@provos/ironcurtain 0.7.2 → 0.9.0

package/src/config/mcp-servers.json

@@ -12,8 +12,14 @@
     "env": {
       "MCP_TRANSPORT_TYPE": "stdio"
     },
-    "sandbox": false,
-    "_comment": "sandbox: false because @anthropic-ai/sandbox-runtime always runs with --unshare-net (network namespace isolation). On Linux there is no way to selectively allow network access — the SOCKS proxy + GIT_SSH_COMMAND workaround is only implemented on macOS. With sandboxing enabled, git push/fetch/clone over SSH fail with DNS resolution errors. The intended config once upstream supports selective network on Linux: { \"filesystem\": { \"denyRead\": [\"~/.gnupg\", \"~/.aws\"] }, \"network\": { \"allowedDomains\": [\"github.com\", \"*.github.com\", \"gitlab.com\", \"*.gitlab.com\"] } }"
+    "sandbox": {
+      "filesystem": {
+        "denyRead": ["~/.gnupg", "~/.aws"]
+      },
+      "network": {
+        "allowedDomains": ["github.com", "*.github.com", "gitlab.com", "*.gitlab.com"]
+      }
+    }
   },
   "fetch": {
     "description": "HTTP requests and web search",
@@ -31,5 +37,28 @@
       "ghcr.io/github/github-mcp-server"
     ],
     "sandbox": false
+  },
+  "google-workspace": {
+    "description": "Google Workspace tools (Gmail, Calendar, Drive, Docs, Sheets, Slides)",
+    "command": "npx",
+    "args": ["-y", "@alanse/mcp-server-google-workspace@1.0.2"],
+    "env": {},
+    "_comment": "npm registry domains are needed for the initial npx -y install. To remove them, vendor the package as a local dependency instead.",
+    "sandbox": {
+      "filesystem": {
+        "denyRead": ["~"],
+        "allowRead": ["/usr", "/lib", "/etc"]
+      },
+      "network": {
+        "allowedDomains": [
+          "googleapis.com",
+          "*.googleapis.com",
+          "accounts.google.com",
+          "oauth2.googleapis.com",
+          "registry.npmjs.org",
+          "*.npmjs.org"
+        ]
+      }
+    }
   }
 }

package/dist/pipeline/mcp-connections.d.ts

@@ -1,16 +0,0 @@
-/**
- * MCP server connection helpers for dynamic list resolution.
- *
- * Connects to MCP servers needed by list definitions that require
- * tool-use-based resolution (requiresMcp: true).
- */
-import type { MCPServerConfig } from '../config/types.js';
-import type { ListDefinition } from './types.js';
-import type { McpServerConnection } from './list-resolver.js';
-/**
- * Connects to MCP servers needed for data-backed list resolution.
- * Only connects to servers hinted by list definitions with requiresMcp: true.
- * Returns a map keyed by server name for the resolver.
- */
-export declare function connectMcpServersForLists(definitions: ListDefinition[], mcpServers: Record<string, MCPServerConfig>): Promise<Map<string, McpServerConnection>>;
-export declare function disconnectMcpServers(connections: Map<string, McpServerConnection>): Promise<void>;

package/dist/pipeline/mcp-connections.js

@@ -1,61 +0,0 @@
-/**
- * MCP server connection helpers for dynamic list resolution.
- *
- * Connects to MCP servers needed by list definitions that require
- * tool-use-based resolution (requiresMcp: true).
- */
-import chalk from 'chalk';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { permissiveJsonSchemaValidator } from '../trusted-process/permissive-output-validator.js';
-import { VERSION } from '../version.js';
-/**
- * Connects to MCP servers needed for data-backed list resolution.
- * Only connects to servers hinted by list definitions with requiresMcp: true.
- * Returns a map keyed by server name for the resolver.
- */
-export async function connectMcpServersForLists(definitions, mcpServers) {
-    const mcpDefs = definitions.filter((d) => d.requiresMcp);
-    const hasUnhintedLists = mcpDefs.some((d) => !d.mcpServerHint);
-    // Connect all configured servers if any list lacks a hint,
-    // otherwise connect only the hinted servers.
-    const neededServers = hasUnhintedLists
-        ? new Set(Object.keys(mcpServers))
-        : new Set(mcpDefs
-            .filter((d) => d.mcpServerHint != null)
-            .map((d) => d.mcpServerHint));
-    const entries = await Promise.all([...neededServers].map(async (serverName) => {
-        const serverConfig = mcpServers[serverName];
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- serverName may not exist in mcpServers at runtime (from mcpServerHint)
-        if (!serverConfig) {
-            console.error(`  ${chalk.yellow('Warning:')} MCP server "${serverName}" not configured — skipping`);
-            return null;
-        }
-        const transport = new StdioClientTransport({
-            command: serverConfig.command,
-            args: serverConfig.args,
-            env: serverConfig.env ? { ...process.env, ...serverConfig.env } : undefined,
-            stderr: 'pipe',
-        });
-        // Drain piped stderr to prevent backpressure
-        if (transport.stderr) {
-            transport.stderr.on('data', () => { });
-        }
-        const client = new Client({ name: 'ironcurtain-list-resolver', version: VERSION }, { jsonSchemaValidator: permissiveJsonSchemaValidator });
-        await client.connect(transport);
-        const toolsResult = await client.listTools();
-        return [serverName, { client, tools: toolsResult.tools }];
-    }));
-    return new Map(entries.filter((e) => e !== null));
-}
-export async function disconnectMcpServers(connections) {
-    for (const conn of connections.values()) {
-        try {
-            await conn.client.close();
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-    }
-}
-//# sourceMappingURL=mcp-connections.js.map

package/dist/pipeline/mcp-connections.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-connections.js","sourceRoot":"","sources":["../../src/pipeline/mcp-connections.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKxC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA6B,EAC7B,UAA2C;IAE3C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,6CAA6C;IAC7C,MAAM,aAAa,GAAG,gBAAgB;QACpC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,GAAG,CACL,OAAO;aACJ,MAAM,CAAC,CAAC,CAAC,EAA6C,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;aACjF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAC/B,CAAC;IAEN,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAiD,EAAE;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5C,iJAAiJ;QACjJ,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,UAAU,6BAA6B,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YACvG,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,6CAA6C;QAC7C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EACvD,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,CACvD,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAE7C,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAA6C;IACtF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC"}