@mxf-dev/core 2.0.4 → 3.0.0

package/src/protocols/mcp/tools/TestTools.ts

@@ -40,15 +40,27 @@ import { TOOL_CATEGORIES } from '../../../constants/ToolNames.js';
 import { defineTool, ToolRunContext } from '../defineTool.js';
 import { ToolError } from '../ToolError.js';
 import { executeShellCommand } from './InfrastructureTools.js';
+import { resolveWorkspacePath } from '../security/McpToolPolicy.js';
 
 /** Exit code the shell reports when a command could not be found or spawned. */
 const COMMAND_NOT_FOUND = 127;
 
 const workingDirectoryProperty = {
     type: 'string',
-    description: 'Working directory path (defaults to the server working directory)'
+    description: 'Working directory under MXF_WORKSPACE_ROOT (defaults to MXF_WORKSPACE_ROOT)'
 };
 
+function resolveTestFiles(
+    inputs: string[] | undefined,
+    workingDirectory: string,
+    consumer: string
+): string[] {
+    return (inputs ?? []).map(input => resolveWorkspacePath(
+        path.resolve(workingDirectory, input),
+        consumer
+    ));
+}
+
 /** Outcome of a test run, in the shape every runner here reports. */
 export interface TestRunResult {
     runner: 'jest' | 'mocha' | 'vitest';
@@ -80,7 +92,7 @@ async function runTestRunner(
             channelId: context.channelId,
             requestId: context.requestId
         },
-        workingDirectory: workingDirectory || process.cwd(),
+        workingDirectory,
         captureOutput: true
     });
 
@@ -197,6 +209,10 @@ export const jestTestTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'test_jest workingDirectory'
+        );
         const args = ['--no-watchman', '--passWithNoTests'];
 
         if (input.coverage) {
@@ -212,10 +228,10 @@ export const jestTestTool = defineTool<
             args.push('--testNamePattern', input.testNamePattern);
         }
         if (input.testFiles && input.testFiles.length > 0) {
-            args.push(...input.testFiles);
+            args.push(...resolveTestFiles(input.testFiles, workingDirectory, 'test_jest file'));
         }
 
-        return runTestRunner('jest', args, input.workingDirectory, context);
+        return runTestRunner('jest', args, workingDirectory, context);
     }
 });
 
@@ -265,6 +281,10 @@ export const mochaTestTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'test_mocha workingDirectory'
+        );
         const args: string[] = [];
 
         if (input.reporter) {
@@ -280,10 +300,10 @@ export const mochaTestTool = defineTool<
             args.push('--recursive');
         }
         if (input.testFiles && input.testFiles.length > 0) {
-            args.push(...input.testFiles);
+            args.push(...resolveTestFiles(input.testFiles, workingDirectory, 'test_mocha file'));
         }
 
-        return runTestRunner('mocha', args, input.workingDirectory, context);
+        return runTestRunner('mocha', args, workingDirectory, context);
     }
 });
 
@@ -322,6 +342,10 @@ export const vitestTestTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'test_vitest workingDirectory'
+        );
         // `run` is Vitest's non-watching mode. Without it Vitest watches by
         // default and the process would never exit.
         const args = ['run'];
@@ -333,10 +357,10 @@ export const vitestTestTool = defineTool<
             args.push('--reporter', input.reporter);
         }
         if (input.testFiles && input.testFiles.length > 0) {
-            args.push(...input.testFiles);
+            args.push(...resolveTestFiles(input.testFiles, workingDirectory, 'test_vitest file'));
         }
 
-        return runTestRunner('vitest', args, input.workingDirectory, context);
+        return runTestRunner('vitest', args, workingDirectory, context);
     }
 });
 
@@ -348,7 +372,10 @@ export const vitestTestTool = defineTool<
  * steps later.
  */
 async function detectFramework(workingDirectory: string): Promise<'jest' | 'mocha' | 'vitest'> {
-    const packageJsonPath = path.join(workingDirectory, 'package.json');
+    const packageJsonPath = resolveWorkspacePath(
+        path.join(workingDirectory, 'package.json'),
+        'test_runner package.json'
+    );
 
     let raw: string;
     try {
@@ -426,7 +453,10 @@ export const testRunnerTool = defineTool<
         }
     },
     run: async (input, context) => {
-        const workingDirectory = input.workingDirectory || process.cwd();
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'test_runner workingDirectory'
+        );
         const requested = input.framework ?? 'auto';
 
         const detected = requested === 'auto';
@@ -459,7 +489,7 @@ export const testRunnerTool = defineTool<
         }
 
         if (input.testFiles && input.testFiles.length > 0) {
-            args.push(...input.testFiles);
+            args.push(...resolveTestFiles(input.testFiles, workingDirectory, 'test_runner file'));
         }
 
         const result = await runTestRunner(framework, args, workingDirectory, context);

package/src/protocols/mcp/tools/TypeScriptTools.ts

@@ -38,15 +38,28 @@ import { TOOL_CATEGORIES } from '../../../constants/ToolNames.js';
 import { defineTool, ToolRunContext } from '../defineTool.js';
 import { ToolError } from '../ToolError.js';
 import { executeShellCommand, ShellCommandResult } from './InfrastructureTools.js';
+import * as path from 'path';
+import { resolveWorkspacePath } from '../security/McpToolPolicy.js';
 
 /** Exit code the shell reports when a command could not be found or spawned. */
 const COMMAND_NOT_FOUND = 127;
 
 const workingDirectoryProperty = {
     type: 'string',
-    description: 'Working directory path (defaults to the server working directory)'
+    description: 'Working directory under MXF_WORKSPACE_ROOT (defaults to MXF_WORKSPACE_ROOT)'
 };
 
+function resolveInputPaths(
+    inputs: string[] | undefined,
+    workingDirectory: string,
+    consumer: string
+): string[] {
+    return (inputs ?? []).map(input => resolveWorkspacePath(
+        path.resolve(workingDirectory, input),
+        consumer
+    ));
+}
+
 /**
  * Run one of the node toolchain binaries via npx.
  *
@@ -64,7 +77,7 @@ async function runNpx(
             channelId: context.channelId,
             requestId: context.requestId
         },
-        workingDirectory: workingDirectory || process.cwd(),
+        workingDirectory,
         captureOutput: true
     });
 
@@ -144,12 +157,20 @@ export const typescriptCheckTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'typescript_check workingDirectory'
+        );
         const tscArgs = ['tsc', '--noEmit', '--pretty', 'false'];
         if (input.files && input.files.length > 0) {
-            tscArgs.push(...input.files);
+            tscArgs.push(...resolveInputPaths(
+                input.files,
+                workingDirectory,
+                'typescript_check file'
+            ));
         }
 
-        const result = await runNpx(tscArgs, input.workingDirectory, context);
+        const result = await runNpx(tscArgs, workingDirectory, context);
 
         // tsc writes diagnostics to stdout and exits 1 when it finds any. That is
         // the tool working, not the tool failing.
@@ -195,11 +216,15 @@ export const typescriptBuildTool = defineTool<
     },
     run: async (input, context) => {
         const startedAt = Date.now();
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'typescript_build workingDirectory'
+        );
 
         if (input.clean) {
             const cleanResult = await runNpx(
                 ['tsc', '--build', '--clean'],
-                input.workingDirectory,
+                workingDirectory,
                 context
             );
             // A failed clean leaves stale output behind, which makes the build's
@@ -212,7 +237,7 @@ export const typescriptBuildTool = defineTool<
             }
         }
 
-        const result = await runNpx(['tsc', '--build'], input.workingDirectory, context);
+        const result = await runNpx(['tsc', '--build'], workingDirectory, context);
 
         const errors = (result.stdout ?? '')
             .split('\n')
@@ -255,15 +280,23 @@ export const typescriptFormatTool = defineTool<
     },
     run: async (input, context) => {
         const mode: 'check' | 'write' = input.check ? 'check' : 'write';
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'typescript_format workingDirectory'
+        );
         const prettierArgs = ['prettier', input.check ? '--check' : '--write'];
 
         if (input.files && input.files.length > 0) {
-            prettierArgs.push(...input.files);
+            prettierArgs.push(...resolveInputPaths(
+                input.files,
+                workingDirectory,
+                'typescript_format file'
+            ));
         } else {
             prettierArgs.push('**/*.{ts,tsx,js,jsx}');
         }
 
-        const result = await runNpx(prettierArgs, input.workingDirectory, context);
+        const result = await runNpx(prettierArgs, workingDirectory, context);
 
         // In check mode prettier exits 1 when files need formatting — a finding,
         // not a failure. In write mode a non-zero exit means it could not write.
@@ -314,18 +347,26 @@ export const typescriptLintTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'typescript_lint workingDirectory'
+        );
         const eslintArgs = ['eslint', '--format', 'json'];
         if (input.fix) {
             eslintArgs.push('--fix');
         }
 
         if (input.files && input.files.length > 0) {
-            eslintArgs.push(...input.files);
+            eslintArgs.push(...resolveInputPaths(
+                input.files,
+                workingDirectory,
+                'typescript_lint file'
+            ));
         } else {
             eslintArgs.push('**/*.{ts,tsx,js,jsx}');
         }
 
-        const result = await runNpx(eslintArgs, input.workingDirectory, context);
+        const result = await runNpx(eslintArgs, workingDirectory, context);
 
         // ESLint exits 1 when it finds errors, but always prints its JSON report.
         // No parseable report means ESLint itself fell over — that is a failure,
@@ -386,16 +427,24 @@ export const typescriptTestTool = defineTool<
         }
     },
     run: async (input, context) => {
+        const workingDirectory = resolveWorkspacePath(
+            input.workingDirectory,
+            'typescript_test workingDirectory'
+        );
         const jestArgs = ['jest', '--no-watchman', '--passWithNoTests'];
 
         if (input.coverage) {
             jestArgs.push('--coverage');
         }
         if (input.testFiles && input.testFiles.length > 0) {
-            jestArgs.push(...input.testFiles);
+            jestArgs.push(...resolveInputPaths(
+                input.testFiles,
+                workingDirectory,
+                'typescript_test file'
+            ));
         }
 
-        const result = await runNpx(jestArgs, input.workingDirectory, context);
+        const result = await runNpx(jestArgs, workingDirectory, context);
 
         // Jest writes its summary to stderr, not stdout.
         const output = [result.stdout, result.stderr].filter(Boolean).join('\n');

package/src/protocols/mcp/tools/UserInputTools.ts

@@ -343,8 +343,22 @@ Use after calling request_user_input to retrieve the response.`,
         context: McpToolHandlerContext
     ): Promise<McpToolHandlerResult> => {
         try {
+            const agentId = context.agentId as AgentId;
+            const channelId = context.channelId as ChannelId;
+            if (!agentId || !channelId) {
+                return {
+                    content: {
+                        type: 'text',
+                        data: JSON.stringify({
+                            success: false,
+                            error: 'Agent ID and channel ID are required to read a user input response'
+                        })
+                    }
+                };
+            }
+
             const manager = UserInputRequestManager.getInstance();
-            const result = manager.getRequest(input.requestId);
+            const result = manager.getRequest(input.requestId, agentId, channelId);
 
             if (!result) {
                 return {

package/src/protocols/mcp/tools/UserMemoryTools.ts

@@ -45,12 +45,17 @@ const logger = new Logger('info', 'UserMemoryTools', 'server');
 /** Valid memory types — used for input validation across all tools */
 const VALID_TYPES: UserMemoryType[] = ['user', 'feedback', 'project', 'reference'];
 
-/**
- * Resolves the userId from context. Prefers channelId (session-scoped) over
- * agentId, falling back to 'anonymous' if neither is set.
- */
-function getUserId(context: McpToolHandlerContext): string {
-    return context.channelId || context.agentId || 'anonymous';
+/** Derive a collision-safe persistent scope from authenticated identity only. */
+export function getUserMemoryScopeKey(context: McpToolHandlerContext): string {
+    if (typeof context.agentId !== 'string' || context.agentId.trim().length === 0 ||
+        typeof context.channelId !== 'string' || context.channelId.trim().length === 0) {
+        throw new Error('User memory requires exact authenticated agent and channel identity');
+    }
+    if (context.agentId !== context.agentId.trim() ||
+        context.channelId !== context.channelId.trim()) {
+        throw new Error('User memory identity must not contain surrounding whitespace');
+    }
+    return JSON.stringify([context.agentId, context.channelId]);
 }
 
 // ─── Tool: user_memory_save ───────────────────────────────────────────────────
@@ -99,27 +104,22 @@ export const userMemorySaveTool: McpToolDefinition = {
 
         // Validate type is a recognised value
         if (!VALID_TYPES.includes(type)) {
-            return {
-                content: {
-                    type: 'text',
-                    data: `Invalid type "${type}". Must be one of: ${VALID_TYPES.join(', ')}.`
-                }
-            };
+            throw new Error(`Invalid type "${type}". Must be one of: ${VALID_TYPES.join(', ')}.`);
         }
 
         // Validate required string fields are non-empty
         if (!title?.trim()) {
-            return { content: { type: 'text', data: 'title must not be empty.' } };
+            throw new Error('title must not be empty.');
         }
         if (!description?.trim()) {
-            return { content: { type: 'text', data: 'description must not be empty.' } };
+            throw new Error('description must not be empty.');
         }
         if (!content?.trim()) {
-            return { content: { type: 'text', data: 'content must not be empty.' } };
+            throw new Error('content must not be empty.');
         }
 
         try {
-            const userId = getUserId(context);
+            const userId = getUserMemoryScopeKey(context);
             const service = UserMemoryService.getInstance();
             await service.save(userId, { type, title, description, content });
             logger.info(`Saved user memory "${title}" (${type}) for userId=${userId}`);
@@ -132,12 +132,7 @@ export const userMemorySaveTool: McpToolDefinition = {
         } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             logger.error('user_memory_save failed', err);
-            return {
-                content: {
-                    type: 'text',
-                    data: `Failed to save memory: ${message}`
-                }
-            };
+            throw new Error(`Failed to save memory: ${message}`);
         }
     }
 };
@@ -184,24 +179,19 @@ export const userMemoryRecallTool: McpToolDefinition = {
 
         // Validate query is non-empty
         if (!query?.trim()) {
-            return { content: { type: 'text', data: 'query must not be empty.' } };
+            throw new Error('query must not be empty.');
         }
 
         // Validate optional type
         if (type !== undefined && !VALID_TYPES.includes(type)) {
-            return {
-                content: {
-                    type: 'text',
-                    data: `Invalid type "${type}". Must be one of: ${VALID_TYPES.join(', ')}.`
-                }
-            };
+            throw new Error(`Invalid type "${type}". Must be one of: ${VALID_TYPES.join(', ')}.`);
         }
 
         // Clamp limit to 1–50
         const resolvedLimit = limit !== undefined ? Math.min(50, Math.max(1, limit)) : 5;
 
         try {
-            const userId = getUserId(context);
+            const userId = getUserMemoryScopeKey(context);
             const service = UserMemoryService.getInstance();
             const results = await service.recall(userId, query, { type, limit: resolvedLimit });
 
@@ -227,12 +217,7 @@ export const userMemoryRecallTool: McpToolDefinition = {
         } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             logger.error('user_memory_recall failed', err);
-            return {
-                content: {
-                    type: 'text',
-                    data: `Failed to recall memories: ${message}`
-                }
-            };
+            throw new Error(`Failed to recall memories: ${message}`);
         }
     }
 };
@@ -269,16 +254,11 @@ export const userMemoryForgetTool: McpToolDefinition = {
 
         // Require at least one deletion target
         if (!memoryId?.trim() && !searchTerm?.trim()) {
-            return {
-                content: {
-                    type: 'text',
-                    data: 'At least one of memoryId or searchTerm must be provided.'
-                }
-            };
+            throw new Error('At least one of memoryId or searchTerm must be provided.');
         }
 
         try {
-            const userId = getUserId(context);
+            const userId = getUserMemoryScopeKey(context);
             const service = UserMemoryService.getInstance();
             const { deleted } = await service.forget(userId, {
                 memoryId: memoryId?.trim() || undefined,
@@ -300,12 +280,7 @@ export const userMemoryForgetTool: McpToolDefinition = {
         } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             logger.error('user_memory_forget failed', err);
-            return {
-                content: {
-                    type: 'text',
-                    data: `Failed to delete memory: ${message}`
-                }
-            };
+            throw new Error(`Failed to delete memory: ${message}`);
         }
     }
 };
@@ -338,16 +313,11 @@ export const userMemoryShakeTool: McpToolDefinition = {
 
         // Validate thresholdDays if provided
         if (thresholdDays !== undefined && (typeof thresholdDays !== 'number' || thresholdDays < 1)) {
-            return {
-                content: {
-                    type: 'text',
-                    data: 'thresholdDays must be a number >= 1.'
-                }
-            };
+            throw new Error('thresholdDays must be a number >= 1.');
         }
 
         try {
-            const userId = getUserId(context);
+            const userId = getUserMemoryScopeKey(context);
             const service = UserMemoryService.getInstance();
             const stale = await service.shake(userId, thresholdDays);
 
@@ -376,12 +346,7 @@ export const userMemoryShakeTool: McpToolDefinition = {
         } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             logger.error('user_memory_shake failed', err);
-            return {
-                content: {
-                    type: 'text',
-                    data: `Failed to shake memories: ${message}`
-                }
-            };
+            throw new Error(`Failed to shake memories: ${message}`);
         }
     }
 };