@sayknow-cli/coding-agent 0.4.7 → 0.5.1

package/src/runtime-mcp/manager.ts

@@ -6,12 +6,12 @@
  */
 import * as path from "node:path";
 import * as url from "node:url";
-import type { TSchema } from "@sayknow-cli/ai";
+import { isCanonicalMCPOAuthBinding, resolveMCPOAuthResourceOrigin, type TSchema } from "@sayknow-cli/ai";
 import { logger } from "@sayknow-cli/utils";
 import type { SourceMeta } from "../capability/types";
 import * as configValue from "../config/resolve-config-value";
 import type { CustomTool } from "../extensibility/custom-tools/types";
-import type { AuthStorage } from "../session/auth-storage";
+import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
 import {
 	connectToServer,
 	disconnectServer,
@@ -27,7 +27,6 @@ import {
 	unsubscribeFromResources,
 } from "./client";
 import { loadAllMCPConfigs, validateServerConfig } from "./config";
-import { refreshMCPOAuthToken } from "./oauth-flow";
 import type { MCPToolDetails } from "./tool-bridge";
 import { DeferredMCPTool, MCPTool } from "./tool-bridge";
 import type { MCPToolCache } from "./tool-cache";
@@ -69,17 +68,24 @@ type ConnectionTask = {
 
 const STARTUP_TIMEOUT_MS = 250;
 const STARTUP_TIMEOUT_GRACE_MS = 500;
+/**
+ * Default ceiling on how long `discoverAndConnect` waits for a server batch to
+ * come up. Deliberately short: a config with a large `timeout` must not be able
+ * to hang ordinary startup. ACP lifecycle launches carry their own, larger
+ * budget derived from the readiness deadline (see `maxStartupTimeoutMs`).
+ */
 const MAX_STARTUP_TIMEOUT_MS = 1_750;
 
-function resolveStartupTimeoutMs(configs: MCPServerConfig[]): number {
+export function resolveStartupTimeoutMs(configs: MCPServerConfig[], maxStartupTimeoutMs?: number): number {
+	const ceiling =
+		typeof maxStartupTimeoutMs === "number" && Number.isFinite(maxStartupTimeoutMs) && maxStartupTimeoutMs > 0
+			? Math.max(STARTUP_TIMEOUT_MS, maxStartupTimeoutMs)
+			: MAX_STARTUP_TIMEOUT_MS;
 	const configuredTimeouts = configs
 		.map(config => config.timeout)
 		.filter((timeout): timeout is number => typeof timeout === "number" && Number.isFinite(timeout) && timeout > 0);
 	if (configuredTimeouts.length === 0) return STARTUP_TIMEOUT_MS;
-	return Math.min(
-		MAX_STARTUP_TIMEOUT_MS,
-		Math.max(STARTUP_TIMEOUT_MS, Math.max(...configuredTimeouts) + STARTUP_TIMEOUT_GRACE_MS),
-	);
+	return Math.min(ceiling, Math.max(STARTUP_TIMEOUT_MS, Math.max(...configuredTimeouts) + STARTUP_TIMEOUT_GRACE_MS));
 }
 
 function trackPromise<T>(promise: Promise<T>): TrackedPromise<T> {
@@ -186,6 +192,13 @@ export interface MCPDiscoverOptions {
 export interface MCPManagerOptions {
 	/** Restrict this instance to tools from an explicit MCP config. */
 	toolsOnly?: boolean;
+	/**
+	 * Ceiling for the startup wait, in milliseconds. Only ACP lifecycle launches
+	 * set this, so a slow ACP MCP handshake gets the readiness budget while every
+	 * other consumer keeps the short default. Non-positive or non-finite values
+	 * are ignored and the default applies.
+	 */
+	maxStartupTimeoutMs?: number;
 }
 
 /**
@@ -270,12 +283,15 @@ export class MCPManager {
 		);
 	}
 
+	readonly #maxStartupTimeoutMs: number | undefined;
+
 	constructor(
 		private cwd: string,
 		private toolCache: MCPToolCache | null = null,
 		options: MCPManagerOptions = {},
 	) {
 		this.#toolsOnly = options.toolsOnly === true;
+		this.#maxStartupTimeoutMs = options.maxStartupTimeoutMs;
 	}
 
 	isToolsOnly(): boolean {
@@ -634,7 +650,10 @@ export class MCPManager {
 		}
 
 		if (connectionTasks.length > 0) {
-			const startupTimeoutMs = resolveStartupTimeoutMs(connectionTasks.map(task => task.config));
+			const startupTimeoutMs = resolveStartupTimeoutMs(
+				connectionTasks.map(task => task.config),
+				this.#maxStartupTimeoutMs,
+			);
 			const firstUnexpectedFailure = Promise.withResolvers<{ reason: unknown }>();
 			if (this.#toolsOnly) {
 				for (const task of connectionTasks) {
@@ -1469,64 +1488,63 @@ export class MCPManager {
 		let resolved: MCPServerConfig = { ...config };
 
 		const auth = config.auth;
-		if (auth?.type === "oauth" && auth.credentialId && this.#authStorage) {
+		if (auth?.type === "oauth") {
+			if (!auth.credentialId || !this.#authStorage || (config.type !== "http" && config.type !== "sse")) {
+				throw new MCPExpectedFailure();
+			}
 			const credentialId = auth.credentialId;
 			let credential = this.#authStorage.get(credentialId);
-			if (credential?.type === "oauth") {
-				// Proactive refresh: 5-minute buffer before expiry
-				// Force refresh: on 401/403 auth errors (revoked tokens, clock skew, missing expires)
-				const REFRESH_BUFFER_MS = 5 * 60_000;
-				const shouldRefresh =
-					forceRefresh || (credential.expires && Date.now() >= credential.expires - REFRESH_BUFFER_MS);
-				let refreshedCredential:
-					| {
-							type: "oauth";
-							access: string;
-							refresh: string;
-							expires: number;
-					  }
-					| undefined;
-				if (shouldRefresh && credential.refresh && auth.tokenUrl) {
-					try {
-						const refreshed = await refreshMCPOAuthToken(
-							auth.tokenUrl,
-							credential.refresh,
-							auth.clientId,
-							auth.clientSecret,
-						);
-						refreshedCredential = { type: "oauth", ...refreshed };
-					} catch (error) {
-						if (!(error instanceof MCPExpectedFailure)) throw error;
-						if (this.#toolsOnly) {
-							logger.debug("MCP OAuth refresh failed");
-						} else {
-							logger.warn("MCP OAuth refresh failed, using existing token");
-						}
+			const binding = credential?.type === "oauth" ? credential.mcpBinding : undefined;
+			const endpointOrigin = resolveMCPOAuthResourceOrigin(config.url);
+			if (
+				credential?.type !== "oauth" ||
+				!binding ||
+				!isCanonicalMCPOAuthBinding(binding) ||
+				binding.resourceOrigin !== endpointOrigin ||
+				(auth.tokenUrl !== undefined && auth.tokenUrl !== binding.tokenEndpoint)
+			) {
+				throw new MCPExpectedFailure();
+			}
+
+			// Proactive refresh: 5-minute buffer before expiry
+			// Force refresh: on 401/403 auth errors (revoked tokens, clock skew, missing expires)
+			const REFRESH_BUFFER_MS = 5 * 60_000;
+			const shouldRefresh =
+				forceRefresh || (credential.expires && Date.now() >= credential.expires - REFRESH_BUFFER_MS);
+			if (shouldRefresh && credential.refresh) {
+				let refreshedCredential: OAuthCredential | undefined;
+				try {
+					refreshedCredential = await this.#authStorage.forceRefreshOAuthCredential(credentialId, credential, {
+						clientId: auth.clientId,
+						clientSecret: auth.clientSecret,
+					});
+				} catch {
+					if (forceRefresh) throw new MCPExpectedFailure();
+					if (this.#toolsOnly) {
+						logger.debug("MCP OAuth refresh failed");
+					} else {
+						logger.warn("MCP OAuth refresh failed, using existing token");
 					}
 				}
 				if (refreshedCredential) {
-					await this.#authStorage.set(credentialId, refreshedCredential);
+					const refreshedBinding = refreshedCredential.mcpBinding;
+					if (
+						!refreshedBinding ||
+						refreshedBinding.resourceOrigin !== binding.resourceOrigin ||
+						refreshedBinding.tokenEndpoint !== binding.tokenEndpoint
+					) {
+						throw new MCPExpectedFailure();
+					}
 					credential = refreshedCredential;
 				}
-
-				if (resolved.type === "http" || resolved.type === "sse") {
-					resolved = {
-						...resolved,
-						headers: {
-							...resolved.headers,
-							Authorization: `Bearer ${credential.access}`,
-						},
-					};
-				} else {
-					resolved = {
-						...resolved,
-						env: {
-							...resolved.env,
-							OAUTH_ACCESS_TOKEN: credential.access,
-						},
-					};
-				}
 			}
+			resolved = {
+				...config,
+				headers: {
+					...config.headers,
+					Authorization: `Bearer ${credential.access}`,
+				},
+			};
 		}
 		if (this.#toolsOnly && resolved.type === "stdio") {
 			resolved = { ...resolved, noInheritEnv: true };

package/src/runtime-mcp/oauth-flow.ts

@@ -8,29 +8,10 @@
 import type { OAuthCallbackFlowOptions } from "@sayknow-cli/ai/utils/oauth/callback-server";
 import { OAuthCallbackFlow } from "@sayknow-cli/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@sayknow-cli/ai/utils/oauth/types";
-import { MCPExpectedFailure } from "./types";
 
 const DEFAULT_PORT = 3000;
 const CALLBACK_PATH = "/callback";
 const CALLBACK_BIND_HOSTNAME = "127.0.0.1";
-type RefreshTokenResponse = {
-	access_token: string;
-	refresh_token?: string;
-	expires_in?: number;
-};
-
-function isRefreshTokenResponse(value: unknown): value is RefreshTokenResponse {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const payload = value as Record<string, unknown>;
-	return (
-		typeof payload.access_token === "string" &&
-		payload.access_token.length > 0 &&
-		(payload.refresh_token === undefined || typeof payload.refresh_token === "string") &&
-		(payload.expires_in === undefined ||
-			(typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) && payload.expires_in >= 0))
-	);
-}
-
 function isLoopbackHostname(hostname: string): boolean {
 	return hostname === "localhost" || hostname === "127.0.0.1";
 }
@@ -384,56 +365,3 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		}
 	}
 }
-
-/**
- * Refresh an MCP OAuth token using the standard refresh_token grant.
- * Returns updated credentials; preserves the old refresh token if the server doesn't rotate it.
- */
-export async function refreshMCPOAuthToken(
-	tokenUrl: string,
-	refreshToken: string,
-	clientId?: string,
-	clientSecret?: string,
-): Promise<OAuthCredentials> {
-	const params = new URLSearchParams({
-		grant_type: "refresh_token",
-		refresh_token: refreshToken,
-	});
-	if (clientId) params.set("client_id", clientId);
-	if (clientSecret) params.set("client_secret", clientSecret);
-
-	let response: Response;
-	try {
-		response = await fetch(tokenUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: params.toString(),
-		});
-	} catch (error) {
-		throw new MCPExpectedFailure(error);
-	}
-
-	if (!response.ok) {
-		let text: string;
-		try {
-			text = await response.text();
-		} catch (error) {
-			throw new MCPExpectedFailure(error);
-		}
-		throw new MCPExpectedFailure(new Error(`MCP OAuth refresh failed: ${response.status} ${text}`));
-	}
-
-	let data: unknown;
-	try {
-		data = await response.json();
-	} catch {
-		throw new MCPExpectedFailure();
-	}
-	if (!isRefreshTokenResponse(data)) throw new MCPExpectedFailure();
-	const expiresIn = data.expires_in ?? 3600;
-	return {
-		access: data.access_token,
-		refresh: data.refresh_token ?? refreshToken,
-		expires: Date.now() + expiresIn * 1000,
-	};
-}

package/src/runtime-mcp/plugin-network-boundary.ts

@@ -0,0 +1,101 @@
+import { type AddressResolver, guardedPublicFetch } from "../web/insane/url-guard";
+import { cancelMCPStream } from "./content-limits";
+import type { MCPHttpServerConfig, MCPSseServerConfig } from "./types";
+
+const PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY: unique symbol = Symbol("plugin-mcp-public-network-boundary");
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 20;
+const REQUEST_BODY_HEADERS = [
+	"content-encoding",
+	"content-language",
+	"content-length",
+	"content-location",
+	"content-type",
+] as const;
+
+/** Mark an in-memory plugin-bundle remote MCP config for connection-bound public-network enforcement. */
+export function bindPluginMcpToPublicNetwork<T extends MCPHttpServerConfig | MCPSseServerConfig>(config: T): T {
+	return Object.assign(config, { [PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY]: true });
+}
+
+/** The marker is an internal symbol, so persisted user MCP configs cannot opt into or forge this path. */
+export function isPluginMcpPublicNetworkBound(config: MCPHttpServerConfig | MCPSseServerConfig): boolean {
+	return (
+		(config as MCPHttpServerConfig & { [PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY]?: boolean })[
+			PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY
+		] === true
+	);
+}
+
+function blocked(reason: string): Error {
+	return new Error(`Plugin MCP network request blocked: ${reason}`);
+}
+
+function parseHttpsUrl(rawUrl: string): URL {
+	let url: URL;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw blocked("invalid URL");
+	}
+	if (url.protocol !== "https:") throw blocked("HTTPS is required");
+	return url;
+}
+
+function rewritesToGet(status: number, method: string): boolean {
+	return (
+		((status === 301 || status === 302) && method === "POST") ||
+		(status === 303 && method !== "GET" && method !== "HEAD")
+	);
+}
+
+/**
+ * Fetch a plugin-bundle MCP request through a DNS-pinned public address. Every
+ * redirect is handled manually and revalidated before the next connection.
+ */
+export async function fetchPluginMcpRequest(
+	rawUrl: string,
+	init: BunFetchRequestInit,
+	options: { resolver?: AddressResolver; maxRedirects?: number } = {},
+): Promise<Response> {
+	let currentUrl = parseHttpsUrl(rawUrl);
+	let currentInit: BunFetchRequestInit = { ...init };
+	const maxRedirects = options.maxRedirects ?? MAX_REDIRECTS;
+
+	for (let redirectCount = 0; ; redirectCount++) {
+		const dial = await guardedPublicFetch(currentUrl.toString(), currentInit, { resolver: options.resolver });
+		if (!dial.ok) throw blocked(dial.reason);
+		const { response, logicalUrl } = dial;
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+		const location = response.headers.get("location");
+		if (!location) return response;
+		if (redirectCount >= maxRedirects) {
+			cancelMCPStream(response.body);
+			throw blocked("redirect limit exceeded");
+		}
+
+		let nextUrl: URL;
+		try {
+			nextUrl = parseHttpsUrl(new URL(location, logicalUrl).toString());
+		} catch (error) {
+			cancelMCPStream(response.body);
+			throw error;
+		}
+		if (logicalUrl.origin !== nextUrl.origin) {
+			cancelMCPStream(response.body);
+			throw blocked("cross-origin redirects are not allowed");
+		}
+
+		const headers = new Headers(currentInit.headers);
+		const method = (currentInit.method ?? "GET").toUpperCase();
+		if (rewritesToGet(response.status, method)) {
+			for (const name of REQUEST_BODY_HEADERS) headers.delete(name);
+			currentInit = { ...currentInit, method: "GET", headers, body: undefined };
+		} else {
+			currentInit = { ...currentInit, headers };
+		}
+		currentUrl = nextUrl;
+		cancelMCPStream(response.body);
+	}
+}

package/src/runtime-mcp/redaction.ts

@@ -0,0 +1,30 @@
+const REDACTED = "<redacted>";
+const SENSITIVE_KEY_PATTERN = /(?:token|secret|key|credential|password|authorization|auth|bearer|cookie|session)/i;
+
+export function redactMCPEndpoint(value: string | undefined): string | undefined {
+	if (!value) return value;
+	try {
+		const url = new URL(value);
+		if (url.username) url.username = REDACTED;
+		if (url.password) url.password = REDACTED;
+		if (url.pathname !== "/") url.pathname = `/${REDACTED}`;
+		for (const key of Array.from(url.searchParams.keys())) {
+			url.searchParams.set(key, REDACTED);
+		}
+		url.hash = "";
+		return url.toString();
+	} catch {
+		return REDACTED;
+	}
+}
+
+export function redactMCPDiagnosticValue(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(redactMCPDiagnosticValue);
+	if (!value || typeof value !== "object") return value;
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entry]) => [
+			key,
+			SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : redactMCPDiagnosticValue(entry),
+		]),
+	);
+}

package/src/runtime-mcp/smithery-auth.ts

@@ -2,9 +2,18 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isEnoent, logger } from "@sayknow-cli/utils";
 import { getAgentDir } from "@sayknow-cli/utils/dirs";
+import { $credentialEnv } from "@sayknow-cli/utils/env";
 
 const SMITHERY_AUTH_FILENAME = "smithery.json";
-const SMITHERY_URL = process.env.SMITHERY_URL || "https://smithery.ai";
+/**
+ * Smithery web origin, from trusted environment sources only.
+ *
+ * This origin serves the CLI auth session and the verification URL the user is
+ * sent to, so whatever can set it can drive the login flow. `$env` merges the
+ * caller's `cwd/.env` into `process.env`, so reading it there would let
+ * repository content redirect that flow.
+ */
+const SMITHERY_URL = $credentialEnv("SMITHERY_URL") || "https://smithery.ai";
 
 type SmitheryCliAuthSession = {
 	sessionId: string;
@@ -31,6 +40,11 @@ function normalizeApiKey(value: string | undefined): string | undefined {
 	return trimmed.length > 0 ? trimmed : undefined;
 }
 
+/** Test seam: the Smithery origin and env API key as resolved from trusted env. */
+export function resolveSmitheryEnvForTest(): { url: string; apiKey: string | undefined } {
+	return { url: SMITHERY_URL, apiKey: normalizeApiKey($credentialEnv("SMITHERY_API_KEY")) };
+}
+
 export function getSmitheryLoginUrl(): string {
 	return SMITHERY_URL;
 }
@@ -62,7 +76,8 @@ export async function pollSmitheryCliAuthSession(
 }
 
 export async function getSmitheryApiKey(): Promise<string | undefined> {
-	const envKey = normalizeApiKey(process.env.SMITHERY_API_KEY);
+	// Trusted sources only: this key authenticates every Smithery API call.
+	const envKey = normalizeApiKey($credentialEnv("SMITHERY_API_KEY"));
 	if (envKey) return envKey;
 
 	const authPath = getSmitheryAuthPath();

package/src/runtime-mcp/smithery-connect.ts

@@ -1,4 +1,14 @@
-const SMITHERY_API_BASE_URL = (process.env.SMITHERY_API_URL || "https://api.smithery.ai").replace(/\/+$/, "");
+import { $credentialEnv } from "@sayknow-cli/utils/env";
+
+/**
+ * Smithery API base, from trusted environment sources only.
+ *
+ * Every request to this base carries `Authorization: Bearer <apiKey>` and the
+ * `/connect` routes return the connection records the agent consumes, so
+ * whatever can set it receives the key and supplies those records. `$env` merges
+ * the caller's `cwd/.env` into `process.env`.
+ */
+const SMITHERY_API_BASE_URL = ($credentialEnv("SMITHERY_API_URL") || "https://api.smithery.ai").replace(/\/+$/, "");
 
 export class SmitheryConnectError extends Error {
 	status: number;