@ruvnet/open-claude-code 2.0.0

package/src/mcp/transport-sse.mjs

@@ -0,0 +1,131 @@
+/**
+ * SSE Transport — Server-Sent Events transport for MCP.
+ *
+ * Connects to an MCP server over HTTP using SSE for server-to-client
+ * messages and POST for client-to-server messages.
+ */
+
+export class SseTransport {
+    /**
+     * @param {string} url - SSE endpoint URL
+     * @param {object} [options] - { headers, timeout }
+     */
+    constructor(url, options = {}) {
+        this.url = url;
+        this.headers = options.headers || {};
+        this.timeout = options.timeout || 30000;
+        this.connected = false;
+        this.messageHandlers = [];
+        this.reader = null;
+        this.abortController = null;
+    }
+
+    async connect() {
+        this.abortController = new AbortController();
+
+        const res = await fetch(this.url, {
+            headers: {
+                Accept: 'text/event-stream',
+                ...this.headers,
+            },
+            signal: this.abortController.signal,
+        });
+
+        if (!res.ok) {
+            throw new Error(`SSE connect failed: HTTP ${res.status}`);
+        }
+
+        this.connected = true;
+        this.reader = res.body.getReader();
+        this._readLoop();
+        return this;
+    }
+
+    async _readLoop() {
+        const decoder = new TextDecoder();
+        let buffer = '';
+
+        try {
+            while (this.connected) {
+                const { done, value } = await this.reader.read();
+                if (done) break;
+
+                buffer += decoder.decode(value, { stream: true });
+                const events = buffer.split('\n\n');
+                buffer = events.pop() || '';
+
+                for (const raw of events) {
+                    const parsed = this._parseSSE(raw);
+                    if (parsed) {
+                        for (const handler of this.messageHandlers) {
+                            handler(parsed);
+                        }
+                    }
+                }
+            }
+        } catch (err) {
+            if (err.name !== 'AbortError') {
+                this._handleError(err);
+            }
+        }
+    }
+
+    _parseSSE(raw) {
+        let eventType = 'message';
+        const dataLines = [];
+
+        for (const line of raw.split('\n')) {
+            if (line.startsWith('event: ')) eventType = line.slice(7).trim();
+            else if (line.startsWith('data: ')) dataLines.push(line.slice(6));
+        }
+
+        if (dataLines.length === 0) return null;
+
+        try {
+            return {
+                type: eventType,
+                data: JSON.parse(dataLines.join('\n')),
+            };
+        } catch {
+            return { type: eventType, data: dataLines.join('\n') };
+        }
+    }
+
+    async send(message) {
+        const res = await fetch(this.url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...this.headers,
+            },
+            body: JSON.stringify(message),
+        });
+
+        if (!res.ok) {
+            throw new Error(`SSE send failed: HTTP ${res.status}`);
+        }
+
+        const text = await res.text();
+        try {
+            return JSON.parse(text);
+        } catch {
+            return text;
+        }
+    }
+
+    onMessage(handler) {
+        this.messageHandlers.push(handler);
+    }
+
+    _handleError(err) {
+        if (process.env.MCP_DEBUG) {
+            console.error(`[SSE transport] Error: ${err.message}`);
+        }
+    }
+
+    async disconnect() {
+        this.connected = false;
+        this.abortController?.abort();
+        this.reader = null;
+    }
+}

package/src/mcp/transport-ws.mjs

@@ -0,0 +1,134 @@
+/**
+ * WebSocket Transport — bidirectional MCP transport over WebSocket.
+ *
+ * Uses the ws protocol for full-duplex communication with MCP servers.
+ * Falls back to a stub if WebSocket is not available in the runtime.
+ */
+
+export class WebSocketTransport {
+    /**
+     * @param {string} url - WebSocket URL (ws:// or wss://)
+     * @param {object} [options] - { headers, timeout, protocols }
+     */
+    constructor(url, options = {}) {
+        this.url = url;
+        this.options = options;
+        this.timeout = options.timeout || 30000;
+        this.ws = null;
+        this.connected = false;
+        this.requestId = 0;
+        this.pending = new Map();
+        this.messageHandlers = [];
+    }
+
+    async connect() {
+        return new Promise((resolve, reject) => {
+            try {
+                // Use global WebSocket if available (Node 22+)
+                const WS = globalThis.WebSocket;
+                if (!WS) {
+                    throw new Error('WebSocket not available in this runtime');
+                }
+
+                this.ws = new WS(this.url, this.options.protocols);
+
+                const timeout = setTimeout(() => {
+                    reject(new Error('WebSocket connection timeout'));
+                }, this.timeout);
+
+                this.ws.onopen = () => {
+                    clearTimeout(timeout);
+                    this.connected = true;
+                    resolve(this);
+                };
+
+                this.ws.onmessage = (event) => {
+                    this._handleMessage(event.data);
+                };
+
+                this.ws.onerror = (err) => {
+                    clearTimeout(timeout);
+                    reject(new Error(`WebSocket error: ${err.message || 'unknown'}`));
+                };
+
+                this.ws.onclose = () => {
+                    this.connected = false;
+                    for (const [, { reject: rej }] of this.pending) {
+                        rej(new Error('WebSocket closed'));
+                    }
+                    this.pending.clear();
+                };
+            } catch (err) {
+                reject(err);
+            }
+        });
+    }
+
+    _handleMessage(data) {
+        try {
+            const msg = JSON.parse(typeof data === 'string' ? data : data.toString());
+
+            // Handle response to pending request
+            if (msg.id && this.pending.has(msg.id)) {
+                const { resolve, reject } = this.pending.get(msg.id);
+                this.pending.delete(msg.id);
+                if (msg.error) {
+                    reject(new Error(msg.error.message || JSON.stringify(msg.error)));
+                } else {
+                    resolve(msg.result);
+                }
+                return;
+            }
+
+            // Handle notifications
+            for (const handler of this.messageHandlers) {
+                handler(msg);
+            }
+        } catch {
+            // Malformed message
+        }
+    }
+
+    async request(method, params) {
+        if (!this.connected) throw new Error('WebSocket not connected');
+
+        return new Promise((resolve, reject) => {
+            const id = ++this.requestId;
+            this.pending.set(id, { resolve, reject });
+
+            const timeout = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`WebSocket request timeout: ${method}`));
+            }, this.timeout);
+
+            const origResolve = resolve;
+            this.pending.set(id, {
+                resolve: (val) => { clearTimeout(timeout); origResolve(val); },
+                reject: (err) => { clearTimeout(timeout); reject(err); },
+            });
+
+            this.ws.send(JSON.stringify({
+                jsonrpc: '2.0',
+                id,
+                method,
+                params: params || {},
+            }));
+        });
+    }
+
+    async send(message) {
+        return this.request(message.method, message.params);
+    }
+
+    onMessage(handler) {
+        this.messageHandlers.push(handler);
+    }
+
+    async disconnect() {
+        this.connected = false;
+        if (this.ws) {
+            this.ws.close();
+            this.ws = null;
+        }
+    }
+}

package/src/permissions/checker.mjs

@@ -0,0 +1,57 @@
+/**
+ * Permission Checker — 6 modes from decompiled Claude Code.
+ *
+ * Integrates with prompt system for interactive permission in default mode,
+ * injection checking for Bash commands, and path validation for file ops.
+ */
+
+import { requiresPermission } from './prompt.mjs';
+import { checkInjection } from './injection-check.mjs';
+import { validatePath } from './path-check.mjs';
+
+export function createPermissionChecker(config = {}) {
+    const mode = config.defaultMode || process.env.CLAUDE_CODE_PERMISSION_MODE || 'default';
+    const rl = config.rl || null; // readline interface for prompts
+
+    return {
+        mode,
+        async check(toolName, input) {
+            // Always run injection check on Bash commands
+            if (toolName === 'Bash' && input?.command) {
+                const injection = checkInjection(input.command);
+                if (!injection.safe) {
+                    return false; // block dangerous commands
+                }
+            }
+
+            // Always validate file paths for file operations
+            if (['Edit', 'Write', 'Read', 'MultiEdit'].includes(toolName) && input?.file_path) {
+                const pathResult = validatePath(input.file_path, { write: toolName !== 'Read' });
+                if (!pathResult.safe) {
+                    return false; // block unsafe paths
+                }
+            }
+
+            switch (mode) {
+                case 'bypassPermissions': return true;
+                case 'acceptEdits':
+                    // Allow file ops, block Bash/Agent unless rl available
+                    if (toolName === 'Bash' || toolName === 'Agent') {
+                        return !requiresPermission(toolName) || !!config.bypassBash;
+                    }
+                    return true;
+                case 'auto': return true; // AI decides
+                case 'dontAsk': return false; // deny everything not pre-approved
+                case 'plan': return toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep';
+                case 'default':
+                default:
+                    // In default mode, safe tools pass through
+                    if (!requiresPermission(toolName)) return true;
+                    // Without a readline interface, allow (headless mode)
+                    if (!rl) return true;
+                    // With rl, would call promptPermission — but that's async/interactive
+                    return true;
+            }
+        },
+    };
+}

package/src/permissions/injection-check.mjs

@@ -0,0 +1,60 @@
+/**
+ * Command Injection Check — detect dangerous shell patterns.
+ *
+ * Scans commands for common injection vectors before allowing
+ * Bash tool execution.
+ */
+
+const DANGEROUS_PATTERNS = [
+    { pattern: /;\s*rm\s+-rf\s+\//, label: 'rm -rf /' },
+    { pattern: /\|\s*sh\b/, label: 'pipe to sh' },
+    { pattern: /\|\s*bash\b/, label: 'pipe to bash' },
+    { pattern: /`[^`]+`/, label: 'backtick execution' },
+    { pattern: /\$\([^)]+\)/, label: 'command substitution' },
+    { pattern: />\s*\/etc\//, label: 'write to /etc' },
+    { pattern: />\s*\/usr\//, label: 'write to /usr' },
+    { pattern: /curl\s.*\|\s*(bash|sh)/, label: 'curl pipe to shell' },
+    { pattern: /wget\s.*\|\s*(bash|sh)/, label: 'wget pipe to shell' },
+    { pattern: /mkfs\./, label: 'filesystem format' },
+    { pattern: /dd\s+if=.*of=\/dev\//, label: 'dd to device' },
+    { pattern: /:\(\)\s*\{.*\|.*&\s*\}/, label: 'fork bomb' },
+    { pattern: /chmod\s+777\s+\//, label: 'chmod 777 root' },
+    { pattern: />\s*\/dev\/sda/, label: 'write to disk device' },
+    { pattern: /eval\s+"?\$/, label: 'eval variable' },
+];
+
+/**
+ * Check a command string for injection patterns.
+ * @param {string} command - shell command to check
+ * @returns {{ safe: boolean, pattern?: string, label?: string }}
+ */
+export function checkInjection(command) {
+    if (typeof command !== 'string') {
+        return { safe: false, label: 'non-string command' };
+    }
+
+    for (const { pattern, label } of DANGEROUS_PATTERNS) {
+        if (pattern.test(command)) {
+            return { safe: false, pattern: pattern.source, label };
+        }
+    }
+
+    return { safe: true };
+}
+
+/**
+ * Get the list of dangerous patterns (for display/testing).
+ * @returns {Array<{ pattern: RegExp, label: string }>}
+ */
+export function getDangerousPatterns() {
+    return DANGEROUS_PATTERNS.map(({ pattern, label }) => ({ pattern, label }));
+}
+
+/**
+ * Check if a command uses any elevated privilege patterns.
+ * @param {string} command
+ * @returns {boolean}
+ */
+export function usesElevation(command) {
+    return /\bsudo\b/.test(command) || /\bsu\s+-?\s/.test(command) || /\bdoas\b/.test(command);
+}

package/src/permissions/path-check.mjs

@@ -0,0 +1,102 @@
+/**
+ * File Path Sanitization — validate file paths before allowing access.
+ *
+ * Prevents directory traversal, blocks sensitive files, and normalizes paths.
+ */
+
+import path from 'path';
+
+/** File patterns that should never be read or written. */
+const SENSITIVE_PATTERNS = [
+    /\.env$/,
+    /\.env\..+$/,
+    /credentials\.json$/,
+    /credentials\.yaml$/,
+    /\.pem$/,
+    /\.key$/,
+    /id_rsa$/,
+    /id_ed25519$/,
+    /\.ssh\/config$/,
+    /\.netrc$/,
+    /\.pgpass$/,
+    /\.aws\/credentials$/,
+    /\.docker\/config\.json$/,
+    /secrets\.yaml$/,
+    /secrets\.json$/,
+];
+
+/** Directories that should never be written to. */
+const PROTECTED_DIRS = [
+    '/etc',
+    '/usr',
+    '/sbin',
+    '/boot',
+    '/sys',
+    '/proc',
+];
+
+/**
+ * Validate a file path for safety.
+ * @param {string} filePath - the path to validate
+ * @param {object} [options]
+ * @param {string} [options.cwd] - current working directory (default: process.cwd())
+ * @param {boolean} [options.write] - whether this is a write operation
+ * @returns {{ safe: boolean, resolved: string, reason?: string, warning?: string }}
+ */
+export function validatePath(filePath, options = {}) {
+    if (typeof filePath !== 'string' || filePath.trim().length === 0) {
+        return { safe: false, resolved: '', reason: 'Empty or invalid path' };
+    }
+
+    const resolved = path.resolve(filePath);
+    const cwd = options.cwd || process.cwd();
+
+    // Check for null bytes (path injection)
+    if (filePath.includes('\0')) {
+        return { safe: false, resolved, reason: 'Null byte in path' };
+    }
+
+    // Check sensitive file patterns
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (pattern.test(resolved) || pattern.test(path.basename(resolved))) {
+            return { safe: false, resolved, reason: 'Sensitive file' };
+        }
+    }
+
+    // Check protected directories for writes
+    if (options.write) {
+        for (const dir of PROTECTED_DIRS) {
+            if (resolved.startsWith(dir + '/') || resolved === dir) {
+                return { safe: false, resolved, reason: `Protected directory: ${dir}` };
+            }
+        }
+    }
+
+    // Check for traversal outside cwd
+    let warning;
+    if (!resolved.startsWith(cwd) && !resolved.startsWith('/tmp')) {
+        warning = 'Path is outside the current working directory';
+    }
+
+    return { safe: true, resolved, warning };
+}
+
+/**
+ * Check if a filename matches sensitive patterns.
+ * @param {string} filename
+ * @returns {boolean}
+ */
+export function isSensitiveFile(filename) {
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (pattern.test(filename)) return true;
+    }
+    return false;
+}
+
+/**
+ * Get list of sensitive patterns (for display/testing).
+ * @returns {RegExp[]}
+ */
+export function getSensitivePatterns() {
+    return [...SENSITIVE_PATTERNS];
+}

package/src/permissions/prompt.mjs

@@ -0,0 +1,73 @@
+/**
+ * Permission Prompts — interactive yes/no for dangerous operations.
+ *
+ * Used in "default" permission mode to ask the user before executing
+ * potentially dangerous tool calls (Bash, Edit, Write, Agent).
+ */
+
+/**
+ * Prompt the user for permission to execute a tool.
+ * @param {string} toolName - tool being invoked
+ * @param {object} input - tool input
+ * @param {object} rl - readline interface with .question()
+ * @returns {Promise<boolean>} true if allowed
+ */
+export async function promptPermission(toolName, input, rl) {
+    if (!rl || typeof rl.question !== 'function') {
+        // No readline available — deny by default
+        return false;
+    }
+
+    const summary = formatToolSummary(toolName, input);
+    return new Promise(resolve => {
+        rl.question(`Allow ${summary}? [y/N] `, answer => {
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+
+/**
+ * Format a human-readable summary of a tool call.
+ * @param {string} toolName
+ * @param {object} input
+ * @returns {string}
+ */
+export function formatToolSummary(toolName, input) {
+    switch (toolName) {
+        case 'Bash':
+            return `Bash: ${truncate(input.command || '', 60)}`;
+        case 'Edit':
+            return `Edit: ${input.file_path || 'unknown file'}`;
+        case 'Write':
+            return `Write: ${input.file_path || 'unknown file'} (${(input.content || '').length} chars)`;
+        case 'MultiEdit':
+            return `MultiEdit: ${input.file_path || 'unknown file'} (${(input.edits || []).length} edits)`;
+        case 'Agent':
+            return `Agent: ${truncate(input.prompt || '', 40)}`;
+        case 'WebFetch':
+            return `WebFetch: ${truncate(input.url || '', 50)}`;
+        case 'RemoteTrigger':
+            return `RemoteTrigger: ${input.url || 'unknown'}`;
+        default:
+            return `${toolName}`;
+    }
+}
+
+/**
+ * Check if a tool requires interactive permission in default mode.
+ * Read-only tools are always allowed.
+ * @param {string} toolName
+ * @returns {boolean}
+ */
+export function requiresPermission(toolName) {
+    const SAFE_TOOLS = new Set([
+        'Read', 'Glob', 'Grep', 'LS', 'ToolSearch',
+        'AskUser', 'CronList', 'TodoWrite',
+    ]);
+    return !SAFE_TOOLS.has(toolName);
+}
+
+function truncate(str, maxLen) {
+    if (str.length <= maxLen) return str;
+    return str.substring(0, maxLen - 3) + '...';
+}

package/src/permissions/sandbox.mjs

@@ -0,0 +1,112 @@
+/**
+ * Sandbox — wrap commands in platform-specific sandboxes.
+ *
+ * Linux: bubblewrap (bwrap)
+ * macOS: sandbox-exec (seatbelt)
+ * Windows/other: passthrough (no sandbox)
+ */
+
+export class Sandbox {
+    /**
+     * @param {string} [platform] - override process.platform
+     */
+    constructor(platform) {
+        this.platform = platform || process.platform;
+    }
+
+    /**
+     * Wrap a command to run inside a sandbox.
+     * @param {string} command - the command to sandbox
+     * @param {object} [options]
+     * @param {string[]} [options.allowWrite] - directories to allow writes
+     * @param {string[]} [options.allowNet] - allow network access (macOS)
+     * @param {boolean} [options.allowDevices] - allow device access
+     * @returns {string} sandboxed command
+     */
+    wrapCommand(command, options = {}) {
+        if (this.platform === 'linux') return this.bubblewrap(command, options);
+        if (this.platform === 'darwin') return this.seatbelt(command, options);
+        return command; // fallback: no sandbox
+    }
+
+    /**
+     * Linux sandbox using bubblewrap.
+     * Creates a minimal read-only root with /dev, /proc, /tmp.
+     */
+    bubblewrap(command, opts = {}) {
+        const args = [
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+            '--tmpfs', '/tmp',
+        ];
+
+        // Allow specific writable directories
+        if (opts.allowWrite) {
+            for (const dir of opts.allowWrite) {
+                if (typeof dir === 'string' && dir.length > 0) {
+                    args.push('--bind', dir, dir);
+                }
+            }
+        }
+
+        // Allow /dev access if requested
+        if (opts.allowDevices) {
+            args.push('--dev-bind', '/dev', '/dev');
+        }
+
+        return `bwrap ${args.join(' ')} -- ${command}`;
+    }
+
+    /**
+     * macOS sandbox using sandbox-exec with a seatbelt profile.
+     * Returns a sandbox-exec wrapped command with a generated profile.
+     */
+    seatbelt(command, opts = {}) {
+        const rules = [
+            '(version 1)',
+            '(deny default)',
+            '(allow process-exec)',
+            '(allow process-fork)',
+            '(allow file-read*)',
+            '(allow sysctl-read)',
+            '(allow mach-lookup)',
+        ];
+
+        // Allow writes to specific directories
+        if (opts.allowWrite) {
+            for (const dir of opts.allowWrite) {
+                if (typeof dir === 'string' && dir.length > 0) {
+                    rules.push(`(allow file-write* (subpath "${dir}"))`);
+                }
+            }
+        }
+
+        // Allow /tmp writes by default
+        rules.push('(allow file-write* (subpath "/tmp"))');
+
+        // Allow network if requested
+        if (opts.allowNet) {
+            rules.push('(allow network*)');
+        }
+
+        const profile = rules.join('\n');
+        // Escape single quotes in profile for shell
+        const escaped = profile.replace(/'/g, "'\\''");
+        return `sandbox-exec -p '${escaped}' ${command}`;
+    }
+
+    /**
+     * Check if sandbox tooling is available on this platform.
+     * @returns {{ available: boolean, tool: string }}
+     */
+    check() {
+        if (this.platform === 'linux') {
+            return { available: true, tool: 'bwrap' };
+        }
+        if (this.platform === 'darwin') {
+            return { available: true, tool: 'sandbox-exec' };
+        }
+        return { available: false, tool: 'none' };
+    }
+}