@mindstone/mcp-server-salesforce 0.1.3 → 0.2.1

package/dist/utils.js

@@ -1,4 +1,5 @@
 import { ConnectorError } from './types.js';
+import { wrapUntrusted } from './untrusted-content.js';
 /**
  * Wraps a tool handler with standard error handling.
  */
@@ -25,9 +26,44 @@ export function withErrorHandling(fn) {
                     isError: true,
                 };
             }
-            const errorMessage = error instanceof Error ? error.message : String(error);
+            // Unexpected errors: log the raw detail locally for diagnostics, then
+            // decide what the model may see.
+            console.error('[Salesforce MCP] Unexpected error while handling tool call:', error);
+            // jsforce API errors (HttpApiError shape: string errorCode): the message
+            // is authored by the vendor API (validation-rule text, error bodies) and
+            // stays actionable for the caller, but it is org-controlled text, so it
+            // MUST be enveloped before it reaches model-visible output (invariant #6).
+            const vendorCode = error.errorCode;
+            if (error instanceof Error && typeof vendorCode === 'string') {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({
+                                ok: false,
+                                error: wrapUntrusted(error.message, 'salesforce:vendor_errors'),
+                                code: 'VENDOR_ERROR',
+                                vendor_code: vendorCode,
+                            }),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            // Anything else (runtime failures, network errors, …): return a
+            // sanitised message — ad-hoc error text can embed environment details
+            // such as tokens or file paths.
             return {
-                content: [{ type: 'text', text: JSON.stringify({ ok: false, error: errorMessage }) }],
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            ok: false,
+                            error: 'Unexpected internal error while handling the request',
+                            code: 'INTERNAL_ERROR',
+                        }),
+                    },
+                ],
                 isError: true,
             };
         }
@@ -57,6 +93,19 @@ export function escapeSOQL(value) {
         .replace(/%/g, '\\%')
         .replace(/_/g, '\\_');
 }
+/**
+ * Escape a user-supplied search term for interpolation inside a SOSL
+ * `FIND {term}` clause. SOSL gives special meaning to a different character
+ * set than SOQL — every reserved character is backslash-escaped so the term
+ * is always a single literal token and can never break out of the braces or
+ * inject operators (AND/OR groupings, wildcards, field scoping).
+ */
+export function escapeSOSL(term) {
+    if (!term)
+        return '';
+    // Backslash MUST be escaped first to avoid double-escaping.
+    return term.replace(/\\/g, '\\\\').replace(/([?&|!{}[\]()^~*:"+-])/g, '\\$1');
+}
 /**
  * Escape a user-supplied substring for interpolation inside a SOQL
  * `LIKE '%...%'` clause. Identical to `escapeSOQL` semantically (both
@@ -96,6 +145,24 @@ export function formatSOQLDate(dateStr, paramName) {
     }
     return match[1];
 }
+/**
+ * Format a date or datetime string as a SOQL datetime literal (UTC).
+ * Accepts a plain date ("2026-01-09", treated as midnight UTC) or an ISO 8601
+ * datetime ("2026-01-09T14:30:00Z", offsets supported).
+ */
+export function formatSOQLDateTime(value, paramName) {
+    const dateOnly = value.match(/^(\d{4}-\d{2}-\d{2})$/);
+    if (dateOnly)
+        return `${dateOnly[1]}T00:00:00Z`;
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?(\.\d{1,3})?(Z|[+-]\d{2}:?\d{2})?$/.test(value)) {
+        throw new ConnectorError(`Invalid ${paramName}: "${value}"`, 'INVALID_DATE_FORMAT', 'Use ISO 8601 (e.g., "2026-01-09T14:30:00Z") or a plain date ("2026-01-09", treated as midnight UTC)');
+    }
+    const parsed = new Date(value);
+    if (Number.isNaN(parsed.getTime())) {
+        throw new ConnectorError(`Invalid ${paramName}: "${value}"`, 'INVALID_DATE_FORMAT', 'Use ISO 8601 (e.g., "2026-01-09T14:30:00Z") or a plain date ("2026-01-09", treated as midnight UTC)');
+    }
+    return parsed.toISOString();
+}
 /**
  * Validate field names and return validated or default fields.
  */
@@ -125,10 +192,70 @@ export function validateAndMergeCustomFields(updateData, fields) {
     }
 }
 export const ALLOWED_FILTER_OPERATORS = new Set(['=', '!=', '<', '>', '<=', '>=', 'LIKE']);
+/**
+ * Vendor error payloads (e.g. `SaveResult.errors`) are org-authored text:
+ * validation-rule messages and error bodies are defined in the customer's
+ * Salesforce org and can carry arbitrary content. Envelope them before they
+ * reach model-visible output (AGENTS.md invariant #6, FOX-3490).
+ */
+export function formatVendorErrors(errors) {
+    const detail = typeof errors === 'string' ? errors : JSON.stringify(errors);
+    return wrapUntrusted(detail ?? 'Unknown vendor error', 'salesforce:vendor_errors');
+}
+/**
+ * 15- or 18-character alphanumeric Salesforce record ID.
+ */
+const SALESFORCE_ID_SHAPE = /^[a-zA-Z0-9]{15}(?:[a-zA-Z0-9]{3})?$/;
+/**
+ * The structural exemption applies ONLY when a `*Id`-keyed value actually has
+ * the shape of a Salesforce ID: record IDs are copied verbatim into follow-up
+ * tool calls (update, convert, link), so enveloping them would corrupt that
+ * flow. An org-authored string under an Id-named key that is not a valid ID
+ * is external text and is enveloped like any other. `attributes` is not
+ * exempt as a whole either — its nested values (type, url) are sanitized
+ * recursively. Everything else reachable inside a Salesforce record (names,
+ * emails, descriptions, subjects, …) is authored in the external system and
+ * MUST be enveloped (AGENTS.md invariant #6, FOX-3490).
+ */
+function isStructuralRecordValue(key, value) {
+    if (key !== 'Id' && !key.endsWith('Id'))
+        return false;
+    return typeof value === 'string' && SALESFORCE_ID_SHAPE.test(value);
+}
+function wrapRecordValue(value, source) {
+    if (typeof value === 'string')
+        return wrapUntrusted(value, source);
+    if (Array.isArray(value))
+        return value.map((item) => wrapRecordValue(item, source));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            isStructuralRecordValue(key, item) ? item : wrapRecordValue(item, source),
+        ]));
+    }
+    return value;
+}
+/**
+ * Envelope every external-text field in a list of Salesforce records before
+ * they are returned to the LLM. Only values under `Id`/`*Id` keys that are
+ * actually shaped like Salesforce IDs pass through raw, so downstream tool
+ * calls can use them as identifiers.
+ */
+export function sanitizeRecords(records, source) {
+    return records.map((record) => wrapRecordValue(record, source));
+}
+/**
+ * Envelope every string inside an arbitrary external-data blob (report
+ * results, metadata payloads), leaving only shape-validated Salesforce IDs
+ * raw. Use for non-record response shapes where every value is org-authored.
+ */
+export function sanitizeExternalData(value, source) {
+    return wrapRecordValue(value, source);
+}
 export function checkSaveResult(result, errorMessage) {
     const res = Array.isArray(result) ? result[0] : result;
     if (!res.success) {
-        throw new ConnectorError(errorMessage, 'UPDATE_ERROR', JSON.stringify(res.errors));
+        throw new ConnectorError(errorMessage, 'UPDATE_ERROR', formatVendorErrors(res.errors));
     }
 }
 //# sourceMappingURL=utils.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstone/mcp-server-salesforce",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "mcpName": "io.github.mindstone/mcp-server-salesforce",
   "description": "Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, and custom objects via Salesforce API",
   "license": "FSL-1.1-MIT",