@remcp/remcp 0.1.2 → 0.1.4

package/src/review-sandbox.mjs

@@ -1,96 +0,0 @@
-import { mkdirSync, readFileSync, writeFileSync, appendFileSync, readdirSync, statSync } from 'node:fs';
-import { resolve, relative, dirname, basename } from 'node:path';
-import { sha256 } from './util.mjs';
-
-export const REVIEW_SANDBOX_ID = 'review-sandbox';
-
-function text(value, isError = false) {
-  return { content: [{ type: 'text', text: String(value) }], ...(isError ? { isError: true } : {}) };
-}
-
-function rootFor(uid) {
-  const dataDir = process.env.DATA_DIR || './data';
-  const root = resolve(dataDir, 'review-sandboxes', sha256(uid).slice(0, 32), 'workspace');
-  mkdirSync(root, { recursive: true });
-  const readme = resolve(root, 'README.txt');
-  try { statSync(readme); } catch {
-    writeFileSync(readme, 'ReMCP Review Sandbox\n\nThis isolated workspace is available for submission testing.\n', { mode: 0o600 });
-  }
-  return root;
-}
-
-function safePath(uid, input = '/workspace') {
-  const root = rootFor(uid);
-  let candidate = String(input || '').trim().replace(/\\/g, '/');
-  if (candidate === '/workspace' || candidate === 'workspace' || candidate === '/') candidate = '';
-  candidate = candidate.replace(/^\/workspace\/?/, '').replace(/^\/+/, '');
-  const target = resolve(root, candidate);
-  const rel = relative(root, target);
-  if (rel.startsWith('..') || rel === '..') throw new Error('Path must stay inside /workspace');
-  return { root, target, display: `/workspace${rel ? `/${rel.replaceAll('\\', '/')}` : ''}` };
-}
-
-export function reviewSandboxDevice() {
-  return { id: REVIEW_SANDBOX_ID, name: 'ReMCP Review Sandbox', hostname: 'isolated-review-workspace', platform: 'sandbox', arch: 'virtual', online: true, connectedAt: null, sandbox: true };
-}
-function listDirectory(uid, args) {
-  const { target, display } = safePath(uid, args.path);
-  const entries = readdirSync(target, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
-  const lines = entries.map(entry => `${entry.isDirectory() ? '[DIR]' : '[FILE]'} ${entry.name}`);
-  return text(`${display}\n${lines.join('\n') || '(empty)'}`);
-}
-
-function readFile(uid, args) {
-  if (args.isUrl) return text('The review sandbox does not fetch URLs. Pair a real device to use URL reads.', true);
-  const { target, display } = safePath(uid, args.path);
-  const body = readFileSync(target, 'utf8');
-  const lines = body.split(/\r?\n/);
-  const offset = Math.max(0, Number(args.offset || 0));
-  const length = Math.max(1, Math.min(1000, Number(args.length || 1000)));
-  return text(`${display}\n${lines.slice(offset, offset + length).join('\n')}`);
-}
-
-function writeFile(uid, args) {
-  const { target, display } = safePath(uid, args.path);
-  mkdirSync(dirname(target), { recursive: true });
-  if (args.mode === 'append') appendFileSync(target, String(args.content), { mode: 0o600 });
-  else writeFileSync(target, String(args.content), { mode: 0o600 });
-  return text(`Wrote ${Buffer.byteLength(String(args.content))} bytes to ${display}.`);
-}
-
-function createDirectory(uid, args) {
-  const { target, display } = safePath(uid, args.path);
-  mkdirSync(target, { recursive: true });
-  return text(`Directory ready: ${display}`);
-}
-function fileInfo(uid, args) {
-  const { target, display } = safePath(uid, args.path);
-  const info = statSync(target);
-  return text(JSON.stringify({ path: display, type: info.isDirectory() ? 'directory' : 'file', size: info.size, modifiedAt: info.mtime.toISOString() }, null, 2));
-}
-
-function startProcess(uid, args) {
-  const root = rootFor(uid);
-  const command = String(args.command || '').trim();
-  if (command === 'pwd') return text('/workspace');
-  if (/^ls(?:\s+-[alh]+)?$/.test(command)) return listDirectory(uid, { path: '/workspace' });
-  const cat = command.match(/^cat\s+(.+)$/);
-  if (cat) return readFile(uid, { path: cat[1].replace(/^['"]|['"]$/g, '') });
-  const echo = command.match(/^echo(?:\s+)(.*)$/s);
-  if (echo) return text(echo[1].replace(/^['"]|['"]$/g, ''));
-  return text(`Review Sandbox only permits pwd, ls, cat, and echo. Pair a real device to run other commands. Workspace: ${root}`, true);
-}
-
-export function reviewSandboxCall(uid, name, args = {}) {
-  try {
-    if (name === 'list_directory') return listDirectory(uid, args);
-    if (name === 'read_file') return readFile(uid, args);
-    if (name === 'write_file') return writeFile(uid, args);
-    if (name === 'create_directory') return createDirectory(uid, args);
-    if (name === 'get_file_info') return fileInfo(uid, args);
-    if (name === 'start_process') return startProcess(uid, args);
-    return text(`${name} is not enabled in the isolated Review Sandbox. Pair a real device to use this tool.`, true);
-  } catch (error) {
-    return text(error instanceof Error ? error.message : String(error), true);
-  }
-}

package/src/server.mjs

@@ -1,159 +0,0 @@
-import http from 'node:http';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import express from 'express';
-import helmet from 'helmet';
-import { rateLimit } from 'express-rate-limit';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
-import { config } from './config.mjs';
-import { createDevice, createPairCode, consumePairCode, revokeDevice } from './db.mjs';
-import { requireFirebase, requireMcpAuth } from './auth.mjs';
-import { oauthRouter } from './oauth.mjs';
-import { createRelay } from './relay.mjs';
-import { createMcpServer } from './mcp.mjs';
-import { now, randomId, randomToken, sha256 } from './util.mjs';
-import { VERSION } from './version.mjs';
-
-const app = express();
-app.set('trust proxy', 1);
-app.disable('x-powered-by');
-const firebaseFrame = `https://${config.firebase.authDomain}`;
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", 'https://www.gstatic.com', 'https://apis.google.com', 'https://www.google.com'],
-      connectSrc: ["'self'", 'https://identitytoolkit.googleapis.com', 'https://securetoken.googleapis.com', 'https://www.googleapis.com', 'https://apis.google.com', 'https://accounts.google.com'],
-      imgSrc: ["'self'", 'data:'],
-      styleSrc: ["'self'"],
-      fontSrc: ["'none'"],
-      frameSrc: [firebaseFrame, 'https://accounts.google.com', 'https://apis.google.com'],
-      objectSrc: ["'none'"],
-      baseUri: ["'none'"],
-      formAction: ["'self'", 'https://accounts.google.com'],
-      frameAncestors: ["'none'"],
-    },
-  },
-  crossOriginOpenerPolicy: { policy: 'same-origin-allow-popups' },
-  strictTransportSecurity: config.publicUrl.startsWith('https://') ? { maxAge: 31536000, includeSubDomains: false } : false,
-  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-}));
-app.use((req, res, next) => {
-  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
-  const dynamicPath = req.path === '/health' || req.path === '/mcp' || req.path.startsWith('/api/') || req.path.startsWith('/oauth/') || req.path.startsWith('/.well-known/');
-  if (dynamicPath) {
-    res.setHeader('Cache-Control', 'no-store, max-age=0');
-    res.setHeader('CDN-Cache-Control', 'no-store');
-    res.setHeader('Cloudflare-CDN-Cache-Control', 'no-store');
-  }
-  next();
-});
-app.use(express.json({ limit: '256kb' }));
-app.use(express.urlencoded({ extended: false, limit: '256kb', parameterLimit: 50 }));
-const pairClaimLimiter = rateLimit({ windowMs: 60_000, limit: 20, standardHeaders: 'draft-8', legacyHeaders: false });
-
-const httpServer = http.createServer(app);
-const relay = createRelay(httpServer);
-const sessions = new Map();
-const publicDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../public');
-
-app.get('/health', (_req, res) => res.json({ ok: true, service: 'remcp', version: VERSION, connectedDevices: relay.onlineCount() }));
-app.get(config.domainVerificationPath, (_req, res) => {
-  if (!config.domainVerificationToken) return res.status(404).type('text/plain').send('Not configured');
-  res.type('text/plain').send(config.domainVerificationToken);
-});
-app.get('/api/config', (_req, res) => res.json({ publicUrl: config.publicUrl, mcpUrl: `${config.publicUrl}/mcp`, firebase: config.firebase }));
-app.get('/.well-known/security.txt', (_req, res) => res.type('text/plain').send(`Contact: ${config.publicUrl}/support\nPolicy: ${config.publicUrl}/security\nExpires: 2027-09-16T00:00:00Z\nCanonical: ${config.publicUrl}/.well-known/security.txt\n`));
-
-app.post('/api/pair/create', requireFirebase, (req, res) => {
-  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
-  let code = '';
-  const bytes = Buffer.from(randomToken(12));
-  for (let i = 0; i < 8; i++) code += alphabet[bytes[i] % alphabet.length];
-  const expiresAt = now() + config.pairTtlSeconds * 1000;
-  createPairCode(req.user.uid, sha256(code), expiresAt);
-  res.json({ code, expiresAt, command: `npx --yes ${config.installSpec} connect --server ${config.publicUrl} --code ${code} --install` });
-});
-
-app.post('/api/pair/claim', pairClaimLimiter, (req, res) => {
-  const code = String(req.body?.code || '').replace(/\s+/g, '').toUpperCase();
-  const pair = consumePairCode(sha256(code));
-  if (!pair) return res.status(400).json({ error: 'invalid_or_expired_pairing_code' });
-  const deviceToken = randomToken(32);
-  const device = createDevice({
-    id: randomId(), uid: pair.uid,
-    name: String(req.body?.name || req.body?.hostname || 'My computer').slice(0, 100),
-    tokenHash: sha256(deviceToken), hostname: String(req.body?.hostname || '').slice(0, 180),
-    platform: String(req.body?.platform || '').slice(0, 32), arch: String(req.body?.arch || '').slice(0, 32),
-  });
-  res.json({ deviceId: device.id, deviceToken, agentUrl: config.publicUrl.replace(/^http/, 'ws') + '/agent' });
-});
-
-app.get('/api/me', requireFirebase, (req, res) => res.json({ user: req.user, devices: relay.devicesFor(req.user.uid) }));
-app.delete('/api/devices/:id', requireFirebase, (req, res) => {
-  const result = revokeDevice(req.user.uid, String(req.params.id));
-  if (!result.changes) return res.status(404).json({ error: 'device_not_found' });
-  res.status(204).end();
-});
-
-app.use(oauthRouter);
-app.all('/mcp', requireMcpAuth, async (req, res) => {
-  try {
-    const sessionId = req.headers['mcp-session-id'];
-    let entry = typeof sessionId === 'string' ? sessions.get(sessionId) : undefined;
-    if (entry && entry.uid !== req.mcpAuth.uid) return res.status(403).json({ error: 'session_owner_mismatch' });
-    if (!entry) {
-      if (sessionId || !isInitializeRequest(req.body)) return res.status(400).json({ error: 'invalid_or_missing_mcp_session' });
-      const mcpServer = createMcpServer(req.mcpAuth.uid, relay);
-      let transport;
-      transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: randomId,
-        onsessioninitialized: id => sessions.set(id, { transport, mcpServer, uid: req.mcpAuth.uid }),
-        onsessionclosed: id => sessions.delete(id),
-      });
-      transport.onclose = () => {
-        const id = transport.sessionId;
-        if (id) sessions.delete(id);
-        void mcpServer.close();
-      };
-      await mcpServer.connect(transport);
-      entry = { transport, mcpServer, uid: req.mcpAuth.uid };
-    }
-    await entry.transport.handleRequest(req, res, req.body);
-  } catch (error) {
-    console.error('MCP request failed', error);
-    if (!res.headersSent) res.status(500).json({ error: 'mcp_request_failed' });
-  }
-});
-
-const noStoreExtensions = new Set(['.html', '.css', '.js', '.webmanifest']);
-app.use(express.static(publicDir, {
-  extensions: ['html'],
-  maxAge: 0,
-  dotfiles: 'deny',
-  setHeaders: (res, filePath) => {
-    const extension = path.extname(filePath).toLowerCase();
-    if (noStoreExtensions.has(extension)) {
-      // The public site changes independently from the API. Never let a CDN
-      // combine HTML from one deploy with CSS/JS from another deploy.
-      res.setHeader('Cache-Control', 'no-store, max-age=0');
-      res.setHeader('CDN-Cache-Control', 'no-store');
-      res.setHeader('Cloudflare-CDN-Cache-Control', 'no-store');
-      return;
-    }
-    res.setHeader('Cache-Control', 'public, max-age=86400');
-  },
-}));
-app.get('*path', (req, res) => {
-  if (!req.accepts('html')) return res.status(404).json({ error: 'not_found' });
-  res.status(404).sendFile(path.join(publicDir, 'index.html'));
-});
-app.use((error, _req, res, _next) => {
-  console.error('Unhandled request error', error instanceof Error ? error.message : String(error));
-  if (!res.headersSent) res.status(500).json({ error: 'internal_server_error' });
-});
-
-httpServer.listen(config.port, '0.0.0.0', () => {
-  console.log(`ReMCP ${config.publicUrl} listening on 0.0.0.0:${config.port}`);
-});