@mokoconsulting/mokologs-mcp 4.1.0 → 4.2.0

package/CODE_OF_CONDUCT.md

@@ -14,7 +14,7 @@
 	DEFGROUP: 
 	INGROUP: Project.Documentation
 	REPO: MokoConsulting/Template-NPM
-	VERSION: 04.01.00
+	VERSION: 04.02.00
 	PATH: ./CODE_OF_CONDUCT.md
 	BRIEF: Contributor Covenant Code of Conduct version 1.3.0
 -->

package/CONTRIBUTING.md

@@ -14,7 +14,7 @@
 	DEFGROUP: 
 	INGROUP: Project.Documentation
 	REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-NPM
-	VERSION: 04.01.00
+	VERSION: 04.02.00
 	PATH: ./CONTRIBUTING.md
 	BRIEF: Contribution guidelines for the project
 -->

package/Makefile

@@ -10,7 +10,7 @@
 # Identity (auto-filled by workflow sync — the Makefile is the version source of truth)
 # ==============================================================================
 PROJECT_NAME    := mokologs-mcp
-PROJECT_VERSION := 04.01.00
+PROJECT_VERSION := 04.02.00
 PLATFORM        := npm
 
 # ==============================================================================

package/SECURITY.md

@@ -23,7 +23,7 @@ DEFGROUP: Template-Generic
 INGROUP: Template-Generic.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 PATH: /SECURITY.md
-VERSION: 04.01.00
+VERSION: 04.02.00
 BRIEF: Security vulnerability reporting and handling policy
 -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mokoconsulting/mokologs-mcp",
-	"version": "4.1.0",
+	"version": "4.2.0",
 	"description": "MCP server for multi-source log triage & analysis — discover, tail, search, and assess logs across local and remote sources",
 	"type": "module",
 	"main": "dist/index.js",

package/source/config.ts

@@ -70,6 +70,11 @@ const SourceSchema = z.object({
 	})
 	.refine((s) => s.type !== 'gitea' || !!s.baseUrl, {
 		message: 'a "gitea" source requires "baseUrl"',
+	})
+	// A `windows` source reads the LOCAL Event Log in this version (no remote transport).
+	// Its `logDirs` are interpreted as Event Log channel names (e.g. ["System","Application"]).
+	.refine((s) => s.type !== 'windows' || !s.ssh, {
+		message: 'a "windows" source is local-only in this version (no "ssh" block); put channel names in "logDirs"',
 	});
 
 const RedactionSchema = z

package/source/reader.ts

@@ -22,12 +22,16 @@ import { gunzipSync } from 'node:zlib';
 import { dirname, basename, join } from 'node:path';
 import { Client } from 'ssh2';
 import type { LogSource, ReadResult, RedactionPolicy } from './types.js';
+import { winListLogs, winFetchEvents, winNewestRecordId } from './winlog.js';
 
 export interface ReadCaps {
 	maxBytes: number;
 	maxLines: number;
 }
 
+/** Max Event Log records a single watch_log delta read pulls (bounded follow). */
+const MAX_WIN_WATCH_EVENTS = 1000;
+
 /**
  * POSIX single-quote a value for safe interpolation into a remote shell command
  * (ssh2's exec always runs through the login shell). Mirrors mokossh `shq()`:
@@ -327,6 +331,13 @@ export async function tail(
 ): Promise<ReadResult> {
 	const n = Math.min(opts.lines, opts.caps.maxLines);
 
+	// Windows Event Log (#14): `target` is a channel name; fetch the N newest events
+	// rendered one-per-line. Rotation does not apply (the Event Log has no .1/.gz).
+	if (source.type === 'windows') {
+		const win = await winFetchEvents(opts.target, n);
+		return toResult(sourceName, opts.target, win, { maxBytes: opts.caps.maxBytes, maxLines: n });
+	}
+
 	if (opts.includeRotated) {
 		const segs = await resolveRotatedFiles(source, opts.target); // oldest → newest
 		let combined = '';
@@ -358,6 +369,20 @@ export async function grep(
 ): Promise<ReadResult> {
 	const n = Math.min(opts.lines, opts.caps.maxLines);
 
+	// Windows Event Log (#14): fetch the recent events (bounded by maxLines) rendered
+	// one-per-line, then filter by the pattern on the rendered line. This is what lets
+	// get_errors / get_server_status match Level words (Error/Critical/Warning).
+	if (source.type === 'windows') {
+		const raw = await winFetchEvents(opts.target, opts.caps.maxLines);
+		const re = new RegExp(opts.pattern, opts.ignoreCase ? 'i' : undefined);
+		const matched = raw
+			.split(/\r?\n/)
+			.filter((l) => l && re.test(l))
+			.slice(-n)
+			.join('\n');
+		return toResult(sourceName, opts.target, matched, opts.caps);
+	}
+
 	if (opts.includeRotated) {
 		const segs = await resolveRotatedFiles(source, opts.target); // oldest → newest
 		let combined = '';
@@ -398,6 +423,9 @@ export interface LogFileInfo {
  * `extensions` (default `.log`). Returns path/size/mtime, capped to `limit`.
  */
 export async function listLogs(source: LogSource, caps: ReadCaps, limit = 200): Promise<LogFileInfo[]> {
+	// Windows Event Log (#14): the "files" are the channels this source reads.
+	if (source.type === 'windows') return winListLogs(source, limit);
+
 	const exts = source.extensions ?? ['.log'];
 	const dirs = source.logDirs ?? (source.ssh ? ['/var/log'] : ['.']);
 	const out: LogFileInfo[] = [];
@@ -439,6 +467,8 @@ export async function listLogs(source: LogSource, caps: ReadCaps, limit = 200):
 
 /** Byte size of a file (local or remote); 0 when missing. */
 export async function sizeOf(source: LogSource, path: string): Promise<number> {
+	// Windows Event Log (#14): the watch cursor is the newest RecordId (monotonic).
+	if (source.type === 'windows') return winNewestRecordId(path);
 	if (source.ssh) {
 		const out = await sshRun(source, `stat -c %s ${shq(path)} 2>/dev/null || wc -c < ${shq(path)} 2>/dev/null`, 64);
 		return parseInt(out.trim(), 10) || 0;
@@ -452,6 +482,9 @@ export async function sizeOf(source: LogSource, path: string): Promise<number> {
 
 /** Read a file from byte `offset` to EOF, byte-capped (the watch_log delta read). */
 export async function readFrom(source: LogSource, path: string, offset: number, maxBytes: number): Promise<string> {
+	// Windows Event Log (#14): `offset` is the last-seen RecordId cursor — return the
+	// rendered events newer than it (bounded). maxBytes is applied by the caller's cap.
+	if (source.type === 'windows') return winFetchEvents(path, MAX_WIN_WATCH_EVENTS, offset);
 	if (source.ssh) {
 		return sshRun(source, `tail -c +${offset + 1} ${shq(path)} 2>/dev/null | head -c ${maxBytes}`, maxBytes);
 	}

package/source/winlog.ts

@@ -0,0 +1,177 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mokologs-mcp.WinLog
+ * INGROUP: mokologs-mcp
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokologs-mcp
+ * PATH: /source/winlog.ts
+ * VERSION: 01.00.00
+ * BRIEF: Windows Event Log source adapter (#14). Reads local Event Log channels
+ *        (System/Application/Security/…) via PowerShell Get-WinEvent and renders
+ *        each event as ONE line — `<iso> <Level> <Channel> <Provider>[<Id>]: <msg>`
+ *        — so the generic reader tools (tail/grep/get_errors/get_server_status)
+ *        work unchanged against it. Local Windows only in this version.
+ *
+ *        SECURITY: every caller-supplied value (channel, max, cursor) is passed to
+ *        PowerShell via the child ENVIRONMENT and referenced as a $env: variable in
+ *        a FIXED script — never string-interpolated into the command — so a channel
+ *        name cannot inject PowerShell. powershell.exe is resolved to an absolute
+ *        path. Channel names are also charset-validated as defense in depth.
+ */
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { statSync } from 'node:fs';
+import { join, resolve as presolve } from 'node:path';
+import type { LogSource } from './types.js';
+import type { LogFileInfo } from './reader.js';
+
+const execFileP = promisify(execFile);
+const IS_WIN = process.platform === 'win32';
+
+/** Event Log channels used when a windows source lists none (via `logDirs`). */
+const DEFAULT_CHANNELS = ['System', 'Application', 'Security', 'Setup'];
+
+/** Valid Event Log channel name (e.g. `System`, `Microsoft-Windows-Kernel-Power/Operational`). */
+const CHANNEL_RE = /^[A-Za-z0-9 _.\-/%()]+$/;
+
+const PS_TIMEOUT_MS = 30_000;
+const MAX_EVENTS_CEILING = 5000;
+
+function assertWindows(): void {
+	if (!IS_WIN) {
+		throw new Error('windows source: Event Log access requires the mokologs MCP to run on Windows (local only in this version).');
+	}
+}
+
+/** The Event Log channels this source reads (charset-validated). */
+export function channelsOf(source: LogSource): string[] {
+	const list = source.logDirs && source.logDirs.length ? source.logDirs : DEFAULT_CHANNELS;
+	return list.filter((c) => CHANNEL_RE.test(c));
+}
+
+// Resolve powershell.exe to an ABSOLUTE path (canonical System32 first, then PATH:
+// pwsh.exe / powershell.exe). Never run a bare name — avoids cwd/planted-binary pickup.
+let cachedPwsh: string | null | undefined;
+function resolvePowershell(): string {
+	if (cachedPwsh !== undefined) {
+		if (cachedPwsh) return cachedPwsh;
+		throw new Error('PowerShell not found.');
+	}
+	const isFile = (p: string): boolean => {
+		try { return statSync(p).isFile(); } catch { return false; }
+	};
+	const sysRoot = process.env.SystemRoot || process.env.windir || 'C:\\Windows';
+	const candidates = [join(sysRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')];
+	for (const d of (process.env.PATH ?? '').split(';')) {
+		if (d && d.trim() && d !== '.') candidates.push(join(d, 'pwsh.exe'), join(d, 'powershell.exe'));
+	}
+	for (const c of candidates) {
+		if (isFile(c)) { cachedPwsh = presolve(c); return cachedPwsh; }
+	}
+	cachedPwsh = null;
+	throw new Error('PowerShell not found (looked for System32 powershell.exe and pwsh/powershell on PATH).');
+}
+
+/**
+ * Run a FIXED PowerShell script. Caller parameters are supplied via a minimal
+ * child environment (MLOG_* keys) and read inside the script as `$env:MLOG_*`
+ * variables — they are NEVER concatenated into the command string, so no value
+ * can inject PowerShell. A non-zero exit returns whatever stdout was produced.
+ */
+async function runPs(script: string, params: Record<string, string>): Promise<string> {
+	assertWindows();
+	const bin = resolvePowershell();
+	const env: NodeJS.ProcessEnv = {
+		SystemRoot: process.env.SystemRoot,
+		windir: process.env.windir,
+		PATH: process.env.PATH,
+		Path: process.env.Path,
+		PATHEXT: process.env.PATHEXT,
+		TEMP: process.env.TEMP,
+		TMP: process.env.TMP,
+		USERPROFILE: process.env.USERPROFILE,
+		...params,
+	};
+	try {
+		const { stdout } = await execFileP(bin, ['-NoProfile', '-NonInteractive', '-Command', script], {
+			env,
+			timeout: PS_TIMEOUT_MS,
+			maxBuffer: 16 * 1024 * 1024,
+			windowsHide: true,
+			shell: false,
+		});
+		return stdout ?? '';
+	} catch (err) {
+		return (err as { stdout?: string }).stdout ?? '';
+	}
+}
+
+// Render N events (optionally only those newer than a RecordId cursor) as one
+// line each, oldest→newest. Fixed script; channel/max/since arrive via $env.
+const RENDER_SCRIPT = `
+$ErrorActionPreference='SilentlyContinue'
+$ch=$env:MLOG_CHANNEL
+$max=[int]$env:MLOG_MAX
+$since=$env:MLOG_SINCE
+try { $ev = Get-WinEvent -LogName $ch -MaxEvents $max -ErrorAction Stop } catch { $ev=@() }
+if ($since) { $sid=[int64]$since; $ev = $ev | Where-Object { $_.RecordId -gt $sid } }
+$ev | Sort-Object RecordId | ForEach-Object {
+  $lvl=$_.LevelDisplayName; if(-not $lvl){$lvl='Information'}
+  $m=$_.Message; if(-not $m){$m=''}
+  $m=($m -replace '\\r?\\n',' ')
+  if($m.Length -gt 2000){$m=$m.Substring(0,2000)}
+  '{0} {1} {2} {3}[{4}]: {5}' -f $_.TimeCreated.ToString('s'), $lvl, $ch, $_.ProviderName, $_.Id, $m
+}`;
+
+/** Fetch rendered event lines for a channel (optionally since a RecordId cursor). */
+export async function winFetchEvents(channel: string, maxEvents: number, sinceRecordId?: number): Promise<string> {
+	assertWindows();
+	if (!CHANNEL_RE.test(channel)) throw new Error(`windows source: invalid Event Log channel name "${channel}".`);
+	const max = Math.max(1, Math.min(Math.floor(maxEvents) || 1, MAX_EVENTS_CEILING));
+	const params: Record<string, string> = { MLOG_CHANNEL: channel, MLOG_MAX: String(max) };
+	if (sinceRecordId !== undefined && Number.isFinite(sinceRecordId)) params.MLOG_SINCE = String(Math.floor(sinceRecordId));
+	return runPs(RENDER_SCRIPT, params);
+}
+
+/** List the source's Event Log channels as "files" (name, record count, newest write time). */
+export async function winListLogs(source: LogSource, limit = 200): Promise<LogFileInfo[]> {
+	assertWindows();
+	const channels = channelsOf(source);
+	if (!channels.length) return [];
+	const script = `
+$ErrorActionPreference='SilentlyContinue'
+($env:MLOG_CHANNELS -split ';') | ForEach-Object {
+  if(-not $_){ return }
+  try {
+    $l = Get-WinEvent -ListLog $_ -ErrorAction Stop
+    $t = if($l.LastWriteTime){ $l.LastWriteTime.ToString('s') } else { '' }
+    '{0}\t{1}\t{2}' -f [int64]$l.RecordCount, $t, $l.LogName
+  } catch {}
+}`;
+	const out = await runPs(script, { MLOG_CHANNELS: channels.join(';') });
+	const files: LogFileInfo[] = [];
+	for (const line of out.split(/\r?\n/)) {
+		if (!line.trim()) continue;
+		const [size, mtime, ...rest] = line.split('\t');
+		const path = rest.join('\t').trim();
+		if (path) files.push({ path, size: Number(size) || 0, mtime: (mtime || '').trim() });
+	}
+	return files.slice(0, limit);
+}
+
+/** Newest RecordId in a channel — the monotonic cursor used by watch_log. 0 when empty/absent. */
+export async function winNewestRecordId(channel: string): Promise<number> {
+	assertWindows();
+	if (!CHANNEL_RE.test(channel)) return 0;
+	const out = await runPs(
+		`$ErrorActionPreference='SilentlyContinue'
+try { $e = Get-WinEvent -LogName $env:MLOG_CHANNEL -MaxEvents 1 -ErrorAction Stop; if($e){ [int64]$e[0].RecordId } else { 0 } } catch { 0 }`,
+		{ MLOG_CHANNEL: channel },
+	);
+	return parseInt(out.trim(), 10) || 0;
+}