@olares/lares-core 0.15.6 → 0.15.9

package/larepass/transcript.js

@@ -1,4 +1,6 @@
-import { producedPathsFromView } from "../files/deliverables.js";
+import { producedPathsFromView, turnMediaPathsFromEvent } from "../files/deliverables.js";
+import { durablePathFromToolCall, parseToolArguments } from "../files/published-tools.js";
+import { concludingReply } from "../voice/speech.js";
 import { contextForm, contextProvenance, isHumanUserSource } from "./context-provenance.js";
 import { toolRowModel } from "./tool-row.js";
 import { createTurnMetrics } from "./turn-metrics.js";
@@ -99,6 +101,7 @@ export function foldTranscript(entries) {
   const items = [];
   const blocks = new Map();
   const tools = new Map();
+  const durableCalls = new Map();
   const metrics = createTurnMetrics();
   const lastReply = new Map();
   const retries = new Map();
@@ -106,8 +109,17 @@ export function foldTranscript(entries) {
   let files = [];
   let filesAt = -1;
   let running = false;
+  let runningSince = 0;
   let error = "";
+  let reply = null;
   let streamCursor = { loc: "", kind: "", index: 0 };
+  let activeTurn = 0;
+  const ended = new Map();
+
+  const tag = (row) => {
+    row.turn = activeTurn;
+    return row;
+  };
 
   const rememberFile = (path) => {
     if (!path || fileSeen.has(path)) return;
@@ -121,7 +133,7 @@ export function foldTranscript(entries) {
       items[filesAt].paths = [...files];
       return;
     }
-    items.push({ type: "files", paths: [...files] });
+    items.push(tag({ type: "files", paths: [...files] }));
     filesAt = items.length - 1;
   };
 
@@ -135,7 +147,7 @@ export function foldTranscript(entries) {
   };
 
   const putBlock = (turn, step, index, row) => {
-    const stored = upsert(items, blocks, blockKey(turn, step, index), row);
+    const stored = upsert(items, blocks, blockKey(turn, step, index), tag(row));
     // The turn's readings belong under its closing reply, the row whose action
     // bar ends the turn on screen.
     if (stored.type === "assistant") lastReply.set(Number(turn) || 0, stored);
@@ -229,15 +241,19 @@ export function foldTranscript(entries) {
 
     if (event.type === "turn/start") {
       closeTurn();
+      if (Number.isInteger(data.turn)) activeTurn = data.turn;
       files = [];
       fileSeen.clear();
       filesAt = -1;
       running = true;
+      runningSince = Number(event.time) || 0;
       error = "";
+      reply = null;
       continue;
     }
 
     if (event.type === "turn/end") {
+      ended.set(activeTurn, data.reason?.kind || "completed");
       if (data.reason?.kind === "error") {
         error = data.reason.error?.message || "turn failed";
       }
@@ -248,22 +264,24 @@ export function foldTranscript(entries) {
     if (event.type === "user/message") {
       const text = textFromBlocks(data.content);
       if (isHumanUserSource(data.source)) {
-        if (text) items.push({ type: "user", text });
+        if (text) items.push(tag({ type: "user", text }));
         continue;
       }
       const provenance = contextProvenance(data.source);
-      items.push({
+      items.push(tag({
         type: "context",
         role: provenance.role,
         label: provenance.label,
         form: contextForm(data.source),
         text,
-      });
+      }));
       continue;
     }
 
     if (event.type === "assistant/message") {
       applyAssistantMessage(data);
+      const text = concludingReply(event);
+      if (text) reply = { seq: event.seq, text };
       continue;
     }
 
@@ -276,7 +294,7 @@ export function foldTranscript(entries) {
       const callView = callViewOf(view);
       const argsRaw = typeof data.arguments === "string" ? data.arguments : "";
       const model = toolRowModel(data.name, argsRaw);
-      const row = {
+      const row = tag({
         type: "tool",
         callId: data.callId,
         name: data.name,
@@ -284,9 +302,19 @@ export function foldTranscript(entries) {
         argsRaw,
         paths: producedPathsFromView(callView),
         ...model,
-      };
+      });
       items.push(row);
-      if (data.callId) tools.set(data.callId, items.length - 1);
+      if (data.callId) {
+        tools.set(data.callId, items.length - 1);
+        const path = durablePathFromToolCall(data.name, parseToolArguments(data.arguments));
+        if (path) durableCalls.set(data.callId, path);
+      }
+      continue;
+    }
+
+    const publishedMedia = turnMediaPathsFromEvent(event);
+    if (publishedMedia.length > 0) {
+      for (const path of publishedMedia) rememberFile(path);
       continue;
     }
 
@@ -300,6 +328,7 @@ export function foldTranscript(entries) {
         if (resultView?.title) tool.title = resultView.title;
         if (tool.status === "done") {
           for (const path of tool.paths) rememberFile(path);
+          rememberFile(durableCalls.get(id));
         }
       }
       continue;
@@ -307,7 +336,7 @@ export function foldTranscript(entries) {
 
     if (event.type === "llm/retry") {
       const retryId = data.retryId || String(event.seq ?? items.length);
-      upsert(items, retries, retryId, {
+      upsert(items, retries, retryId, tag({
         type: "retry",
         retryId,
         retry: data.retry,
@@ -317,7 +346,7 @@ export function foldTranscript(entries) {
         seconds: retrySeconds(data.delayMs),
         failure: data.failure,
         retryState: "scheduled",
-      });
+      }));
       continue;
     }
 
@@ -333,11 +362,20 @@ export function foldTranscript(entries) {
     const value = metrics.value(turn);
     if (value) row.metrics = value;
   }
+  for (const [turn, reason] of ended) {
+    const row = items.find((item) => item.turn === turn);
+    if (!row) continue;
+    row.turnReason = reason;
+    const value = metrics.value(turn);
+    if (value) row.turnRunMs = value.runMs;
+  }
   if (running) syncFiles();
   return {
     items,
     messages: messagesFromItems(items),
     running,
+    runningSince: running ? runningSince : 0,
     error,
+    reply,
   };
 }

package/mcp/approval.js

@@ -0,0 +1,152 @@
+import { createHash } from "node:crypto";
+
+/**
+ * MCP calls follow the session permission preset.
+ *
+ * Full access (`danger-full-access`) runs every MCP tool. Read-only and
+ * workspace-write allow a tool that declares `readOnlyHint`, and ask before
+ * any other MCP tool — the same approval seam a local write uses when the
+ * sandbox does not already allow the effect. Public names must match
+ * `@deepseek-ai/dsh-mcp-client` (`mcp__<server>__<tool>`, hashed when lossy).
+ */
+
+const MAX_PUBLIC_NAME_LENGTH = 64;
+const INVALID_NAME_CHARS = /[^A-Za-z0-9_-]/g;
+const HASH_LENGTH = 12;
+const CAPTURE = Symbol.for("lares.mcp.client-capture");
+
+export function mcpPublicToolName(serverName, rawName) {
+  const joined = `mcp__${serverName}__${rawName}`;
+  const normalized = joined.replace(INVALID_NAME_CHARS, "_");
+  if (normalized === joined && normalized.length <= MAX_PUBLIC_NAME_LENGTH) return normalized;
+  const hash = createHash("sha256").update(`${serverName}\0${rawName}`).digest("hex").slice(0, HASH_LENGTH);
+  return `${normalized.slice(0, MAX_PUBLIC_NAME_LENGTH - HASH_LENGTH - 1)}_${hash}`;
+}
+
+/** MCP's default is that a tool may modify state unless it says otherwise. */
+export function mcpToolMutates(annotations) {
+  return annotations?.readOnlyHint !== true;
+}
+
+export function decideMcpToolGate({ name, annotation, sandboxMode, prior }) {
+  if (!prior || prior.kind !== "allow") return prior;
+  if (typeof name !== "string" || !name.startsWith("mcp__")) return prior;
+  if (sandboxMode === "danger-full-access") return prior;
+  if (annotation !== undefined && !mcpToolMutates(annotation)) return prior;
+  return { kind: "ask" };
+}
+
+function readOnlyAnnotation(annotations) {
+  return annotations?.readOnlyHint === true ? { readOnlyHint: true } : {};
+}
+
+export function createMcpAnnotationIndex() {
+  const pendingByServer = new Map();
+  const live = new Map();
+  const liveByServer = new Map();
+
+  return {
+    stage(serverName, { first, tools }) {
+      const pending = first || !pendingByServer.has(serverName) ? new Map() : pendingByServer.get(serverName);
+      pendingByServer.set(serverName, pending);
+      for (const tool of tools) {
+        if (!tool || typeof tool.name !== "string" || tool.name === "") continue;
+        pending.set(mcpPublicToolName(serverName, tool.name), readOnlyAnnotation(tool.annotations));
+      }
+    },
+    commit(publicName) {
+      for (const [serverName, pending] of pendingByServer) {
+        if (!pending.has(publicName)) continue;
+        live.set(publicName, pending.get(publicName));
+        let names = liveByServer.get(serverName);
+        if (!names) {
+          names = new Set();
+          liveByServer.set(serverName, names);
+        }
+        names.add(publicName);
+        return;
+      }
+    },
+    drop(serverName) {
+      pendingByServer.delete(serverName);
+      const names = liveByServer.get(serverName);
+      liveByServer.delete(serverName);
+      if (!names) return;
+      for (const publicName of names) live.delete(publicName);
+    },
+    get(publicName) {
+      return live.has(publicName) ? live.get(publicName) : undefined;
+    },
+  };
+}
+
+export function recordMcpToolPage(index, serverName, request, result) {
+  const tools = Array.isArray(result?.tools) ? result.tools : [];
+  index.stage(serverName, { first: !request?.params?.cursor, tools });
+}
+
+function sameList(left, right) {
+  const a = Array.isArray(left) ? left : [];
+  const b = Array.isArray(right) ? right : [];
+  return a.length === b.length && a.every((item, index) => item === b[index]);
+}
+
+function sameUrl(configured, actual) {
+  try {
+    return new URL(configured).href === new URL(actual).href;
+  } catch {
+    return false;
+  }
+}
+
+function transportUrl(transport) {
+  const url = transport?._url;
+  if (typeof url === "string") return url;
+  return typeof url?.href === "string" ? url.href : "";
+}
+
+export function mcpServerNameForTransport(transport, servers) {
+  if (!transport || !Array.isArray(servers)) return undefined;
+  const url = transportUrl(transport);
+  if (url) {
+    return servers.find((server) =>
+      server?.enabled !== false
+      && server.transport === "streamable-http"
+      && sameUrl(server.url, url)
+    )?.serverName;
+  }
+  const params = transport._serverParams;
+  if (!params || typeof params.command !== "string") return undefined;
+  return servers.find((server) =>
+    server?.enabled !== false
+    && server.transport === "stdio"
+    && server.command === params.command
+    && sameList(server.args, params.args)
+    && String(server.cwd ?? "") === String(params.cwd ?? "")
+  )?.serverName;
+}
+
+/** Observe `tools/list` on an MCP `Client` prototype and stage annotations. */
+export function bindMcpClientCapture(proto, gate) {
+  if (proto[CAPTURE]) {
+    proto[CAPTURE].gate = gate;
+    return;
+  }
+  const connect = proto.connect;
+  const request = proto.request;
+  const state = { gate, clients: new WeakMap() };
+  proto.connect = async function connectCaptured(transport, ...rest) {
+    const serverName = mcpServerNameForTransport(transport, state.gate.servers());
+    if (serverName) state.clients.set(this, serverName);
+    return connect.call(this, transport, ...rest);
+  };
+  proto.request = async function requestCaptured(req, ...rest) {
+    const result = await request.call(this, req, ...rest);
+    const serverName = state.clients.get(this);
+    if (serverName && req?.method === "tools/list") {
+      recordMcpToolPage(state.gate.annotations, serverName, req, result);
+    }
+    return result;
+  };
+  proto[CAPTURE] = state;
+}

package/mcp/client.js

@@ -0,0 +1,38 @@
+import { createSnapshotStore } from "../tools/async.js";
+
+export const API = "/api/lares/mcp";
+
+const settings = createSnapshotStore();
+
+async function readPayload(res, path) {
+  const payload = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(payload?.error?.message ?? payload?.error?.code ?? `${path} → ${res.status}`);
+  }
+  return settings.remember(payload);
+}
+
+async function post(path, body) {
+  const res = await fetch(`${API}${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return readPayload(res, path);
+}
+
+export function rememberedMcpSettings() {
+  return settings.peek();
+}
+
+export function loadMcpSettings(options = {}) {
+  return settings.load(async () => readPayload(await fetch(API), "/"), options);
+}
+
+export function saveMcpServer(server, previousName = "") {
+  return post("/save", { server, previousName });
+}
+
+export function removeMcpServer(serverName) {
+  return post("/remove", { serverName });
+}

package/mcp/config.js

@@ -0,0 +1,139 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonFile } from "../tools/json-file.js";
+
+const SERVER_NAME = /^[A-Za-z0-9_-]{1,32}$/;
+const MAX_SERVERS = 32;
+const MAX_ENTRIES = 64;
+
+export class McpConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.code = "invalid_mcp_server";
+    this.status = 400;
+  }
+}
+
+export function mcpConfigPath(dataDir) {
+  return join(dataDir, "mcp", "servers.json");
+}
+
+function requiredString(value, field, max = 2048) {
+  const text = typeof value === "string" ? value.trim() : "";
+  if (!text) throw new McpConfigError(`${field} is required`);
+  if (text.length > max) throw new McpConfigError(`${field} is too long`);
+  return text;
+}
+
+function stringRecord(value, field) {
+  if (value === undefined) return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new McpConfigError(`${field} must be an object`);
+  }
+  const entries = Object.entries(value);
+  if (entries.length > MAX_ENTRIES) throw new McpConfigError(`${field} has too many entries`);
+  return Object.fromEntries(entries.map(([key, item]) => {
+    const name = requiredString(key, `${field} key`, 256);
+    if (typeof item !== "string" || item.length > 8192) {
+      throw new McpConfigError(`${field}.${name} must be a string`);
+    }
+    return [name, item];
+  }));
+}
+
+function stringArray(value, field) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > MAX_ENTRIES) {
+    throw new McpConfigError(`${field} must be an array with at most ${MAX_ENTRIES} entries`);
+  }
+  return value.map((item, index) => {
+    if (typeof item !== "string" || item.length > 8192) {
+      throw new McpConfigError(`${field}[${index}] must be a string`);
+    }
+    return item;
+  });
+}
+
+export function normalizeMcpServer(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new McpConfigError("server must be an object");
+  }
+  const serverName = requiredString(value.serverName, "serverName", 32);
+  if (!SERVER_NAME.test(serverName)) {
+    throw new McpConfigError("serverName may contain only letters, numbers, underscores, and hyphens");
+  }
+  const enabled = value.enabled !== false;
+  if (value.transport === "streamable-http") {
+    const url = requiredString(value.url, "url");
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new McpConfigError("url must be valid");
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new McpConfigError("url must use http or https");
+    }
+    return {
+      serverName,
+      enabled,
+      transport: "streamable-http",
+      url: parsed.toString(),
+      headers: stringRecord(value.headers, "headers"),
+    };
+  }
+  if (value.transport === "stdio") {
+    return {
+      serverName,
+      enabled,
+      transport: "stdio",
+      command: requiredString(value.command, "command", 1024),
+      args: stringArray(value.args, "args"),
+      env: stringRecord(value.env, "env"),
+      cwd: typeof value.cwd === "string" ? value.cwd.trim() : "",
+    };
+  }
+  throw new McpConfigError("transport must be streamable-http or stdio");
+}
+
+export function loadMcpServers(dataDir) {
+  const path = mcpConfigPath(dataDir);
+  if (!existsSync(path)) return [];
+  let document;
+  try {
+    document = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error(`invalid MCP configuration: ${path}`);
+  }
+  if (!document || document.version !== 1 || !Array.isArray(document.servers)) {
+    throw new Error(`invalid MCP configuration: ${path}`);
+  }
+  if (document.servers.length > MAX_SERVERS) {
+    throw new Error(`MCP configuration exceeds ${MAX_SERVERS} servers`);
+  }
+  const servers = document.servers.map(normalizeMcpServer);
+  const names = new Set();
+  for (const server of servers) {
+    if (names.has(server.serverName)) {
+      throw new Error(`duplicate MCP serverName: ${server.serverName}`);
+    }
+    names.add(server.serverName);
+  }
+  return servers;
+}
+
+export function saveMcpServers(dataDir, servers) {
+  if (!Array.isArray(servers) || servers.length > MAX_SERVERS) {
+    throw new McpConfigError(`servers must contain at most ${MAX_SERVERS} entries`);
+  }
+  const normalized = servers.map(normalizeMcpServer);
+  const names = new Set();
+  for (const server of normalized) {
+    if (names.has(server.serverName)) {
+      throw new McpConfigError(`duplicate serverName: ${server.serverName}`);
+    }
+    names.add(server.serverName);
+  }
+  writeJsonFile(mcpConfigPath(dataDir), { version: 1, servers: normalized });
+  return normalized;
+}