@shawnstack/quickforge 1.3.1 → 1.3.2

package/server/mcp/config.mjs

@@ -0,0 +1,217 @@
+import path from 'node:path'
+import { atomicUpdate, readStore } from '../storage.mjs'
+
+const MCP_CONFIG_KEY = 'mcpServers'
+const VALID_NAME_RE = /^(?!.*--)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/
+const MAX_SERVERS = 50
+const MAX_ARGS = 100
+const MAX_ENV_KEYS = 100
+
+function isPlainObject(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+function normalizeName(value) {
+  const name = String(value || '').trim().toLowerCase()
+  if (!VALID_NAME_RE.test(name) || name.length > 64) {
+    const error = new Error('MCP server name must be lowercase letters, numbers, and hyphens only.')
+    error.statusCode = 400
+    throw error
+  }
+  return name
+}
+
+function normalizeString(value, field, { required = false, max = 4096 } = {}) {
+  const text = typeof value === 'string' ? value.trim() : ''
+  if (required && !text) {
+    const error = new Error(`${field} is required`)
+    error.statusCode = 400
+    throw error
+  }
+  if (text.length > max) {
+    const error = new Error(`${field} is too long`)
+    error.statusCode = 400
+    throw error
+  }
+  return text
+}
+
+function normalizeStringArray(value, field) {
+  if (value === undefined || value === null || value === '') return []
+  if (!Array.isArray(value)) {
+    const error = new Error(`${field} must be an array`)
+    error.statusCode = 400
+    throw error
+  }
+  if (value.length > MAX_ARGS) {
+    const error = new Error(`${field} has too many entries`)
+    error.statusCode = 400
+    throw error
+  }
+  return value.map((item, index) => normalizeString(item, `${field}[${index}]`, { max: 2048 }))
+}
+
+function normalizeEnv(value) {
+  if (value === undefined || value === null || value === '') return {}
+  if (!isPlainObject(value)) {
+    const error = new Error('env must be an object')
+    error.statusCode = 400
+    throw error
+  }
+  const entries = Object.entries(value)
+  if (entries.length > MAX_ENV_KEYS) {
+    const error = new Error('env has too many entries')
+    error.statusCode = 400
+    throw error
+  }
+  const result = {}
+  for (const [key, item] of entries) {
+    const envKey = normalizeString(key, 'env key', { required: true, max: 128 })
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envKey)) {
+      const error = new Error(`Invalid environment variable name: ${envKey}`)
+      error.statusCode = 400
+      throw error
+    }
+    result[envKey] = normalizeString(item, `env.${envKey}`, { max: 4096 })
+  }
+  return result
+}
+
+function normalizeHeaders(value) {
+  if (value === undefined || value === null || value === '') return {}
+  if (!isPlainObject(value)) {
+    const error = new Error('headers must be an object')
+    error.statusCode = 400
+    throw error
+  }
+  const entries = Object.entries(value)
+  if (entries.length > MAX_ENV_KEYS) {
+    const error = new Error('headers has too many entries')
+    error.statusCode = 400
+    throw error
+  }
+  const result = {}
+  for (const [key, item] of entries) {
+    const headerKey = normalizeString(key, 'header key', { required: true, max: 128 })
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(headerKey)) {
+      const error = new Error(`Invalid HTTP header name: ${headerKey}`)
+      error.statusCode = 400
+      throw error
+    }
+    result[headerKey] = normalizeString(item, `headers.${headerKey}`, { max: 4096 })
+  }
+  return result
+}
+
+function normalizeCwd(value) {
+  const cwd = normalizeString(value, 'cwd', { max: 4096 })
+  return cwd ? path.resolve(cwd) : ''
+}
+
+export function normalizeMcpServerConfig(value, fallbackName = '') {
+  if (!isPlainObject(value)) {
+    const error = new Error('MCP server config must be an object')
+    error.statusCode = 400
+    throw error
+  }
+  const name = normalizeName(value.name || fallbackName)
+  const transport = normalizeString(value.transport || value.type || 'stdio', 'transport', { required: true, max: 32 })
+  if (!['stdio', 'sse', 'http'].includes(transport)) {
+    const error = new Error('MCP transport must be stdio, sse, or http')
+    error.statusCode = 400
+    throw error
+  }
+  const url = normalizeString(value.url, 'url', { required: transport !== 'stdio', max: 4096 })
+  if (url) {
+    try {
+      const parsed = new URL(url)
+      if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('invalid protocol')
+    } catch {
+      const error = new Error('url must be a valid HTTP(S) URL')
+      error.statusCode = 400
+      throw error
+    }
+  }
+  return {
+    name,
+    enabled: value.enabled !== false,
+    transport,
+    url,
+    command: transport === 'stdio' ? normalizeString(value.command, 'command', { required: true, max: 1024 }) : '',
+    args: transport === 'stdio' ? normalizeStringArray(value.args, 'args') : [],
+    cwd: transport === 'stdio' ? normalizeCwd(value.cwd) : '',
+    env: transport === 'stdio' ? normalizeEnv(value.env) : normalizeHeaders(value.headers || value.env),
+    updatedAt: typeof value.updatedAt === 'string' ? value.updatedAt : new Date().toISOString(),
+  }
+}
+
+export function normalizeMcpServers(value) {
+  const rawServers = Array.isArray(value)
+    ? value
+    : isPlainObject(value)
+      ? Object.entries(value).map(([name, config]) => ({ ...config, name: config?.name || name }))
+      : []
+  const result = []
+  const seen = new Set()
+  for (const item of rawServers.slice(0, MAX_SERVERS)) {
+    const server = normalizeMcpServerConfig(item)
+    if (seen.has(server.name)) continue
+    seen.add(server.name)
+    result.push(server)
+  }
+  return result
+}
+
+export async function readMcpServers() {
+  const settings = await readStore('settings')
+  return normalizeMcpServers(settings?.[MCP_CONFIG_KEY])
+}
+
+export async function writeMcpServers(servers) {
+  const normalized = normalizeMcpServers(servers)
+  return atomicUpdate('settings', (settings) => {
+    settings[MCP_CONFIG_KEY] = normalized.map((server) => ({ ...server, updatedAt: new Date().toISOString() }))
+    return settings
+  }).then((settings) => normalizeMcpServers(settings?.[MCP_CONFIG_KEY]))
+}
+
+export async function upsertMcpServer(server) {
+  const normalized = normalizeMcpServerConfig(server)
+  return atomicUpdate('settings', (settings) => {
+    const servers = normalizeMcpServers(settings?.[MCP_CONFIG_KEY])
+    const index = servers.findIndex((item) => item.name === normalized.name)
+    const next = { ...normalized, updatedAt: new Date().toISOString() }
+    if (index >= 0) servers[index] = next
+    else servers.push(next)
+    settings[MCP_CONFIG_KEY] = servers
+    return settings
+  }).then((settings) => normalizeMcpServers(settings?.[MCP_CONFIG_KEY]))
+}
+
+export async function deleteMcpServer(name) {
+  const normalizedName = normalizeName(name)
+  return atomicUpdate('settings', (settings) => {
+    settings[MCP_CONFIG_KEY] = normalizeMcpServers(settings?.[MCP_CONFIG_KEY]).filter((server) => server.name !== normalizedName)
+    return settings
+  }).then((settings) => normalizeMcpServers(settings?.[MCP_CONFIG_KEY]))
+}
+
+export async function setMcpServerEnabled(name, enabled) {
+  const normalizedName = normalizeName(name)
+  return atomicUpdate('settings', (settings) => {
+    const servers = normalizeMcpServers(settings?.[MCP_CONFIG_KEY])
+    const index = servers.findIndex((server) => server.name === normalizedName)
+    if (index < 0) {
+      const error = new Error(`MCP server not found: ${normalizedName}`)
+      error.statusCode = 404
+      throw error
+    }
+    servers[index] = {
+      ...servers[index],
+      enabled: Boolean(enabled),
+      updatedAt: new Date().toISOString(),
+    }
+    settings[MCP_CONFIG_KEY] = servers
+    return settings
+  }).then((settings) => normalizeMcpServers(settings?.[MCP_CONFIG_KEY]))
+}

package/server/mcp/registry.mjs

@@ -0,0 +1,310 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
+import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { readMcpServers } from './config.mjs'
+import { logger } from '../utils/logger.mjs'
+
+const TOOL_PREFIX = 'mcp__'
+const CONNECT_TIMEOUT_MS = 15_000
+const CALL_TIMEOUT_MS = 120_000
+const MAX_TEXT_LENGTH = 60_000
+
+const connections = new Map()
+let refreshPromise = null
+
+function isPlainObject(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+function sanitizeToolName(value) {
+  return String(value || '')
+    .trim()
+    .replace(/[^A-Za-z0-9_-]/g, '_')
+    .replace(/^_+|_+$/g, '') || 'tool'
+}
+
+function quickForgeToolName(serverName, toolName) {
+  return `${TOOL_PREFIX}${serverName}__${sanitizeToolName(toolName)}`
+}
+
+function parseQuickForgeToolName(value) {
+  const name = String(value || '')
+  if (!name.startsWith(TOOL_PREFIX)) return null
+  const rest = name.slice(TOOL_PREFIX.length)
+  const index = rest.indexOf('__')
+  if (index <= 0 || index >= rest.length - 2) return null
+  return {
+    serverName: rest.slice(0, index),
+    toolName: rest.slice(index + 2),
+  }
+}
+
+function withTimeout(promise, timeoutMs, message) {
+  let timer
+  return Promise.race([
+    promise.finally(() => clearTimeout(timer)),
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(message)), timeoutMs)
+    }),
+  ])
+}
+
+function truncateText(value, max = MAX_TEXT_LENGTH) {
+  const text = String(value ?? '')
+  return text.length > max ? `${text.slice(0, max)}\n\n[truncated ${text.length - max} characters]` : text
+}
+
+function resolveEnv(env = {}) {
+  const result = { ...process.env }
+  for (const [key, value] of Object.entries(env || {})) {
+    const text = String(value ?? '')
+    const match = text.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/)
+    result[key] = match ? (process.env[match[1]] || '') : text
+  }
+  return result
+}
+
+function resolveHeaders(env = {}) {
+  const headers = {}
+  for (const [key, value] of Object.entries(env || {})) {
+    const text = String(value ?? '')
+    const match = text.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/)
+    const resolved = match ? (process.env[match[1]] || '') : text
+    if (resolved) headers[key] = resolved
+  }
+  return headers
+}
+
+function createTransport(config) {
+  if (config.transport === 'stdio') {
+    return new StdioClientTransport({
+      command: config.command,
+      args: config.args,
+      cwd: config.cwd || undefined,
+      env: resolveEnv(config.env),
+      stderr: 'pipe',
+    })
+  }
+
+  const requestInit = { headers: resolveHeaders(config.env) }
+  if (config.transport === 'sse') return new SSEClientTransport(new URL(config.url), { requestInit })
+  if (config.transport === 'http') return new StreamableHTTPClientTransport(new URL(config.url), { requestInit })
+
+  throw new Error(`Unsupported MCP transport: ${config.transport}`)
+}
+
+function resultContentToText(result) {
+  if (Array.isArray(result?.content)) {
+    return result.content.map((item) => {
+      if (item?.type === 'text') return item.text || ''
+      if (item?.type === 'image') return `[image: ${item.mimeType || 'unknown mime'}]`
+      if (item?.type === 'audio') return `[audio: ${item.mimeType || 'unknown mime'}]`
+      if (item?.type === 'resource') {
+        const resource = item.resource || {}
+        if (typeof resource.text === 'string') return `[resource: ${resource.uri || 'unknown'}]\n${resource.text}`
+        return `[resource: ${resource.uri || 'unknown'}]`
+      }
+      if (item?.type === 'resource_link') return `[resource link: ${item.uri || item.name || 'unknown'}]`
+      return JSON.stringify(item)
+    }).join('\n')
+  }
+  if (Object.prototype.hasOwnProperty.call(result || {}, 'toolResult')) return JSON.stringify(result.toolResult, null, 2)
+  if (result?.structuredContent) return JSON.stringify(result.structuredContent, null, 2)
+  return JSON.stringify(result, null, 2)
+}
+
+async function connectServer(config) {
+  const client = new Client({ name: 'quickforge', version: '1.0.0' }, { capabilities: {} })
+  const transport = createTransport(config)
+
+  const connection = {
+    config,
+    client,
+    transport,
+    status: 'connecting',
+    error: null,
+    tools: [],
+    connectedAt: null,
+    stderr: '',
+  }
+
+  transport.stderr?.on?.('data', (chunk) => {
+    connection.stderr = truncateText(connection.stderr + chunk.toString(), 4000)
+  })
+  transport.onclose = () => {
+    connection.status = 'disconnected'
+  }
+  transport.onerror = (error) => {
+    connection.status = 'error'
+    connection.error = error?.message || 'MCP transport error'
+  }
+
+  await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, `MCP server ${config.name} connection timed out`)
+  const listed = await withTimeout(client.listTools(), CONNECT_TIMEOUT_MS, `MCP server ${config.name} tool discovery timed out`)
+  connection.tools = Array.isArray(listed?.tools) ? listed.tools : []
+  connection.status = 'connected'
+  connection.connectedAt = new Date().toISOString()
+  return connection
+}
+
+async function closeConnection(connection) {
+  try {
+    await connection?.transport?.close?.()
+  } catch {
+    // ignore close errors
+  }
+}
+
+function isSameConfig(left, right) {
+  return JSON.stringify({
+    enabled: left?.enabled,
+    transport: left?.transport,
+    url: left?.url || '',
+    command: left?.command,
+    args: left?.args || [],
+    cwd: left?.cwd || '',
+    env: left?.env || {},
+  }) === JSON.stringify({
+    enabled: right?.enabled,
+    transport: right?.transport,
+    url: right?.url || '',
+    command: right?.command,
+    args: right?.args || [],
+    cwd: right?.cwd || '',
+    env: right?.env || {},
+  })
+}
+
+async function refreshConnections() {
+  const servers = await readMcpServers()
+  const enabled = new Map(servers.filter((server) => server.enabled).map((server) => [server.name, server]))
+
+  for (const [name, connection] of connections) {
+    const nextConfig = enabled.get(name)
+    if (!nextConfig || !isSameConfig(connection.config, nextConfig)) {
+      connections.delete(name)
+      await closeConnection(connection)
+    }
+  }
+
+  for (const config of enabled.values()) {
+    if (connections.has(config.name)) continue
+    try {
+      const connection = await connectServer(config)
+      connections.set(config.name, connection)
+    } catch (error) {
+      logger.error(`Failed to connect MCP server ${config.name}:`, error)
+      connections.set(config.name, {
+        config,
+        client: null,
+        transport: null,
+        status: 'error',
+        error: error?.message || 'Failed to connect MCP server',
+        tools: [],
+        connectedAt: null,
+        stderr: '',
+      })
+    }
+  }
+
+  return connections
+}
+
+export async function refreshMcpConnections() {
+  if (!refreshPromise) {
+    refreshPromise = refreshConnections().finally(() => {
+      refreshPromise = null
+    })
+  }
+  return refreshPromise
+}
+
+export async function getMcpStatus() {
+  await refreshMcpConnections()
+  const servers = await readMcpServers()
+  return servers.map((server) => {
+    const connection = connections.get(server.name)
+    return {
+      ...server,
+      command: server.transport === 'stdio' ? server.command : '',
+      args: server.transport === 'stdio' ? server.args : [],
+      cwd: server.transport === 'stdio' ? server.cwd : '',
+      status: server.enabled ? (connection?.status || 'disconnected') : 'disabled',
+      error: connection?.error || null,
+      connectedAt: connection?.connectedAt || null,
+      toolCount: connection?.tools?.length || 0,
+      tools: (connection?.tools || []).map((tool) => ({
+        name: tool.name,
+        quickForgeName: quickForgeToolName(server.name, tool.name),
+        description: tool.description || '',
+      })),
+      stderr: connection?.status === 'error' ? connection?.stderr || '' : '',
+    }
+  })
+}
+
+export async function createMcpToolDefinitions() {
+  await refreshMcpConnections()
+  const definitions = []
+  for (const [serverName, connection] of connections) {
+    if (connection.status !== 'connected') continue
+    for (const tool of connection.tools || []) {
+      definitions.push({
+        name: quickForgeToolName(serverName, tool.name),
+        label: tool.title || tool.name,
+        description: `[MCP:${serverName}] ${tool.description || tool.name}`,
+        parameters: isPlainObject(tool.inputSchema) ? tool.inputSchema : { type: 'object', properties: {} },
+        mcp: { serverName, toolName: tool.name },
+      })
+    }
+  }
+  return definitions
+}
+
+export function isMcpToolName(name) {
+  return Boolean(parseQuickForgeToolName(name))
+}
+
+export async function callMcpTool(toolName, params = {}) {
+  await refreshMcpConnections()
+  const parsed = parseQuickForgeToolName(toolName)
+  if (!parsed) {
+    const error = new Error(`Invalid MCP tool name: ${toolName}`)
+    error.statusCode = 400
+    throw error
+  }
+  const connection = connections.get(parsed.serverName)
+  if (!connection || connection.status !== 'connected' || !connection.client) {
+    const error = new Error(`MCP server is not connected: ${parsed.serverName}`)
+    error.statusCode = 503
+    throw error
+  }
+  const tool = (connection.tools || []).find((item) => sanitizeToolName(item.name) === parsed.toolName || item.name === parsed.toolName)
+  if (!tool) {
+    const error = new Error(`Unknown MCP tool: ${toolName}`)
+    error.statusCode = 404
+    throw error
+  }
+  const result = await withTimeout(
+    connection.client.callTool({ name: tool.name, arguments: params || {} }),
+    CALL_TIMEOUT_MS,
+    `MCP tool ${toolName} timed out`,
+  )
+  return {
+    isError: Boolean(result?.isError),
+    content: truncateText(resultContentToText(result)),
+    details: {
+      mcp: true,
+      server: parsed.serverName,
+      tool: tool.name,
+      structuredContent: result?.structuredContent,
+    },
+  }
+}
+
+export async function shutdownMcpConnections() {
+  const current = [...connections.values()]
+  connections.clear()
+  await Promise.all(current.map(closeConnection))
+}

package/server/routes/agent.mjs

@@ -14,6 +14,7 @@ import {
   restoreAgent,
   touchSession,
   listSessions,
+  refreshAllSessionTools,
   updateSessionYoloMode,
   updateSessionModel,
   updateSessionThinkingLevel,

package/server/routes/mcp.mjs

@@ -0,0 +1,71 @@
+import { sendJson, readJsonBody } from '../utils/response.mjs'
+import { refreshAllSessionTools } from '../agent-manager.mjs'
+import { deleteMcpServer, normalizeMcpServers, readMcpServers, setMcpServerEnabled, upsertMcpServer, writeMcpServers } from '../mcp/config.mjs'
+import { getMcpStatus, refreshMcpConnections } from '../mcp/registry.mjs'
+
+async function refreshMcpAndAgentTools() {
+  await refreshMcpConnections()
+  const refreshedSessions = await refreshAllSessionTools()
+  return { servers: await getMcpStatus(), refreshedSessions }
+}
+
+export async function handleMcpApi(req, res, url) {
+  const parts = url.pathname.split('/').filter(Boolean)
+
+  if (req.method === 'GET' && url.pathname === '/api/mcp/servers') {
+    sendJson(res, 200, { servers: await getMcpStatus() })
+    return
+  }
+
+  if (req.method === 'PUT' && url.pathname === '/api/mcp/servers') {
+    const body = await readJsonBody(req)
+    const server = await upsertMcpServer(body?.server || body)
+    const payload = await refreshMcpAndAgentTools()
+    sendJson(res, 200, { ...payload, saved: server })
+    return
+  }
+
+  if (req.method === 'PUT' && url.pathname === '/api/mcp/config') {
+    const body = await readJsonBody(req)
+    const incoming = Array.isArray(body?.servers) ? body.servers : body?.mcpServers
+    const mode = body?.mode === 'replace' ? 'replace' : 'merge'
+    const imported = normalizeMcpServers(incoming)
+
+    if (mode === 'replace') {
+      await writeMcpServers(imported)
+    } else {
+      for (const server of imported) await upsertMcpServer(server)
+    }
+
+    const payload = await refreshMcpAndAgentTools()
+    sendJson(res, 200, payload)
+    return
+  }
+
+  if (req.method === 'PUT' && parts[0] === 'api' && parts[1] === 'mcp' && parts[2] === 'servers' && parts[3] && parts[4] === 'enabled') {
+    const body = await readJsonBody(req)
+    await setMcpServerEnabled(decodeURIComponent(parts[3]), body?.enabled === true)
+    sendJson(res, 200, await refreshMcpAndAgentTools())
+    return
+  }
+
+  if (req.method === 'POST' && url.pathname === '/api/mcp/reconnect') {
+    sendJson(res, 200, await refreshMcpAndAgentTools())
+    return
+  }
+
+  if (req.method === 'DELETE' && parts[0] === 'api' && parts[1] === 'mcp' && parts[2] === 'servers' && parts[3]) {
+    await deleteMcpServer(decodeURIComponent(parts[3]))
+    sendJson(res, 200, await refreshMcpAndAgentTools())
+    return
+  }
+
+  if (req.method === 'GET' && url.pathname === '/api/mcp/config') {
+    sendJson(res, 200, { servers: await readMcpServers() })
+    return
+  }
+
+  const error = new Error('Not found')
+  error.statusCode = 404
+  throw error
+}