@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/lib/mcp.js

@@ -12,9 +12,9 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { execFileSync } from 'child_process';
 import * as os from 'os';
-import { getMcpDir, getUserMcpDir, getProjectAgentsDir, getVersionsDir } from './state.js';
+import { getMcpDir, getUserMcpDir, getProjectAgentsDir, getVersionsDir, getUserAgentsDir } from './state.js';
 import { getBinaryPath, getVersionHomePath } from './versions.js';
-import { IS_WINDOWS, needsWindowsShell } from './platform/index.js';
+import { IS_WINDOWS, execFileShellSpec } from './platform/index.js';
 import { AGENTS } from './agents.js';
 import { isCapable } from './capabilities.js';
 import { setGeminiAutoUpdateDisabled, updateGeminiSettings } from './gemini-settings.js';
@@ -93,13 +93,116 @@ function isStringRecord(value) {
         return false;
     return Object.values(value).every((item) => typeof item === 'string');
 }
+// ─── Project MCP trust (RUSH-1776) ───────────────────────────────────────────
+// Project-scoped MCP configs (<repo>/.agents/mcp/*.yaml) are UNTRUSTED by
+// default. An MCP server is an arbitrary command spawned under the agent's
+// authority, so merely cloning a hostile repo must never auto-register or run
+// it. A project's MCP servers enter the register/spawn path only after the user
+// explicitly trusts that project (`agents mcp trust`), recorded in a user-owned
+// store OUTSIDE any repo so a cloned repo can't grant itself trust. User- and
+// system-scoped MCPs (~/.agents/mcp/*) are always trusted.
+/** Path to the user-owned project-trust store (never inside a repo). */
+export function getMcpTrustStorePath() {
+    return path.join(getUserAgentsDir(), 'mcp-trust.yaml');
+}
+/**
+ * Key a project by its ROOT (parent of `.agents/`), resolved through symlinks
+ * so the key is stable no matter how the cwd was spelled.
+ */
+function normalizeProjectKey(projectAgentsDir) {
+    const root = path.dirname(projectAgentsDir);
+    try {
+        return fs.realpathSync(root);
+    }
+    catch {
+        return path.resolve(root);
+    }
+}
+function readTrustedProjects() {
+    const storePath = getMcpTrustStorePath();
+    if (!fs.existsSync(storePath))
+        return new Set();
+    let parsed;
+    try {
+        parsed = yaml.parse(fs.readFileSync(storePath, 'utf-8'));
+    }
+    catch {
+        return new Set();
+    }
+    const list = parsed && typeof parsed === 'object' && Array.isArray(parsed.trustedProjects)
+        ? parsed.trustedProjects
+        : [];
+    const out = new Set();
+    for (const entry of list) {
+        if (typeof entry !== 'string' || entry.length === 0)
+            continue;
+        try {
+            out.add(fs.realpathSync(entry));
+        }
+        catch {
+            out.add(path.resolve(entry));
+        }
+    }
+    return out;
+}
+function writeTrustedProjects(trusted) {
+    const storePath = getMcpTrustStorePath();
+    fs.mkdirSync(path.dirname(storePath), { recursive: true });
+    fs.writeFileSync(storePath, yaml.stringify({ trustedProjects: Array.from(trusted).sort() }), 'utf-8');
+}
+/**
+ * Whether the project that owns `projectAgentsDir` has been explicitly trusted
+ * for MCP auto-apply. Untrusted by default (fail closed).
+ */
+export function isProjectMcpTrusted(projectAgentsDir) {
+    return readTrustedProjects().has(normalizeProjectKey(projectAgentsDir));
+}
+/**
+ * Record explicit trust for the project containing `cwd` so its project-scoped
+ * MCP servers may be registered/spawned. Returns the trusted project root, or
+ * null when `cwd` is not inside a project (no `.agents/` to trust).
+ */
+export function trustProjectMcp(cwd = process.cwd()) {
+    const projectAgentsDir = getProjectAgentsDir(cwd);
+    if (!projectAgentsDir)
+        return null;
+    const key = normalizeProjectKey(projectAgentsDir);
+    const trusted = readTrustedProjects();
+    if (!trusted.has(key)) {
+        trusted.add(key);
+        writeTrustedProjects(trusted);
+    }
+    return key;
+}
+/** Revoke MCP trust for the project containing `cwd`. Returns true if it was trusted. */
+export function untrustProjectMcp(cwd = process.cwd()) {
+    const projectAgentsDir = getProjectAgentsDir(cwd);
+    if (!projectAgentsDir)
+        return false;
+    const key = normalizeProjectKey(projectAgentsDir);
+    const trusted = readTrustedProjects();
+    if (!trusted.delete(key))
+        return false;
+    writeTrustedProjects(trusted);
+    return true;
+}
 /**
  * List all MCP server configs from ~/.agents/mcp/.
+ *
+ * When `enforceProjectTrust` is set, project-scoped configs are included only
+ * for a project the user has explicitly trusted (see `isProjectMcpTrusted`) —
+ * this is the choke point that keeps an untrusted cloned repo's MCP servers out
+ * of the register/spawn path. It ALSO fixes name-collision shadowing: an
+ * untrusted project entry is dropped before dedup, so it can never mask a
+ * same-named user entry. Display callers omit the flag to surface project
+ * entries (command+args and all) regardless of trust.
  */
-export function listMcpServerConfigs(cwd = process.cwd()) {
+export function listMcpServerConfigs(cwd = process.cwd(), options = {}) {
     const dirs = [];
     const projectAgentsDir = getProjectAgentsDir(cwd);
-    if (projectAgentsDir) {
+    const includeProject = projectAgentsDir !== null
+        && (!options.enforceProjectTrust || isProjectMcpTrusted(projectAgentsDir));
+    if (projectAgentsDir && includeProject) {
         dirs.push({ scope: 'project', dir: path.join(projectAgentsDir, 'mcp') });
     }
     // User dir first (wins on name collision), then system
@@ -175,7 +278,10 @@ export function installMcpConfigCentrally(sourcePath) {
  * Otherwise returns all servers.
  */
 export function getMcpServersByName(names, options = {}) {
-    const allServers = listMcpServerConfigs(options.cwd);
+    // This feeds the register/spawn path (installMcpServers, workflow assembly),
+    // so untrusted project-scoped servers are excluded by default (fail closed).
+    const enforceProjectTrust = options.enforceProjectTrust ?? true;
+    const allServers = listMcpServerConfigs(options.cwd, { enforceProjectTrust });
     if (!names || names.length === 0) {
         return allServers;
     }
@@ -228,20 +334,24 @@ function installMcpViaClaude(binaryPath, server, versionHome) {
             server.config.command,
             ...(server.config.args || [])
         ];
-        execFileSync(binaryPath, args, {
+        // RUSH-1752: user-controlled MCP command/args must not reach cmd.exe unquoted.
+        const spec = execFileShellSpec(binaryPath, args);
+        execFileSync(spec.command, spec.args, {
             stdio: 'pipe',
             timeout: 30000,
             env: execEnv,
-            shell: needsWindowsShell(binaryPath),
+            shell: spec.shell,
         });
     }
     else {
         // claude mcp add --scope user --transport http -- <name> <url>
-        execFileSync(binaryPath, ['mcp', 'add', '--scope', 'user', '--transport', 'http', '--', server.name, server.config.url], {
+        const httpArgs = ['mcp', 'add', '--scope', 'user', '--transport', 'http', '--', server.name, server.config.url];
+        const spec = execFileShellSpec(binaryPath, httpArgs);
+        execFileSync(spec.command, spec.args, {
             stdio: 'pipe',
             timeout: 30000,
             env: execEnv,
-            shell: needsWindowsShell(binaryPath),
+            shell: spec.shell,
         });
     }
 }
@@ -259,11 +369,13 @@ function installMcpViaCodex(binaryPath, server, versionHome) {
             server.config.command,
             ...(server.config.args || [])
         ];
-        execFileSync(binaryPath, args, {
+        // RUSH-1752: user-controlled MCP command/args must not reach cmd.exe unquoted.
+        const spec = execFileShellSpec(binaryPath, args);
+        execFileSync(spec.command, spec.args, {
             stdio: 'pipe',
             timeout: 30000,
             env: { ...process.env, HOME: versionHome },
-            shell: needsWindowsShell(binaryPath),
+            shell: spec.shell,
         });
     }
     // Note: Codex may not support HTTP MCPs
@@ -314,7 +426,9 @@ function registerMcpCommand(agentId, name, commandSpec, scope, transport, option
             ? ['mcp', 'add', '--transport', transport, '--scope', scope, '--', name, ...commandArgs]
             : ['mcp', 'add', '--', name, ...commandArgs];
         const env = options.home ? { ...process.env, HOME: options.home } : process.env;
-        execFileSync(bin, args, { stdio: 'pipe', timeout: 30000, env, shell: needsWindowsShell(bin) });
+        // RUSH-1752: user-controlled MCP command/args must not reach cmd.exe unquoted.
+        const spec = execFileShellSpec(bin, args);
+        execFileSync(spec.command, spec.args, { stdio: 'pipe', timeout: 30000, env, shell: spec.shell });
         return { success: true };
     }
     catch (err) {

package/dist/lib/monitors/config.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Monitor (event-triggered watcher) configuration, validation, and CRUD.
+ *
+ * A monitor is a routine whose trigger is a *watched source* instead of a
+ * *clock*. It watches a SOURCE, detects a CONDITION change, and fires an ACTION —
+ * reusing the routines daemon, dispatch engine, device model, and notify path.
+ *
+ * Monitors are YAML files in ~/.agents/monitors/. This module owns the on-disk
+ * shape (mirroring lib/routines.ts read/write helpers), hand-rolled validation
+ * (mirroring validateJob — no zod), and the device-owner eligibility gate.
+ */
+import type { AgentId } from '../types.js';
+/** Source types a monitor can watch. */
+export type MonitorSourceType = 'command' | 'poll' | 'poll-http' | 'webhook' | 'ws' | 'file' | 'device';
+/** Webhook source filters — reuse the github/linear matcher shape from triggers/webhook.ts. */
+export interface MonitorWebhookSource {
+    source: 'github' | 'linear';
+    event: string;
+    repo?: string;
+    branch?: string;
+    action?: string;
+    teamKey?: string;
+    label?: string;
+}
+/**
+ * What a monitor watches. Exactly one source-payload field is populated, keyed by
+ * `type`: `command`/`interval` for command/poll, `url`/`interval` for poll-http,
+ * `wsUrl` for ws, `path` for file, `device` for device, `webhook` for webhook.
+ */
+export interface MonitorSource {
+    type: MonitorSourceType;
+    /** Shell command whose stdout is the observation (command, poll). */
+    command?: string;
+    /** Re-evaluation interval (poll, poll-http; optional for command/file/device). e.g. `30s`, `15m`, `8h`. */
+    interval?: string;
+    /** URL to GET (poll-http). */
+    url?: string;
+    /** WebSocket URL; each frame is an observation (ws). */
+    wsUrl?: string;
+    /** File or directory to watch (file). */
+    path?: string;
+    /** A registered fleet device whose health/reachability is the observation (device). */
+    device?: string;
+    /** Webhook trigger filters (webhook). */
+    webhook?: MonitorWebhookSource;
+}
+/** How an observation becomes a fire. */
+export type MonitorConditionMode = 'on-change' | 'match' | 'every';
+export interface MonitorCondition {
+    mode: MonitorConditionMode;
+    /** Regex (required for `match` mode) — fire when the observation matches. */
+    match?: string;
+    /**
+     * What counts as "the same event" for de-duplication. When set, the dedupe
+     * signature is the first regex match of this expression against the
+     * observation (so re-observing the same token is silent); when omitted, the
+     * full observation is the signature.
+     */
+    dedupeKey?: string;
+}
+/** Action types a monitor can fire. */
+export type MonitorActionType = 'run' | 'routine' | 'notify' | 'webhook-out';
+/**
+ * What a monitor does on a fire. Shares the run-shaped fields (agent, prompt,
+ * mode, effort, timeout) conceptually with JobConfig (lib/routines.ts) so
+ * dispatch reuses the routines path (executeJobDetached). The fired event is
+ * injected into the prompt as `{event}`.
+ */
+export interface ActionConfig {
+    type: MonitorActionType;
+    /** run: which agent to spawn. */
+    agent?: AgentId;
+    /** run: the prompt; `{event}` is replaced with the fired event summary. */
+    prompt?: string;
+    /** run: execution mode (shared with routines). */
+    mode?: 'plan' | 'edit' | 'auto' | 'skip' | 'full';
+    /** run: reasoning effort (shared with routines). */
+    effort?: 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'auto';
+    /** run: kill the action if it runs longer than this (e.g. `10m`). */
+    timeout?: string;
+    /** routine: name of an existing routine to fire. */
+    routine?: string;
+    /** notify: channel for the notification (default `telegram`). */
+    notifyChannel?: string;
+    /** webhook-out: URL to POST the event to. */
+    url?: string;
+}
+/** Full monitor configuration (persisted as YAML in ~/.agents/monitors/). */
+export interface MonitorConfig {
+    name: string;
+    enabled: boolean;
+    source: MonitorSource;
+    condition: MonitorCondition;
+    action: ActionConfig;
+    /**
+     * Pin-to-one OWNER device — the single machine whose daemon evaluates the
+     * source and fires. Exactly-once for v1 (no distributed lock). When set, only
+     * that machine is eligible; everywhere else the monitor is inert.
+     */
+    device?: string;
+    /**
+     * Fleet allowlist (advanced) — each listed device evaluates and fires
+     * independently, like routines' `devices`. Mutually exclusive with `device`.
+     */
+    devices?: string[];
+    /** Execute the ACTION on this machine over SSH (placement), distinct from the owner that fires it. */
+    runOn?: string;
+    /** Firehose guard: auto-pause the monitor if it fires more than `max` times per `per`. */
+    rateLimit?: {
+        max: number;
+        per: string;
+    };
+    /** User-defined prompt variables (expanded like routines' variables). */
+    variables?: Record<string, string>;
+    /** Pin the agent version for `run` actions (omit to use the run strategy). */
+    version?: string;
+}
+/**
+ * A fired event. `summary` is injected into the action prompt as `{event}`;
+ * `payload` carries the structured observation for `webhook-out` and inspection.
+ */
+export interface MonitorEvent {
+    monitorName: string;
+    firedAt: string;
+    summary: string;
+    payload: Record<string, unknown>;
+}
+/**
+ * Parse a human interval string (e.g. `30s`, `15m`, `8h`, `1d`, `1h30m`) into
+ * milliseconds. Unlike routines' parseTimeout, seconds are supported (polls tick
+ * in seconds). Returns null on empty/unparseable/zero input.
+ */
+export declare function parseInterval(interval: string): number | null;
+/**
+ * True when the monitor may evaluate + fire on this machine. Owner semantics:
+ * `device` (single owner, exactly-once) → only that machine; else `devices`
+ * (allowlist) → any listed machine; else unrestricted. Both sides normalize so
+ * `Yosemite-S0` and `yosemite-s0.tailnet.ts.net` agree with `yosemite-s0`.
+ */
+export declare function monitorRunsOnThisDevice(config: Pick<MonitorConfig, 'device' | 'devices'>): boolean;
+/**
+ * Validate a partial monitor config, returning a list of human-readable errors.
+ * Hand-rolled like validateJob (lib/routines.ts) — no zod. Rejects: no source,
+ * two sources, no action, two actions, match-mode without `match`, plus the
+ * per-type field/shape checks.
+ */
+export declare function validateMonitor(config: Partial<MonitorConfig>): string[];
+/** List all monitor configs in ~/.agents/monitors/. */
+export declare function listMonitors(): MonitorConfig[];
+/** Read a single monitor config by name. Returns null if not found or corrupt. */
+export declare function readMonitor(name: string): MonitorConfig | null;
+/** Get the filesystem path of a monitor's YAML config, or null if not found. */
+export declare function getMonitorPath(name: string): string | null;
+/** Write a monitor config to disk atomically, omitting fields that match defaults. */
+export declare function writeMonitor(config: MonitorConfig): void;
+/** Delete a monitor config file by name. Returns true if the file existed. */
+export declare function deleteMonitor(name: string): boolean;
+/** Enable or disable a monitor by name. */
+export declare function setMonitorEnabled(name: string, enabled: boolean): void;
+/** Check whether a monitor with the given name exists on disk. */
+export declare function monitorExists(name: string): boolean;