@waishnav/devspace 1.0.0 → 1.0.2

package/dist/oauth-store.js

@@ -0,0 +1,138 @@
+import { randomUUID } from "node:crypto";
+import { InvalidRequestError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { openDatabase } from "./db/client.js";
+function redirectHostAllowed(redirectUri, allowedHosts) {
+    let parsed;
+    try {
+        parsed = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+        return true;
+    return allowedHosts.includes(parsed.hostname);
+}
+export class SqliteOAuthStore {
+    database;
+    constructor(stateDir) {
+        this.database = openDatabase(stateDir);
+        this.deleteExpiredTokens(Math.floor(Date.now() / 1000));
+    }
+    getClient(clientId) {
+        const row = this.database.sqlite
+            .prepare("select client_json from oauth_clients where client_id = ?")
+            .get(clientId);
+        return row ? JSON.parse(row.client_json) : undefined;
+    }
+    registerClient(client, allowedRedirectHosts) {
+        if (!client.redirect_uris.every((uri) => redirectHostAllowed(String(uri), allowedRedirectHosts))) {
+            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const registered = {
+            ...client,
+            client_id: `devspace-${randomUUID()}`,
+            client_id_issued_at: now,
+            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
+            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
+            response_types: client.response_types ?? ["code"],
+        };
+        this.database.sqlite
+            .prepare("insert into oauth_clients (client_id, client_json, issued_at) values (?, ?, ?)")
+            .run(registered.client_id, JSON.stringify(registered), now);
+        return registered;
+    }
+    saveAccessToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_access_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    getAccessToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_access_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToAccessTokenRecord(row) : undefined;
+    }
+    deleteAccessToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where token_hash = ?").run(tokenHash);
+    }
+    saveRefreshToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_refresh_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    saveTokenPair(pair, consumedRefreshTokenHash) {
+        const save = this.database.sqlite.transaction(() => {
+            if (consumedRefreshTokenHash) {
+                const result = this.database.sqlite
+                    .prepare("delete from oauth_refresh_tokens where token_hash = ?")
+                    .run(consumedRefreshTokenHash);
+                if (result.changes !== 1)
+                    return false;
+            }
+            this.saveAccessToken(pair.accessTokenHash, pair.accessToken);
+            this.saveRefreshToken(pair.refreshTokenHash, pair.refreshToken);
+            return true;
+        });
+        return save.immediate();
+    }
+    getRefreshToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_refresh_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToRefreshTokenRecord(row) : undefined;
+    }
+    deleteRefreshToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where token_hash = ?").run(tokenHash);
+    }
+    close() {
+        this.database.close();
+    }
+    deleteExpiredTokens(nowSeconds) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where expires_at < ?").run(nowSeconds);
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where expires_at < ?").run(nowSeconds);
+    }
+}
+export class SqliteOAuthClientsStore {
+    store;
+    allowedRedirectHosts;
+    constructor(store, allowedRedirectHosts) {
+        this.store = store;
+        this.allowedRedirectHosts = allowedRedirectHosts;
+    }
+    getClient(clientId) {
+        return this.store.getClient(clientId);
+    }
+    registerClient(client) {
+        return this.store.registerClient(client, this.allowedRedirectHosts);
+    }
+}
+function rowToAccessTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}
+function rowToRefreshTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}

package/dist/review-checkpoints.js

@@ -13,7 +13,7 @@ export function createReviewCheckpointManager() {
             try {
                 const eligibility = await getGitEligibility(root);
                 if (!eligibility.ok || !eligibility.gitRoot) {
-                    state.diagnostic = eligibility.message ?? "review_changes requires a Git workspace in this version.";
+                    state.diagnostic = eligibility.message ?? "show_changes requires a Git workspace in this version.";
                     return;
                 }
                 state.gitRoot = eligibility.gitRoot;
@@ -25,14 +25,14 @@ export function createReviewCheckpointManager() {
                 state.diagnostic = error instanceof Error ? error.message : String(error);
             }
         },
-        async reviewChanges({ workspaceId, root, since = "last_review", markReviewed = true }) {
+        async reviewChanges({ workspaceId, root, since = "last_shown", markReviewed = true }) {
             let state = states.get(workspaceId);
             if (!state) {
                 await this.initializeWorkspace({ workspaceId, root });
                 state = states.get(workspaceId);
             }
             if (!state?.gitRoot) {
-                throw new Error(state?.diagnostic ?? "review_changes requires a Git workspace in this version.");
+                throw new Error(state?.diagnostic ?? "show_changes requires a Git workspace in this version.");
             }
             const baselineRef = since === "workspace_open" ? state.openRef : state.baselineRef;
             const baseline = (await git(state.gitRoot, ["rev-parse", "--verify", `${baselineRef}^{commit}`])).stdout.trim();
@@ -50,7 +50,7 @@ export function createReviewCheckpointManager() {
             }
             return {
                 result: summary.files === 0
-                    ? `No changes since ${since === "workspace_open" ? "workspace open" : "last review"}.`
+                    ? `No changes since ${since === "workspace_open" ? "workspace open" : "last shown changes"}.`
                     : `Changed ${summary.files} ${summary.files === 1 ? "file" : "files"} (+${summary.additions} -${summary.removals}).`,
                 summary,
                 files,

package/dist/server.js

@@ -45,7 +45,7 @@ function shouldAttachWidget(mode, kind) {
         case "off":
             return false;
         case "changes":
-            return kind === "workspace" || kind === "review_changes";
+            return kind === "workspace" || kind === "show_changes";
         case "full":
             return true;
     }
@@ -93,10 +93,10 @@ function serverInstructions(config, toolNames) {
         ? `When ${toolNames.openWorkspace} returns available skills and a task matches a skill, use ${toolNames.read} to read that skill's path before proceeding. Skill paths may be outside the workspace, but ${toolNames.read} only permits advertised SKILL.md files and files under already-loaded skill directories. `
         : "";
     const agentsMd = `Follow instructions returned by ${toolNames.openWorkspace}. Before working under a path listed in availableAgentsFiles, use ${toolNames.read} to inspect that instruction file and follow it. `;
-    const review = config.widgets === "changes"
-        ? " After completing a coherent set of file modifications, call review_changes once to show the user an aggregate diff review."
+    const showChanges = config.widgets === "changes"
+        ? " After creating, editing, or overwriting files, call show_changes once after the related file changes are complete so the user can see the aggregate diff."
         : "";
-    return `Use DevSpace as a local coding workspace. Call ${toolNames.openWorkspace} once per project folder or worktree to obtain a workspaceId. Reuse that same workspaceId for all later file, search, edit, write, review, and shell tools in that folder; do not call ${toolNames.openWorkspace} again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. ${agentsMd}${skills}${inspection}Prefer ${toolNames.edit} for targeted modifications, ${toolNames.write} only for new files or complete rewrites, and ${toolNames.shell} for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not create or modify files with ${toolNames.shell}; avoid shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or any command whose purpose is to write project files.${review}`;
+    return `Use DevSpace as a local coding workspace. Call ${toolNames.openWorkspace} once per project folder or worktree to obtain a workspaceId. Reuse that same workspaceId for all later file, search, edit, write, show-changes, and shell tools in that folder; do not call ${toolNames.openWorkspace} again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. ${agentsMd}${skills}${inspection}Prefer ${toolNames.edit} for targeted modifications, ${toolNames.write} only for new files or complete rewrites, and ${toolNames.shell} for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not create or modify files with ${toolNames.shell}; avoid shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or any command whose purpose is to write project files.${showChanges}`;
 }
 function resultOutputSchema(extra = {}) {
     return {
@@ -328,7 +328,7 @@ function createMcpServer(config, workspaces, reviewCheckpoints) {
     });
     registerAppTool(server, "open_workspace", {
         title: "Open workspace",
-        description: "Open a local project directory as a coding workspace. Call this once per project folder or worktree before reading, editing, searching, writing, reviewing, or running commands. Reuse the returned workspaceId for later calls in the same folder; do not call open_workspace again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. By default this opens the actual checkout; set mode=\"worktree\" when the user asks for an isolated or parallel coding session. Returns a workspaceId, loaded root project instructions, and nested instruction file paths the model should read before working in those directories.",
+        description: "Open a local project directory as a coding workspace. Call this once per project folder or worktree before reading, editing, searching, writing, showing changes, or running commands. Reuse the returned workspaceId for later calls in the same folder; do not call open_workspace again unless switching folders/worktrees, changing checkout/worktree mode, the workspaceId is rejected as unknown, or the user explicitly asks to reopen. By default this opens the actual checkout; set mode=\"worktree\" when the user asks for an isolated or parallel coding session. Returns a workspaceId, loaded root project instructions, and nested instruction file paths the model should read before working in those directories.",
         inputSchema: {
             path: z
                 .string()
@@ -669,24 +669,24 @@ function createMcpServer(config, workspaces, reviewCheckpoints) {
         };
     });
     if (config.widgets === "changes") {
-        registerAppTool(server, "review_changes", {
-            title: "Review changes",
-            description: "Review aggregate file changes in an open workspace since the last review checkpoint or since the workspace was opened. Use this after a coherent set of file modifications to show a single diff review card.",
+        registerAppTool(server, "show_changes", {
+            title: "Show changes",
+            description: "Show aggregate file changes in an open workspace since the last shown checkpoint or since the workspace was opened. After you create, edit, or overwrite files, call this once when the related file changes are complete so the user can inspect the combined diff.",
             inputSchema: {
                 workspaceId: z
                     .string()
                     .describe("Workspace identifier returned by open_workspace."),
                 since: z
-                    .enum(["last_review", "workspace_open"])
+                    .enum(["last_shown", "workspace_open"])
                     .optional()
-                    .describe("Defaults to last_review. Use workspace_open to compare against the initial open_workspace checkpoint."),
+                    .describe("Defaults to last_shown. Use workspace_open to compare against the initial open_workspace checkpoint."),
                 markReviewed: z
                     .boolean()
                     .optional()
-                    .describe("Defaults to true. When true, advances the last_review checkpoint to the current workspace state."),
+                    .describe("Defaults to true. When true, advances the last shown checkpoint to the current workspace state."),
             },
             outputSchema: resultOutputSchema(),
-            ...toolWidgetDescriptorMeta(config, "review_changes"),
+            ...toolWidgetDescriptorMeta(config, "show_changes"),
             annotations: { readOnlyHint: true },
         }, async ({ workspaceId, since, markReviewed }) => {
             const startedAt = performance.now();
@@ -694,12 +694,12 @@ function createMcpServer(config, workspaces, reviewCheckpoints) {
             const review = await reviewCheckpoints.reviewChanges({
                 workspaceId,
                 root: workspace.root,
-                since: since ?? "last_review",
+                since: since ?? "last_shown",
                 markReviewed: markReviewed ?? true,
             });
             const content = [textBlock(review.result)];
             logToolCall(config, {
-                tool: "review_changes",
+                tool: "show_changes",
                 workspaceId,
                 success: true,
                 durationMs: Math.round(performance.now() - startedAt),
@@ -707,7 +707,7 @@ function createMcpServer(config, workspaces, reviewCheckpoints) {
             return {
                 content,
                 _meta: {
-                    tool: "review_changes",
+                    tool: "show_changes",
                     card: {
                         workspaceId,
                         summary: review.summary,
@@ -989,7 +989,7 @@ export function createServer(config = loadConfig()) {
     const transports = new Map();
     const mcpUrl = new URL("/mcp", config.publicBaseUrl);
     const resourceServerUrl = resourceUrlFromServerUrl(mcpUrl);
-    const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl);
+    const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl, config.stateDir);
     const bearerAuth = requireBearerAuth({
         verifier: oauthProvider,
         requiredScopes: [config.oauth.scopes[0] ?? "devspace"],
@@ -1125,7 +1125,18 @@ export function createServer(config = loadConfig()) {
             }
         }
     });
-    return { app, config };
+    let closed = false;
+    return {
+        app,
+        config,
+        close: () => {
+            if (closed)
+                return;
+            closed = true;
+            oauthProvider.close();
+            workspaceStore.close?.();
+        },
+    };
 }
 async function isMainModule() {
     if (!process.argv[1])
@@ -1135,8 +1146,8 @@ async function isMainModule() {
     return modulePath === entrypointPath;
 }
 if (await isMainModule()) {
-    const { app, config } = createServer();
-    app.listen(config.port, config.host, () => {
+    const { app, config, close } = createServer();
+    const httpServer = app.listen(config.port, config.host, () => {
         console.log(`devspace listening on http://${config.host}:${config.port}/mcp`);
         console.log(`allowed roots: ${config.allowedRoots.join(", ")}`);
         console.log("auth: oauth owner-token flow required");
@@ -1145,4 +1156,12 @@ if (await isMainModule()) {
         console.log(`asset logging: ${config.logging.assets ? "enabled" : "disabled"}`);
         console.log(`trust proxy: ${config.logging.trustProxy ? "enabled" : "disabled"}`);
     });
+    const shutdown = () => {
+        httpServer.close(() => {
+            close();
+            process.exit(0);
+        });
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
 }