@prohost/cli 0.2.2 → 0.2.3

package/dist/agent/run.js

@@ -18,10 +18,12 @@
  *   the command a second time and post a second reply.
  */
 import os from 'node:os';
+import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
 import { completeRun, postReply } from './api.js';
 import { claudeCommand, isClaudeExec, looksLikeResumeFailure, parseClaudeOutput, writeMcpConfig, } from './claude.js';
-import { MCP_API_KEY_ENV_VAR, codexCommand, isCodexExec, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { MCP_API_KEY_ENV_VAR, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, disableEntriesThatLoad, extraMcpEntries, isCodexExec, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
 import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
 import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, eventData, parseRunRequest, } from './contract.js';
 import { ensureWorkspace, streamUrlFor, workspacePath } from './credentials.js';
@@ -116,13 +118,12 @@ function resolveWorkdir(options, log) {
     }
 }
 /**
- * Assemble the per-process runtime: workspace, session ledger, and — for Claude
- * Code only — the MCP config that gives the agent tools.
+ * Assemble the per-process runtime: workspace, session ledger, and the
+ * brain-specific MCP preparation used immediately before each run.
  *
- * Every step here is allowed to fail without stopping the harness. An agent
- * that answers from the prompt alone is the product as it shipped; refusing to
- * start because a config file couldn't be written would be a regression
- * dressed up as a safety check.
+ * Brain-specific MCP preparation happens per run. A daemon is long-lived, so
+ * an extras-file deletion or newly installed Codex server must take effect on
+ * the next invocation rather than after a restart or cache timeout.
  */
 function buildRuntime(options, log) {
     const workdir = resolveWorkdir(options, log);
@@ -134,53 +135,51 @@ function buildRuntime(options, log) {
             : 'plain';
     const skipPermissions = options.safeTools !== true;
     if (brain === 'plain') {
-        return { workdir, sessions, brain, skipPermissions, mcpWired: false };
+        return { workdir, sessions, brain, skipPermissions, prepareMcp: () => ({ mcpWired: false }) };
     }
     const mcpUrl = options.credentials.mcp_url;
-    let mcpConfigPath;
-    let codexMcpUrl;
-    let execEnv;
+    let announced = '';
+    const announce = (lines) => {
+        const message = lines.join('\n');
+        if (message === announced)
+            return;
+        for (const line of lines)
+            log(line);
+        announced = message;
+    };
     if (!mcpUrl) {
         log(`${timestamp()} ! this pairing carries no MCP endpoint; the agent will run without ProhostAI tools`);
     }
-    else if (brain === 'claude') {
-        try {
-            mcpConfigPath = writeMcpConfig({
-                mcpUrl,
-                apiKey: options.credentials.api_key,
-                env: options.env,
-            });
-        }
-        catch (err) {
-            // Said out loud rather than swallowed: the visible symptom would
-            // otherwise be an agent that answers "I can't look that up", which reads
-            // like a model problem and sends someone to the wrong file.
-            log(`${timestamp()} ! could not write the MCP config ` +
-                `(${err instanceof Error ? err.message : String(err)}); the agent will run without ` +
-                'ProhostAI tools');
+    const prepareMcp = brain === 'claude'
+        ? () => {
+            const extras = loadExtraMcpServers({ env: options.env });
+            announce(extras.warnings.map((warning) => `${timestamp()} ! ${warning}`));
+            // Always pass an explicit strict config, including when it is empty.
+            // Omitting the path would make `--strict-mcp-config` ineffective and
+            // expose Claude's user/project MCP servers under skipped permissions.
+            try {
+                const mcpConfigPath = writeMcpConfig({
+                    mcpUrl,
+                    apiKey: options.credentials.api_key,
+                    extraServers: extras.servers,
+                    env: options.env,
+                });
+                return { mcpConfigPath, mcpWired: Boolean(mcpUrl) };
+            }
+            catch (err) {
+                const detail = err instanceof Error ? err.message : String(err);
+                return {
+                    mcpWired: false,
+                    error: `could not write the strict Claude MCP config (${detail})`,
+                };
+            }
         }
-    }
-    else {
-        // Codex needs no file: the server is a `-c` override on each invocation and
-        // the key is read from the child's environment. Nothing to fail, so nothing
-        // to fall back from.
-        codexMcpUrl = mcpUrl;
-        execEnv = { [MCP_API_KEY_ENV_VAR]: options.credentials.api_key };
-    }
-    const mcpWired = Boolean(mcpConfigPath ?? codexMcpUrl);
-    const tools = mcpWired ? `, ProhostAI tools wired in as ${MCP_SERVER_NAME}` : '';
+        : codexMcpEntryProvider(options, log, workdir);
+    const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
     const where = workdir ? ` (workspace: ${workdir})` : '';
     log(brain === 'claude'
         ? `${timestamp()} ⚙ Claude Code detected — resuming a session per conversation${tools}${where}`
         : `${timestamp()} ⚙ Codex detected — resuming a thread per conversation${tools}${where}`);
-    if (brain === 'codex' && mcpWired) {
-        // The one asymmetry worth an operator knowing about, because it is a
-        // security property they may be assuming they have. Claude Code is told to
-        // load our config and nothing else; Codex has no equivalent switch, so its
-        // own `~/.codex/config.toml` servers come along.
-        log(`${timestamp()} ! Codex has no --strict-mcp-config equivalent: this run also holds ` +
-            'whatever MCP servers your ~/.codex/config.toml defines.');
-    }
     // Said out loud every start-up, not buried in --help. This is the line that
     // tells an operator their machine will run tool calls, unprompted, on text
     // written by someone else in their workspace.
@@ -191,7 +190,153 @@ function buildRuntime(options, log) {
             'access, on instructions from your workspace. Use --safe-tools to gate them.'
         : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
             'approval will not run (nobody is at a terminal to approve it).');
-    return { workdir, sessions, brain, mcpConfigPath, codexMcpUrl, execEnv, mcpWired, skipPermissions };
+    return { workdir, sessions, brain, prepareMcp, skipPermissions };
+}
+/**
+ * Prepare a fresh Codex MCP override immediately before each invocation.
+ *
+ * No cache is safe here: Codex rereads its config per invocation and the
+ * extras file is the operator's live grant list. Fresh reads make both a new
+ * configured server and a revoked extra visible to the very next run.
+ */
+export function codexMcpEntryProvider(options, log, workdir) {
+    let announced = '';
+    return () => {
+        const extras = loadExtraMcpServers({ env: options.env });
+        const lines = extras.warnings.map((warning) => `${timestamp()} ! ${warning}`);
+        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir);
+        const said = lines.join('\n');
+        if (said !== announced) {
+            for (const line of lines)
+                log(line);
+            announced = said;
+        }
+        return prepared;
+    };
+}
+/*
+ * Every `mcp_servers` entry a Codex run gets: ours, the operator's extras, and
+ * verified switches that keep the operator's own servers out. Preparation is
+ * fail-closed: an unprovable boundary never reaches an unsandboxed agent.
+ */
+function codexMcpEntries(options, extraServers, log, workdir) {
+    const fail = (detail) => {
+        log(`${timestamp()} ! ${detail}`);
+        return { mcpWired: false, error: detail };
+    };
+    const probe = options.probeImpl ?? defaultProbe;
+    if (codexShellSyntax(options.exec)) {
+        return fail('--exec uses shell quoting, expansion, glob, comment, escape, or control syntax that the Codex ' +
+            'isolation verifier cannot tokenize safely; use a plain argv-shaped Codex command');
+    }
+    const binary = codexBinary(options.exec);
+    const entries = [];
+    const execEnv = {};
+    if (options.credentials.mcp_url) {
+        entries.push(prohostMcpEntry(options.credentials.mcp_url));
+        execEnv[MCP_API_KEY_ENV_VAR] = options.credentials.api_key;
+    }
+    const profile = codexProfileName(options.exec);
+    if (profile) {
+        return fail(`--exec runs Codex under profile "${profile}", whose MCP servers cannot be enumerated; ` +
+            'remove the profile flag before running this harness');
+    }
+    const inventoryFlag = codexMcpInventoryFlag(options.exec);
+    if (inventoryFlag) {
+        return fail(`--exec includes ${inventoryFlag}, which can change Codex's MCP or plugin inventory, or its ` +
+            `working directory, outside the configuration the harness can verify; remove cwd, config, feature, ` +
+            'and --ignore-user-config flags');
+    }
+    const configured = listMcpServers(binary, probe, undefined, workdir);
+    if (configured === null) {
+        return fail('could not ask Codex which MCP servers it has configured');
+    }
+    const configuredNames = new Set(configured.map((server) => server.name));
+    if (configuredNames.has(MCP_SERVER_NAME)) {
+        return fail(`your Codex config already defines the reserved MCP server name "${MCP_SERVER_NAME}"; ` +
+            'rename or remove it so credentials cannot be merged into the paired server');
+    }
+    const collisions = Object.keys(extraServers).filter((name) => configuredNames.has(name));
+    if (collisions.length > 0) {
+        log(`${timestamp()} ! ${EXTRA_MCP_FILENAME} reuses names your Codex config already defines, ` +
+            `so those entries were ignored (Codex would merge their credentials): ${collisions.join(', ')}. Rename them to use them.`);
+    }
+    const usableExtras = Object.fromEntries(Object.entries(extraServers).filter(([name]) => !collisions.includes(name)));
+    const extra = extraMcpEntries(usableExtras);
+    if (extra.skipped.length > 0) {
+        log(`${timestamp()} ! could not pass these extra MCP servers to Codex ` +
+            `(value not expressible as a safe config override): ${extra.skipped.join(', ')}`);
+    }
+    let acceptedExtraEntries = [];
+    if (extra.entries.length > 0) {
+        if (listMcpServers(binary, probe, mcpServersOverride(extra.entries), workdir) === null) {
+            log(`${timestamp()} ! Codex rejected the server definitions in ${EXTRA_MCP_FILENAME}; ` +
+                'the run will continue without those optional extras');
+        }
+        else {
+            acceptedExtraEntries = extra.entries;
+            entries.push(...acceptedExtraEntries);
+            Object.assign(execEnv, extra.env);
+        }
+    }
+    // A configured collision was dropped above, so it is deliberately disabled.
+    const acceptedExtraNames = new Set(Object.keys(usableExtras).filter((name) => !extra.skipped.includes(name)));
+    if (acceptedExtraEntries.length === 0)
+        acceptedExtraNames.clear();
+    const targets = [...configuredNames].filter((name) => !acceptedExtraNames.has(name));
+    const { entries: disabled, failed } = disableEntriesThatLoad(binary, probe, targets, workdir);
+    if (failed.length > 0) {
+        return fail(`these Codex MCP servers could not be disabled: ${failed.join(', ')}`);
+    }
+    entries.push(...disabled);
+    if (disabled.length > 0) {
+        log(`${timestamp()} ⚙ your own Codex MCP servers are disabled for agent runs: ${targets.join(', ')}`);
+    }
+    // Verify the exact combined override, not its pieces. This catches a config
+    // merge that re-enables a server and a server installed between the initial
+    // survey and this final probe.
+    const override = mcpServersOverride(entries);
+    const finalListing = listMcpServers(binary, probe, override, workdir);
+    if (finalListing === null)
+        return fail('Codex rejected the final isolated MCP configuration');
+    const allowed = new Set([
+        ...(options.credentials.mcp_url ? [MCP_SERVER_NAME] : []),
+        ...acceptedExtraNames,
+    ]);
+    const enabled = new Set(finalListing.filter((server) => server.enabled).map((server) => server.name));
+    const missing = [...allowed].filter((name) => !enabled.has(name));
+    if (missing.length > 0) {
+        return fail(`expected MCP servers are missing or disabled after isolation: ${missing.join(', ')}`);
+    }
+    const unexpected = finalListing.filter((server) => server.enabled && !allowed.has(server.name));
+    if (unexpected.length > 0) {
+        return fail(`unexpected MCP servers remain enabled after isolation: ${unexpected.map((server) => server.name).join(', ')}`);
+    }
+    return {
+        codexMcpEntries: entries,
+        execEnv: Object.keys(execEnv).length > 0 ? execEnv : undefined,
+        mcpWired: Boolean(options.credentials.mcp_url),
+    };
+}
+/**
+ * Run one short command and capture stdout.
+ *
+ * `shell: true` for the same reason `exec.ts` uses it — the binary name comes
+ * out of the operator's own `--exec` string and may be a quoted path — and for
+ * the same reason it is safe: nothing event-derived reaches this command line.
+ * `cwd` must match the eventual run exactly, because Codex loads trusted
+ * project `.codex/config.toml` layers from there.
+ */
+function defaultProbe(command, cwd) {
+    const result = spawnSync(command, {
+        shell: true,
+        cwd,
+        encoding: 'utf8',
+        // Generous for a config read, short enough that a wedged binary delays
+        // a run rather than wedging the daemon.
+        timeout: 15_000,
+    });
+    return { status: result.status, stdout: result.stdout ?? '' };
 }
 /**
  * Run the agent command once and turn its output into a reply.
@@ -202,7 +347,7 @@ function buildRuntime(options, log) {
  * tell a failed turn from a successful one. A plain command's behaviour here is
  * byte-for-byte what it was before this function existed.
  */
-async function runTurn(run, prompt, options, runtime, log) {
+async function runTurn(run, prompt, options, runtime, mcp, log) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -215,12 +360,15 @@ async function runTurn(run, prompt, options, runtime, log) {
         prompt,
         timeoutMs: remainingMs(),
         cwd: runtime.workdir,
-        env: runtime.execEnv,
+        env: mcp.execEnv,
         spawnImpl: options.spawnImpl,
     });
     // Wall clock for the whole turn, retry included — what the operator waited,
     // rather than what the last attempt took.
     const elapsed = () => Date.now() - startedAt;
+    if (mcp.error) {
+        return { ok: false, reason: 'MCP isolation could not be established', detail: mcp.error, durationMs: 0 };
+    }
     const failure = (result) => ({
         ok: false,
         reason: result.error ??
@@ -249,12 +397,12 @@ async function runTurn(run, prompt, options, runtime, log) {
     const build = (resume) => codex
         ? codexCommand(options.exec, {
             sessionId: resume,
-            mcpUrl: runtime.codexMcpUrl,
+            mcpEntries: mcp.codexMcpEntries,
             skipPermissions: runtime.skipPermissions,
         })
         : claudeCommand(options.exec, {
             sessionId: resume,
-            mcpConfigPath: runtime.mcpConfigPath,
+            mcpConfigPath: mcp.mcpConfigPath,
             skipPermissions: runtime.skipPermissions,
         });
     let result = await exec(build(sessionId));
@@ -275,8 +423,18 @@ async function runTurn(run, prompt, options, runtime, log) {
     }
     if (!result.ok)
         return failure(result);
+    // A denied tool is not an error either brain reports — the turn succeeds and
+    // the reply just quietly lacks whatever the tool would have found. Printing
+    // it is the difference between "the agent seems dumb" and "the agent asked
+    // for WebSearch and there was nobody to approve it".
+    const reportDenials = (denials) => {
+        if (denials.length > 0) {
+            log(`    ! tools the agent asked for and was refused: ${denials.join(', ')}`);
+        }
+    };
     if (codex) {
         const output = parseCodexOutput(result.stdout);
+        reportDenials(output.denials);
         if (!output.ok) {
             return {
                 ok: false,
@@ -288,13 +446,7 @@ async function runTurn(run, prompt, options, runtime, log) {
         return { ok: true, reply: output.text, durationMs: elapsed(), sessionId: output.sessionId };
     }
     const parsed = parseClaudeOutput(result.stdout);
-    // A denied tool is not an error the agent reports — the turn succeeds and the
-    // reply just quietly lacks whatever the tool would have found. Printing it is
-    // the difference between "the agent seems dumb" and "the agent asked for
-    // WebSearch and there was nobody to approve it".
-    if (parsed.denials.length > 0) {
-        log(`    ! tools the agent asked for and was refused: ${parsed.denials.join(', ')}`);
-    }
+    reportDenials(parsed.denials);
     if (!parsed.ok) {
         return {
             ok: false,
@@ -315,18 +467,21 @@ async function handleRun(run, options, runtime, api, log, sleep) {
     const label = `run ${run.run_id.slice(0, 12)}`;
     const surface = run.conversation_id ?? run.kind ?? 'no conversation';
     log(`${timestamp()} ▶ ${label} started (${surface})`);
+    const mcp = runtime.prepareMcp();
     const prompt = buildPrompt(run, {
         agentName: options.credentials.agent?.name ?? 'your agent',
         // Named only when the tools are actually reachable from this invocation.
         // Telling an agent about an endpoint it has no client for is what produced
         // replies describing lookups that never happened.
-        mcpServerName: runtime.mcpWired ? MCP_SERVER_NAME : undefined,
-        // Only Claude Code's spelling has been verified against the binary, so only
-        // Claude Code gets told a pattern. See PromptContext.mcpToolPattern.
-        mcpToolPattern: runtime.brain === 'claude' && runtime.mcpWired ? MCP_TOOL_PATTERN : undefined,
+        mcpServerName: mcp.mcpWired ? MCP_SERVER_NAME : undefined,
+        // Both shaped brains spell MCP tools `mcp__<server>__<tool>` — Codex's was
+        // an open question until it was measured against the binary in 0.2.3. A
+        // `plain` command is still told the server name only: we have no idea what
+        // it is. See PromptContext.mcpToolPattern.
+        mcpToolPattern: runtime.brain !== 'plain' && mcp.mcpWired ? MCP_TOOL_PATTERN : undefined,
         toolsGated: !runtime.skipPermissions,
     });
-    const result = await runTurn(run, prompt, options, runtime, log);
+    const result = await runTurn(run, prompt, options, runtime, mcp, log);
     const seconds = (result.durationMs / 1000).toFixed(1);
     if (!result.ok) {
         const { reason } = result;

package/dist/index.js

@@ -57,6 +57,16 @@ function printHelp() {
         '                   act; with --safe-tools expect it to answer rather than do. Alias:',
         '                   --no-skip-permissions.',
         '',
+        'Extra MCP servers (opt-in):',
+        '  A run gets the ProhostAI MCP server and nothing else. To add more, create',
+        '  $PROHOST_HOME/extra-mcp.json yourself — the CLI never writes it — holding the same',
+        '  {"mcpServers": {...}} object Claude Code\'s --mcp-config takes. Works on Claude Code',
+        '  and Codex.',
+        '  EVERY server you add is exercisable by anyone who can trigger this agent, with',
+        '  permission prompts off and no human in the loop. Scope each one as narrowly as it',
+        '  will go. The name "prohost" is reserved; a malformed file is a warning and a run',
+        '  without extras. Which servers loaded is printed to agent.log at start-up.',
+        '',
         'agent install-daemon flags:  (macOS: launchd; Linux: prints a systemd-user unit)',
         '  --exec           The same command you would pass to `agent run` (required).',
         '  --workdir, --timeout, --machine, --url, --allow-unverified, --safe-tools — passed to `agent run`.',

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.2.2";
+export declare const CLI_VERSION = "0.2.3";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.2.2";
+export declare const USER_AGENT = "prohost-cli/0.2.3";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.2.2';
+export const CLI_VERSION = '0.2.3';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",