { isMemoryToolName, validateMemoryToolArguments } from '../../shared/memory-tools.js';
 import { prepareMemoryControlReply, prepareMemoryToolEnvelope, sliceMemoryBodyFragment, } from '../utils/memory-token-budget.js';
 import { createExternalMemoryBudgetContext, reserveMemoryBudget, reserveMemoryBudgetDenial, wasMemoryFragmentDelivered, } from './memory-budget-service.js';
-import { listMemories, listMemoryOperations, listMemoryScopes, listWorkspaceMemoryOperations, readMemory, remember, searchMemories, } from './memory-service.js';
+import { listMemories, listMemoryOperations, listMemoryScopes, listWorkspaceMemoryOperations, listWorkspaceMemoryScopes, readMemory, remember, searchMemories, } from './memory-service.js';
 function externalActor(source) {
     if (source.kind !== 'mcp')
         throw new TypeError('External memory tools require MCP client context');
@@ -176,7 +176,7 @@ function chargeExternalOutput(input) {
     return addBudgetReceipt(sized.data, input.contextId, reservation.estimatedTokens, reservation.remainingTokens);
 }
 /** Execute the external memory surface; caller identity is always derived from MCP transport. */
-export function executeMemoryMcpTool(name, input, source) {
+export function executeMemoryMcpTool(name, input, source, allowedWorkspaceIds) {
     if (!isMemoryToolName(name))
         throw new TypeError(`Unknown memory tool '${name}'`);
     const actor = externalActor(source);
@@ -212,11 +212,13 @@ export function executeMemoryMcpTool(name, input, source) {
     try {
         switch (name) {
             case 'list_memory_scopes':
-                data = boundedScopes(listMemoryScopes({
-                    ...(args.workspace_id ? { workspaceId: args.workspace_id } : {}),
-                    ...(cursor ? { cursor } : {}),
-                    ...(limit ? { limit } : {}),
-                }));
+                data = boundedScopes(allowedWorkspaceIds
+                    ? listWorkspaceMemoryScopes(args.workspace_id ? allowedWorkspaceIds.filter((id) => id === args.workspace_id) : allowedWorkspaceIds, { ...(cursor ? { cursor } : {}), ...(limit ? { limit } : {}) })
+                    : listMemoryScopes({
+                        ...(args.workspace_id ? { workspaceId: args.workspace_id } : {}),
+                        ...(cursor ? { cursor } : {}),
+                        ...(limit ? { limit } : {}),
+                    }));
                 break;
             case 'list_memories': {
                 const page = listMemories({ ...selection, actor, ...(cursor ? { cursor } : {}), ...(limit ? { limit } : {}) });

package/dist/server/services/memory-service.js

@@ -210,6 +210,21 @@ export function resolveMemoryScope(input) {
     }
     return materializeScope(input);
 }
+/** Resolve only the workspace-owned scope, without creating or exposing ancestors. */
+export function resolveWorkspaceMemoryScope(workspaceId) {
+    return materializeScope({ level: 'workspace', workspaceId });
+}
+/** Catalogue for a caller whose authority is explicitly restricted to these workspaces. */
+export function listWorkspaceMemoryScopes(workspaceIds, options = {}) {
+    const limit = requireBoundedPage(options.limit);
+    const offset = requireCursor(options.cursor);
+    const exists = getDb().prepare('SELECT id FROM workspaces WHERE id = ?');
+    const existing = [...new Set(workspaceIds)].sort().filter((id) => exists.get(id));
+    return {
+        items: existing.slice(offset, offset + limit).map(resolveWorkspaceMemoryScope),
+        ...(offset + limit < existing.length ? { nextCursor: String(offset + limit) } : {}),
+    };
+}
 /** Lists persisted scopes; a workspace view always includes the exact applicable ancestors. */
 export function listMemoryScopes(options = {}) {
     const limit = requireBoundedPage(options.limit);

package/dist/server/services/network-access-service.js

@@ -64,18 +64,29 @@ const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '::ffff:127.0.
  * scheme (`http://127.0.0.1:3000`); adding a scheme when none is present runs
  * both through the same URL rules, including the bracketed IPv6 form.
  */
-function headerHostname(value) {
+function parseOrigin(value) {
+    if (!/^https?:\/\/[^/?#\\\s]+$/i.test(value))
+        return null;
     try {
-        const hostname = new URL(value.includes('://') ? value : `http://${value}`).hostname;
-        if (!hostname)
-            return null;
-        // The URL parser keeps IPv6 hostnames bracketed; compare on the bare address.
-        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+        const url = new URL(value);
+        return url.hostname && !url.username && !url.password ? url : null;
     }
     catch {
         return null;
     }
 }
+function parseHost(value) {
+    if (!value || /[/?#@\\\s]/.test(value))
+        return null;
+    return parseOrigin(`http://${value}`);
+}
+function headerHostname(value) {
+    const url = value.includes('://') ? parseOrigin(value) : parseHost(value);
+    const hostname = url?.hostname;
+    if (!hostname)
+        return null;
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
 /**
  * True when a raw `Host`/`Origin` value names the machine itself. Always
  * allowed, whatever the settings say, which lets a caller settle the common
@@ -83,7 +94,7 @@ function headerHostname(value) {
  * both synchronous, and this runs on every request.
  */
 export function isLocalRequestHost(value) {
-    if (!value)
+    if (!value || !parseHost(value))
         return false;
     const hostname = headerHostname(value);
     return hostname !== null && LOCAL_HOSTNAMES.has(hostname);
@@ -95,52 +106,35 @@ function isAllowedHostname(hostname, enabled, lanHostnames) {
         return true;
     return enabled && lanHostnames.includes(hostname);
 }
-/**
- * Guards against DNS rebinding: a page on `evil.com` whose domain re-resolves
- * to 127.0.0.1 reaches this server with `Host: evil.com`, and the browser then
- * treats every response as same-origin. Only the names by which the machine is
- * legitimately reachable are accepted — its own loopback names, plus its LAN
- * addresses once network access is enabled.
- *
- * Behind a reverse proxy the Host is whatever domain the operator chose. When
- * they declare it via `KOBO_NETWORK_ACCESS_PROXY_HOST` it is enforced like any
- * other name; without it we cannot tell their domain from an attacker's, so
- * anything is accepted. That mode also turns off the loopback exemption, so
- * every `/api/*` request has to carry the token.
- *
- * Residual risk when the hostname is left undeclared: the SPA shell is served
- * outside `/api/*` and therefore behind no token, so a rebinding page can be
- * handed the real interface and ask the user to paste their token into it.
- * Declaring the hostname closes that; otherwise, authenticate at the proxy.
- */
+/** Reject malformed/rebinding hosts. Proxy mode requires a declared public host;
+ * loopback remains reachable for authenticated internal clients and health checks. */
 export function isAllowedRequestHost(params) {
     if (!params.host)
         return false;
-    const hostname = headerHostname(params.host);
+    const hostname = parseHost(params.host) ? headerHostname(params.host) : null;
     if (params.behindProxy) {
-        // No declared hostname means we cannot tell the operator's domain from an
-        // attacker's, so anything goes — the historical behaviour.
+        if (!hostname)
+            return false;
         if (!params.proxyHostname)
-            return true;
+            return LOCAL_HOSTNAMES.has(hostname);
         return hostname === params.proxyHostname || (hostname !== null && LOCAL_HOSTNAMES.has(hostname));
     }
     return isAllowedHostname(hostname, params.enabled, params.lanHostnames);
 }
-/**
- * Hostname declared via `KOBO_NETWORK_ACCESS_PROXY_HOST`, or null when unset.
- *
- * Behind a reverse proxy we otherwise have to accept any Host, which leaves the
- * door open to a rebinding page being served the real interface and asking the
- * user to paste their token into it. Declaring the domain the proxy serves
- * closes that, and costs one environment variable in the compose file where
- * the other network-access settings already live.
- */
+/** Validated hostname declared by the operator; invalid/missing values fail closed. */
 export function resolveProxyHostname(env = process.env) {
     const raw = env.KOBO_NETWORK_ACCESS_PROXY_HOST?.trim();
     if (!raw)
         return null;
     return headerHostname(raw);
 }
+/** Exact public origin. A bare configured hostname implies HTTPS. */
+export function resolveProxyOrigin(env = process.env) {
+    const raw = env.KOBO_NETWORK_ACCESS_PROXY_HOST?.trim();
+    if (!raw)
+        return null;
+    return parseOrigin(raw.includes('://') ? raw : `https://${raw}`)?.origin ?? null;
+}
 /**
  * Names the site a request was driven from. Guards two things.
  *
@@ -173,29 +167,22 @@ export function resolveProxyHostname(env = process.env) {
 export function isAllowedOrigin(params) {
     if (params.origin === undefined)
         return true;
-    const origin = authority(params.origin);
-    if (origin === null)
+    const origin = parseOrigin(params.origin)?.origin;
+    if (!origin)
         return false;
     if (params.behindProxy) {
         if (!params.proxyHostname)
-            return true;
-        return headerHostname(params.origin) === params.proxyHostname;
+            return false;
+        const expected = params.proxyOrigin ?? parseOrigin(`https://${params.proxyHostname}`)?.origin;
+        return origin === expected;
     }
-    // `quasar dev` proxies to the backend with changeOrigin, so it rewrites the
-    // Host to ours while the browser stays on the Quasar port. The two cannot
-    // match there, hence the explicit declaration.
-    if (params.devOrigin && origin === authority(params.devOrigin))
+    // The explicit Quasar development origin can differ from the backend port.
+    if (params.devOrigin && origin === parseOrigin(params.devOrigin)?.origin)
         return true;
-    return params.requestHost !== undefined && origin === authority(params.requestHost);
-}
-/** Host and port of a raw `Host`/`Origin` value, or null when unparseable. */
-function authority(value) {
-    try {
-        return new URL(value.includes('://') ? value : `http://${value}`).host || null;
-    }
-    catch {
-        return null;
-    }
+    if (!params.requestHost || !parseHost(params.requestHost))
+        return false;
+    const protocol = params.requestProtocol ?? 'http:';
+    return origin === parseOrigin(`${protocol}//${params.requestHost}`)?.origin;
 }
 /**
  * Origin the development client is served from, declared by the `dev` script
@@ -231,23 +218,6 @@ export function evaluateNetworkAccess(params) {
         return { allow: true, status: 200 };
     return { allow: false, status: 401 };
 }
-/** WS upgrade authorization: parses `?token=` from the raw URL. */
-export function authorizeWsUpgrade(params) {
-    let providedToken;
-    try {
-        providedToken = new URL(params.rawUrl ?? '/', 'http://localhost').searchParams.get('token') ?? undefined;
-    }
-    catch {
-        providedToken = undefined;
-    }
-    return evaluateNetworkAccess({
-        address: params.address,
-        enabled: params.enabled,
-        expectedToken: params.expectedToken,
-        providedToken,
-        trustLoopback: params.trustLoopback,
-    }).allow;
-}
 /**
  * Reads KOBO_NETWORK_ACCESS_ENABLED / KOBO_NETWORK_ACCESS_BEHIND_PROXY and
  * returns only the fields an env var actually specifies — an unset env var