@moretea-labs/forge 1.6.0 → 1.7.1

package/src/cli/mcp/oauth.ts

@@ -1,5 +1,16 @@
 import { randomUUID } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'fs';
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'fs';
 import { dirname } from 'path';
 import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
 import { InvalidGrantError, InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
@@ -25,6 +36,20 @@ function issueToken(): string {
   return randomUUID();
 }
 
+function fsyncFile(path: string): void {
+  const fd = openSync(path, 'r');
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function fsyncDirectory(path: string): void {
+  try {
+    const fd = openSync(path, 'r');
+    try { fsyncSync(fd); } finally { closeSync(fd); }
+  } catch {
+    // Directory fsync is unavailable on some supported platforms/filesystems.
+  }
+}
+
 export class McpOAuthTokenStore implements OAuthRegisteredClientsStore {
   private accessTokens = new Map<string, AuthInfo>();
   private refreshTokens = new Map<string, string>();
@@ -33,8 +58,12 @@ export class McpOAuthTokenStore implements OAuthRegisteredClientsStore {
   constructor(private readonly path: string, private readonly fallbackPaths: string[] = []) {}
 
   load(): void {
+    this.accessTokens.clear();
+    this.refreshTokens.clear();
+    this.clients.clear();
     let loaded = false;
     let mergedFallback = false;
+    let primaryCorrupt = false;
     for (const [index, path] of [this.path, ...this.fallbackPaths].entries()) {
       if (!existsSync(path)) continue;
       try {
@@ -59,22 +88,35 @@ export class McpOAuthTokenStore implements OAuthRegisteredClientsStore {
         }
         loaded = true;
       } catch (_error) {
-        // Corrupt local auth state should not prevent starting the server.
+        if (index === 0) primaryCorrupt = true;
       }
     }
-    if (loaded && mergedFallback) this.flush();
+    if (primaryCorrupt && !loaded) {
+      throw new Error('MCP_OAUTH_STORE_CORRUPT: primary OAuth state is unreadable and no valid fallback is available');
+    }
+    if (loaded && (mergedFallback || primaryCorrupt)) this.flush();
   }
 
   flush(): void {
-    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
-    chmodSync(dirname(this.path), 0o700);
+    const directory = dirname(this.path);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    chmodSync(directory, 0o700);
     const data: TokenData = {
       accessTokens: Object.fromEntries(this.accessTokens),
       refreshTokens: Object.fromEntries(this.refreshTokens),
       clients: Object.fromEntries(this.clients),
     };
-    writeFileSync(this.path, `${JSON.stringify(data, null, 2)}\n`, { encoding: 'utf-8', mode: 0o600 });
-    chmodSync(this.path, 0o600);
+    const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temporary, `${JSON.stringify(data, null, 2)}\n`, { encoding: 'utf-8', mode: 0o600 });
+      chmodSync(temporary, 0o600);
+      fsyncFile(temporary);
+      renameSync(temporary, this.path);
+      chmodSync(this.path, 0o600);
+      fsyncDirectory(directory);
+    } finally {
+      rmSync(temporary, { force: true });
+    }
   }
 
   getClient(clientId: string): OAuthClientInformationFull | undefined {
@@ -127,10 +169,115 @@ export class McpOAuthTokenStore implements OAuthRegisteredClientsStore {
     }
     return undefined;
   }
+
+  setTokenPair(accessToken: string, info: AuthInfo, refreshToken: string): void {
+    this.accessTokens.set(accessToken, info);
+    this.refreshTokens.set(refreshToken, accessToken);
+    this.flush();
+  }
+
+  rotateRefreshToken(
+    previousRefreshToken: string,
+    nextRefreshToken: string,
+    accessToken: string,
+    info: AuthInfo,
+  ): void {
+    this.refreshTokens.delete(previousRefreshToken);
+    this.accessTokens.set(accessToken, info);
+    this.refreshTokens.set(nextRefreshToken, accessToken);
+    this.flush();
+  }
+
+  revokeToken(token: string): void {
+    const linkedAccessToken = this.refreshTokens.get(token);
+    if (linkedAccessToken) {
+      this.refreshTokens.delete(token);
+      this.accessTokens.delete(linkedAccessToken);
+      for (const [refreshToken, accessToken] of this.refreshTokens) {
+        if (accessToken === linkedAccessToken) this.refreshTokens.delete(refreshToken);
+      }
+      this.flush();
+      return;
+    }
+
+    this.accessTokens.delete(token);
+    for (const [refreshToken, accessToken] of this.refreshTokens) {
+      if (accessToken === token) this.refreshTokens.delete(refreshToken);
+    }
+    this.flush();
+  }
 }
 
-export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerProvider {
-  const authCodes = new Map<string, { challenge: string; clientId: string }>();
+interface PendingAuthorizationCode {
+  challenge: string;
+  clientId: string;
+  issuedAt: number;
+  expiresAt: number;
+}
+
+export interface McpOAuthProviderOptions {
+  now?: () => number;
+  authorizationCodeTtlSeconds?: number;
+  maxPendingAuthorizationCodes?: number;
+  maxPendingAuthorizationCodesPerClient?: number;
+}
+
+const DEFAULT_AUTHORIZATION_CODE_TTL_SECONDS = 10 * 60;
+const DEFAULT_MAX_PENDING_AUTHORIZATION_CODES = 512;
+const DEFAULT_MAX_PENDING_AUTHORIZATION_CODES_PER_CLIENT = 32;
+
+export function createMcpOAuthProvider(
+  store: McpOAuthTokenStore,
+  options: McpOAuthProviderOptions = {},
+): OAuthServerProvider {
+  const authCodes = new Map<string, PendingAuthorizationCode>();
+  const currentTime = options.now ?? nowSeconds;
+  const ttlSeconds = Math.max(30, Math.trunc(options.authorizationCodeTtlSeconds ?? DEFAULT_AUTHORIZATION_CODE_TTL_SECONDS));
+  const globalLimit = Math.max(8, Math.trunc(options.maxPendingAuthorizationCodes ?? DEFAULT_MAX_PENDING_AUTHORIZATION_CODES));
+  const clientLimit = Math.max(2, Math.min(globalLimit, Math.trunc(
+    options.maxPendingAuthorizationCodesPerClient ?? DEFAULT_MAX_PENDING_AUTHORIZATION_CODES_PER_CLIENT,
+  )));
+
+  const purgeExpiredCodes = (now = currentTime()): void => {
+    for (const [code, pending] of authCodes) {
+      if (pending.expiresAt <= now) authCodes.delete(code);
+    }
+  };
+
+  const evictOldest = (predicate: (entry: PendingAuthorizationCode) => boolean): boolean => {
+    let oldest: { code: string; issuedAt: number } | undefined;
+    for (const [code, pending] of authCodes) {
+      if (!predicate(pending)) continue;
+      if (!oldest || pending.issuedAt < oldest.issuedAt) oldest = { code, issuedAt: pending.issuedAt };
+    }
+    if (!oldest) return false;
+    authCodes.delete(oldest.code);
+    return true;
+  };
+
+  const reserveAuthorizationCodeCapacity = (clientId: string, now: number): void => {
+    purgeExpiredCodes(now);
+    while ([...authCodes.values()].filter((pending) => pending.clientId === clientId).length >= clientLimit) {
+      if (!evictOldest((pending) => pending.clientId === clientId)) break;
+    }
+    while (authCodes.size >= globalLimit) {
+      if (!evictOldest(() => true)) break;
+    }
+  };
+
+  const pendingAuthorizationCode = (
+    client: OAuthClientInformationFull,
+    authorizationCode: string,
+  ): PendingAuthorizationCode => {
+    const now = currentTime();
+    purgeExpiredCodes(now);
+    const stored = authCodes.get(authorizationCode);
+    if (!stored || stored.clientId !== client.client_id || stored.expiresAt <= now) {
+      if (stored?.expiresAt !== undefined && stored.expiresAt <= now) authCodes.delete(authorizationCode);
+      throw new InvalidGrantError('Invalid authorization code');
+    }
+    return stored;
+  };
 
   return {
     get clientsStore(): OAuthRegisteredClientsStore {
@@ -138,10 +285,14 @@ export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerPr
     },
 
     async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res): Promise<void> {
+      const now = currentTime();
+      reserveAuthorizationCodeCapacity(client.client_id, now);
       const code = issueToken();
       authCodes.set(code, {
         challenge: params.codeChallenge,
         clientId: client.client_id,
+        issuedAt: now,
+        expiresAt: now + ttlSeconds,
       });
       const redirectUrl = new URL(params.redirectUri);
       redirectUrl.searchParams.set('code', code);
@@ -149,10 +300,8 @@ export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerPr
       res.redirect(302, redirectUrl.toString());
     },
 
-    async challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string> {
-      const stored = authCodes.get(authorizationCode);
-      if (!stored) throw new InvalidGrantError('Invalid authorization code');
-      return stored.challenge;
+    async challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string> {
+      return pendingAuthorizationCode(client, authorizationCode).challenge;
     },
 
     async exchangeAuthorizationCode(
@@ -160,22 +309,21 @@ export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerPr
       authorizationCode: string,
       _codeVerifier?: string,
     ): Promise<OAuthTokens> {
-      const stored = authCodes.get(authorizationCode);
-      if (!stored || stored.clientId !== client.client_id) {
-        throw new InvalidGrantError('Invalid authorization code');
-      }
+      pendingAuthorizationCode(client, authorizationCode);
+      // Delete before issuing credentials. A failed downstream persistence is
+      // retried as a new OAuth flow rather than making an authorization code
+      // replayable after a partial token response.
       authCodes.delete(authorizationCode);
       const accessToken = issueToken();
       const refreshToken = issueToken();
       const expiresIn = 30 * 24 * 60 * 60;
       const expiresAt = nowSeconds() + expiresIn;
-      store.setAccessToken(accessToken, {
+      store.setTokenPair(accessToken, {
         token: accessToken,
         clientId: client.client_id,
         scopes: ['forge'],
         expiresAt,
-      });
-      store.setRefreshToken(refreshToken, accessToken);
+      }, refreshToken);
       return {
         access_token: accessToken,
         token_type: 'Bearer',
@@ -191,11 +339,14 @@ export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerPr
       if (!accessToken || !existing || existing.clientId !== client.client_id) {
         throw new InvalidGrantError('Invalid refresh token');
       }
-      store.deleteRefreshToken(refreshToken);
       const nextRefreshToken = issueToken();
       const expiresIn = 30 * 24 * 60 * 60;
-      store.setAccessToken(accessToken, { ...existing, expiresAt: nowSeconds() + expiresIn });
-      store.setRefreshToken(nextRefreshToken, accessToken);
+      store.rotateRefreshToken(
+        refreshToken,
+        nextRefreshToken,
+        accessToken,
+        { ...existing, expiresAt: nowSeconds() + expiresIn },
+      );
       return {
         access_token: accessToken,
         token_type: 'Bearer',
@@ -218,9 +369,7 @@ export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerPr
     },
 
     async revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void> {
-      store.deleteAccessToken(request.token);
-      const refreshToken = store.findRefreshTokenByAccessToken(request.token);
-      if (refreshToken) store.deleteRefreshToken(refreshToken);
+      store.revokeToken(request.token);
     },
   };
 }

package/src/cli/mcp/post-finalize-work-attribution.ts

@@ -0,0 +1,150 @@
+import { classifyRepositoryCommand } from '../repositories/command-classifier';
+import { resolveRepositorySelection } from '../repositories/registry';
+import { executionIdentityForRepository } from '../../runtime/control-plane/execution/execution-identity';
+import { getWorkContract } from '../../runtime/control-plane/facade/work-contract-store';
+import { isTerminalWorkContractStatus } from '../../runtime/control-plane/facade/types';
+import {
+  classifyRepositoryCommandRoute,
+  executeRepositoryCommandViaProcessRuntime,
+} from '../../runtime/execution/process-runtime/command-facade';
+import {
+  callRepositoryTool,
+  type RepositoryToolCallerContext,
+} from './repository-tools';
+import type { CallToolResult } from './tools';
+
+function result(payload: Record<string, unknown>, isError = false): CallToolResult {
+  return {
+    content: [{ type: 'text', text: JSON.stringify(payload) }],
+    structuredContent: payload,
+    ...(isError ? { isError: true } : {}),
+  };
+}
+
+function optionalNumber(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string' && value.trim()) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+  }
+  return undefined;
+}
+
+/**
+ * A completed Work is historical attribution, never mutation authority.
+ *
+ * Finalize cleanup may remove the Work-owned checkout and release its Controller
+ * lease, but a Controller can still need to observe the repository immediately
+ * afterwards (for example `git status -sb`). Keep that observation attributed to
+ * the completed Work without reopening the Work lifecycle or writer lease.
+ *
+ * This path intentionally accepts only typed argv commands that the same command
+ * classifier used by Process Runtime proves readonly. Everything else falls
+ * through to the normal repository facade so active-Work ownership, terminal
+ * mutation fences, and completion-receipt remote-delivery rules stay authoritative.
+ */
+export async function callPostFinalizeWorkReadOnlyCommand(
+  controllerHome: string,
+  name: string,
+  args: Record<string, unknown>,
+  caller?: RepositoryToolCallerContext,
+): Promise<CallToolResult | undefined> {
+  if (name !== 'repository_command_execute') return undefined;
+  if (typeof args.workspace_root === 'string' && args.workspace_root.trim()) return undefined;
+
+  const requestedWorkId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
+  const principalId = caller?.principalId?.trim() ?? '';
+  const command = args.command;
+  if (!requestedWorkId || !principalId || !Array.isArray(command) || !command.every((entry) => typeof entry === 'string')) {
+    return undefined;
+  }
+
+  const repository = resolveRepositorySelection({
+    repoId: typeof args.repo_id === 'string' && args.repo_id.trim() ? args.repo_id.trim() : undefined,
+    controllerHome,
+    allowSoleRepository: true,
+  });
+  if (!repository) return undefined;
+
+  const work = getWorkContract({ controllerHome, repoId: repository.repoId }, requestedWorkId);
+  if (
+    !work
+    || !isTerminalWorkContractStatus(work.status)
+    || work.status !== 'completed'
+    || !work.completionReceipt
+    || work.completionReceipt.workId !== requestedWorkId
+    || !work.principalId?.trim()
+    || work.principalId.trim() !== principalId
+  ) {
+    return undefined;
+  }
+
+  const classification = classifyRepositoryCommand(command, repository.defaultBranch);
+  if (classification.risk !== 'readonly') return undefined;
+  const route = classifyRepositoryCommandRoute(command, {
+    defaultBranch: repository.defaultBranch,
+    timeoutMs: optionalNumber(args.timeout_ms),
+  });
+  if (route.route !== 'process_direct' || route.reason !== 'readonly_fast_path') return undefined;
+
+  const executionIdentity = executionIdentityForRepository(repository, { workId: requestedWorkId });
+  const execution = await executeRepositoryCommandViaProcessRuntime({
+    controllerHome,
+    repository,
+    command,
+    cwd: typeof args.cwd === 'string' ? args.cwd : undefined,
+    timeoutMs: optionalNumber(args.timeout_ms),
+    interactiveWaitMs: optionalNumber(args.interactive_wait_ms),
+    maxOutputBytes: optionalNumber(args.max_output_bytes),
+    requestId: typeof args.request_id === 'string' ? args.request_id : undefined,
+    workId: requestedWorkId,
+    executionIdentity,
+  });
+
+  if (execution.route !== 'process_direct' || execution.process) {
+    return result({
+      accepted: false,
+      mode: 'reject',
+      path: 'post_finalize_readonly_route_mismatch',
+      route: 'reject',
+      repoId: repository.repoId,
+      checkoutId: repository.activeCheckoutId,
+      workId: requestedWorkId,
+      lifecycleClosed: true,
+      error: {
+        code: 'POST_FINALIZE_READONLY_ROUTE_MISMATCH',
+        message: 'Post-finalize Work attribution may execute only through the bounded readonly direct lane.',
+      },
+    }, true);
+  }
+
+  return result({
+    accepted: true,
+    mode: 'process_direct',
+    path: 'process_direct',
+    route: 'process_direct',
+    reason: 'post_finalize_work_readonly_followup',
+    repoId: repository.repoId,
+    checkoutId: repository.activeCheckoutId,
+    workId: requestedWorkId,
+    lifecycleClosed: true,
+    postFinalizeAttribution: 'readonly_followup',
+    completed: true,
+    ok: execution.ok === true,
+    exitCode: execution.exitCode,
+    stdout: execution.stdout,
+    stderr: execution.stderr,
+    durableSideEffects: execution.durableSideEffects,
+    next: 'Post-finalize readonly observation completed without reopening Work mutation authority or creating durable execution state.',
+  });
+}
+
+export async function callRepositoryToolWithPostFinalizeAttribution(
+  controllerHome: string,
+  name: string,
+  args: Record<string, unknown>,
+  caller?: RepositoryToolCallerContext,
+): Promise<CallToolResult | undefined> {
+  const followup = await callPostFinalizeWorkReadOnlyCommand(controllerHome, name, args, caller);
+  return followup ?? callRepositoryTool(controllerHome, name, args, caller);
+}