@triflux/remote 10.51.0 → 10.52.0

package/scripts/lib/legacy-mcp-cleanup.mjs

@@ -9,6 +9,7 @@ import {
   readFileSync,
   realpathSync,
   renameSync,
+  rmSync,
   statSync,
   unlinkSync,
   writeFileSync,
@@ -781,3 +782,285 @@ export function cleanupLegacyMcp({
   }
   return result;
 }
+
+const HUB_SERVER = "tfx-hub";
+const HUB_TASK = "TrifluxHubEnsure";
+const HUB_CONFIG_FILES = [
+  [".claude.json", "json"],
+  [".claude/settings.json", "json"],
+  [".claude/mcp.json", "json"],
+  [".codex/config.json", "json"],
+  [".codex/config.toml", "toml"],
+  [".gemini/settings.json", "json"],
+  [".gemini/config/mcp_config.json", "json"],
+];
+
+// 허브가 등록한 항목은 loopback 의 /mcp 주소다. 다른 모양이면 사용자 항목으로 본다.
+function isHubEntry(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config))
+    return false;
+  return [config.url, config.httpUrl, config.serverUrl].some((value) => {
+    try {
+      const url = new URL(value);
+      return (
+        url.protocol === "http:" &&
+        ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) &&
+        url.pathname === "/mcp"
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
+function removeHubFromJson(original, file, warnings) {
+  const data = JSON.parse(original);
+  if (!data || typeof data !== "object" || Array.isArray(data))
+    throw new Error(`${file}: JSON 객체가 아닙니다`);
+  const groups = [
+    data.mcpServers,
+    ...Object.values(data.projects ?? {}).map((project) => project?.mcpServers),
+  ];
+  let count = 0;
+  for (const entries of groups) {
+    if (
+      !entries ||
+      typeof entries !== "object" ||
+      Array.isArray(entries) ||
+      !(HUB_SERVER in entries)
+    )
+      continue;
+    if (!isHubEntry(entries[HUB_SERVER])) {
+      warnings.push(`${file}: ${HUB_SERVER} 항목의 소유를 확인할 수 없어 보존`);
+      continue;
+    }
+    delete entries[HUB_SERVER];
+    count++;
+  }
+  return {
+    output: count ? `${JSON.stringify(data, null, 2)}\n` : original,
+    count,
+  };
+}
+
+function removeHubFromToml(original, file, warnings) {
+  const data = toml.parse(original);
+  const entry = data.mcp_servers?.[HUB_SERVER];
+  if (!entry) return { output: original, count: 0 };
+  if (!isHubEntry(entry)) {
+    warnings.push(`${file}: ${HUB_SERVER} 항목의 소유를 확인할 수 없어 보존`);
+    return { output: original, count: 0 };
+  }
+  // [mcp_servers.tfx-hub] 와 그 하위 표만 다음 표 머리글 전까지 걷어낸다.
+  const hubHeader = new RegExp(
+    `^\\s*\\[\\s*mcp_servers\\s*\\.\\s*(?:"${HUB_SERVER}"|'${HUB_SERVER}'|${HUB_SERVER})\\s*(?:\\.[^\\]]*)?\\]`,
+  );
+  const kept = [];
+  let skipping = false;
+  let trailing = [];
+  for (const line of original.split(/(?<=\n)/)) {
+    if (/^\s*\[/.test(line)) {
+      skipping = hubHeader.test(line);
+      if (!skipping) {
+        while (trailing[0]?.trim() === "" && kept.at(-1)?.trim() === "")
+          trailing.shift();
+        kept.push(...trailing);
+      }
+      trailing = [];
+    } else if (skipping) {
+      trailing = /^\s*(?:#.*)?\r?\n?$/.test(line) ? [...trailing, line] : [];
+      continue;
+    }
+    if (!skipping) kept.push(line);
+  }
+  const output = kept.join("");
+  delete data.mcp_servers[HUB_SERVER];
+  if (!Object.keys(data.mcp_servers).length) delete data.mcp_servers;
+  try {
+    if (!isDeepStrictEqual(toml.parse(output), data))
+      throw new Error("TOML 구조 불일치");
+  } catch {
+    warnings.push(`${file}: 이주 결과 TOML 검증 실패, 파일 보존`);
+    return { output: original, count: 0 };
+  }
+  return { output, count: 1 };
+}
+
+function hubCommandLine(pid, platform, run) {
+  const result =
+    platform === "win32"
+      ? runPowerShell(
+          run,
+          `(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine`,
+        )
+      : tryRun(run, "ps", ["-p", String(pid), "-o", "command="]);
+  if (result.ok) return result.output.trim() || null;
+  // ps 는 프로세스가 없을 때 status 1 로 끝난다. PowerShell 실패는 확인 불가다.
+  return platform !== "win32" && result.status === 1 ? null : undefined;
+}
+
+function stopHub(home, platform, run, result) {
+  const pidFile = join(home, ".claude/cache/tfx-hub/hub.pid");
+  const target = fileTarget(pidFile);
+  if (!target) return;
+  let pid;
+  try {
+    pid = Number(JSON.parse(readFileSync(target, "utf8")).pid);
+  } catch {
+    /* 아래에서 보존 처리 */
+  }
+  if (!Number.isInteger(pid) || pid <= 1) {
+    result.warnings.push(`${pidFile}: pid 를 읽을 수 없어 보존`);
+    return;
+  }
+  const command = hubCommandLine(pid, platform, run);
+  if (command === undefined) {
+    result.warnings.push(`${pidFile}: pid ${pid} 확인 실패, 종료하지 않음`);
+    return;
+  }
+  if (command !== null) {
+    if (!/[/\\]hub[/\\]server\.mjs(?:["'\s]|$)/.test(command)) {
+      // 허브가 아닌 프로세스는 건드리지 않고 우리 파일만 지운다.
+      unlinkSync(target);
+      result.changed = true;
+      return;
+    }
+    const stopped =
+      platform === "win32"
+        ? tryRun(run, "taskkill", ["/F", "/T", "/PID", String(pid)])
+        : tryRun(run, "kill", ["-TERM", String(pid)]);
+    let gone = false;
+    for (let attempt = 0; stopped.ok && attempt < 10 && !gone; attempt++) {
+      gone = hubCommandLine(pid, platform, run) === null;
+      if (!gone)
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+    }
+    if (!gone) {
+      result.warnings.push(`${pidFile}: pid ${pid} 종료 확인 실패, 파일 보존`);
+      return;
+    }
+    result.hubStopped = true;
+  }
+  unlinkSync(target);
+  result.changed = true;
+}
+
+function removeHubTask(run, result) {
+  const query = tryRun(run, "schtasks.exe", [
+    "/Query",
+    "/TN",
+    HUB_TASK,
+    "/FO",
+    "LIST",
+    "/V",
+  ]);
+  if (!query.ok) return;
+  if (!query.output.includes("hub-ensure.mjs")) {
+    result.warnings.push(`${HUB_TASK}: hub-ensure 작업이 아니라 보존`);
+    return;
+  }
+  const removed = tryRun(run, "schtasks.exe", [
+    "/Delete",
+    "/TN",
+    HUB_TASK,
+    "/F",
+  ]);
+  if (removed.ok) result.changed = true;
+  else result.warnings.push(`${HUB_TASK}: 예약 작업 삭제 실패`);
+}
+
+/** cwd 의 프로젝트 MCP 파일 중 제거된 허브가 만든 tfx-hub 항목이 있는 파일을 돌려준다. */
+export function findProjectHubEntries(cwd = process.cwd()) {
+  return [".mcp.json", ".claude/mcp.json"].flatMap((relative) => {
+    const file = join(cwd, relative);
+    try {
+      const data = JSON.parse(readFileSync(file, "utf8"));
+      return isHubEntry(data?.mcpServers?.[HUB_SERVER]) ? [file] : [];
+    } catch {
+      return [];
+    }
+  });
+}
+
+/** 제거된 허브의 설정 항목, 실행 중인 프로세스, 예약 작업, 설치본 스냅샷(gemini, codex)을 정리한다. */
+export function cleanupTfxHub({
+  home = homedir(),
+  platform = osPlatform(),
+  run = defaultRun,
+  pluginRoot,
+} = {}) {
+  const result = {
+    ok: true,
+    changed: false,
+    removed: 0,
+    backups: [],
+    warnings: [],
+    hubStopped: false,
+  };
+  const injected = run !== defaultRun;
+  // 테스트에서는 실제 홈과 시스템 명령을 건드리지 않는다.
+  if (
+    !injected &&
+    (process.env.NODE_TEST_CONTEXT || process.env.TRIFLUX_TEST_HOME)
+  ) {
+    result.skipped = true;
+    return result;
+  }
+  for (const [relative, kind] of HUB_CONFIG_FILES) {
+    const file = join(home, relative);
+    try {
+      const target = fileTarget(file);
+      if (!target) continue;
+      const original = readFileSync(target, "utf8");
+      const plan =
+        kind === "toml"
+          ? removeHubFromToml(original, file, result.warnings)
+          : removeHubFromJson(original, file, result.warnings);
+      if (!plan.count) continue;
+      if (
+        fileTarget(file) !== target ||
+        readFileSync(target, "utf8") !== original
+      ) {
+        result.warnings.push(`${file}: 검사 후 변경되어 건너뜀`);
+        continue;
+      }
+      result.backups.push(writeAtomic(file, target, plan.output));
+      result.removed += plan.count;
+      result.changed = true;
+    } catch {
+      result.warnings.push(`${file}: 설정 형식 또는 읽기 실패`);
+      result.ok = false;
+    }
+  }
+  const realSystem =
+    injected ||
+    (resolve(home) === resolve(homedir()) && platform === osPlatform());
+  if (realSystem) {
+    try {
+      stopHub(home, platform, run, result);
+      if (platform === "win32") removeHubTask(run, result);
+    } catch (error) {
+      result.ok = false;
+      result.warnings.push(`허브 프로세스 정리 실패: ${error.message}`);
+    }
+  } else {
+    result.warnings.push("격리 HOME: 허브 프로세스와 예약 작업 정리는 건너뜀");
+  }
+  for (const name of pluginRoot
+    ? ["gemini-snapshots", "codex-snapshots"]
+    : []) {
+    const snapshots = join(pluginRoot, "references", name);
+    // EBUSY, EPERM, 읽기 전용 설치 디렉터리에서도 setup 이 멈추지 않게 한다.
+    try {
+      if (lstatSync(snapshots, { throwIfNoEntry: false })?.isDirectory()) {
+        rmSync(snapshots, { recursive: true, force: true });
+        result.changed = true;
+      }
+    } catch (error) {
+      result.warnings.push(
+        `${snapshots}: 삭제 실패 (${error.code ?? error.message})`,
+      );
+    }
+  }
+  return result;
+}

package/scripts/lib/mcp-guard-engine.mjs

@@ -19,35 +19,23 @@ import { fileURLToPath } from "node:url";
 
 const PROJECT_ROOT = fileURLToPath(new URL("../../", import.meta.url));
 const DEFAULT_REGISTRY_PATH = join(PROJECT_ROOT, "config", "mcp-registry.json");
-const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
-const DEFAULT_HUB_PATH = "/mcp";
 const SERVER_POLICIES = new Set(["hosted", "stdio"]);
 const DEFAULT_REGISTRY = Object.freeze({
   $schema: "mcp-registry-schema",
   version: 1,
   description: "MCP 서버 중앙 레지스트리 — 진실의 원천",
   defaults: {
-    transport: "hub-url",
-    hub_base: "http://127.0.0.1:27888",
+    transport: "http",
   },
   policy_notes: {
     transport:
-      'Server transport accepts "hub-url" for triflux Hub URL flow, "http" for direct Streamable HTTP MCP endpoints, or "stdio" for upstream-stdio-only MCP servers (rare; only for servers that have no hosted HTTP endpoint, e.g. brave-search). stdio servers require command, args, and may include env.',
+      'Server transport accepts "http" for direct Streamable HTTP MCP endpoints, or "stdio" for upstream-stdio-only MCP servers (rare; only for servers that have no hosted HTTP endpoint, e.g. brave-search). stdio servers require command, args, and may include env.',
     headers:
       'Optional headers are allowed only for HTTP-compatible transports. Each header value must be a descriptor: {"value":"literal"} for non-secret static values, {"env":"ENV_VAR_NAME"} for secrets resolved at sync/runtime, or {"env":"ENV_VAR_NAME","prefix":"Bearer "} for common authorization formats.',
     secret_safety:
       "Resolved secret values must not be written back to this registry file. Missing env vars warn during sync and do not emit empty secret headers.",
   },
-  servers: {
-    "tfx-hub": {
-      policy: "hosted",
-      transport: "hub-url",
-      url: "http://127.0.0.1:27888/mcp",
-      safe: true,
-      targets: ["claude", "gemini", "codex", "antigravity"],
-      description: "triflux Hub MCP 서버",
-    },
-  },
+  servers: {},
   policies: {
     unknown_server_action: "warn",
     sync_denylist: [],
@@ -711,28 +699,6 @@ function upsertTomlServer(raw, name, config, codex = {}) {
   return output.join("\n");
 }
 
-function getHubServerEntry(registry) {
-  const entries = Object.entries(registry?.servers || {});
-  if (entries.length === 0) {
-    return [
-      "tfx-hub",
-      {
-        url: `${registry?.defaults?.hub_base || "http://127.0.0.1:27888"}${DEFAULT_HUB_PATH}`,
-      },
-    ];
-  }
-
-  return (
-    entries.find(([name]) => name === "tfx-hub") ||
-    entries.find(([, config]) => config?.transport === "hub-url") ||
-    entries[0]
-  );
-}
-
-function _makeHubRuntimeConfig() {
-  return { url: resolveHubUrl() };
-}
-
 function serverTargets(serverConfig) {
   if (Array.isArray(serverConfig?.targets) && serverConfig.targets.length > 0) {
     return [
@@ -806,10 +772,7 @@ export function buildDesiredServerRecord(name, serverConfig, filePath) {
     };
   }
 
-  const url =
-    serverConfig?.transport === "hub-url"
-      ? resolveHubUrl()
-      : normalizeUrl(serverConfig?.url || "");
+  const url = normalizeUrl(serverConfig?.url || "");
   const basenameValue = pathBasename(filePath);
   const resolvedHeaders = resolveHeaderDescriptors(
     name,
@@ -1205,10 +1168,8 @@ export function validateRegistry(registry) {
         errors.push(`registry.servers.${name}.policy must be hosted or stdio`);
       }
       const transport = server.transport || registry.defaults?.transport;
-      if (!["hub-url", "http", "stdio"].includes(transport)) {
-        errors.push(
-          `registry.servers.${name}.transport must be hub-url, http, or stdio`,
-        );
+      if (!["http", "stdio"].includes(transport)) {
+        errors.push(`registry.servers.${name}.transport must be http or stdio`);
       }
       if (
         policy === "hosted" &&
@@ -1407,6 +1368,38 @@ export function validateRegistry(registry) {
   return errors;
 }
 
+const warnedLegacyHub = new Set();
+
+// 허브가 있던 시기의 사용자 레지스트리는 hub-url 항목을 걸러내고 기본 transport 를 http 로 읽는다.
+function dropLegacyHub(registry) {
+  if (!registry || typeof registry !== "object" || Array.isArray(registry))
+    return registry;
+  const next = { ...registry };
+  if (next.defaults?.transport === "hub-url") {
+    const { hub_base: _hubBase, ...defaults } = next.defaults;
+    next.defaults = { ...defaults, transport: "http" };
+  }
+  if (
+    next.servers &&
+    typeof next.servers === "object" &&
+    !Array.isArray(next.servers)
+  ) {
+    next.servers = Object.fromEntries(
+      Object.entries(next.servers).filter(([name, server]) => {
+        if (server?.transport !== "hub-url") return true;
+        if (!warnedLegacyHub.has(name)) {
+          warnedLegacyHub.add(name);
+          process.stderr.write(
+            `[mcp-guard] 제거된 hub-url 서버 ${name} 항목을 무시합니다\n`,
+          );
+        }
+        return false;
+      }),
+    );
+  }
+  return next;
+}
+
 export function inspectRegistry() {
   if (!existsSync(registryPath())) {
     return {
@@ -1419,7 +1412,7 @@ export function inspectRegistry() {
   }
 
   try {
-    const registry = readJsonFile(registryPath());
+    const registry = dropLegacyHub(readJsonFile(registryPath()));
     const errors = validateRegistry(registry);
     return {
       path: registryPath(),
@@ -1669,56 +1662,6 @@ export function scanForStdioServers(filePath) {
   return scanConfig(filePath).stdioServers;
 }
 
-export function resolveHubUrl() {
-  const registryState = inspectRegistry();
-  const registry = registryState.valid
-    ? registryState.registry
-    : cloneDefaultRegistry();
-  const [, hubServer] = getHubServerEntry(registry);
-  const fallbackRaw =
-    hubServer?.url ||
-    `${registry?.defaults?.hub_base || "http://127.0.0.1:27888"}${DEFAULT_HUB_PATH}`;
-
-  let fallback;
-  try {
-    fallback = new URL(fallbackRaw);
-  } catch {
-    fallback = new URL(`http://127.0.0.1:27888${DEFAULT_HUB_PATH}`);
-  }
-
-  const envPortRaw = Number(process.env.TFX_HUB_PORT || "");
-  const envPort =
-    Number.isFinite(envPortRaw) && envPortRaw > 0 ? envPortRaw : null;
-  const target = {
-    protocol: fallback.protocol || "http:",
-    host: fallback.hostname || "127.0.0.1",
-    port: envPort || Number(fallback.port || 27888),
-    pathname:
-      fallback.pathname && fallback.pathname !== "/"
-        ? fallback.pathname
-        : DEFAULT_HUB_PATH,
-  };
-
-  // PR #158 정책: port = TFX_HUB_PORT env (없으면 registry/default 27888) single source.
-  // hub.pid 는 loopback host 힌트 전용. 과거 pid port cascade 는 오염된 port 영속화의
-  // 원인이었고 hub-ensure.resolveHubTarget 에서 이미 제거됨. 여기도 일관 적용.
-  const hubPidPath = join(homedir(), ".claude", "cache", "tfx-hub", "hub.pid");
-  if (existsSync(hubPidPath)) {
-    try {
-      const info = readJsonFile(hubPidPath);
-      if (typeof info?.host === "string") {
-        const host = info.host.trim();
-        if (LOOPBACK_HOSTS.has(host)) target.host = host;
-      }
-    } catch {
-      // pid 파일 파싱 실패 시 registry 기본값 사용
-    }
-  }
-
-  const hostPart = target.host.includes(":") ? `[${target.host}]` : target.host;
-  return `${target.protocol}//${hostPart}:${target.port}${target.pathname}`;
-}
-
 export function isWatchedPath(filePath) {
   const registryState = inspectRegistry();
   const registry = registryState.valid
@@ -1758,8 +1701,7 @@ export function addRegistryServer(name, url, options = {}) {
   const registry = registryState.valid
     ? loadRegistry()
     : cloneDefaultRegistry();
-  const transport =
-    options.transport || (trimmedName === "tfx-hub" ? "hub-url" : "http");
+  const transport = options.transport || "http";
   const policy = options.policy || (transport === "stdio" ? "stdio" : "hosted");
 
   registry.servers[trimmedName] = {