@massa-ai/mcp-client 1.51.0 → 1.53.0

package/dist/config-cli.js

@@ -2174,17 +2174,11 @@ function detectRoute(platform, host) {
   if (route === "file")
     return { kind: "proceed" };
   if (route === "marketplace") {
-    if (host === "claude")
+    if (host === "claude" || host === "codex")
       return { kind: "proceed" };
-    if (host === "codex") {
-      return {
-        kind: "refuse",
-        reason: "codex marketplace-route installs are refused (in-place bundle rewrite would dirty a checkout " + "and break the drift gate) \u2014 use the dev path: MASSA_AI_MODEL_PROFILE + regenerate."
-      };
-    }
     return {
       kind: "refuse",
-      reason: "claude/codex marketplace-route installs are refused (in-place bundle rewrite would dirty a checkout " + "and break the drift gate) \u2014 use the dev path: MASSA_AI_MODEL_PROFILE + regenerate."
+      reason: "marketplace-route installs need an explicit, supported host before switching " + "(claude and codex proceed; no other host resolves a live write target yet) \u2014 " + "use the dev path: MASSA_AI_MODEL_PROFILE + regenerate."
     };
   }
   return {
@@ -2383,6 +2377,61 @@ var init_lock = __esm(() => {
 import fs5 from "fs";
 import os5 from "os";
 import path9 from "path";
+function splitPluginKey(pluginKey) {
+  const at = pluginKey.indexOf("@");
+  if (at === -1)
+    return null;
+  const pluginName = pluginKey.slice(0, at);
+  const marketplaceName = pluginKey.slice(at + 1);
+  if (!pluginName || !marketplaceName)
+    return null;
+  return { pluginName, marketplaceName };
+}
+function isContainedPath(root, candidate) {
+  const rel = path9.relative(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !path9.isAbsolute(rel);
+}
+function resolveDirectorySourceRoot(targetHome, pluginKey) {
+  const split = splitPluginKey(pluginKey);
+  if (!split)
+    return;
+  const { pluginName, marketplaceName } = split;
+  const knownMarketplacesPath = path9.join(targetHome, ".claude", "plugins", "known_marketplaces.json");
+  let known;
+  try {
+    known = JSON.parse(fs5.readFileSync(knownMarketplacesPath, "utf8"));
+  } catch {
+    return;
+  }
+  const entry = known?.[marketplaceName];
+  if (!entry || entry.source?.source !== "directory")
+    return;
+  const installLocation = entry.installLocation;
+  if (!installLocation)
+    return null;
+  const manifestPath = path9.join(installLocation, ".claude-plugin", "marketplace.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(fs5.readFileSync(manifestPath, "utf8"));
+  } catch {
+    return null;
+  }
+  const plugin = manifest.plugins?.find((p) => p?.name === pluginName);
+  const relSource = plugin?.source;
+  if (!relSource)
+    return null;
+  const resolvedInstallLocation = path9.resolve(installLocation);
+  const composed = path9.resolve(resolvedInstallLocation, relSource);
+  if (!isContainedPath(resolvedInstallLocation, composed))
+    return null;
+  try {
+    if (!fs5.existsSync(composed))
+      return null;
+  } catch {
+    return null;
+  }
+  return composed;
+}
 function selectRecord(records) {
   if (records.length === 0)
     return;
@@ -2402,6 +2451,9 @@ function selectRecord(records) {
 function resolveClaudeMarketplaceRoot(opts = {}) {
   const targetHome = opts.targetHome ?? os5.homedir();
   const pluginKey = opts.pluginKey ?? DEFAULT_PLUGIN_KEY;
+  const directoryResult = resolveDirectorySourceRoot(targetHome, pluginKey);
+  if (directoryResult !== undefined)
+    return directoryResult;
   const registryPath = path9.join(targetHome, ".claude", "plugins", "installed_plugins.json");
   let records;
   try {
@@ -2433,6 +2485,7 @@ import fs6 from "fs";
 import path10 from "path";
 import os6 from "os";
 import crypto4 from "crypto";
+import { execFileSync as execFileSync2 } from "child_process";
 function namedError3(name, message) {
   const err = new SwitchEngineError(message);
   err.name = name;
@@ -2511,6 +2564,46 @@ function matchesGlob(filename, glob) {
   const suffix = glob.slice(starIdx + 1);
   return filename.length >= prefix.length + suffix.length && filename.startsWith(prefix) && filename.endsWith(suffix);
 }
+function matchingFileNames(dir, glob) {
+  return fs6.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && matchesGlob(e.name, glob)).map((e) => e.name);
+}
+function detectGitAvailability(dir) {
+  try {
+    const out = execFileSync2("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"], {
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return out.toString().trim() === "true" ? "in-repo" : "not-a-repo";
+  } catch (err) {
+    return err.code === "ENOENT" ? "no-git" : "not-a-repo";
+  }
+}
+function gitTrackedFileNames(dir, filenames) {
+  if (filenames.length === 0)
+    return new Set;
+  try {
+    const out = execFileSync2("git", ["-C", dir, "ls-files", "--", ...filenames], {
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(out.toString().split(`
+`).map((line) => line.trim()).filter(Boolean));
+  } catch {
+    return new Set;
+  }
+}
+function checkTrackedPathGuard(activeDir, filenames) {
+  if (filenames.length === 0 || !fs6.existsSync(activeDir))
+    return GUARD_PASS;
+  const availability = detectGitAvailability(activeDir);
+  if (availability === "no-git")
+    return GUARD_UNCHECKED;
+  if (availability === "not-a-repo")
+    return GUARD_PASS;
+  const tracked = gitTrackedFileNames(activeDir, filenames);
+  if (tracked.size === 0)
+    return GUARD_PASS;
+  const offending = filenames.find((name) => tracked.has(name));
+  return { blocked: true, path: path10.join(activeDir, offending), unchecked: false };
+}
 function assertStateWritable(stateFilePath) {
   const dir = path10.dirname(stateFilePath);
   try {
@@ -2640,12 +2733,27 @@ function switchProfile(opts) {
         rows.push({ host: h.host, status: "switched" });
         continue;
       }
+      const candidateNames = matchingFileNames(h.variantDir, h.layout.activeGlob);
+      const guard = checkTrackedPathGuard(h.layout.activeDir, candidateNames);
+      if (guard.blocked) {
+        rows.push({
+          host: h.host,
+          status: "failed",
+          reason: `refusing to write ${guard.path} \u2014 it is tracked by git and this switch would dirty the checkout`
+        });
+        continue;
+      }
       try {
         const filesChanged = copyVariant(h.host, h.layout, h.variantDir);
         updatePlatform(stateFilePath, h.host, {
           modelProfile: { profile: opts.profile, switchedAt: new Date().toISOString() }
         });
-        rows.push({ host: h.host, status: "switched", filesChanged });
+        rows.push({
+          host: h.host,
+          status: "switched",
+          filesChanged,
+          ...guard.unchecked ? { reason: "tracked-path guard could not verify (git unavailable) \u2014 proceeded unchecked" } : {}
+        });
       } catch (err) {
         rows.push({ host: h.host, status: "failed", reason: err.message });
       }
@@ -2661,7 +2769,7 @@ function orderRows(universe, rows) {
   const byHost = new Map(rows.map((r) => [r.host, r]));
   return HOSTS.filter((h) => universe.includes(h) && byHost.has(h)).map((h) => byHost.get(h));
 }
-var SwitchEngineError, UnknownProfileError = (profile, known) => namedError3("UnknownProfileError", `unknown profile "${profile}" \u2014 installed: ${known.length > 0 ? known.join(", ") : "none"}`), NoHostsDetectedError = () => namedError3("NoHostsDetectedError", "no installed hosts found");
+var SwitchEngineError, UnknownProfileError = (profile, known) => namedError3("UnknownProfileError", `unknown profile "${profile}" \u2014 installed: ${known.length > 0 ? known.join(", ") : "none"}`), NoHostsDetectedError = () => namedError3("NoHostsDetectedError", "no installed hosts found"), GUARD_PASS, GUARD_UNCHECKED;
 var init_engine = __esm(() => {
   init_hosts();
   init_state();
@@ -2673,6 +2781,8 @@ var init_engine = __esm(() => {
       this.name = "SwitchEngineError";
     }
   };
+  GUARD_PASS = { blocked: false, unchecked: false };
+  GUARD_UNCHECKED = { blocked: false, unchecked: true };
 });
 
 // ../../packages/shared/dist/profile-switch/report.js
@@ -122043,7 +122153,7 @@ var init_context_controller = __esm(() => {
 });
 
 // ../../packages/core/dist/services/executor/runtime.js
-import { execFileSync as execFileSync2, execSync } from "child_process";
+import { execFileSync as execFileSync3, execSync } from "child_process";
 function commandExists(cmd) {
   try {
     const check2 = isWindows ? `where ${cmd}` : `command -v ${cmd}`;
@@ -122076,7 +122186,7 @@ function getVersion(cmd, args = ["--version"], deps) {
         timeout: 5000
       }).trim().split(/\r?\n/)[0];
     }
-    return execFileSync2(cmd, args, {
+    return execFileSync3(cmd, args, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
@@ -122217,12 +122327,12 @@ var init_runtime = __esm(() => {
 
 // ../../packages/core/dist/services/executor/sandbox.js
 import { realpathSync as realpathSync2 } from "fs";
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 function isDockerAvailable() {
   if (_dockerAvailable !== null)
     return _dockerAvailable;
   try {
-    execFileSync3("docker", ["--version"], { stdio: "pipe", timeout: 5000 });
+    execFileSync4("docker", ["--version"], { stdio: "pipe", timeout: 5000 });
     _dockerAvailable = true;
   } catch {
     _dockerAvailable = false;
@@ -122233,7 +122343,7 @@ function isSeatbeltAvailable() {
   if (_seatbeltAvailable !== null)
     return _seatbeltAvailable;
   try {
-    execFileSync3("sandbox-exec", ["--version"], { stdio: "pipe", timeout: 5000 });
+    execFileSync4("sandbox-exec", ["--version"], { stdio: "pipe", timeout: 5000 });
     _seatbeltAvailable = true;
   } catch {
     _seatbeltAvailable = false;
@@ -122338,7 +122448,7 @@ var init_sandbox = __esm(() => {
 });
 
 // ../../packages/core/dist/services/executor/executor.js
-import { spawn, execSync as execSync2, execFileSync as execFileSync4 } from "child_process";
+import { spawn, execSync as execSync2, execFileSync as execFileSync5 } from "child_process";
 import { mkdtempSync, writeFileSync as writeFileSync2, rmSync, realpathSync as realpathSync3 } from "fs";
 import { join as join3, resolve as resolve5, isAbsolute, relative as relative2 } from "path";
 import { tmpdir } from "os";
@@ -122541,7 +122651,7 @@ ${body}`;
     const binPath = srcPath.replace(/\.rs$/, isWin ? ".exe" : "");
     try {
       try {
-        execFileSync4("rustc", [srcPath, "-o", binPath], {
+        execFileSync5("rustc", [srcPath, "-o", binPath], {
           cwd,
           timeout: Math.min(timeout, 60000),
           encoding: "utf-8",
@@ -123516,7 +123626,7 @@ var init_git_ref_validation = __esm(() => {
 });
 
 // ../../packages/core/dist/services/symbol/impact-analysis.js
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 function readBfsCteFlag() {
   try {
     return Boolean(config.get("impact")?.bfsCteEnabled);
@@ -123842,19 +123952,19 @@ function defaultDiffRunner(projectPath, scope, baseBranch, since) {
     let diffRange;
     if (since) {
       try {
-        ref = execFileSync5("git", ["-C", projectPath, "rev-parse", "--verify", `${since}^{commit}`], {
+        ref = execFileSync6("git", ["-C", projectPath, "rev-parse", "--verify", `${since}^{commit}`], {
           cwd: projectPath,
           encoding: "utf-8",
           stdio: ["ignore", "pipe", "pipe"]
         }).trim();
       } catch {
-        ref = execFileSync5("git", ["-C", projectPath, "rev-list", "-1", `--before=${since}`, "HEAD"], {
+        ref = execFileSync6("git", ["-C", projectPath, "rev-list", "-1", `--before=${since}`, "HEAD"], {
           cwd: projectPath,
           encoding: "utf-8",
           stdio: ["ignore", "pipe", "pipe"]
         }).trim();
         if (!ref) {
-          const emptyTree = execFileSync5("git", ["hash-object", "-t", "tree", "--stdin"], {
+          const emptyTree = execFileSync6("git", ["hash-object", "-t", "tree", "--stdin"], {
             cwd: projectPath,
             encoding: "utf-8",
             input: "",
@@ -123866,7 +123976,7 @@ function defaultDiffRunner(projectPath, scope, baseBranch, since) {
     }
     args.push(diffRange ?? `${ref}...HEAD`);
   }
-  const out = execFileSync5("git", args, {
+  const out = execFileSync6("git", args, {
     cwd: projectPath,
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
@@ -123878,7 +123988,7 @@ function defaultDiffRunner(projectPath, scope, baseBranch, since) {
   let untrackedFiltered = 0;
   const merged = new Set(tracked);
   if (includeUntracked) {
-    const untracked = execFileSync5("git", ["-C", projectPath, "ls-files", "--others", "--exclude-standard"], {
+    const untracked = execFileSync6("git", ["-C", projectPath, "ls-files", "--others", "--exclude-standard"], {
       cwd: projectPath,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -126760,6 +126870,85 @@ var init_scheduler = __esm(() => {
   };
 });
 
+// ../../packages/core/dist/data/proposal/proposal-payload-validation.js
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isString(value) {
+  return typeof value === "string";
+}
+function isNumber(value) {
+  return typeof value === "number";
+}
+function isValidProposalPayload(kind, value) {
+  const rule = PROPOSAL_PAYLOAD_RULES[kind];
+  if (!Object.keys(value).every((key) => rule.allowedKeys.includes(key)))
+    return false;
+  if (rule.requireNonEmpty && Object.keys(value).length === 0)
+    return false;
+  for (const [field, fieldRule] of Object.entries(rule.fields)) {
+    const present = value[field] !== undefined;
+    if (!present) {
+      if (!fieldRule.optional)
+        return false;
+      continue;
+    }
+    if (!fieldRule.validate(value[field]))
+      return false;
+  }
+  return true;
+}
+function assertValidProposalPayload(kind, value) {
+  if (!isRecord(value)) {
+    throw new ProposalPayloadValidationError(kind, `proposal payload must be an object for kind "${kind}"`);
+  }
+  if (!isValidProposalPayload(kind, value)) {
+    throw new ProposalPayloadValidationError(kind, `proposal payload is invalid for kind "${kind}"`);
+  }
+}
+var PROPOSAL_PAYLOAD_RULES, ProposalPayloadValidationError;
+var init_proposal_payload_validation = __esm(() => {
+  PROPOSAL_PAYLOAD_RULES = {
+    "memory.create": {
+      allowedKeys: ["content", "type", "level", "importance", "tags"],
+      fields: {
+        content: { optional: false, validate: isString },
+        type: { optional: true, validate: isString },
+        level: { optional: true, validate: isNumber },
+        importance: { optional: true, validate: isNumber },
+        tags: { optional: true, validate: isStringArray }
+      }
+    },
+    "memory.update": {
+      allowedKeys: ["content", "importance", "tags"],
+      requireNonEmpty: true,
+      fields: {
+        content: { optional: true, validate: isString },
+        importance: { optional: true, validate: isNumber },
+        tags: { optional: true, validate: isStringArray }
+      }
+    },
+    "memory.tag": {
+      allowedKeys: ["tags"],
+      fields: {
+        tags: { optional: false, validate: isStringArray }
+      }
+    }
+  };
+  ProposalPayloadValidationError = class ProposalPayloadValidationError extends Error {
+    kind;
+    statusCode = 400;
+    constructor(kind, message) {
+      super(message);
+      this.kind = kind;
+      this.name = "ProposalPayloadValidationError";
+    }
+  };
+});
+
 // ../../packages/core/dist/data/proposal/proposal-contract.js
 class MemoryProposalStore {
   rows = [];
@@ -126783,26 +126972,53 @@ class MemoryProposalStore {
     row.decidedAt = decidedAt ?? Date.now();
     return structuredClone(row);
   }
+  async create(input) {
+    assertValidProposalPayload(input.kind, input.payload);
+    const record2 = {
+      id: input.id,
+      projectId: input.projectId,
+      kind: input.kind,
+      targetMemoryId: input.targetMemoryId ?? null,
+      payload: input.payload,
+      rationale: input.rationale ?? "",
+      status: "pending",
+      createdAt: input.createdAt ?? Date.now(),
+      decidedAt: null
+    };
+    this.rows.push(structuredClone(record2));
+    return structuredClone(record2);
+  }
+  async update(id, patch) {
+    const row = this.rows.find((item) => item.id === id);
+    if (!row)
+      return null;
+    if (patch.payload !== undefined)
+      assertValidProposalPayload(row.kind, patch.payload);
+    if (patch.rationale !== undefined)
+      row.rationale = patch.rationale;
+    if (patch.payload !== undefined)
+      row.payload = patch.payload;
+    return structuredClone(row);
+  }
+  async delete(id) {
+    const index = this.rows.findIndex((item) => item.id === id);
+    if (index === -1)
+      return null;
+    this.rows.splice(index, 1);
+    return id;
+  }
   async journalMode() {
     return "memory";
   }
 }
 var PROPOSAL_STATUSES, PROPOSAL_KINDS;
 var init_proposal_contract = __esm(() => {
+  init_proposal_payload_validation();
   PROPOSAL_STATUSES = ["pending", "approved", "rejected"];
   PROPOSAL_KINDS = ["memory.create", "memory.update", "memory.tag"];
 });
 
 // ../../packages/core/dist/data/proposal/proposal-repository-pg.js
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function stringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function validKeys(value, allowed) {
-  return Object.keys(value).every((key) => allowed.includes(key));
-}
 function parsePayload(raw2, kind) {
   let value;
   try {
@@ -126813,15 +127029,7 @@ function parsePayload(raw2, kind) {
   if (!isRecord(value)) {
     throw storeCorruption("proposal.payload_json", new TypeError("expected object"));
   }
-  let valid = false;
-  if (kind === "memory.create") {
-    valid = validKeys(value, ["content", "type", "level", "importance", "tags"]) && typeof value.content === "string" && (value.type === undefined || typeof value.type === "string") && (value.level === undefined || typeof value.level === "number") && (value.importance === undefined || typeof value.importance === "number") && (value.tags === undefined || stringArray(value.tags));
-  } else if (kind === "memory.update") {
-    valid = validKeys(value, ["content", "importance", "tags"]) && Object.keys(value).length > 0 && (value.content === undefined || typeof value.content === "string") && (value.importance === undefined || typeof value.importance === "number") && (value.tags === undefined || stringArray(value.tags));
-  } else {
-    valid = validKeys(value, ["tags"]) && stringArray(value.tags);
-  }
-  if (!valid) {
+  if (!isValidProposalPayload(kind, value)) {
     throw storeCorruption("proposal.payload_json", new TypeError("invalid proposal payload"));
   }
   return value;
@@ -126955,6 +127163,65 @@ class PgProposalStore {
     this.mirror.set(id, persisted);
     return structuredClone(persisted);
   }
+  async create(input) {
+    assertValidProposalPayload(input.kind, input.payload);
+    const record2 = {
+      id: input.id,
+      projectId: input.projectId,
+      kind: input.kind,
+      targetMemoryId: input.targetMemoryId ?? null,
+      payload: input.payload,
+      rationale: input.rationale ?? "",
+      status: "pending",
+      createdAt: input.createdAt ?? Date.now(),
+      decidedAt: null
+    };
+    await this.insert(record2);
+    return record2;
+  }
+  async update(id, patch) {
+    await this.ensureHydrated();
+    const current = this.mirror.get(id);
+    if (!current)
+      return null;
+    if (patch.payload !== undefined) {
+      assertValidProposalPayload(current.kind, patch.payload);
+    }
+    const merged = {
+      ...current,
+      ...patch.rationale !== undefined ? { rationale: patch.rationale } : {},
+      ...patch.payload !== undefined ? { payload: patch.payload } : {}
+    };
+    let rows;
+    try {
+      rows = await this.getClient().$queryRaw`
+        UPDATE proposals
+        SET rationale = ${merged.rationale}, payload_json = ${JSON.stringify(merged.payload)}
+        WHERE id = ${id}
+        RETURNING id, project_id, kind, target_memory_id, payload_json,
+                  rationale, status, created_at, decided_at`;
+    } catch (error51) {
+      throw searchBackendUnavailable("proposal_store", error51);
+    }
+    if (!rows[0])
+      return null;
+    const persisted = toRecord(rows[0]);
+    this.mirror.set(id, persisted);
+    return structuredClone(persisted);
+  }
+  async delete(id) {
+    await this.ensureHydrated();
+    let affected;
+    try {
+      affected = await this.getClient().$executeRaw`DELETE FROM proposals WHERE id = ${id}`;
+    } catch (error51) {
+      throw searchBackendUnavailable("proposal_store", error51);
+    }
+    if (affected === 0)
+      return null;
+    this.mirror.delete(id);
+    return id;
+  }
   async journalMode() {
     await this.ensureHydrated();
     return "postgres";
@@ -126971,6 +127238,7 @@ var init_proposal_repository_pg = __esm(() => {
   init_alias_resolver();
   init_search_diagnostics();
   init_proposal_contract();
+  init_proposal_payload_validation();
 });
 
 // ../../packages/core/dist/data/proposal/proposal-repository.js