@sigrun/ext-mcp 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -6,6 +6,85 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Security
+- **stdio MCP servers receive an allowlisted environment instead of sigrun's
+  process environment.** `SIGRUN_API_TOKEN` and provider keys were inherited
+  by every spawned stdio server; they now see only the variables their
+  declaration names plus a minimal base. Previously published `0.2.0` is
+  affected; `0.2.1` is the first release with the fix.
+
+### Changed
+- **Upgrade behavior:** catalog servers now default to `credentials: "user"`.
+  Existing installs that rely on one system-wide server must explicitly
+  select `credentials: "shared"` and provide `sharedAuthority`. Shared MCP
+  servers hand every permitted user's agent the admin's credential for that
+  service.
+
+### Fixed
+- Per-user tool publication is declared even with an empty or shared-only
+  catalog, so lifecycle activation and prompt rendering no longer fail when
+  there are no personal catalog servers. Because the declaration is
+  unconditional, core's boot sweep now writes `sigrun.mcp@<owner>` into every
+  owned conversation's selection on the first boot after upgrading, even with
+  no `mcp.json` or `userServers: "none"`. That is a one-time durable write:
+  the name resolves to nothing while no tools are published, so nothing
+  changes for the conversation, and later boots report zero.
+- Catalog enablement now mounts through `surfaces.settings` and uses core's
+  actual flat settings shape: each toggle and changed key is the bare server
+  name. Shared-authority help is punctuated and guarded against missing
+  programmatic input.
+- Prompt sections resolve the conversation owner through the harness's
+  committed-read surface instead of the server-bound identity bridge, so
+  harness-only boots cannot hang while preparing a request.
+
+### Added
+- User-supplied MCP servers in per-user settings, gated by `userServers:
+  "none" | "remote" | "all"` and validated with the operator config parser.
+  Tools publish as `u_<server>/<tool>`; live policy changes reconcile every
+  active user. The `all` mode also permits URL servers, but reports
+  user-supplied stdio as a named configuration error because the host's
+  static user-service contract cannot launch it safely.
+- Per-user OAuth start/complete extension routes with ten-minute in-memory
+  PKCE state scoped by user and server. Completion stores the raw access
+  token in the caller's scoped secrets; the CLI refuses per-user servers.
+- Token storage retires and reconnects the caller's catalog connection.
+  Core owns the process lifecycle: a still-live child retains its original
+  environment until idle-stop or exit because the host contract cannot force
+  a relaunch.
+- MCP catalog entries default to per-user credentials, with lazy per-user
+  stdio services, scoped token injection, remote connections, and tools
+  published only for their owner. Opt-in availability and per-user settings
+  control enablement; disabling removes tools and drains active calls.
+- Shared entries require `sharedAuthority`, retain system-tool behavior,
+  and enforce their optional user allowlist and enablement at call time.
+  Prompt sections list only servers available to the calling user.
+
+### Security
+- Stdio servers no longer inherit sigrun's environment. They are spawned
+  with an allowlist (`PATH`, `HOME`, `TMPDIR`, `LANG`, `LC_*`, `TZ`,
+  `TERM`, `USER`, `LOGNAME`, `SHELL`, `NPM_CONFIG_CACHE`,
+  `SSH_AUTH_SOCK`) plus their configured `env` and stored token.
+  Previously every server could read `SIGRUN_API_TOKEN`,
+  `SIGRUN_PROXY_SECRET` and provider keys. A server that relied on an
+  inherited variable must now list it in its `env`.
+
+## [0.2.0] - 2026-10-22
+### Added
+- Remote MCP servers: a `servers` entry may be `{url, headers?, exposure?,
+  toolExposure?, timeout?}` instead of a stdio `{command, args}`. Streamable
+  HTTP is the transport (POST per frame, JSON or SSE reply,
+  `mcp-session-id` captured and echoed); a legacy HTTP+SSE server is adopted
+  automatically — whether it 404/405s the POST or (crawl4ai's shape) answers
+  it with an `endpoint` event — so no supergateway-style adapter is needed.
+- `mcp.json` now resolves from the sigrun config dir
+  (`SIGRUN_CONFIG_DIR/mcp.json`) before the home fallback, matching every
+  other sigrun store.
+
+### Fixed
+- SSE parsing handles CRLF line endings (the spec allows them; live servers
+  emit them).
+- Streamable replies stop at the id-matching frame — servers legitimately
+  hold SSE streams open past the reply.
 
 ## [0.1.0] - 2026-10-13
 ### Added

package/README.md

@@ -2,8 +2,10 @@
 
 Register MCP server tools as pi-durable tools, named `<server>/<tool>`.
 
-Config: `~/.config/sigrun/mcp.json` (or the `SIGRUN_MCP_CONFIG` env override
-pointing at any path). Each entry under `"servers"` names a stdio MCP server:
+Config: the sigrun config dir's `mcp.json` (`SIGRUN_CONFIG_DIR/mcp.json`; a
+bare user install falls back to `~/.config/sigrun/mcp.json`; the
+`SIGRUN_MCP_CONFIG` env override points at any path). Each entry under
+`"servers"` names an MCP server — stdio or remote:
 
 ```json
 {
@@ -13,6 +15,11 @@ pointing at any path). Each entry under `"servers"` names a stdio MCP server:
 			"args": ["-y", "@modelcontextprotocol/server-github"],
 			"exposure": "codemode",
 			"timeout": 120
+		},
+		"search": {
+			"url": "https://mcp.example.test/mcp",
+			"headers": { "Authorization": "Bearer <token>" },
+			"exposure": "direct"
 		}
 	}
 }
@@ -20,8 +27,31 @@ pointing at any path). Each entry under `"servers"` names a stdio MCP server:
 
 ## Server fields
 
-- `command`, `args` (required) — how to spawn the server.
-- `env` — extra environment variables for the child process.
+- `command`, `args` (stdio) — how to spawn the server.
+- `url` (remote) — the server endpoint (http/https). Streamable HTTP is the
+  transport; a legacy HTTP+SSE server (2024-11-05 shape — GET stream +
+  `endpoint` event + message POSTs) is adopted automatically, so no adapter
+  process is needed.
+- `headers` (remote) — extra request headers (auth etc.), sent on every
+  request. For per-user servers, configured `Authorization` is removed;
+  only that user's scoped token supplies it.
+- `env` (stdio) — extra environment variables for the child process. For
+  per-user servers, configured `MCP_ACCESS_TOKEN` is removed; only that
+  user's scoped token supplies it.
+- `credentials` — `"user"` (default) or `"shared"`. User-credential servers
+  start per user in the host's service jail; remote user servers connect
+  with the user's scoped token. Existing installs needing one system-wide
+  server must explicitly select `"shared"`.
+- `sharedAuthority` — required, non-empty one-line reason when
+  `credentials` is `"shared"`. Shared MCP servers hand every permitted
+  user's agent the admin's credential for that service; the settings
+  section displays this reason and warning beside the server.
+- `users` — optional string allowlist for a shared server. Only those
+  users may call its tools; this field is invalid for user-credential
+  servers. Ownerless calls fail closed.
+- `availability` — `"all"` (default) or `"opt-in"`. The per-user settings
+  section stores each server's enablement as a flat boolean keyed by its
+  bare server name. `"all"` starts enabled; `"opt-in"` starts disabled.
 - `enabled` (default `true`) / `disabled` — skip the server entirely. Set one,
   never both: a server that is simultaneously on and off is a config error and
   fails loudly.
@@ -33,8 +63,47 @@ pointing at any path). Each entry under `"servers"` names a stdio MCP server:
 - `toolExposure` — per-tool overrides of `exposure`: an object mapping tool
   names (exact) or `*`-globs (e.g. `"get-*"`) to exposure words. An exact name
   always wins; among matching patterns the FIRST one in config order wins.
-- `oauth` — the authorization-code (PKCE) flow block; see `sigrun-ext-mcp oauth
-  <server>` (the CLI mints and stores a token; the spawn injects it).
+- `oauth` (stdio) — the authorization-code (PKCE) flow block. Shared servers
+  use `sigrun-ext-mcp oauth <server>` and the file token store. Per-user
+  servers use `POST /v1/ext/sigrun-mcp/oauth/<server>/start`, then
+  `POST /v1/ext/sigrun-mcp/oauth/<server>/complete` with
+  `{ "redirectedUrl": "<full redirected URL>" }`; the CLI refuses these
+  servers so their credentials cannot enter the shared store.
+
+Per-user PKCE state stays in memory for ten minutes and is scoped to the
+authenticated user and server. Completion stores only the raw access token in
+that user's `token:<server>` secret. It then retires and reconnects that
+user's catalog connection. Core owns the process lifecycle: releasing the last
+handle arms idle-stop, so a still-live child keeps its original environment
+until that timer fires or it crashes; the extension cannot force a relaunch
+through the host contract. An already idle-stopped server launches fresh on
+the next activation and reads the new token immediately.
+
+`userServers` is the separate admin policy for user-supplied servers:
+`"none"` (default), `"remote"`, or `"all"`. It is distinct from the admin
+catalog's `credentials` and `availability` fields above. Catalog names
+starting `u_` are reserved for those user-supplied servers and rejected.
+
+When enabled, the **Your MCP servers** settings section accepts a JSON object
+under the `servers` key. Entries use the same validation rules as `mcp.json`;
+a user server name may not start with `u_`. Its tools publish only to that
+user as `u_<server>/<tool>`. `"remote"` permits URL servers and ignores stdio;
+`"all"` permits URL servers too. A live policy change reconciles every active
+user, retiring disallowed connections and removing their tools without a
+restart. Lifecycle events re-read the policy from `mcp.json`, since this
+operator file is not part of core's settings document. The contributed
+settings sections are selected at extension load: changing `none` to an
+enabled policy needs a restart to add the editor, and changing to `none`
+needs a restart to remove it; connection gating itself takes effect at the
+next lifecycle event. A catalog server literally named `servers` is rejected
+because it would shadow this settings namespace.
+
+**Named limitation — `all` and user-supplied stdio:** sigrun declares per-user
+services statically at load and passes no server name to `UserService.start`.
+Consequently a dynamic, named user-supplied stdio service cannot be launched.
+Under `"all"`, such an entry is reported as a configuration error naming the
+server; its command is never spawned in sigrun's process, and no tools are
+published. `"all"` does **not** make user-supplied stdio functional.
 
 ## Exposure: how tools reach callers
 

package/dist/cli.js

@@ -17,7 +17,7 @@
  * flow / 5-minute timeout).
  */
 import { createInterface } from "node:readline";
-import { loadMcpConfig, MCP_CONFIG_ENV } from "./config.js";
+import { isStdioServer, loadMcpConfig, MCP_CONFIG_ENV, } from "./config.js";
 import { startOauth } from "./oauth.js";
 import { resolveMcpTokenPath } from "./tokens.js";
 /** The flow timeout (matches startOauth's default; explicit so the user's
@@ -71,7 +71,11 @@ export async function runCli(argv, io = { stdout: process.stdout, stderr: proces
         io.stderr.write(`error: no server named "${parsed.server}" in the MCP config\n`);
         return 1;
     }
-    if (server.oauth === undefined) {
+    if (server.credentials !== "shared") {
+        io.stderr.write(`error: server "${parsed.server}" uses per-user credentials; use POST /v1/ext/sigrun-mcp/oauth/${parsed.server}/start instead\n`);
+        return 1;
+    }
+    if (!isStdioServer(server) || server.oauth === undefined) {
         io.stderr.write(`error: server "${parsed.server}" has no oauth block in the MCP config\n`);
         return 1;
     }

package/dist/client.d.ts

@@ -1,12 +1,20 @@
 /**
- * Minimal hand-rolled MCP stdio client (ruling 3): JSON-RPC 2.0 over
- * newline-delimited stdio, no pi-mcp dependency.
+ * The MCP client: a transport-neutral JSON-RPC 2.0 engine plus two
+ * transports.
  *
- * Lifecycle: spawn → `initialize` handshake (protocolVersion "2025-06-18",
- * clientInfo, capabilities) → `notifications/initialized` → `tools/list`
- * (discovery) → `tools/call` (execution). Requests correlate by id; the
- * response frame's `id` must match a pending request (a notification is
- * never a reply). A spawn failure or handshake failure rejects `connect`,
+ * stdio (the original transport): newline-delimited JSON-RPC over a spawned
+ * child's pipes. Remote (streamable HTTP): every request POSTs to the
+ * configured URL; the reply is a JSON body OR an SSE stream. A server that
+ * 404/405s the POST (the pre-2025-03-26 "HTTP+SSE" transport — still common,
+ * e.g. many self-hosted servers) falls back to the legacy shape: a GET
+ * stream for server→client frames and a discovered message endpoint for
+ * client→server POSTs.
+ *
+ * Lifecycle (both transports): `initialize` handshake (protocolVersion
+ * "2025-06-18", clientInfo, capabilities) → `notifications/initialized` →
+ * `tools/list` (discovery) → `tools/call` (execution). Requests correlate
+ * by id; the response frame's `id` must match a pending request (a
+ * notification is never a reply). A connect failure rejects `connect`,
  * never affecting any other server (per-server isolation).
  *
  * Per-request timeout (codemode parity, spec slice 3): every request REJECTS
@@ -14,35 +22,31 @@
  * awaiting a hung server forever. A `notifications/progress` frame naming a
  * pending request's id (sent as the request's `progressToken`) RESETS that
  * request's deadline — a server that keeps reporting progress stays alive
- * as long as it works. A timeout rejects the call but never kills the child
- * (per-server isolation: the next request gets a fresh chance).
+ * as long as it works. A timeout rejects the call but never kills the
+ * transport (per-server isolation: the next request gets a fresh chance).
  */
-import { type ChildProcess } from "node:child_process";
 import type { McpServerConfig, McpToolDefinition, McpToolResult } from "./types.js";
-/** One connected MCP server: a live child process speaking JSON-RPC. */
-export declare class McpClient {
-    #private;
-    /** @internal constructed by {@link connectMcpServer}. */
-    constructor(name: string, child: ChildProcess);
-    /**
-     * The MCP handshake: `initialize` then `notifications/initialized`.
-     * The initialize reply is validated to carry the protocol version.
-     */
-    handshake(): Promise<void>;
-    /** Discover the server's tools (`tools/list`). */
+/** The public client surface (what the extension consumes). */
+export interface McpClient {
     listTools(): Promise<McpToolDefinition[]>;
-    /** Execute one tool (`tools/call`); an `isError` result resolves (it is a
-     * valid tool outcome, not a protocol failure). `timeoutSeconds` caps the
-     * wait per request (default 60; progress notifications reset it). */
     callTool(name: string, args: Record<string, unknown>, timeoutSeconds?: number): Promise<McpToolResult>;
-    /** Wait for the child to exit (used by tests / shutdown checks). */
-    exited(): Promise<Error | undefined>;
-    /** Kill the child and tear down (idempotent). */
+    /** Tear the connection down (idempotent). */
     close(): void;
 }
+/** The byte streams of a core-launched per-user service. */
+export interface McpServiceHandle {
+    readonly stdin: WritableStream<Uint8Array>;
+    readonly stdout: ReadableStream<Uint8Array>;
+    readonly exited: Promise<{
+        code: number | null;
+        signal: string | null;
+    }>;
+    release(): void;
+}
 /**
- * Spawn and connect one configured MCP server. Throws on spawn failure or a
- * failed handshake — per-server isolation is the CALLER's policy (the
- * extension connects all servers with `.catch` per server).
+ * Spawn/connect one configured MCP server (stdio or remote by config
+ * shape). Throws on spawn/connect failure or a failed handshake —
+ * per-server isolation is the CALLER's policy (the extension connects all
+ * servers with `.catch` per server).
  */
-export declare function connectMcpServer(name: string, config: McpServerConfig): Promise<McpClient>;
+export declare function connectMcpServer(name: string, config: McpServerConfig, handle?: McpServiceHandle): Promise<McpClient>;