@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/src/shared/mcp-manager.ts

@@ -4,7 +4,13 @@
  * Wraps @langchain/mcp-adapters MultiServerMCPClient with:
  * - Conversion from ResolvedMcpServer[] to the SDK's Connection config
  * - Proper async cleanup via close()
- * - Tool filtering based on discovered capabilities
+ * - Input-schema sanitization of unicode-invalid regex patterns
+ *   (issue #420; semantics in shared/mcp-schema-sanitizer.ts) — a vendor
+ *   pattern that cannot compile under the /u flag must not leave its tool
+ *   permanently uncallable
+ * - Tool filtering by each server's effective enabled_tools allow-list
+ *   (issue #350; semantics in shared/mcp-enabled-tools.ts) — the model only
+ *   ever sees the tools the agent's manifest enables
  *
  * Transport policy (stdio is local-runner-only) is enforced upstream at
  * resolution time by shared/mcp-transport-guard.ts — servers reaching
@@ -16,10 +22,10 @@
  * (HOME, LOGNAME, PATH, SHELL, TERM, USER — getDefaultEnvironment in
  * @modelcontextprotocol/sdk, merged under whatever we pass). The
  * runner's own process env is never passed: it carries runner-internal
- * credentials (STIGMER_TOKEN, STIGMER_RUNNER_HITL_SECRET,
- * CURSOR_API_KEY, LLM provider keys) that no third-party MCP subprocess
- * may see. A declared-empty env and an undeclared env are deliberately
- * equivalent — both yield the SDK base environment.
+ * credentials (enumerated in runner-credential-keys.ts) that no
+ * third-party MCP subprocess may see. A declared-empty env and an
+ * undeclared env are deliberately equivalent — both yield the SDK base
+ * environment.
  *
  * The Cursor execution path does NOT use this manager — it passes MCP
  * configs directly to the Cursor SDK via toCursorMcpConfig(). This
@@ -32,6 +38,8 @@ import { MultiServerMCPClient } from "@langchain/mcp-adapters";
 import type { Connection } from "@langchain/mcp-adapters";
 import type { DynamicStructuredTool } from "@langchain/core/tools";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
+import { filterToolsByEnabledTools } from "./mcp-enabled-tools.js";
+import { sanitizeSchemaPatterns } from "./mcp-schema-sanitizer.js";
 
 /**
  * Convert harness-agnostic ResolvedMcpServer[] into the
@@ -95,11 +103,51 @@ export async function connectMcpServers(
   }
 
   const client = new MultiServerMCPClient(connectionConfig);
-  const serverToolMap = await client.initializeConnections();
+  const discoveredToolMap = await client.initializeConnections();
 
+  // Drop unicode-invalid regex patterns from every discovered tool's input
+  // schema BEFORE anything downstream holds a reference (issue #420):
+  // @langchain/core re-validates against tool.schema on every invocation,
+  // so one vendor pattern that cannot compile under the /u flag would
+  // otherwise make its tool permanently uncallable. Semantics and the
+  // loosen-never-tighten invariant live in shared/mcp-schema-sanitizer.ts.
+  for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+    for (const tool of discovered) {
+      const droppedPatterns = sanitizeSchemaPatterns(tool.schema);
+      if (droppedPatterns.length > 0) {
+        console.warn(
+          `[MCP] Server '${slug}' tool '${tool.name}': dropped ` +
+          `${droppedPatterns.length} regex pattern(s) that cannot compile ` +
+          `under the unicode flag — the tool stays callable, the server ` +
+          `still validates its own inputs (issue #420): ` +
+          droppedPatterns
+            .map((d) =>
+              `${d.location} ${JSON.stringify(d.pattern)}` +
+              (d.compilesWithoutUnicodeFlag ? "" : " (invalid without /u too)"),
+            )
+            .join(", "),
+        );
+      }
+    }
+  }
+
+  // Enforce each server's effective enabled_tools allow-list (issue #350)
+  // HERE, before anything downstream sees the tools: the parent tool list,
+  // the approval gate's toolServerMap, and the sub-agent McpAccess filter
+  // (whose subset-of-parent check is only real against a narrowed map) all
+  // derive from this result. Servers without a restriction (enabledTools
+  // absent — including synthesized attachments) pass through untouched.
+  const enabledBySlug = new Map(
+    servers.map((s) => [s.slug, s.enabledTools]),
+  );
+  const serverToolMap: Record<string, DynamicStructuredTool[]> = {};
   const tools: DynamicStructuredTool[] = [];
-  for (const serverTools of Object.values(serverToolMap)) {
-    tools.push(...serverTools);
+  for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+    const filtered = filterToolsByEnabledTools(
+      slug, discovered, enabledBySlug.get(slug),
+    );
+    serverToolMap[slug] = filtered;
+    tools.push(...filtered);
   }
 
   console.log(

package/src/shared/mcp-resolver.ts

@@ -11,7 +11,7 @@
  * there until the two are consolidated.
  */
 
-import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { McpServerUsage, ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { StigmerClient } from "../client/stigmer-client.js";
@@ -26,6 +26,7 @@ import {
   filterEnvToDeclaredKeys,
   PlaceholderResolutionError,
 } from "./placeholder-resolver.js";
+import { effectiveEnabledTools } from "./mcp-enabled-tools.js";
 
 /**
  * Harness-agnostic intermediate representation of a resolved MCP server.
@@ -45,6 +46,28 @@ export interface ResolvedMcpServer {
   toolApprovals: ToolApprovalPolicy[];
   pinnedToolApprovals: ToolApprovalPolicy[];
   discoveredCapabilitiesEmpty: boolean;
+  /**
+   * The EFFECTIVE tool allow-list for this server (issue #350): the usage's
+   * enabled_tools, falling back to the server's default_enabled_tools when
+   * the usage's list is empty (see shared/mcp-enabled-tools.ts). Absent when
+   * unrestricted — which keeps synthesized attachment servers (built without
+   * a usage) and the discovery path unfiltered by construction. Enforced at
+   * connect time by connectMcpServers (shared/mcp-manager.ts).
+   */
+  enabledTools?: string[];
+  /**
+   * Layer-3 per-agent approval overrides from the usage that resolved this
+   * server (issue #349): riding the resolved server is what SCOPES an
+   * override to its own server — a flat cross-server list is how an
+   * override once leaked onto (or silently un-gated) a same-named tool on
+   * another server. Deliberately REQUIRED, not optional: empty means "no
+   * overrides", and every construction site — including the near-duplicate
+   * Cursor resolver and the synthesized attachments, which have no usage
+   * and therefore no layer 3 — must say so explicitly, so a forgotten
+   * mirror cannot compile. Consumed by mergeApprovalPolicies
+   * (shared/approval-policy.ts).
+   */
+  toolApprovalOverrides: ToolApprovalOverride[];
 }
 
 export interface McpResolutionResult {
@@ -78,7 +101,13 @@ export async function resolveMcpServers(
         envVars,
         ref.slug,
       );
-      const server = mcpServerToResolved(mcpServer, ref.slug, serverEnv);
+      const server = mcpServerToResolved(
+        mcpServer,
+        ref.slug,
+        serverEnv,
+        usage.enabledTools,
+        usage.toolApprovalOverrides ?? [],
+      );
       if (server) {
         assertTransportAllowed(server.slug, server.connectionType, transportPosture);
         resolved.push(server);
@@ -108,6 +137,8 @@ export function mcpServerToResolved(
   server: McpServer,
   slug: string,
   envVars: Record<string, string>,
+  usageEnabledTools?: readonly string[],
+  usageToolApprovalOverrides: ToolApprovalOverride[] = [],
 ): ResolvedMcpServer | null {
   const spec = server.spec;
   if (!spec) return null;
@@ -123,6 +154,13 @@ export function mcpServerToResolved(
     toolApprovals,
     pinnedToolApprovals,
     discoveredCapabilitiesEmpty,
+    // Callers without a usage (the discovery activity) pass nothing, so the
+    // default_enabled_tools fallback still applies but a per-agent
+    // restriction cannot: discovery must see the server's full toolset.
+    enabledTools: effectiveEnabledTools(usageEnabledTools, spec.defaultEnabledTools),
+    // Same no-usage rule for layer 3: discovery has no agent context, so no
+    // per-agent overrides exist — defaulting to [] keeps that structural.
+    toolApprovalOverrides: usageToolApprovalOverrides,
   };
 
   switch (spec.serverType.case) {
@@ -170,4 +208,37 @@ export function extractMcpServerSlugs(usages: McpServerUsage[]): string[] {
     .filter((s): s is string => !!s);
 }
 
+/**
+ * Merge MCP server usages from agent (base) and session (overlay).
+ *
+ * Replicates session_context_merge.py::merge_mcp_server_usages():
+ * - Agent-level usages are the base set
+ * - Session-level usages extend or override by mcp_server_ref.slug
+ * - If both reference the same slug, session-level takes precedence —
+ *   the WHOLE usage, including enabled_tools and approval overrides
+ *
+ * Shared by both harnesses (blueprint-resolver.ts for Cursor,
+ * execute-deep-agent/setup.ts for the native harness) so a duplicate slug
+ * resolves identically everywhere: exactly one usage per server, whose
+ * enabled_tools is the one the enforcement filter honors.
+ */
+export function mergeMcpServerUsages(
+  agentUsages: McpServerUsage[],
+  sessionUsages: McpServerUsage[],
+): McpServerUsage[] {
+  const bySlug = new Map<string, McpServerUsage>();
+
+  for (const usage of agentUsages) {
+    const slug = usage.mcpServerRef?.slug;
+    if (slug) bySlug.set(slug, usage);
+  }
+
+  for (const usage of sessionUsages) {
+    const slug = usage.mcpServerRef?.slug;
+    if (slug) bySlug.set(slug, usage);
+  }
+
+  return [...bySlug.values()];
+}
+
 export { PlaceholderResolutionError } from "./placeholder-resolver.js";

package/src/shared/mcp-schema-sanitizer.ts

@@ -0,0 +1,224 @@
+/**
+ * Unicode-flag regex sanitization for MCP tool input schemas (issue #420).
+ *
+ * Why this exists: real-world MCP servers ship JSON-schema `pattern` values
+ * that are legal as plain ECMAScript regexes but invalid under the unicode
+ * flag (PayPal's `^https\:\/\/` — `\:` is an invalid escape under /u).
+ * @langchain/core validates tool input on EVERY call with
+ * @cfworker/json-schema, which compiles patterns via `new RegExp(p, "u")`
+ * at exactly two uncaught sites: the `pattern` keyword and each
+ * `patternProperties` key. One bad vendor pattern therefore makes the tool
+ * permanently uncallable on the deep-agent path — every invocation dies
+ * with a cryptic SyntaxError before the tool is ever reached. (The third
+ * /u compile site, `format: "regex"`, validates instance values inside a
+ * try/catch and fails gracefully — not a crash surface.)
+ *
+ * The fix: at the deep-agent connect funnel (mcp-manager.ts
+ * connectMcpServers), drop every pattern that cannot compile under /u.
+ * Dropping is deliberate — rewriting to a /u-safe equivalent would need an
+ * Annex-B-aware regex transpiler, disproportionate machinery for what is
+ * best-effort client-side validation; the MCP server still validates its
+ * own inputs server-side. This mirrors the loosening posture of
+ * @langchain/mcp-adapters' own schema pipeline (dereferenceJsonSchema →
+ * simplifyJsonSchemaForLLM), which already normalizes schemas for this
+ * exact validator.
+ *
+ * THE INVARIANT: sanitization may only ever LOOSEN validation, never
+ * tighten it. Dropping a `patternProperties` entry naively would violate
+ * this — @cfworker marks pattern-matched keys as "evaluated" and routes
+ * unevaluated keys into the `additionalProperties` / `unevaluatedProperties`
+ * checks, so under `additionalProperties: false` the drop would flip a
+ * crash into a false REJECTION of valid inputs. Whenever a
+ * `patternProperties` entry is dropped, any restrictive
+ * `additionalProperties` / `unevaluatedProperties` at that schema level is
+ * therefore relaxed too.
+ *
+ * Scope: this sanitizer serves the EXECUTION path only. Discovery
+ * (activities/discover-mcp-server.ts) persists tool schemas verbatim from
+ * listTools — deliberately: the stored schema is the vendor's truth for
+ * display, and discovery never invokes tools, so it cannot hit the crash.
+ * Do not "extend" sanitization there.
+ */
+
+/** One dropped regex constraint, for the caller's log line. */
+export interface DroppedPattern {
+  /** JSON-pointer-style path of the dropped constraint within the schema. */
+  location: string;
+  /** The pattern source that failed to compile under the unicode flag. */
+  pattern: string;
+  /**
+   * True when the pattern compiles WITHOUT the /u flag — vendor sloppiness
+   * (Annex B legacy syntax), the oss#420 class. False means the regex is
+   * broken outright; either way validation could only crash, so both drop.
+   */
+  compilesWithoutUnicodeFlag: boolean;
+}
+
+/** Keywords whose value is a single subschema. */
+const SINGLE_SCHEMA_KEYWORDS = [
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "items",
+  "additionalItems",
+  "unevaluatedItems",
+  "contains",
+  "not",
+  "if",
+  "then",
+  "else",
+] as const;
+
+/** Keywords whose value is an array of subschemas. */
+const SCHEMA_ARRAY_KEYWORDS = ["anyOf", "allOf", "oneOf", "prefixItems"] as const;
+
+/** Keywords whose value is an object mapping names to subschemas. */
+const SCHEMA_MAP_KEYWORDS = [
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+] as const;
+
+function compilesUnderUnicodeFlag(pattern: string): boolean {
+  try {
+    new RegExp(pattern, "u");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function compilesWithoutUnicodeFlag(pattern: string): boolean {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** JSON-pointer token escaping (RFC 6901): `~` → `~0`, `/` → `~1`. */
+function pointerToken(token: string): string {
+  return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+
+/**
+ * Drop unicode-invalid regex patterns from a JSON schema, in place.
+ *
+ * Walks only schema positions (the recursion set is @cfworker's own
+ * validated-keyword list), so a property literally NAMED "pattern" under
+ * `properties` is never touched. The walker handles composition keywords
+ * (anyOf/allOf/oneOf/not/if-then-else) even though the adapter's
+ * simplifyJsonSchemaForLLM currently strips them, and carries a visited-set
+ * cycle guard even though the adapter's $ref inlining currently guarantees
+ * an acyclic result — correctness here must not depend on another
+ * package's internals holding across dependency bumps.
+ *
+ * Returns the dropped constraints (empty for clean schemas — the common
+ * case, which this walk leaves byte-identical).
+ */
+export function sanitizeSchemaPatterns(schema: unknown): DroppedPattern[] {
+  const dropped: DroppedPattern[] = [];
+  if (!isPlainObject(schema)) return dropped;
+  walkSchema(schema, "", dropped, new Set());
+  return dropped;
+}
+
+function recordDrop(dropped: DroppedPattern[], location: string, pattern: string): void {
+  dropped.push({
+    location,
+    pattern,
+    compilesWithoutUnicodeFlag: compilesWithoutUnicodeFlag(pattern),
+  });
+}
+
+function walkSchema(
+  node: Record<string, unknown>,
+  path: string,
+  dropped: DroppedPattern[],
+  seen: Set<object>,
+): void {
+  if (seen.has(node)) return;
+  seen.add(node);
+
+  if (typeof node.pattern === "string" && !compilesUnderUnicodeFlag(node.pattern)) {
+    recordDrop(dropped, `${path}/pattern`, node.pattern);
+    delete node.pattern;
+  }
+
+  if (isPlainObject(node.patternProperties)) {
+    const patternProperties = node.patternProperties;
+    let droppedEntry = false;
+    for (const key of Object.keys(patternProperties)) {
+      if (compilesUnderUnicodeFlag(key)) continue;
+      recordDrop(dropped, `${path}/patternProperties/${pointerToken(key)}`, key);
+      delete patternProperties[key];
+      droppedEntry = true;
+    }
+    if (droppedEntry) {
+      // Never-tighten: keys the dropped pattern used to match would now
+      // fall through to these checks and could be falsely rejected.
+      if (node.additionalProperties !== undefined && node.additionalProperties !== true) {
+        delete node.additionalProperties;
+      }
+      if (node.unevaluatedProperties !== undefined && node.unevaluatedProperties !== true) {
+        delete node.unevaluatedProperties;
+      }
+      if (Object.keys(patternProperties).length === 0) {
+        delete node.patternProperties;
+      }
+    }
+  }
+
+  for (const keyword of SINGLE_SCHEMA_KEYWORDS) {
+    const value = node[keyword];
+    if (isPlainObject(value)) {
+      walkSchema(value, `${path}/${keyword}`, dropped, seen);
+    }
+  }
+
+  for (const keyword of SCHEMA_ARRAY_KEYWORDS) {
+    const value = node[keyword];
+    if (!Array.isArray(value)) continue;
+    value.forEach((entry, index) => {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/${keyword}/${index}`, dropped, seen);
+      }
+    });
+  }
+
+  for (const keyword of SCHEMA_MAP_KEYWORDS) {
+    const value = node[keyword];
+    if (!isPlainObject(value)) continue;
+    for (const [name, entry] of Object.entries(value)) {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/${keyword}/${pointerToken(name)}`, dropped, seen);
+      }
+    }
+  }
+
+  // Draft-07 `items` tuple form and `dependencies` schema form — both
+  // keywords are dual-shaped, so the typed loops above miss these arms.
+  if (Array.isArray(node.items)) {
+    node.items.forEach((entry, index) => {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/items/${index}`, dropped, seen);
+      }
+    });
+  }
+  if (isPlainObject(node.dependencies)) {
+    for (const [name, entry] of Object.entries(node.dependencies)) {
+      // Array-valued entries are dependentRequired (property names, not
+      // schemas) — only schema-valued entries are walked.
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/dependencies/${pointerToken(name)}`, dropped, seen);
+      }
+    }
+  }
+}