@omercnet/paseo-omp 0.2.1 → 0.3.0-next.101.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omercnet/paseo-omp",
-  "version": "0.2.1",
+  "version": "0.3.0-next.101.1",
   "type": "module",
   "description": "Paseo integration for OMP, including its direct provider and workspace tooling.",
   "license": "MIT",
@@ -36,6 +36,7 @@
     "SUPPORT.md",
     "TESTING.md",
     "docs",
+    "scripts/prepare-dependencies.mjs",
     "index.client.tsx",
     "index.server.ts",
     "client",
@@ -51,26 +52,24 @@
     "test:coverage": "PASEO_OMP_COVERAGE=1 vitest run --coverage",
     "test:integration:docker": "node --import tsx scripts/test-docker-host-tools.ts",
     "test:integration:wsl": "node --import tsx scripts/test-wsl-host-tools.ts",
+    "test:integration:canary": "node --import tsx scripts/test-canary.ts",
     "test:integration:install": "node --import tsx scripts/test-package-install.ts",
-    "package:release": "node --import tsx scripts/package-release.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@getpaseo/protocol": "0.9.0-beta.1",
     "@modelcontextprotocol/sdk": "1.29.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.10",
-    "@getpaseo/cli": "0.8.0",
-    "@getpaseo/client": "0.8.0",
-    "@getpaseo/plugin": "0.8.0",
-    "@getpaseo/protocol": "0.8.0",
+    "@getpaseo/cli": "0.9.0-beta.1",
+    "@getpaseo/client": "0.9.0-beta.1",
+    "@getpaseo/plugin": "0.9.0-beta.1",
     "@tanstack/react-query": "^5.102.3",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.18",
-    "esbuild": "^0.28.0",
     "@vitest/coverage-v8": "^5.0.0",
-    "fflate": "^0.8.3",
     "react": "19.1.0",
     "react-native": "0.81.5",
     "tsx": "^4.20.6",

package/paseo-plugin.json

@@ -1,5 +1,5 @@
 {
   "id": "paseo-omp",
-  "requirements": { "paseo": "^0.8.0" },
-  "build": [["npm", "ci", "--ignore-scripts"]]
+  "requirements": { "paseo": ">=0.8.0 <0.10.0" },
+  "build": [["node", "scripts/prepare-dependencies.mjs"]]
 }

package/scripts/prepare-dependencies.mjs

@@ -0,0 +1,24 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+export function prepareDependencies(root = projectRoot, execute = execFileSync) {
+  if (!existsSync(join(root, "package-lock.json"))) return false;
+
+  execute(
+    process.platform === "win32" ? "npm.cmd" : "npm",
+    ["ci", "--omit=dev", "--ignore-scripts"],
+    {
+      cwd: root,
+      stdio: "inherit",
+    },
+  );
+  return true;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  prepareDependencies();
+}

package/server/mcp-browser.ts

@@ -0,0 +1,95 @@
+import { randomUUID } from "node:crypto";
+import type { RpcInput } from "@getpaseo/plugin";
+import type { openOmpMcpAuthorizationInPaseoBrowser } from "../shared/mcp";
+import { OmpPublicError } from "./provider/security";
+
+const MAX_REGISTERED_SESSIONS = 32;
+const MAX_AUTHORIZATIONS_PER_SESSION = 16;
+
+type BrowserAuthorizationOpener = (url: string) => Promise<void>;
+
+type RegisteredSession = {
+  token: symbol;
+  open: BrowserAuthorizationOpener;
+  authorizations: Set<string>;
+};
+
+type RegisteredAuthorization = {
+  agentId: string;
+  sessionToken: symbol;
+  url: string;
+  open: BrowserAuthorizationOpener;
+};
+
+export interface OmpBrowserAuthorizationRegistration {
+  issue(url: string): string | undefined;
+  remove(): void;
+}
+
+export class OmpBrowserAuthorizationRegistry {
+  private readonly sessions = new Map<string, RegisteredSession>();
+  private readonly authorizations = new Map<string, RegisteredAuthorization>();
+
+  register(agentId: string, open: BrowserAuthorizationOpener): OmpBrowserAuthorizationRegistration {
+    if (this.sessions.has(agentId)) {
+      throw new OmpPublicError("OMP browser authorization is already registered for this agent");
+    }
+    if (this.sessions.size >= MAX_REGISTERED_SESSIONS) {
+      throw new OmpPublicError("OMP browser authorization session limit reached");
+    }
+    const session: RegisteredSession = { token: Symbol(agentId), open, authorizations: new Set() };
+    this.sessions.set(agentId, session);
+
+    return {
+      issue: (url) => {
+        if (this.sessions.get(agentId) !== session) return;
+        if (session.authorizations.size >= MAX_AUTHORIZATIONS_PER_SESSION) {
+          const oldest = session.authorizations.values().next().value;
+          if (oldest) {
+            session.authorizations.delete(oldest);
+            this.authorizations.delete(oldest);
+          }
+        }
+        const authorizationToken = randomUUID();
+        session.authorizations.add(authorizationToken);
+        this.authorizations.set(authorizationToken, {
+          agentId,
+          sessionToken: session.token,
+          url,
+          open,
+        });
+        return authorizationToken;
+      },
+      remove: () => {
+        if (this.sessions.get(agentId) !== session) return;
+        this.sessions.delete(agentId);
+        for (const authorizationToken of session.authorizations) {
+          this.authorizations.delete(authorizationToken);
+        }
+        session.authorizations.clear();
+      },
+    };
+  }
+
+  async open(authorizationToken: string): Promise<void> {
+    const authorization = this.authorizations.get(authorizationToken);
+    const session = authorization ? this.sessions.get(authorization.agentId) : undefined;
+    if (!authorization || session?.token !== authorization.sessionToken) {
+      throw new OmpPublicError("The OMP browser authorization is no longer available");
+    }
+    await authorization.open(authorization.url);
+  }
+
+  clear(): void {
+    this.authorizations.clear();
+    this.sessions.clear();
+  }
+}
+
+export async function resolveOpenOmpMcpAuthorizationInPaseoBrowser(
+  input: RpcInput<typeof openOmpMcpAuthorizationInPaseoBrowser>,
+  registry: OmpBrowserAuthorizationRegistry,
+): Promise<{ opened: true }> {
+  await registry.open(input.authorizationToken);
+  return { opened: true };
+}

package/server/memory.ts

@@ -4,7 +4,7 @@ import { DatabaseSync } from "node:sqlite";
 import type { RpcInput } from "@getpaseo/plugin";
 import { z } from "zod";
 import type { listOmpMemory, OmpMemoryFact } from "../shared/memory";
-import { ompAgentDir } from "./paths";
+import { ompStateDir } from "./paths";
 
 const FactRowSchema = z.object({
   id: z.string(),
@@ -82,5 +82,5 @@ export async function listOmpMemoryFrom(
 export async function resolveListOmpMemory({
   cwd,
 }: RpcInput<typeof listOmpMemory>): Promise<{ bank: string | null; facts: OmpMemoryFact[] }> {
-  return listOmpMemoryFrom(join(ompAgentDir(), "memories", "mnemopi", "banks"), cwd);
+  return listOmpMemoryFrom(join(ompStateDir(), "memories", "mnemopi", "banks"), cwd);
 }

package/server/omp-config.ts

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import type { RpcInput } from "@getpaseo/plugin";
 import { parse as parseYaml } from "yaml";
 import type { ZodType } from "zod";
@@ -26,8 +26,11 @@ const CONFIG_FILENAMES = ["config.yml", "config.yaml"] as const;
 
 type OmpConfigResult = { path: string; available: boolean; config: OmpConfig | null };
 
-async function readFirstExisting(dir: string): Promise<{ path: string; text: string } | undefined> {
-  for (const filename of CONFIG_FILENAMES) {
+async function readFirstExisting(
+  dir: string,
+  filenames: readonly string[] = CONFIG_FILENAMES,
+): Promise<{ path: string; text: string } | undefined> {
+  for (const filename of filenames) {
     const path = join(dir, filename);
     try {
       return { path, text: await readFile(path, "utf8") };
@@ -106,9 +109,12 @@ export function parseOmpConfig(raw: unknown): OmpConfig {
   return config;
 }
 
-export async function readOmpConfigFrom(dir: string): Promise<OmpConfigResult> {
-  const defaultPath = join(dir, CONFIG_FILENAMES[0]);
-  const found = await readFirstExisting(dir);
+export async function readOmpConfigFrom(
+  dir: string,
+  filenames: readonly string[] = CONFIG_FILENAMES,
+): Promise<OmpConfigResult> {
+  const defaultPath = join(dir, filenames[0] ?? CONFIG_FILENAMES[0]);
+  const found = await readFirstExisting(dir, filenames);
   if (!found) return { path: defaultPath, available: false, config: null };
   try {
     const raw: unknown = parseYaml(found.text);
@@ -120,7 +126,10 @@ export async function readOmpConfigFrom(dir: string): Promise<OmpConfigResult> {
 }
 
 export async function resolveListOmpConfig(
-  _input: RpcInput<typeof listOmpConfig>,
+  input: RpcInput<typeof listOmpConfig>,
 ): Promise<OmpConfigResult> {
+  if (input.cwd && isAbsolute(input.cwd) && !input.cwd.includes("\0")) {
+    return readOmpConfigFrom(join(input.cwd, ".omp"), [CONFIG_FILENAMES[0]]);
+  }
   return readOmpConfigFrom(ompAgentDir());
 }

package/server/omp-plugins.ts

@@ -1,5 +1,5 @@
 import { readFile, stat } from "node:fs/promises";
-import { delimiter, join } from "node:path";
+import { delimiter, isAbsolute, join } from "node:path";
 import type { RpcInput } from "@getpaseo/plugin";
 import { z } from "zod";
 import {
@@ -19,6 +19,7 @@ import {
   type OmpPluginState,
 } from "../shared/omp-plugins";
 import { SerialMutationQueue } from "./mutation-queue";
+import { currentOmpEnvironment } from "./paths";
 import {
   type BoundedRun,
   buildStatefulCommandEnv,
@@ -78,9 +79,14 @@ export interface OmpPluginDependencies {
     args: readonly string[],
     outputLimit: number,
     timeoutMs: number,
+    cwd?: string,
   ): Promise<BoundedRun>;
 }
 
+function validWorkspaceCwd(cwd: string | undefined): boolean {
+  return cwd === undefined || (isAbsolute(cwd) && !cwd.includes("\0"));
+}
+
 function boundedText(value: unknown, maximum: number): string | null {
   if (typeof value !== "string" || value.length === 0 || value.length > maximum) return null;
   if (/[\0\r\n]/u.test(value)) return null;
@@ -130,6 +136,7 @@ function parseNpmPlugin(raw: unknown): OmpInstalledPlugin | null {
     enabled: candidate.data.enabled,
     shadowed: false,
     path,
+    configAmbiguous: false,
     description,
     enabledFeatures,
     availableFeatures,
@@ -167,6 +174,7 @@ function parseMarketplacePlugin(raw: unknown): OmpInstalledPlugin | null {
     shadowed: candidate.data.shadowedBy === "project",
     path,
     description: null,
+    configAmbiguous: false,
     enabledFeatures: [],
     availableFeatures: [],
     configurable: false,
@@ -185,13 +193,24 @@ function pluginAliases(plugin: OmpInstalledPlugin): string[] {
 }
 
 function markAmbiguousPlugins(plugins: OmpInstalledPlugin[]): OmpInstalledPlugin[] {
-  const counts = new Map<string, number>();
+  const lifecycleCounts = new Map<string, number>();
+  const configCounts = new Map<string, number>();
+  const lifecycleKey = (plugin: OmpInstalledPlugin) =>
+    plugin.source === "marketplace"
+      ? `marketplace:${plugin.scope}:${plugin.id}`
+      : `npm:${plugin.id}`;
   for (const plugin of plugins) {
-    for (const alias of pluginAliases(plugin)) counts.set(alias, (counts.get(alias) ?? 0) + 1);
+    const key = lifecycleKey(plugin);
+    lifecycleCounts.set(key, (lifecycleCounts.get(key) ?? 0) + 1);
+    if (plugin.packageName) {
+      configCounts.set(plugin.packageName, (configCounts.get(plugin.packageName) ?? 0) + 1);
+    }
   }
   return plugins.map((plugin) => ({
     ...plugin,
-    ambiguous: pluginAliases(plugin).some((alias) => (counts.get(alias) ?? 0) > 1),
+    ambiguous: (lifecycleCounts.get(lifecycleKey(plugin)) ?? 0) > 1,
+    configAmbiguous:
+      plugin.packageName !== undefined && (configCounts.get(plugin.packageName) ?? 0) > 1,
   }));
 }
 
@@ -237,12 +256,12 @@ function readFailure(result: BoundedRun): string {
 
 async function resolveOmpExecutable(): Promise<string | null> {
   return resolveExecutablePath(
-    process.env.OMP_COMMAND ?? "omp",
-    (process.env.PATH ?? "").split(delimiter),
+    currentOmpEnvironment().OMP_COMMAND ?? "omp",
+    (currentOmpEnvironment().PATH ?? "").split(delimiter),
     {
       cwd: process.cwd(),
       platform: process.platform,
-      pathExt: process.env.PATHEXT ?? WINDOWS_DEFAULT_PATHEXT,
+      pathExt: currentOmpEnvironment().PATHEXT ?? WINDOWS_DEFAULT_PATHEXT,
     },
   );
 }
@@ -252,16 +271,17 @@ async function runOmpPlugin(
   args: readonly string[],
   outputLimit: number,
   timeoutMs: number,
+  cwd = process.cwd(),
 ): Promise<BoundedRun> {
   return runBounded(
     defaultSpawn,
     executable,
     args,
-    buildStatefulCommandEnv(process.env),
+    buildStatefulCommandEnv(currentOmpEnvironment()),
     timeoutMs,
     KILL_GRACE_MS,
     outputLimit,
-    process.cwd(),
+    cwd,
   );
 }
 
@@ -270,7 +290,7 @@ async function enrichMarketplaceConfiguration(
 ): Promise<OmpInstalledPlugin[]> {
   const enriched = await Promise.all(
     plugins.map(async (plugin) => {
-      if (plugin.source !== "marketplace" || plugin.scope !== "user" || !plugin.path) return plugin;
+      if (plugin.source !== "marketplace" || !plugin.path) return plugin;
       try {
         const metadataPath = join(plugin.path, "package.json");
         const metadata = await stat(metadataPath);
@@ -301,6 +321,7 @@ const DEFAULT_DEPENDENCIES: OmpPluginDependencies = {
 async function loadPluginState(
   executable: string | null | undefined,
   dependencies: OmpPluginDependencies,
+  cwd?: string,
 ): Promise<OmpPluginState> {
   const resolved = executable === undefined ? await dependencies.resolveExecutable() : executable;
   if (!resolved) return unavailableState("The OMP executable could not be resolved.");
@@ -309,6 +330,7 @@ async function loadPluginState(
     ["plugin", "list", "--json"],
     LIST_OUTPUT_LIMIT,
     READ_TIMEOUT_MS,
+    cwd,
   );
   if (!runSucceeded(result)) return unavailableState(readFailure(result));
   try {
@@ -324,10 +346,11 @@ async function loadPluginState(
 }
 
 export async function listOmpPluginsWithDependencies(
-  _input: RpcInput<typeof listOmpPlugins>,
+  input: RpcInput<typeof listOmpPlugins>,
   dependencies: OmpPluginDependencies,
 ): Promise<OmpPluginState> {
-  return loadPluginState(undefined, dependencies);
+  if (!validWorkspaceCwd(input.cwd)) return unavailableState("The workspace path is invalid.");
+  return loadPluginState(undefined, dependencies, input.cwd);
 }
 
 export async function resolveListOmpPlugins(
@@ -417,12 +440,14 @@ async function loadPluginConfig(
   executable: string,
   plugin: string,
   dependencies: OmpPluginDependencies,
+  cwd?: string,
 ): Promise<OmpPluginConfigState> {
   const result = await dependencies.runPlugin(
     executable,
     ["plugin", "config", "list", plugin, "--json"],
     CONFIG_OUTPUT_LIMIT,
     READ_TIMEOUT_MS,
+    cwd,
   );
   if (!runSucceeded(result)) {
     return unavailableConfig(
@@ -443,9 +468,12 @@ export async function inspectOmpPluginConfigWithDependencies(
   input: RpcInput<typeof inspectOmpPluginConfig>,
   dependencies: OmpPluginDependencies,
 ): Promise<OmpPluginConfigState> {
+  if (!validWorkspaceCwd(input.cwd)) {
+    return unavailableConfig(input.plugin, "The workspace path is invalid.");
+  }
   const executable = await dependencies.resolveExecutable();
   return executable
-    ? loadPluginConfig(executable, input.plugin, dependencies)
+    ? loadPluginConfig(executable, input.plugin, dependencies, input.cwd)
     : unavailableConfig(input.plugin, "The OMP executable could not be resolved.");
 }
 
@@ -492,13 +520,17 @@ export async function mutateOmpPluginConfigWithDependencies(
   input: RpcInput<typeof mutateOmpPluginConfig>,
   dependencies: OmpPluginDependencies,
 ): Promise<{ ok: boolean; message: string; config: OmpPluginConfigState }> {
+  if (!validWorkspaceCwd(input.cwd)) {
+    const config = unavailableConfig(input.plugin, "The workspace path is invalid.");
+    return { ok: false, message: "The workspace path is invalid.", config };
+  }
   const executable = await dependencies.resolveExecutable();
   if (!executable) {
     const config = unavailableConfig(input.plugin, "The OMP executable could not be resolved.");
     return { ok: false, message: "The OMP executable could not be resolved.", config };
   }
 
-  const current = await loadPluginConfig(executable, input.plugin, dependencies);
+  const current = await loadPluginConfig(executable, input.plugin, dependencies, input.cwd);
   const setting = current.settings.find((candidate) => candidate.key === input.key);
   if (!current.available || !setting) {
     return {
@@ -526,8 +558,9 @@ export async function mutateOmpPluginConfigWithDependencies(
     buildOmpPluginConfigMutationArgs(input),
     MUTATION_OUTPUT_LIMIT,
     READ_TIMEOUT_MS,
+    input.cwd,
   );
-  const config = await loadPluginConfig(executable, input.plugin, dependencies);
+  const config = await loadPluginConfig(executable, input.plugin, dependencies, input.cwd);
   const mutationSucceeded = runSucceeded(mutation);
   const ok = mutationSucceeded && config.available;
   return {
@@ -553,7 +586,7 @@ export function resolveMutateOmpPluginConfig(
 
 export function buildOmpPluginMutationArgs(input: OmpPluginMutation): string[] {
   const target = input.action === "install" ? input.source : input.plugin;
-  return ["plugin", input.action, target, "--scope", "user", "--json"];
+  return ["plugin", input.action, target, "--scope", input.scope ?? "user", "--json"];
 }
 
 function mutationFailure(result: BoundedRun): string {
@@ -583,6 +616,10 @@ export async function mutateOmpPluginWithDependencies(
   input: RpcInput<typeof mutateOmpPlugin>,
   dependencies: OmpPluginDependencies,
 ): Promise<{ ok: boolean; message: string; state: OmpPluginState }> {
+  if (!validWorkspaceCwd(input.cwd)) {
+    const state = unavailableState("The workspace path is invalid.");
+    return { ok: false, message: "The workspace path is invalid.", state };
+  }
   const executable = await dependencies.resolveExecutable();
   if (!executable) {
     const state = unavailableState("The OMP executable could not be resolved.");
@@ -590,15 +627,26 @@ export async function mutateOmpPluginWithDependencies(
   }
 
   if (input.action !== "install") {
-    const before = await loadPluginState(executable, dependencies);
+    const before = await loadPluginState(executable, dependencies, input.cwd);
     if (!before.available) {
       return { ok: false, message: "OMP plugin state is unavailable.", state: before };
     }
-    const matches = before.plugins.filter((plugin) => pluginAliases(plugin).includes(input.plugin));
-    if (matches.length !== 1 || matches[0]?.ambiguous || matches[0]?.scope === "project") {
+    const matches = before.plugins.filter(
+      (plugin) =>
+        pluginAliases(plugin).includes(input.plugin) &&
+        (input.scope === undefined || plugin.scope === input.scope),
+    );
+    if (matches.length !== 1 || matches[0]?.ambiguous) {
+      return {
+        ok: false,
+        message: "The plugin target is ambiguous in this scope.",
+        state: before,
+      };
+    }
+    if (matches[0]?.scope === "project" && !input.cwd) {
       return {
         ok: false,
-        message: "The plugin target is ambiguous or not user-scoped.",
+        message: "Project-scoped plugin actions require a workspace.",
         state: before,
       };
     }
@@ -609,8 +657,9 @@ export async function mutateOmpPluginWithDependencies(
     buildOmpPluginMutationArgs(input),
     MUTATION_OUTPUT_LIMIT,
     MUTATION_TIMEOUT_MS,
+    input.cwd,
   );
-  const state = await loadPluginState(executable, dependencies);
+  const state = await loadPluginState(executable, dependencies, input.cwd);
   return {
     ok: runSucceeded(mutation),
     message: runSucceeded(mutation) ? mutationSuccess(input.action) : mutationFailure(mutation),