@sigrun/ext-mcp 0.1.0 → 0.2.1

package/dist/extension.js

@@ -1,115 +1,106 @@
-/**
- * The MCP extension (sigrun-ext-mcp): registers every tool discovered on
- * the configured MCP servers as a pi-durable tool named
- * `<server>/<toolname>` (ruling 4).
- *
- * Contract (sigrun's src/harness/loader.ts): the package default-exports a
- * FACTORY TAKING NO ARGUMENTS, returning `{ extension }`. The loader calls
- * it synchronously at boot, before `Harness.open` reads the registry — so
- * the factory returns immediately and the async connect/discover work lands
- * through a LIVE tools array (the registry re-reads `extension.tools` on
- * every snapshot, so tools discovered after install appear in the harness
- * without a reinstall).
- *
- * Lifecycle (ruling 5): servers spawn eagerly at factory time (a server is
- * a long-lived stdio process; lazy-at-first-use buys nothing and complicates
- * discovery visibility). Each server is ISOLATED: a spawn or handshake or
- * discovery failure quarantines just that server (warned, contributing no
- * tools) and never affects the others. Children are killed on process exit
- * and on `wiring.close()`; there is no loader-side uninstall callback to
- * hook.
- *
- * Config (ruling 2): `mcp.json` resolved as `SIGRUN_MCP_CONFIG` env
- * override → `~/.config/sigrun/mcp.json`. Malformed config THROWS from the
- * factory (the loader's quarantine semantics take over); a missing config
- * is an empty registry (the extension installs with zero tools).
- */
-import { Type } from "@earendil-works/pi-ai";
-import { defineExtension, defineTool, } from "@earendil-works/pi-durable";
+/** Catalog wiring: shared operator services remain system children, while
+ * per-user entries connect and publish through the structural sigrun host. */
+import { defineDoc, defineExtension } from "@earendil-works/pi-durable";
 import { connectMcpServer } from "./client.js";
-import { loadMcpConfig, resolveToolExposure, serverEnabled, } from "./config.js";
+import { loadMcpConfig, MCP_CONFIG_ENV, resolveMcpConfigPath, serverEnabled, } from "./config.js";
+import { createUserOauthFlows, exchangeCode, extractCode, } from "./oauth.js";
+import { storeUserMcpToken } from "./tokens.js";
 import { MCP_SERVERS_SECTION_KEY, partitionForSection, renderMcpServersSection, } from "./section.js";
-/** The extension's pi-durable registry name. */
+import { catalogEnabledFromSettings, createUserCatalog, sharedServerAllowed, discoverMcpTools, } from "./user-servers.js";
 export const MCP_EXTENSION_NAME = "sigrun.mcp";
-/** Render one MCP content block as pi-ai tool-result content. */
-function toContent(block) {
-    if (block.type === "text" && typeof block.text === "string") {
-        return { type: "text", text: block.text };
-    }
-    return { type: "text", text: JSON.stringify(block) };
+/** Standalone tokens need no registry install; the kind/version must match
+ * core's session-meta document so its committed owner is readable here. */
+const SessionOwnerDoc = defineDoc({
+    kind: "sigrun.session-meta",
+    version: 1,
+    scope: "conversation",
+    history: "latest",
+    fork: "current",
+    initial: () => ({}),
+});
+function denied(message) {
+    return {
+        output: [{ type: "text", text: message }],
+        isError: true,
+    };
 }
-/** Build the pi-durable tool for one discovered MCP tool. */
-function mcpTool(serverName, tool, client, exposure, timeoutSeconds) {
-    // MCP advertises a plain JSON Schema for arguments. pi-durable validates
-    // with TypeBox's Compile, which accepts plain JSON Schema objects; pass it
-    // through as an unsafe schema (fallback: the empty object schema when the
-    // server omitted inputSchema).
-    const parameters = (tool.inputSchema !== undefined &&
-        typeof tool.inputSchema === "object" &&
-        tool.inputSchema !== null
-        ? tool.inputSchema
-        : { type: "object" });
-    const toolName = `${serverName}/${tool.name}`;
-    // The exposure mapping onto pi-durable 1.2.0 (spec slice 3):
-    //   codemode → callers: ["tools"] (scripts only, never model-offered);
-    //   deferred → deferred: true (invisible until tool_search loads it);
-    //   direct   → normal registration (model-offered when in the tool set);
-    //   hidden   → never registered (the caller checks and skips).
-    const exposureFlags = exposure === "codemode"
-        ? { callers: ["tools"] }
-        : exposure === "deferred"
-            ? { deferred: true }
-            : {};
-    return defineTool({
-        name: toolName,
-        description: tool.description !== undefined && tool.description !== ""
-            ? tool.description
-            : `MCP tool ${tool.name} on server ${serverName}.`,
-        parameters: Type.Unsafe(parameters),
-        // A tools/call round-trip is external I/O; never rerun on recovery.
-        replay: "unsafe",
-        ...exposureFlags,
-        async execute(args) {
-            const result = await client.callTool(tool.name, { ...args }, timeoutSeconds);
-            const blocks = result.content ?? [];
-            const content = blocks.length > 0 ? blocks.map(toContent) : [];
-            return {
-                output: content.length > 0 ? content : [
-                    { type: "text", text: JSON.stringify(result) },
-                ],
-                isError: result.isError === true,
-                details: result,
-            };
+/** The shared tool wrapper is the authority boundary: registry visibility is
+ * only convenience, and it cannot be bypassed by selecting an extension. */
+function sharedTool(host, name, server, tool) {
+    return {
+        ...tool,
+        execute: async (args, api, context) => {
+            try {
+                if (!(await sharedServerAllowed(host, api.conversationId, name, server))) {
+                    return denied(`MCP server "${name}" is not available for this user`);
+                }
+            }
+            catch (cause) {
+                return denied(`MCP server "${name}" access check failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+            }
+            return tool.execute(args, api, context);
         },
-    });
+    };
 }
-/**
- * The extension factory (the loader contract: no arguments; config resolves
- * from the package context — the `SIGRUN_MCP_CONFIG` override or the sigrun
- * config dir).
- */
-export function createMcpExtension() {
+function errorMessage(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+// The host parameter is REQUIRED: sigrun passes it only to factories whose
+// length is greater than zero. An optional/defaulted parameter has length 0
+// and would silently receive no host, disabling every per-user operation.
+export function createMcpExtension(host) {
+    // Pin the boot-selected path so policy reloads survive callers restoring
+    // their process environment immediately after the factory returns.
+    const configPath = resolveMcpConfigPath();
     const config = loadMcpConfig();
-    const tools = []; // live: discovered tools land here
+    const tools = [];
     const clients = new Map();
-    /** Live per-server exposure mix: which registered tools use codemode /
-     * deferred (the section renders from this snapshot). */
     const serverExposures = new Map();
+    const shared = Object.entries(config.servers).filter(([, server]) => server.credentials === "shared" && serverEnabled(server));
+    const catalog = createUserCatalog(host, config.servers, config.userServers ?? "none");
+    const oauthFlows = createUserOauthFlows();
     let closed = false;
-    // Per-server isolation: each server connects independently; any failure
-    // quarantines that server alone (warned, zero tools) and the others
-    // proceed. A disabled server is skipped before it ever spawns.
+    let liveUserServers = config.userServers ?? "none";
+    let policyRefresh = Promise.resolve();
+    let policyErrorReported = false;
+    const refreshPolicy = async () => {
+        // Lifecycle events are the production file-change signal: mcp.json is
+        // operator configuration, not part of core's settings document.
+        let next = liveUserServers;
+        try {
+            next = loadMcpConfig({
+                ...process.env,
+                [MCP_CONFIG_ENV]: configPath,
+            }).userServers ?? "none";
+            policyErrorReported = false;
+        }
+        catch (cause) {
+            // A transient operator edit must not suppress this event's user
+            // reconciliation or discard the last known-good policy.
+            if (!policyErrorReported) {
+                policyErrorReported = true;
+                console.warn(`mcp policy reload failed for ${configPath}; keeping ${liveUserServers}: ${errorMessage(cause)}`);
+            }
+            return;
+        }
+        if (next === liveUserServers)
+            return policyRefresh;
+        liveUserServers = next;
+        const chain = policyRefresh.then(() => catalog.reconcileAll(next), () => catalog.reconcileAll(next));
+        // Retain a settled recovery point: one failed reconcile must not
+        // poison every subsequent activation with the same stale rejection.
+        policyRefresh = chain.catch(() => undefined);
+        await chain;
+    };
     const pending = [];
-    for (const [name, server] of Object.entries(config.servers)) {
-        if (!serverEnabled(server))
-            continue;
+    for (const [name, server] of shared) {
         pending.push((async () => {
             let client;
             try {
                 client = await connectMcpServer(name, server);
             }
             catch (cause) {
-                console.warn(`mcp server "${name}" quarantined: ${cause instanceof Error ? cause.message : String(cause)}`);
+                console.warn(`mcp server "${name}" quarantined: ${errorMessage(cause)}`);
                 return;
             }
             if (closed) {
@@ -118,57 +109,182 @@ export function createMcpExtension() {
             }
             clients.set(name, client);
             try {
-                const discovered = await client.listTools();
-                const mix = { codemode: false, deferred: false, count: 0 };
-                for (const tool of discovered) {
-                    const exposure = resolveToolExposure(server, tool.name);
-                    if (exposure === "hidden")
-                        continue; // not registered
-                    if (exposure === "codemode")
-                        mix.codemode = true;
-                    if (exposure === "deferred")
-                        mix.deferred = true;
-                    mix.count += 1;
-                    tools.push(mcpTool(name, tool, client, exposure, server.timeout));
+                const discovered = await discoverMcpTools(name, server, client);
+                if (closed) {
+                    client.close();
+                    return;
                 }
-                if (mix.count > 0 && (mix.codemode || mix.deferred)) {
-                    serverExposures.set(name, {
-                        ...mix,
-                        description: `${mix.count} tool${mix.count === 1 ? "" : "s"} from ${server.command} ${server.args.join(" ")}`.trim(),
-                    });
+                tools.push(...discovered.tools.map((tool) => sharedTool(host, name, server, tool)));
+                if (discovered.exposure !== undefined) {
+                    serverExposures.set(name, discovered.exposure);
                 }
             }
             catch (cause) {
                 clients.delete(name);
                 client.close();
-                console.warn(`mcp server "${name}" quarantined during discovery: ${cause instanceof Error ? cause.message : String(cause)}`);
+                console.warn(`mcp server "${name}" quarantined during discovery: ${errorMessage(cause)}`);
             }
         })());
     }
-    const killAll = () => {
+    const activate = async (event) => {
+        await refreshPolicy();
+        if (event.owner !== undefined)
+            await catalog.activate(event.owner);
+    };
+    const errorResponse = (status, error) => Response.json({ error }, { status });
+    const serverFromRequest = (request) => {
+        const match = new URL(request.url).pathname.match(/\/v1\/ext\/sigrun-mcp\/oauth\/([^/]+)\/(?:start|complete)$/);
+        if (match === null)
+            return undefined;
+        try {
+            return decodeURIComponent(match[1]);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const oauthServer = (name) => {
+        if (name === undefined)
+            return undefined;
+        const server = config.servers[name];
+        if (server === undefined ||
+            server.credentials === "shared" ||
+            !serverEnabled(server) ||
+            !("oauth" in server) ||
+            server.oauth === undefined)
+            return undefined;
+        return { ...server, oauth: server.oauth };
+    };
+    const userFrom = (ctx) => ctx.principal?.user;
+    const routes = [
+        {
+            method: "POST",
+            path: "oauth/:server/start",
+            auth: "user",
+            handler: async (request, ctx) => {
+                const user = userFrom(ctx);
+                if (user === undefined)
+                    return errorResponse(400, "no_pending_flow");
+                const name = serverFromRequest(request);
+                const server = oauthServer(name);
+                if (name === undefined || server === undefined) {
+                    return errorResponse(404, "unknown_server");
+                }
+                // No listener: the browser is redirected back to the complete
+                // endpoint, whose URL the user can paste from the address bar.
+                const redirectUri = new URL(`/v1/ext/sigrun-mcp/oauth/${encodeURIComponent(name)}/complete`, request.url).toString();
+                const url = oauthFlows.start(user, name, server.oauth, redirectUri);
+                return Response.json({ url });
+            },
+        },
+        {
+            method: "POST",
+            path: "oauth/:server/complete",
+            auth: "user",
+            handler: async (request, ctx) => {
+                const user = userFrom(ctx);
+                if (user === undefined)
+                    return errorResponse(400, "no_pending_flow");
+                const name = serverFromRequest(request);
+                const server = oauthServer(name);
+                if (name === undefined || server === undefined) {
+                    return errorResponse(404, "unknown_server");
+                }
+                let redirectedUrl;
+                try {
+                    const body = await request.json();
+                    if (typeof body !== "object" || body === null || Array.isArray(body) ||
+                        !("redirectedUrl" in body) ||
+                        typeof body.redirectedUrl !== "string" || body.redirectedUrl === "")
+                        throw new Error("invalid body");
+                    redirectedUrl = body.redirectedUrl;
+                }
+                catch {
+                    return errorResponse(400, "invalid_body");
+                }
+                const flow = oauthFlows.take(user, name);
+                if (flow === undefined)
+                    return errorResponse(400, "no_pending_flow");
+                let code;
+                try {
+                    const extracted = extractCode(redirectedUrl);
+                    if (!("code" in extracted))
+                        throw new Error("authorization failed");
+                    code = extracted.code;
+                }
+                catch {
+                    oauthFlows.release(user, name, flow);
+                    return errorResponse(400, "invalid_redirect");
+                }
+                let token;
+                try {
+                    token = await exchangeCode(server.oauth, code, flow.redirectUri, flow.verifier);
+                }
+                catch {
+                    return errorResponse(502, "exchange_failed");
+                }
+                await storeUserMcpToken(ctx.host, user, name, token.access_token);
+                await catalog.retire(user, name);
+                await catalog.activate(user);
+                return new Response(null, { status: 204 });
+            },
+        },
+    ];
+    const close = async () => {
         if (closed)
             return;
         closed = true;
+        process.off("exit", closeSystemClients);
         for (const client of clients.values())
             client.close();
         clients.clear();
         tools.length = 0;
         serverExposures.clear();
+        await Promise.all(pending);
+        oauthFlows.clear();
+        catalog.close();
     };
-    // Children must not outlive this process. The exit handler must be
-    // synchronous (exit listeners cannot await), so it only SIGTERMs.
-    process.on("exit", killAll);
-    // NOTE: no factory-time boot log for codemode/deferred servers —
-    // exposure is only known AFTER discovery (per-tool resolution), so a
-    // warn here could only fire on config guesses; the per-request
-    // `mcp_servers` section (below) is the real, accurate warning channel.
-    // The `mcp_servers` section (rev 3's corrected warning channel): renders
-    // per request from the live agent. A codemode/deferred server appears ONLY
-    // when its discovery tool (codemode / tool_search) is model-offered in
-    // THIS request; unreachable servers collapse into one notice line.
-    const mcpServersSection = (input) => {
+    const closeSystemClients = () => {
+        for (const client of clients.values())
+            client.close();
+        clients.clear();
+        catalog.close();
+    };
+    process.on("exit", closeSystemClients);
+    const mcpServersSection = async (input, context) => {
+        let user;
+        let settings;
+        try {
+            // PromptInput.read uses only committed harness state. The host identity
+            // bridge is server-bound and may never resolve in harness-only boots.
+            user = (await input.read.snapshot(SessionOwnerDoc, input.conversationId, context))?.owner;
+            if (user !== undefined) {
+                settings = await host.stores.user(user).settings.get();
+            }
+        }
+        catch (cause) {
+            console.warn(`mcp section access read failed: ${errorMessage(cause)}`);
+            return undefined;
+        }
+        const reachable = new Map();
+        for (const [name, server] of shared) {
+            if (user !== undefined &&
+                settings !== undefined &&
+                (server.users === undefined || server.users.includes(user)) &&
+                catalogEnabledFromSettings(name, server, settings)) {
+                const exposure = serverExposures.get(name);
+                if (exposure !== undefined)
+                    reachable.set(name, exposure);
+            }
+        }
+        if (user !== undefined) {
+            await catalog.activate(user);
+            for (const [name, exposure] of catalog.exposures(user)) {
+                reachable.set(name, exposure);
+            }
+        }
         const reaches = new Map();
-        for (const [name, mix] of serverExposures) {
+        for (const [name, mix] of reachable) {
             reaches.set(name, mix.codemode && mix.deferred
                 ? "either"
                 : mix.codemode
@@ -178,7 +294,7 @@ export function createMcpExtension() {
         const offers = new Set(input.agent.tools.map((tool) => tool.name));
         const { listed, unreachable } = partitionForSection(reaches, offers);
         const entries = listed.map((name) => {
-            const mix = serverExposures.get(name);
+            const mix = reachable.get(name);
             return {
                 name,
                 description: mix.description,
@@ -193,17 +309,26 @@ export function createMcpExtension() {
     };
     const extension = defineExtension({
         name: MCP_EXTENSION_NAME,
-        tools, // live array: the registry re-reads it on every snapshot
-        sections: [
-            {
-                key: MCP_SERVERS_SECTION_KEY,
-                render: mcpServersSection,
-            },
-        ],
+        tools,
+        sections: [{ key: MCP_SERVERS_SECTION_KEY, render: mcpServersSection }],
     });
     return {
         extension,
-        close: killAll,
+        perUserTools: catalog.perUserTools,
+        routes,
+        userServices: catalog.userServices,
+        surfaces: { settings: catalog.settings },
+        conversationCreated: activate,
+        runSettled: activate,
+        onSettingsChanged: async (keys, user) => {
+            if (user !== undefined &&
+                (keys.includes("servers") || keys.some((key) => Object.hasOwn(config.servers, key)))) {
+                await catalog.activate(user);
+            }
+            // The host has no settings-read hook. A visit that changes nothing
+            // starts nothing; the committed write is the actionable trigger.
+        },
+        close,
         ready: Promise.all(pending).then(() => undefined),
     };
 }

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 /** sigrun-ext-mcp: register MCP server tools as pi-durable tools. */
 export { createMcpExtension, MCP_EXTENSION_NAME } from "./extension.js";
 export type { McpWiring } from "./extension.js";
+export type { SigrunHost, UserService, ServiceSpec } from "./user-servers.js";
 export { connectMcpServer, McpClient } from "./client.js";
 export { loadMcpConfig, MCP_CONFIG_ENV, parseMcpConfig, resolveMcpConfigPath, } from "./config.js";
 export type { McpConfig, McpOAuthConfig, McpServerConfig, } from "./config.js";
@@ -10,9 +11,7 @@ export { buildAuthorizeUrl, exchangeCode, extractCode, makePkcePair, startOauth,
 export type { OauthFlow, StartOauthOptions } from "./oauth.js";
 export { parseCliArgs, runCli } from "./cli.js";
 import { createMcpExtension } from "./extension.js";
-/**
- * The sigrun extension-package contract (src/harness/loader.ts): the default
- * export is a factory taking no arguments, returning `{ extension }`.
- */
+/** The required host parameter keeps this factory at arity one: sigrun's
+ * loader does not pass a host to optional/defaulted (length-zero) factories. */
 declare const _default: typeof createMcpExtension;
 export default _default;

package/dist/index.js

@@ -1,13 +1,11 @@
 /** sigrun-ext-mcp: register MCP server tools as pi-durable tools. */
 export { createMcpExtension, MCP_EXTENSION_NAME } from "./extension.js";
-export { connectMcpServer, McpClient } from "./client.js";
+export { connectMcpServer } from "./client.js";
 export { loadMcpConfig, MCP_CONFIG_ENV, parseMcpConfig, resolveMcpConfigPath, } from "./config.js";
 export { loadMcpTokens, MCP_ACCESS_TOKEN_ENV, parseMcpTokenStore, resolveMcpTokenPath, saveMcpTokens, spawnEnvWithToken, storeMcpToken, } from "./tokens.js";
 export { buildAuthorizeUrl, exchangeCode, extractCode, makePkcePair, startOauth, } from "./oauth.js";
 export { parseCliArgs, runCli } from "./cli.js";
 import { createMcpExtension } from "./extension.js";
-/**
- * The sigrun extension-package contract (src/harness/loader.ts): the default
- * export is a factory taking no arguments, returning `{ extension }`.
- */
+/** The required host parameter keeps this factory at arity one: sigrun's
+ * loader does not pass a host to optional/defaulted (length-zero) factories. */
 export default createMcpExtension;

package/dist/oauth.d.ts

@@ -44,6 +44,20 @@ export declare function makePkcePair(): {
 };
 /** Build the authorize URL (PKCE S256 + optional scopes + redirect_uri). */
 export declare function buildAuthorizeUrl(oauth: McpOAuthConfig, redirectUri: string, codeChallenge: string): string;
+interface PendingUserFlow {
+    readonly verifier: string;
+    readonly redirectUri: string;
+    readonly expiresAt: number;
+}
+export type UserOauthFlow = PendingUserFlow;
+/** In-memory PKCE state for extension routes; the caller owns token storage. */
+export declare function createUserOauthFlows(now?: () => number): {
+    start(user: string, server: string, oauth: McpOAuthConfig, redirectUri: string): string;
+    take(user: string, server: string): UserOauthFlow | undefined;
+    release(user: string, server: string, flow: UserOauthFlow): void;
+    pendingCount(): number;
+    clear(): void;
+};
 /** Oauth start options (defaults match the CLI: 5-minute timeout). */
 export interface StartOauthOptions {
     /** How long to wait for a code (listener or paste) before failing. */
@@ -58,3 +72,4 @@ export interface StartOauthOptions {
  * resolves with the STORED token (written to the token store).
  */
 export declare function startOauth(serverName: string, oauth: McpOAuthConfig, options?: StartOauthOptions): Promise<OauthFlow>;
+export {};

package/dist/oauth.js

@@ -128,6 +128,56 @@ export function buildAuthorizeUrl(oauth, redirectUri, codeChallenge) {
     }
     return url.toString();
 }
+const USER_FLOW_TTL_MS = 10 * 60_000;
+/** In-memory PKCE state for extension routes; the caller owns token storage. */
+export function createUserOauthFlows(now = Date.now) {
+    const pending = new Map();
+    const key = (user, server) => JSON.stringify([user, server]);
+    return {
+        start(user, server, oauth, redirectUri) {
+            const startedAt = now();
+            // Opportunistic sweeping avoids factory timers while bounding state
+            // to distinct user/server flows started within one TTL window.
+            for (const [flowKey, flow] of pending) {
+                if (flow.expiresAt <= startedAt)
+                    pending.delete(flowKey);
+            }
+            const { verifier, challenge } = makePkcePair();
+            pending.set(key(user, server), {
+                verifier,
+                redirectUri,
+                expiresAt: startedAt + USER_FLOW_TTL_MS,
+            });
+            return buildAuthorizeUrl(oauth, redirectUri, challenge);
+        },
+        take(user, server) {
+            const flowKey = key(user, server);
+            const flow = pending.get(flowKey);
+            if (flow === undefined)
+                return undefined;
+            // Claim before any asynchronous exchange so concurrent completions
+            // cannot reuse one authorization code or PKCE verifier.
+            pending.delete(flowKey);
+            if (flow.expiresAt <= now())
+                return undefined;
+            return flow;
+        },
+        release(user, server, flow) {
+            const flowKey = key(user, server);
+            // A newer start supersedes the old flow; an invalid paste must not
+            // restore stale state over its replacement.
+            if (!pending.has(flowKey) && flow.expiresAt > now()) {
+                pending.set(flowKey, flow);
+            }
+        },
+        pendingCount() {
+            return pending.size;
+        },
+        clear() {
+            pending.clear();
+        },
+    };
+}
 /**
  * Run the flow for one server (the CLI-equivalent `runOauth`): start the
  * loopback listener, build + return the authorize URL, and expose

package/dist/spawn-env.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The environment a stdio MCP server is spawned with (sigrun multi-user
+ * spec §8, the env-leak fix).
+ *
+ * Spawning with `{...process.env, ...}` handed every server sigrun's own
+ * environment: `SIGRUN_API_TOKEN`, `SIGRUN_PROXY_SECRET`, provider keys.
+ * A server now gets an allowlist copied from sigrun's environment, then
+ * its configured `env`, then its stored token (`spawnEnvWithToken`, which
+ * keeps its precedence: token over config).
+ *
+ * The allowlist mirrors core's agent-shell list (`src/harness/agent-env.ts`
+ * in sigrun). It is a copy, not an import, because an extension may only
+ * import core's types-only contract; the two lists change together.
+ */
+import type { McpStdioServerConfig } from "./config.js";
+/** Variables copied from sigrun's environment into every server. */
+export declare const SERVER_ENV_KEYS: readonly string[];
+/**
+ * The spawn env for one stdio server. `source` is sigrun's environment:
+ * it supplies the allowlisted values and locates the token store, and
+ * nothing else from it reaches the server.
+ */
+export declare function serverSpawnEnv(name: string, server: Pick<McpStdioServerConfig, "env" | "oauth">, source?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/spawn-env.js

@@ -0,0 +1,48 @@
+/**
+ * The environment a stdio MCP server is spawned with (sigrun multi-user
+ * spec §8, the env-leak fix).
+ *
+ * Spawning with `{...process.env, ...}` handed every server sigrun's own
+ * environment: `SIGRUN_API_TOKEN`, `SIGRUN_PROXY_SECRET`, provider keys.
+ * A server now gets an allowlist copied from sigrun's environment, then
+ * its configured `env`, then its stored token (`spawnEnvWithToken`, which
+ * keeps its precedence: token over config).
+ *
+ * The allowlist mirrors core's agent-shell list (`src/harness/agent-env.ts`
+ * in sigrun). It is a copy, not an import, because an extension may only
+ * import core's types-only contract; the two lists change together.
+ */
+import { spawnEnvWithToken } from "./tokens.js";
+/** Variables copied from sigrun's environment into every server. */
+export const SERVER_ENV_KEYS = [
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "LANG",
+    "TZ",
+    "TERM",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "NPM_CONFIG_CACHE",
+    "SSH_AUTH_SOCK",
+];
+/** Locale variables (`LC_ALL`, `LC_CTYPE`, …) pass through by prefix. */
+const SERVER_ENV_PREFIXES = ["LC_"];
+/**
+ * The spawn env for one stdio server. `source` is sigrun's environment:
+ * it supplies the allowlisted values and locates the token store, and
+ * nothing else from it reaches the server.
+ */
+export function serverSpawnEnv(name, server, source = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (SERVER_ENV_KEYS.includes(key) ||
+            SERVER_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+            env[key] = value;
+        }
+    }
+    return { ...env, ...spawnEnvWithToken(name, server, source) };
+}