@samanhappy/mcphub 1.1.2 → 1.1.4

package/dist/services/mcpService.js

@@ -1,15 +1,17 @@
+import { hasPersonalOAuth, PersonalOAuthContext, personalOAuthContexts, personalAuthorizationRequired, } from './personalOAuthService.js';
 import { preserveListFreshness, combineListFreshness, remainingListTtl, } from '../utils/listFreshness.js';
 import { expandServerConfig, getServerEnvironment } from './serverConfigEnvironment.js';
 import { getMcpRequestGroup } from '../utils/mcpRequestGroup.js';
 import { LegacyMcpClient } from '../clients/legacyMcpClient.js';
 import { LEGACY_PROTOCOL_VERSIONS } from '../utils/mcpProtocol.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
 import { canAccessGroupRoute } from '../utils/groupAccess.js';
 import { canServeToolRequests } from '../utils/serverAvailability.js';
 import { PrincipalRuntimeService } from './principalRuntimeService.js';
 import { UserContextService } from './userContextService.js';
 import { deleteCredentialBindings, missingCredentialError } from './credentialBindingService.js';
-import { CredentialBindingError, hasCredentialTemplate, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
+import { CredentialBindingError, hasCredentialTemplate, hasPersonalAuthentication, resolveCredentialArguments, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
 import os from 'os';
 import path from 'path';
 import fs from 'fs';
@@ -171,13 +173,13 @@ const sanitizeArgs = (args) => {
     return args.map((arg) => {
         // Remove shell metacharacters that could be used for injection
         // Allow common flags (-f, --flag, -vvv) and paths
-        if (/^[a-zA-Z0-9._/\\:@=+,-]+$/.test(arg)) {
+        if (/^[a-zA-Z0-9._/\\:@=+,-]+$/.test(arg.replace(/\{\{args\.[A-Za-z_][A-Za-z0-9_]*\}\}/g, 'slot'))) {
             return arg;
         }
         // For arguments with special characters, log a warning
         // Also block redirection operators (>, <, >>) and newlines
         logger.warn(`[proxychains] Potentially unsafe argument blocked: ${arg}`);
-        return arg.replace(/[;&|`$(){}[\]!><\n\r]/g, '');
+        return arg.replace(/\{\{args\.[A-Za-z_][A-Za-z0-9_]*\}\}|[;&|`$(){}[\]!><\n\r]/g, (match) => match.startsWith('{{args.') ? match : '');
     });
 };
 /**
@@ -721,16 +723,28 @@ const removeClientState = (id) => {
     for (const client of state.cookieClients)
         client.clearSessionCookies(id);
 };
-const acquireClientState = (serverInfo) => {
+const acquireClientState = (serverInfo, openAiSession) => {
     const contextService = RequestContextService.getInstance();
     const scope = contextService.getRequestContext()?.clientStateScope;
-    const handle = contextService.getHeader('x-mcphub-state-id');
-    if (!scope ||
-        typeof handle !== 'string' ||
-        !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(handle)) {
-        throw new Error('Stateful tools on stateless MCP require authenticated bearer access and X-MCPHub-State-Id (UUID v4)');
+    const explicitHandle = contextService.getHeader('x-mcphub-state-id');
+    if (!scope) {
+        throw new Error('Stateful tools on stateless MCP require authenticated bearer access and an application state handle');
+    }
+    let handle;
+    if (explicitHandle !== undefined) {
+        if (typeof explicitHandle !== 'string' ||
+            !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(explicitHandle)) {
+            throw new Error('X-MCPHub-State-Id must be a UUID v4');
+        }
+        handle = explicitHandle.toLowerCase();
+    }
+    else if (typeof openAiSession === 'string' && openAiSession.trim()) {
+        handle = `openai:${createHash('sha256').update(openAiSession).digest('hex')}`;
+    }
+    else {
+        throw new Error('Stateful tools on stateless MCP require X-MCPHub-State-Id (UUID v4) or _meta["openai/session"]');
     }
-    const id = `client-state:${scope}:${handle.toLowerCase()}`;
+    const id = `client-state:${scope}:${handle}`;
     let state = clientStates.get(id);
     if (state && state.active === 0 && Date.now() - state.lastUsed >= CLIENT_STATE_IDLE_MS) {
         removeClientState(id);
@@ -895,7 +909,7 @@ export const summarizeServerConnections = (infos) => {
 };
 export const getServerConnectionStats = () => {
     // Personal definitions have no shared connection whose readiness can be checked.
-    return summarizeServerConnections(serverInfos.filter((info) => !hasCredentialTemplate(info.config)));
+    return summarizeServerConnections(serverInfos.filter((info) => !hasPersonalAuthentication(info.config)));
 };
 // Returns true if all enabled servers are connected
 export const connected = () => {
@@ -1194,7 +1208,7 @@ export const createTransportFromConfig = async (name, conf) => {
     if (conf.type === 'streamable-http') {
         const options = {};
         let headers = conf.headers
-            ? hasCredentialTemplate(conf)
+            ? hasPersonalAuthentication(conf)
                 ? conf.headers
                 : replaceEnvVars(conf.headers, env)
             : {};
@@ -1220,14 +1234,15 @@ export const createTransportFromConfig = async (name, conf) => {
                 headers,
             };
         }
-        options.fetch = requestAwareFetch;
+        options.fetch =
+            personalOAuthContexts.get(conf)?.wrapFetch(requestAwareFetch) || requestAwareFetch;
         transport = new StreamableHTTPClientTransport(new URL(conf.url || ''), options);
     }
     else if (conf.url) {
         // SSE transport
         const options = {};
         let headers = conf.headers
-            ? hasCredentialTemplate(conf)
+            ? hasPersonalAuthentication(conf)
                 ? conf.headers
                 : replaceEnvVars(conf.headers, env)
             : {};
@@ -1246,7 +1261,7 @@ export const createTransportFromConfig = async (name, conf) => {
         if (Object.keys(headers).length > 0) {
             options.eventSourceInit = {
                 headers,
-                fetch: requestAwareFetch,
+                fetch: personalOAuthContexts.get(conf)?.wrapFetch(requestAwareFetch) || requestAwareFetch,
             };
             options.requestInit = {
                 headers,
@@ -1254,10 +1269,11 @@ export const createTransportFromConfig = async (name, conf) => {
         }
         else {
             options.eventSourceInit = {
-                fetch: requestAwareFetch,
+                fetch: personalOAuthContexts.get(conf)?.wrapFetch(requestAwareFetch) || requestAwareFetch,
             };
         }
-        options.fetch = requestAwareFetch;
+        options.fetch =
+            personalOAuthContexts.get(conf)?.wrapFetch(requestAwareFetch) || requestAwareFetch;
         transport = new SSEClientTransport(new URL(conf.url), options);
     }
     else if (conf.command) {
@@ -1292,12 +1308,13 @@ export const createTransportFromConfig = async (name, conf) => {
         transport = new StdioClientTransport({
             cwd: process.cwd(),
             command: finalCommand,
-            args: finalArgs,
+            // Substitute after expansion and proxy argument cleaning so secrets stay literal.
+            args: resolveCredentialArguments(conf, finalArgs),
             env: env,
             stderr: 'pipe',
             maxBufferSize: validateMaxBufferSize(conf.options?.maxBufferSize),
         });
-        if (transport.stderr && hasCredentialTemplate(conf)) {
+        if (transport.stderr && hasPersonalAuthentication(conf)) {
             transport.stderr.on('data', () => undefined); // Personal upstream diagnostics can contain raw credentials.
         }
         else if (transport.stderr) {
@@ -1324,7 +1341,7 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
     if (!client) {
         throw new Error(`Client not found for server: ${serverInfo.name}`);
     }
-    if (hasCredentialTemplate(serverInfo.config)) {
+    if (hasPersonalAuthentication(serverInfo.config)) {
         return client.callTool(toolParams, options || {});
     }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
@@ -1501,7 +1518,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 });
                 continue;
             }
-            if (hasCredentialTemplate(expandedConf)) {
+            if (hasPersonalAuthentication(expandedConf)) {
                 validateCredentialTemplate(expandedConf);
                 nextServerInfos.push({
                     name,
@@ -2010,15 +2027,26 @@ export const getServersInfo = async (page, limit, user) => {
     const principal = (user ||
         UserContextService.getInstance().getCurrentUser());
     const presentedInfos = await Promise.all(filterServerInfos.map(async (info) => {
-        if (!hasCredentialTemplate(info.config) ||
+        if (!hasPersonalAuthentication(info.config) ||
             info.enabled === false ||
             !principal?.username ||
             principal.credentialEligible === false)
             return info;
+        let ownOAuth;
         try {
+            const personal = hasPersonalOAuth(info.config)
+                ? await PersonalOAuthContext.load(info.name, principal.username, (await getServerDao().findById(info.name)))
+                : undefined;
+            ownOAuth = personal
+                ? {
+                    identityMode: 'personal',
+                    connected: Boolean(personal.config.oauth.accessToken),
+                    authorizationUrl: personal.authorizationUrl,
+                }
+                : undefined;
             const lease = await principalRuntimes.acquire(info.name, principal);
             try {
-                return { ...lease.info, config: info.config };
+                return { ...lease.info, config: info.config, ...(ownOAuth ? { oauth: ownOAuth } : {}) };
             }
             finally {
                 lease.release();
@@ -2027,6 +2055,7 @@ export const getServersInfo = async (page, limit, user) => {
         catch (error) {
             return {
                 ...info,
+                ...(ownOAuth ? { status: 'oauth_required', oauth: ownOAuth } : {}),
                 error: error instanceof CredentialBindingError || error instanceof UpstreamRequestError
                     ? error.message
                     : 'Unable to prepare upstream server',
@@ -2089,6 +2118,8 @@ export const getServersInfo = async (page, limit, user) => {
                 ? {
                     ...(oauth
                         ? {
+                            ...(oauth.identityMode ? { identityMode: oauth.identityMode } : {}),
+                            ...(oauth.connected ? { connected: true } : {}),
                             authorizationUrl: oauth.authorizationUrl,
                             state: oauth.state,
                             ...(oauth.clientIdConfigured ? { clientIdConfigured: true } : {}),
@@ -2101,9 +2132,12 @@ export const getServersInfo = async (page, limit, user) => {
             config: resolvedType || serverConfig?.description || serverConfig?.command
                 ? {
                     ...(resolvedType ? { type: resolvedType } : {}),
-                    ...(hasCredentialTemplate(serverConfig)
+                    ...(hasPersonalAuthentication(serverConfig)
                         ? { credentialTemplate: validateCredentialTemplate(serverConfig) }
                         : {}),
+                    ...(hasPersonalOAuth(serverConfig)
+                        ? { oauth: { identityMode: 'personal' } }
+                        : {}),
                     ...(serverConfig?.description ? { description: serverConfig.description } : {}),
                     // Expose command so the frontend can determine if reinstall is
                     // supported (npx/uvx only). This is not a secret — it's the
@@ -2493,7 +2527,7 @@ const scheduleIdleShutdown = (serverInfo) => {
     clearIdleShutdown(serverInfo);
     if (!serverInfo.config?.startOnDemand ||
         !isStdioServer(serverInfo.config) ||
-        hasCredentialTemplate(serverInfo.config) ||
+        hasPersonalAuthentication(serverInfo.config) ||
         serverInfo.status !== 'connected' ||
         !serverInfo.client ||
         serverInfo.activeToolCalls) {
@@ -2509,7 +2543,7 @@ const scheduleIdleShutdown = (serverInfo) => {
 const beginOnDemandToolCall = (serverInfo) => {
     if (!serverInfo.config?.startOnDemand ||
         !isStdioServer(serverInfo.config) ||
-        hasCredentialTemplate(serverInfo.config)) {
+        hasPersonalAuthentication(serverInfo.config)) {
         return undefined;
     }
     clearIdleShutdown(serverInfo);
@@ -2657,7 +2691,7 @@ const isStdioServer = (conf) => !!conf && (conf.type === 'stdio' || (!conf.type
  */
 const primeOnDemandServers = (gate) => {
     const targets = serverInfos.filter((si) => si.config?.startOnDemand === true &&
-        !hasCredentialTemplate(si.config) &&
+        !hasPersonalAuthentication(si.config) &&
         isStdioServer(si.config) &&
         si.tools.length === 0 &&
         si.enabled !== false);
@@ -2865,12 +2899,17 @@ const getMcpAppsRouteContext = async (sessionId, group) => {
         const eligible = (pinned?.pinnedServerInfos ?? []).filter(canServeToolRequests);
         return eligible.length > 0 ? { enabled: true, serverInfos: eligible } : { enabled: false };
     }
-    const { filteredServerInfos } = await getFilteredServerInfosForGroup(group);
+    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
     const connectedServerInfos = filteredServerInfos.filter((serverInfo) => serverInfo.status === 'connected' && !!serverInfo.client);
     if (connectedServerInfos.length === 0) {
         return { enabled: false };
     }
-    if (connectedServerInfos.length === 1) {
+    // Connection availability must not turn an aggregate route into a raw-name
+    // route: OpenAPI uses openApiClient, and tool calls acquire only the target
+    // personal runtime. Match resolveToolInGroup's configured-route ambiguity check.
+    if (connectedServerInfos.length === 1 &&
+        filteredServerInfos.length === 1 &&
+        serverConfigsByName.size <= 1) {
         return {
             enabled: true,
             serverInfo: connectedServerInfos[0],
@@ -3010,7 +3049,7 @@ const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConf
         return undefined;
     }
     const projectedTool = appsRouteContext.enabled ? tool : stripMcpAppsMetadata(tool);
-    // Single connected server: keep the existing raw (unqualified) name so
+    // Single configured server: keep the existing raw (unqualified) name so
     // widgets that call back with the bare tool name continue to work.
     if (appsRouteContext.serverInfo) {
         return {
@@ -3018,7 +3057,7 @@ const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConf
             name: normalizeToolNameForServer(serverName, projectedTool.name),
         };
     }
-    // Multiple connected servers (Apps-enabled) or Apps disabled: qualify the
+    // Aggregate routes (Apps-enabled) or Apps disabled: qualify the
     // name so it can still be routed to the right server unambiguously.
     return {
         ...projectedTool,
@@ -3162,7 +3201,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
     const getToolStateId = (info, legacyId) => {
         if (!requestContextService.getRequestContext()?.stateless)
             return legacyId;
-        clientStateLease ?? (clientStateLease = acquireClientState(info));
+        clientStateLease ?? (clientStateLease = acquireClientState(info, request.params?._meta?.['openai/session']));
         return clientStateLease.id;
     };
     const reserveHostedIfNeeded = async (serverName, toolName) => {
@@ -3320,7 +3359,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                     keyId,
                     keyName,
                     sourceIp,
-                    hasCredentialTemplate: hasCredentialTemplate(targetServerInfo.config),
+                    hasCredentialTemplate: hasPersonalAuthentication(targetServerInfo.config),
                 });
                 return await maybeCompressToolResult({
                     content: [
@@ -3339,7 +3378,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
             // For servers with perSessionClient: true, use a per-session dedicated client
             let isolatedCtx;
             if (targetServerInfo.config?.perSessionClient &&
-                !hasCredentialTemplate(targetServerInfo.config)) {
+                !hasPersonalAuthentication(targetServerInfo.config)) {
                 const stateId = getToolStateId(targetServerInfo, sessionId);
                 if (!stateId) {
                     throw new Error(`Server '${targetServerInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
@@ -3392,7 +3431,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 keyId,
                 keyName,
                 sourceIp,
-                hasCredentialTemplate: hasCredentialTemplate(targetServerInfo.config),
+                hasCredentialTemplate: hasPersonalAuthentication(targetServerInfo.config),
                 errorMessage: result.isError ? 'Tool returned error response' : undefined,
             });
             return await maybeCompressToolResult(result, {
@@ -3499,7 +3538,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 keyId,
                 keyName,
                 sourceIp,
-                hasCredentialTemplate: hasCredentialTemplate(serverInfo.config),
+                hasCredentialTemplate: hasPersonalAuthentication(serverInfo.config),
             });
             return await maybeCompressToolResult({
                 content: [
@@ -3517,7 +3556,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
         // Handle MCP servers
         // For servers with perSessionClient: true, use a per-session dedicated client
         let isolatedCtx;
-        if (serverInfo.config?.perSessionClient && !hasCredentialTemplate(serverInfo.config)) {
+        if (serverInfo.config?.perSessionClient && !hasPersonalAuthentication(serverInfo.config)) {
             const stateId = getToolStateId(serverInfo, sessionId);
             if (!stateId) {
                 throw new Error(`Server '${serverInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
@@ -3555,7 +3594,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
             keyId,
             keyName,
             sourceIp,
-            hasCredentialTemplate: hasCredentialTemplate(serverInfo.config),
+            hasCredentialTemplate: hasPersonalAuthentication(serverInfo.config),
             errorMessage: result.isError ? 'Tool returned error response' : undefined,
         });
         return await maybeCompressToolResult(result, {
@@ -3594,7 +3633,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
             keyId,
             keyName,
             sourceIp,
-            hasCredentialTemplate: hasCredentialTemplate(serverInfo?.config),
+            hasCredentialTemplate: hasPersonalAuthentication(serverInfo?.config),
             // The reason is an internal diagnostic; the caller-facing message stays
             // identical for hidden and nonexistent targets.
             errorMessage: unavailable
@@ -3867,9 +3906,19 @@ const handleReadResourceRequestImpl = async (request, extra) => {
             ? { cacheMode: 'bypass' }
             : undefined;
         if (server?.client) {
-            result = readOptions
-                ? await server.client.readResource({ uri }, readOptions)
-                : await server.client.readResource({ uri });
+            // A widget URI the upstream also lists in resources/list is read here, not in
+            // the fallback loop below, so it needs the same idle guard: otherwise an
+            // idle timer armed by an earlier read can close an on-demand upstream while
+            // this read is still in flight.
+            const releaseOnDemandRead = beginOnDemandToolCall(server);
+            try {
+                result = readOptions
+                    ? await server.client.readResource({ uri }, readOptions)
+                    : await server.client.readResource({ uri });
+            }
+            finally {
+                releaseOnDemandRead?.();
+            }
             if (!result || !Array.isArray(result.contents)) {
                 throw new Error(`Failed to read resource: ${uri}`);
             }
@@ -3885,10 +3934,23 @@ const handleReadResourceRequestImpl = async (request, extra) => {
                 ? [appsRouteContext.serverInfo]
                 : (appsRouteContext.serverInfos ?? []);
             for (const candidate of candidates) {
-                if (!candidate.client) {
-                    continue;
-                }
+                // An on-demand candidate may be idle yet still advertise its cached widget
+                // link, so a host can read the ui:// resource before any tool call has
+                // woken it. Hold off its idle shutdown for every read, awake or not, so an
+                // armed idle timer or an overlapping read cannot close the server mid-read,
+                // then wake it the same way the call path does if it is not running.
+                let releaseOnDemandRead;
                 try {
+                    if (candidate.config?.startOnDemand && candidate.enabled !== false) {
+                        releaseOnDemandRead = beginOnDemandToolCall(candidate);
+                        if (!candidate.client) {
+                            await ensureServerReady(candidate);
+                        }
+                        candidate.lastUsedAt = Date.now();
+                    }
+                    if (!candidate.client) {
+                        continue;
+                    }
                     const candidateResult = readOptions
                         ? await candidate.client.readResource({ uri }, readOptions)
                         : await candidate.client.readResource({ uri });
@@ -3898,7 +3960,10 @@ const handleReadResourceRequestImpl = async (request, extra) => {
                     }
                 }
                 catch {
-                    // This candidate doesn't own the resource; try the next one.
+                    // This candidate doesn't own the resource (or failed to wake); try the next one.
+                }
+                finally {
+                    releaseOnDemandRead?.();
                 }
             }
             if (!result) {
@@ -4029,6 +4094,9 @@ const createPrincipalRuntime = async (name, resolvedConfig) => {
     }
     catch (error) {
         closeServerRuntime(info);
+        if (hasPersonalOAuth(resolvedConfig) &&
+            personalOAuthContexts.get(resolvedConfig)?.config.oauth.pendingAuthorization)
+            throw personalAuthorizationRequired(name);
         const failure = createUpstreamRequestError(name, 'connect', error, resolvedConfig);
         logger.error(failure.message);
         throw failure;
@@ -4058,7 +4126,7 @@ export const getServerToolsForPrincipal = async (serverName, principal) => {
     }
 };
 const withPrincipalServers = (handler, operation) => async (request, extra) => {
-    if (!serverInfos.some((info) => hasCredentialTemplate(info.config)))
+    if (!serverInfos.some((info) => hasPersonalAuthentication(info.config)))
         return handler(request, extra);
     // Built-in content does not require an upstream credential.
     if (operation === 'prompt') {
@@ -4095,7 +4163,7 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
     }
     // A call to a known target must not spawn or keep unrelated personal children alive.
     const selected = target && (operation === 'tool' || operation === 'prompt') ? [target] : candidates;
-    const templated = selected.filter((info) => hasCredentialTemplate(info.config));
+    const templated = selected.filter((info) => hasPersonalAuthentication(info.config));
     if (!templated.length)
         return handler(request, extra);
     const user = UserContextService.getInstance().getCurrentUser();
@@ -4108,7 +4176,9 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
                 if (!user?.username ||
                     user.credentialEligible === false ||
                     RequestContextService.getInstance().getKeyKindContext() === 'system')
-                    throw missingCredentialError(info.name);
+                    throw hasPersonalOAuth(info.config)
+                        ? personalAuthorizationRequired(info.name)
+                        : missingCredentialError(info.name);
                 const lease = await principalRuntimes.acquire(info.name, user);
                 releases.push(lease.release);
                 scoped.set(info.name, lease.info);
@@ -4137,7 +4207,7 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
         let resolvedRequest = request;
         if (operation === 'tool' &&
             extra?.server &&
-            hasCredentialTemplate(scoped.get(extra.server)?.config)) {
+            hasPersonalAuthentication(scoped.get(extra.server)?.config)) {
             const prefix = `${extra.server}${getNameSeparator()}`;
             if (typeof requestedName === 'string' && !requestedName.startsWith(prefix)) {
                 resolvedRequest =