@triflux/remote 10.48.1 → 10.50.0

package/scripts/lib/mcp-guard-engine.mjs

@@ -1,6 +1,5 @@
 import {
   chmodSync,
-  copyFileSync,
   existsSync,
   mkdirSync,
   readdirSync,
@@ -22,22 +21,7 @@ const PROJECT_ROOT = fileURLToPath(new URL("../../", import.meta.url));
 const DEFAULT_REGISTRY_PATH = join(PROJECT_ROOT, "config", "mcp-registry.json");
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
 const DEFAULT_HUB_PATH = "/mcp";
-const SERVER_POLICIES = new Set([
-  "hosted",
-  "gateway-sse",
-  "gateway-http",
-  "stdio",
-]);
-const GATEWAY_PORTS = Object.freeze({
-  context7: 8100,
-  "brave-search": 8101,
-  exa: 8102,
-  tavily: 8103,
-  jira: 8104,
-  serena: 8105,
-  notion: 8106,
-  "notion-guest": 8107,
-});
+const SERVER_POLICIES = new Set(["hosted", "stdio"]);
 const DEFAULT_REGISTRY = Object.freeze({
   $schema: "mcp-registry-schema",
   version: 1,
@@ -65,7 +49,6 @@ const DEFAULT_REGISTRY = Object.freeze({
     },
   },
   policies: {
-    stdio_action: "replace-with-hub",
     unknown_server_action: "warn",
     sync_denylist: [],
     watched_paths: [
@@ -153,12 +136,6 @@ function registryPath() {
     : DEFAULT_REGISTRY_PATH;
 }
 
-function ensureBackup(filePath) {
-  const backupPath = `${filePath}.bak`;
-  copyFileSync(filePath, backupPath);
-  return backupPath;
-}
-
 function isJsonMcpConfig(filePath) {
   const name = pathBasename(filePath);
   return (
@@ -484,12 +461,9 @@ function resolveEnvDescriptors(name, serverConfig) {
     const envName = descriptor.env;
     const envValue = process.env[envName];
     if (typeof envValue !== "string" || envValue.length === 0) {
-      warnings.push(
-        `[mcp-guard] ${name}.${envKey} env skipped: env ${envName} is not set`,
-      );
-      continue;
+      warnings.push(`[mcp-guard] ${name}.${envKey} env ${envName} is not set`);
     }
-    env[envKey] = envValue;
+    env[envKey] = "${" + envName + "}";
   }
 
   return { descriptors, env, warnings };
@@ -567,22 +541,6 @@ function hasOwnEntries(value) {
   return value && typeof value === "object" && Object.keys(value).length > 0;
 }
 
-function redactHeaders(headers = {}) {
-  const redacted = {};
-  for (const key of Object.keys(headers || {})) {
-    redacted[key] = "***REDACTED***";
-  }
-  return redacted;
-}
-
-function redactServerConfig(config = {}) {
-  if (!config || typeof config !== "object") return config;
-  return {
-    ...config,
-    ...(config.headers ? { headers: redactHeaders(config.headers) } : {}),
-  };
-}
-
 function descriptorsFromCodexConfig(config = {}) {
   const descriptors = {};
   if (typeof config.bearer_token_env_var === "string") {
@@ -691,6 +649,7 @@ function upsertTomlServer(raw, name, config, codex = {}) {
     "http_headers",
     "env_http_headers",
     "env",
+    "env_vars",
   ]);
   const nextManagedLines = [];
   if (typeof config.url === "string") {
@@ -707,6 +666,9 @@ function upsertTomlServer(raw, name, config, codex = {}) {
   }
   const env = formatTomlInlineTable(config.env || {});
   if (env) nextManagedLines.push(`env = ${env}`);
+  if (Array.isArray(codex.env_vars) && codex.env_vars.length > 0) {
+    nextManagedLines.push(`env_vars = ${formatTomlArray(codex.env_vars)}`);
+  }
   if (codex.bearer_token_env_var) {
     nextManagedLines.push(
       `bearer_token_env_var = ${formatTomlString(codex.bearer_token_env_var)}`,
@@ -795,34 +757,6 @@ function serverPolicy(serverConfig = {}, registry = {}) {
   return "hosted";
 }
 
-function gatewaySseUrl(name, serverConfig = {}) {
-  if (typeof serverConfig.url === "string" && serverConfig.url.trim()) {
-    return normalizeUrl(serverConfig.url);
-  }
-  const port =
-    Number(serverConfig.gateway_port || serverConfig.port || 0) ||
-    GATEWAY_PORTS[name];
-  if (!Number.isFinite(port) || port <= 0) return "";
-  return `http://127.0.0.1:${port}/sse`;
-}
-
-function gatewayHttpUrl(name, serverConfig = {}) {
-  if (typeof serverConfig.url === "string" && serverConfig.url.trim()) {
-    return normalizeUrl(serverConfig.url);
-  }
-  const port =
-    Number(serverConfig.gateway_port || serverConfig.port || 0) ||
-    GATEWAY_PORTS[name];
-  if (!Number.isFinite(port) || port <= 0) return "";
-  const path =
-    typeof serverConfig.gateway_path === "string" &&
-    serverConfig.gateway_path.trim()
-      ? serverConfig.gateway_path.trim()
-      : "/mcp";
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  return `http://127.0.0.1:${port}${normalizedPath}`;
-}
-
 function syncDenylistEntries(policy = {}) {
   if (!Array.isArray(policy?.sync_denylist)) return new Set();
   return new Set(
@@ -848,9 +782,11 @@ export function buildDesiredServerRecord(name, serverConfig, filePath) {
   const policy = serverPolicy(serverConfig);
   if (policy === "stdio") {
     const resolvedEnv = resolveEnvDescriptors(name, serverConfig);
-    const envConfig = hasOwnEntries(resolvedEnv.env)
-      ? { env: resolvedEnv.env }
-      : {};
+    const codexTarget = isCodexConfig(filePath);
+    const envConfig =
+      !codexTarget && hasOwnEntries(resolvedEnv.env)
+        ? { env: resolvedEnv.env }
+        : {};
     return {
       name,
       config: {
@@ -859,19 +795,21 @@ export function buildDesiredServerRecord(name, serverConfig, filePath) {
         ...envConfig,
       },
       envDescriptors: resolvedEnv.descriptors,
-      codex: {},
+      codex: codexTarget
+        ? {
+            env_vars: Object.values(resolvedEnv.descriptors).map(
+              (item) => item.env,
+            ),
+          }
+        : {},
       warnings: resolvedEnv.warnings,
     };
   }
 
   const url =
-    policy === "gateway-sse"
-      ? gatewaySseUrl(name, serverConfig)
-      : policy === "gateway-http"
-        ? gatewayHttpUrl(name, serverConfig)
-        : serverConfig?.transport === "hub-url"
-          ? resolveHubUrl()
-          : normalizeUrl(serverConfig?.url || "");
+    serverConfig?.transport === "hub-url"
+      ? resolveHubUrl()
+      : normalizeUrl(serverConfig?.url || "");
   const basenameValue = pathBasename(filePath);
   const resolvedHeaders = resolveHeaderDescriptors(
     name,
@@ -882,46 +820,6 @@ export function buildDesiredServerRecord(name, serverConfig, filePath) {
     ? { headers: resolvedHeaders.headers }
     : {};
 
-  if (policy === "gateway-http") {
-    if (isCodexConfig(filePath)) {
-      return {
-        name,
-        config: { url },
-        headerDescriptors: {},
-        codex: {},
-        warnings: [],
-      };
-    }
-
-    return {
-      name,
-      config: { type: "http", url },
-      headerDescriptors: {},
-      codex: {},
-      warnings: [],
-    };
-  }
-
-  if (policy === "gateway-sse") {
-    if (isCodexConfig(filePath)) {
-      return {
-        name,
-        config: { url, transport: "sse" },
-        headerDescriptors: {},
-        codex: {},
-        warnings: [],
-      };
-    }
-
-    return {
-      name,
-      config: { type: "sse", url },
-      headerDescriptors: {},
-      codex: {},
-      warnings: [],
-    };
-  }
-
   if (
     basenameValue === ".mcp.json" ||
     isClaudeProjectMcpConfig(filePath) ||
@@ -1122,7 +1020,6 @@ function scanCodexConfig(filePath) {
       exists: true,
       parseError: null,
       servers,
-      // Wave 1/2-B: Codex stdio servers are observed but not auto-remediated.
       stdioServers: [],
     };
   } catch (error) {
@@ -1305,9 +1202,7 @@ export function validateRegistry(registry) {
         typeof server.policy !== "string" ||
         !SERVER_POLICIES.has(server.policy)
       ) {
-        errors.push(
-          `registry.servers.${name}.policy must be hosted, gateway-sse, gateway-http, or stdio`,
-        );
+        errors.push(`registry.servers.${name}.policy must be hosted or stdio`);
       }
       const transport = server.transport || registry.defaults?.transport;
       if (!["hub-url", "http", "stdio"].includes(transport)) {
@@ -1321,19 +1216,6 @@ export function validateRegistry(registry) {
       ) {
         errors.push(`registry.servers.${name}.url must be a non-empty string`);
       }
-      if (policy === "gateway-sse" || policy === "gateway-http") {
-        const port = Number(server.gateway_port || server.port || 0);
-        const hasGatewayUrl =
-          typeof server.url === "string" && server.url.trim().length > 0;
-        if (
-          !hasGatewayUrl &&
-          (!Number.isInteger(port) || port <= 0 || port > 65535)
-        ) {
-          errors.push(
-            `registry.servers.${name}.gateway_port must be a valid TCP port for ${policy}`,
-          );
-        }
-      }
       if (policy === "stdio" && server.url !== undefined) {
         errors.push(`registry.servers.${name}.url is not used for stdio`);
       }
@@ -1520,14 +1402,6 @@ export function validateRegistry(registry) {
         }
       }
     }
-    if (
-      registry.policies.stdio_action &&
-      !["replace-with-hub", "warn"].includes(registry.policies.stdio_action)
-    ) {
-      errors.push(
-        "registry.policies.stdio_action must be replace-with-hub or warn",
-      );
-    }
   }
 
   return errors;
@@ -1795,101 +1669,6 @@ export function scanForStdioServers(filePath) {
   return scanConfig(filePath).stdioServers;
 }
 
-export function remediate(filePath, stdioServers, policy = {}) {
-  const resolvedPath = resolveFilePath(filePath);
-  const offenders = Array.isArray(stdioServers)
-    ? stdioServers.filter((server) => server?.name)
-    : [];
-  const action = policy?.stdio_action || "warn";
-
-  if (offenders.length === 0) {
-    return {
-      action: "noop",
-      modified: false,
-      backupPath: null,
-      removedServers: [],
-      warnings: [],
-    };
-  }
-
-  if (action === "warn") {
-    return {
-      action,
-      modified: false,
-      backupPath: null,
-      removedServers: [],
-      warnings: [
-        `[mcp-guard] stdio MCP 감지: ${offenders.map((server) => server.name).join(", ")}`,
-      ],
-    };
-  }
-
-  if (isCodexConfig(resolvedPath)) {
-    return {
-      action,
-      modified: false,
-      backupPath: null,
-      removedServers: [],
-      warnings: ["[mcp-guard] Codex TOML 자동 수정은 Wave 2-B 범위 밖입니다."],
-    };
-  }
-
-  const snapshot = scanConfig(resolvedPath);
-  if (snapshot.parseError) {
-    return {
-      action,
-      modified: false,
-      backupPath: null,
-      removedServers: [],
-      warnings: [`[mcp-guard] 설정 파싱 실패: ${snapshot.parseError.message}`],
-    };
-  }
-
-  let backupPath = null;
-  try {
-    if (existsSync(resolvedPath)) backupPath = ensureBackup(resolvedPath);
-  } catch (error) {
-    return {
-      action,
-      modified: false,
-      backupPath: null,
-      removedServers: [],
-      warnings: [`[mcp-guard] 백업 생성 실패: ${error.message}`],
-    };
-  }
-
-  const removals = offenders.map((server) => server.name);
-  const updates = [];
-  let replacement = null;
-
-  if (action === "replace-with-hub") {
-    const registry = policy.registry || loadRegistryOrDefault();
-    const matchingOffender = offenders.find((server) =>
-      Object.hasOwn(registry.servers || {}, server.name),
-    );
-    const [hubServerName, hubServerConfig] = matchingOffender
-      ? [matchingOffender.name, registry.servers[matchingOffender.name]]
-      : getHubServerEntry(registry);
-    const desired = buildDesiredServerRecord(
-      hubServerName,
-      hubServerConfig,
-      resolvedPath,
-    );
-    replacement = { name: desired.name, ...redactServerConfig(desired.config) };
-    updates.push(desired);
-  }
-
-  const result = updateJsonConfig(resolvedPath, updates, removals);
-  return {
-    action,
-    modified: result.modified,
-    backupPath,
-    removedServers: removals,
-    replacement,
-    warnings: updates.flatMap((update) => update.warnings || []),
-  };
-}
-
 export function resolveHubUrl() {
   const registryState = inspectRegistry();
   const registry = registryState.valid
@@ -1981,13 +1760,7 @@ export function addRegistryServer(name, url, options = {}) {
     : cloneDefaultRegistry();
   const transport =
     options.transport || (trimmedName === "tfx-hub" ? "hub-url" : "http");
-  const policy =
-    options.policy ||
-    (transport === "stdio"
-      ? "stdio"
-      : options.gateway_port || options.port
-        ? "gateway-http"
-        : "hosted");
+  const policy = options.policy || (transport === "stdio" ? "stdio" : "hosted");
 
   registry.servers[trimmedName] = {
     policy,
@@ -2127,26 +1900,6 @@ export function syncRegistryTargets(options = {}) {
         status: "invalid-config",
         message: snapshot.parseError.message,
       });
-      continue;
-    }
-
-    if (
-      snapshot.stdioServers.length > 0 &&
-      !isClaudeUserConfig(target.filePath)
-    ) {
-      const remediation = remediate(target.filePath, snapshot.stdioServers, {
-        ...registry.policies,
-        registry,
-      });
-      actions.push({
-        type: "remediate",
-        filePath: target.filePath,
-        label: target.label,
-        status: remediation.modified ? "updated" : "warning",
-        removedServers: remediation.removedServers,
-        replacement: remediation.replacement || null,
-        warnings: remediation.warnings || [],
-      });
     }
   }
 
@@ -2175,6 +1928,26 @@ export function syncRegistryTargets(options = {}) {
       if (serverConfig?.safe !== true) continue;
       if (!serverAppliesToClient(serverConfig, target.client)) continue;
 
+      if (
+        isCodexConfig(target.filePath) &&
+        serverPolicy(serverConfig) === "stdio"
+      ) {
+        const remappedEnv = Object.entries(
+          normalizeEnvDescriptors(serverConfig.env),
+        ).find(([key, descriptor]) => key !== descriptor.env);
+        if (remappedEnv) {
+          actions.push({
+            type: "sync",
+            filePath: target.filePath,
+            label: target.label,
+            status: "warning",
+            server: name,
+            message: `${name}: Codex env_vars는 ${remappedEnv[1].env}를 ${remappedEnv[0]}로 이름 변경할 수 없습니다`,
+          });
+          continue;
+        }
+      }
+
       const denyKey = syncDenylistKey(target.client, name);
       if (denylist.has(denyKey)) {
         const existing = snapshot.servers.find(

package/scripts/lib/mcp-manifest.mjs

@@ -1,6 +1,6 @@
 // scripts/lib/mcp-manifest.mjs
 // MCP 서버 활성화 매니페스트 — 단일 진실 소스.
-// tfx-setup 위저드가 저장하고, gateway/filter가 참조한다.
+// tfx-setup 위저드가 저장하고, MCP 필터가 참조한다.
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -13,7 +13,7 @@ export const MANIFEST_PATH = join(
   "mcp-enabled.json",
 );
 
-/** API 키 불필요 — 항상 활성화 for gateway-managed MCP servers (현재 없음 — serena는 2026-06-10 core에서 제거) */
+/** API 키 불필요 서버 (현재 없음) */
 export const CORE_SERVERS = Object.freeze([]);
 
 /** 검색 MCP — API 키 필요 */

package/hub/mac-focus.mjs

@@ -1,94 +0,0 @@
-import { execFile } from "node:child_process";
-
-export const FOCUS_SCRIPT_TIMEOUT_MS = 5_000;
-
-const DEFAULT_FOCUS_CANDIDATES = [
-  "iTerm2",
-  "Terminal",
-  "Codex",
-  "Claude",
-  "Antigravity",
-  "Code",
-];
-
-function normalizeAgentId(value) {
-  const id = String(value || "")
-    .trim()
-    .toLowerCase();
-  if (id === "agy" || id === "anti") return "antigravity";
-  return id;
-}
-
-export function getFocusCandidates({ agentId } = {}) {
-  switch (normalizeAgentId(agentId)) {
-    case "codex":
-      return ["Codex", "iTerm2", "Terminal", "Code"];
-    case "claude":
-      return ["Claude", "iTerm2", "Terminal"];
-    case "antigravity":
-      return ["Antigravity", "iTerm2", "Terminal"];
-    default:
-      return [...DEFAULT_FOCUS_CANDIDATES];
-  }
-}
-
-function appleScriptList(values) {
-  return `{${values.map((value) => JSON.stringify(String(value))).join(", ")}}`;
-}
-
-export function buildFocusScript({ agentId, appCandidates } = {}) {
-  const candidates = Array.isArray(appCandidates)
-    ? appCandidates.map(String).filter(Boolean)
-    : getFocusCandidates({ agentId });
-  return `
-set appCandidates to ${appleScriptList(candidates)}
-tell application "System Events"
-  set runningNames to name of every process
-end tell
-repeat with appName in appCandidates
-  set appText to appName as text
-  if runningNames contains appText then
-    tell application appText to activate
-    return "activated " & appText
-  end if
-end repeat
-return "no focus candidate running"
-`;
-}
-
-export function focusSessionOnMac(target = {}, maybeUdsId = null) {
-  const normalizedTarget =
-    target && typeof target === "object"
-      ? target
-      : { sessionId: target, udsId: maybeUdsId };
-  const script = buildFocusScript({ agentId: normalizedTarget.agentId });
-  return new Promise((resolve) => {
-    execFile(
-      "osascript",
-      ["-e", script],
-      { timeout: FOCUS_SCRIPT_TIMEOUT_MS },
-      (err, stdout = "", stderr = "") => {
-        const output = String(stdout || stderr || "").trim();
-        if (err) {
-          console.error("mac-focus error:", err?.message || err);
-          resolve({
-            ok: false,
-            sessionId: normalizedTarget.sessionId || null,
-            pid: Number(normalizedTarget.pid) || null,
-            agentId: normalizedTarget.agentId || null,
-            error: err?.message || String(err),
-            output,
-          });
-          return;
-        }
-        resolve({
-          ok: true,
-          sessionId: normalizedTarget.sessionId || null,
-          pid: Number(normalizedTarget.pid) || null,
-          agentId: normalizedTarget.agentId || null,
-          output,
-        });
-      },
-    );
-  });
-}

package/hub/mac-tray.swift

@@ -1,144 +0,0 @@
-import Cocoa
-import WebKit
-
-class AppDelegate: NSObject, NSApplicationDelegate, NSPopoverDelegate {
-    var statusItem: NSStatusItem!
-    var popover: NSPopover!
-    var webVC: WebViewController!
-    var port: String = "27888"
-
-    func applicationDidFinishLaunching(_ aNotification: Notification) {
-        if CommandLine.arguments.count > 1 {
-            port = CommandLine.arguments[1]
-        }
-
-        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
-        if let button = statusItem.button {
-            button.title = "T"
-            button.target = self
-            button.action = #selector(togglePopover(_:))
-        }
-
-        webVC = WebViewController()
-        webVC.port = port
-        webVC.onFocusComplete = { [weak self] in
-            self?.popover.performClose(nil)
-        }
-
-        popover = NSPopover()
-        popover.contentViewController = webVC
-        popover.behavior = .transient
-        popover.animates = false
-        popover.delegate = self
-    }
-
-    @objc func togglePopover(_ sender: Any?) {
-        if popover.isShown {
-            popover.performClose(sender)
-        } else {
-            if let button = statusItem.button {
-                webVC.reloadForPopover()
-                popover.show(relativeTo: button.bounds, of: button, preferredEdge: .minY)
-            }
-        }
-    }
-}
-
-class WebViewController: NSViewController, WKNavigationDelegate, WKScriptMessageHandler {
-    var webView: WKWebView!
-    var port: String = "27888"
-    let canonicalPort = "27888"
-    var consecutiveFailures = 0
-    var retryWorkItem: DispatchWorkItem?
-    var onFocusComplete: (() -> Void)?
-
-    func logError(_ msg: String) {
-        let path = "/tmp/mac-tray.log"
-        if let outputStream = OutputStream(toFileAtPath: path, append: true) {
-            outputStream.open()
-            let text = "\(Date()): \(msg)\n"
-            let bytesWritten = outputStream.write(text, maxLength: text.utf8.count)
-            outputStream.close()
-        }
-    }
-
-    override func loadView() {
-        let webConfiguration = WKWebViewConfiguration()
-        webConfiguration.userContentController.add(self, name: "tray")
-        let initialFrame = NSRect(x: 0, y: 0, width: 460, height: 720)
-        webView = WKWebView(frame: initialFrame, configuration: webConfiguration)
-
-        // Transparent background for Glassmorphism
-        webView.setValue(false, forKey: "drawsBackground")
-
-        self.view = NSView(frame: initialFrame)
-        webView.frame = self.view.bounds
-        webView.autoresizingMask = [.width, .height]
-        self.view.addSubview(webView)
-
-        self.preferredContentSize = initialFrame.size
-    }
-
-    override func viewDidLoad() {
-        super.viewDidLoad()
-        webView.navigationDelegate = self
-        loadTray()
-    }
-
-    func loadTray() {
-        retryWorkItem?.cancel()
-        if let url = URL(string: "http://127.0.0.1:\(port)/tray.html?t=\(Date().timeIntervalSince1970)") {
-            let request = URLRequest(url: url)
-            webView.load(request)
-        } else {
-            logError("Invalid URL")
-        }
-    }
-
-    func reloadForPopover() {
-        if isViewLoaded {
-            loadTray()
-        }
-    }
-
-    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-        logError("Failed to load: \(error.localizedDescription)")
-        consecutiveFailures += 1
-        if consecutiveFailures >= 3 && port != canonicalPort {
-            port = canonicalPort
-            consecutiveFailures = 0
-            logError("Switching to canonical port \(canonicalPort) after repeated failures")
-            loadTray()
-            return
-        }
-        let retry = DispatchWorkItem { [weak self] in
-            self?.loadTray()
-        }
-        retryWorkItem = retry
-        DispatchQueue.main.asyncAfter(deadline: .now() + 0.35, execute: retry)
-    }
-
-    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-        retryWorkItem?.cancel()
-        retryWorkItem = nil
-        consecutiveFailures = 0
-        logError("Successfully loaded URL")
-    }
-
-    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
-        guard message.name == "tray" else { return }
-        if let body = message.body as? [String: Any],
-           let type = body["type"] as? String,
-           type == "focus-complete" {
-            DispatchQueue.main.async { [weak self] in
-                self?.onFocusComplete?()
-            }
-        }
-    }
-}
-
-let app = NSApplication.shared
-let delegate = AppDelegate()
-app.delegate = delegate
-app.setActivationPolicy(.accessory)
-app.run()