@waishnav/devspace 1.0.1 → 1.0.3

package/dist/config.js

@@ -44,17 +44,16 @@ function normalizeAllowedHosts(rawHosts, derivedHosts) {
 function parseBoolean(value) {
     return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
 }
-function parseMinimalTools(env) {
-    if (env.DEVSPACE_TOOL_MODE === "minimal")
-        return true;
-    if (env.DEVSPACE_TOOL_MODE === "full")
-        return false;
-    if (env.DEVSPACE_TOOL_MODE) {
-        throw new Error(`Invalid DEVSPACE_TOOL_MODE: ${env.DEVSPACE_TOOL_MODE}`);
+function parseToolMode(env) {
+    const mode = env.DEVSPACE_TOOL_MODE;
+    if (mode === "minimal" || mode === "full" || mode === "codex")
+        return mode;
+    if (mode)
+        throw new Error(`Invalid DEVSPACE_TOOL_MODE: ${mode}`);
+    if (env.DEVSPACE_MINIMAL_TOOLS !== undefined) {
+        return parseBoolean(env.DEVSPACE_MINIMAL_TOOLS) ? "minimal" : "full";
     }
-    if (env.DEVSPACE_MINIMAL_TOOLS !== undefined)
-        return parseBoolean(env.DEVSPACE_MINIMAL_TOOLS);
-    return true;
+    return "minimal";
 }
 function parseLogLevel(value) {
     if (!value || value === "info")
@@ -74,8 +73,7 @@ function parsePathList(value) {
     return (value
         ?.split(",")
         .map((entry) => entry.trim())
-        .filter(Boolean)
-        .map((entry) => resolve(expandHomePath(entry))) ?? []);
+        .filter(Boolean) ?? []);
 }
 function parseStringList(value, fallback) {
     const entries = value
@@ -170,7 +168,7 @@ export function loadConfig(env = process.env) {
         allowedRoots: parseAllowedRoots(env.DEVSPACE_ALLOWED_ROOTS ?? files.config.allowedRoots),
         allowedHosts: parseAllowedHosts(env.DEVSPACE_ALLOWED_HOSTS, derivedAllowedHosts),
         publicBaseUrl,
-        minimalTools: parseMinimalTools(env),
+        toolMode: parseToolMode(env),
         toolNaming: parseToolNaming(env.DEVSPACE_TOOL_NAMING),
         widgets: parseWidgetMode(env.DEVSPACE_WIDGETS),
         stateDir: resolve(expandHomePath(env.DEVSPACE_STATE_DIR ?? files.config.stateDir ?? defaultStateDir())),

package/dist/db/client.js

@@ -1,16 +1,23 @@
-import { mkdirSync } from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import * as schema from "./schema.js";
+import { migrateDatabase } from "./migrations.js";
 export function databasePath(stateDir) {
     return join(stateDir, "devspace.sqlite");
 }
 export function openDatabase(stateDir) {
-    mkdirSync(stateDir, { recursive: true });
-    const sqlite = new Database(databasePath(stateDir));
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    chmodSync(stateDir, 0o700);
+    const path = databasePath(stateDir);
+    const sqlite = new Database(path);
+    chmodSync(path, 0o600);
     sqlite.pragma("journal_mode = WAL");
+    sqlite.pragma("synchronous = NORMAL");
+    sqlite.pragma("busy_timeout = 5000");
     sqlite.pragma("foreign_keys = ON");
+    migrateDatabase(sqlite);
     return {
         sqlite,
         db: createDrizzleDatabase(sqlite),

package/dist/db/migrations.js

@@ -0,0 +1,123 @@
+const migrations = [
+    {
+        version: 1,
+        name: "workspace-state",
+        up: migrateWorkspaceState,
+    },
+    {
+        version: 2,
+        name: "oauth-state",
+        up: migrateOAuthState,
+    },
+];
+export function migrateDatabase(sqlite) {
+    const migrate = sqlite.transaction(() => {
+        sqlite.exec(`
+      create table if not exists devspace_schema_migrations (
+        version integer primary key,
+        name text not null,
+        applied_at text not null
+      );
+    `);
+        const applied = new Set(sqlite.prepare("select version from devspace_schema_migrations").all().map((row) => row.version));
+        const recordMigration = sqlite.prepare("insert into devspace_schema_migrations (version, name, applied_at) values (?, ?, ?)");
+        for (const migration of migrations) {
+            if (applied.has(migration.version))
+                continue;
+            migration.up(sqlite);
+            recordMigration.run(migration.version, migration.name, new Date().toISOString());
+        }
+    });
+    migrate.immediate();
+}
+function migrateWorkspaceState(sqlite) {
+    sqlite.exec(`
+    create table if not exists workspace_sessions (
+      id text primary key,
+      root text not null,
+      status text not null default 'active',
+      mode text not null default 'checkout',
+      source_root text,
+      base_ref text,
+      base_sha text,
+      managed text not null default 'false',
+      created_at text not null,
+      last_used_at text not null
+    );
+
+    create index if not exists workspace_sessions_root_idx
+      on workspace_sessions(root, last_used_at desc);
+
+    create index if not exists workspace_sessions_status_idx
+      on workspace_sessions(status, last_used_at desc);
+
+    create table if not exists loaded_agent_files (
+      workspace_session_id text not null,
+      path text not null,
+      content_hash text not null,
+      content text not null,
+      loaded_at text not null,
+      last_seen_at text not null,
+      primary key (workspace_session_id, path),
+      foreign key (workspace_session_id)
+        references workspace_sessions(id)
+        on delete cascade
+    );
+
+    create index if not exists loaded_agent_files_path_idx
+      on loaded_agent_files(path);
+  `);
+    addColumnIfMissing(sqlite, "workspace_sessions", "mode", "text not null default 'checkout'");
+    addColumnIfMissing(sqlite, "workspace_sessions", "source_root", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "base_ref", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "base_sha", "text");
+    addColumnIfMissing(sqlite, "workspace_sessions", "managed", "text not null default 'false'");
+}
+function migrateOAuthState(sqlite) {
+    sqlite.exec(`
+    create table if not exists oauth_clients (
+      client_id text primary key,
+      client_json text not null,
+      issued_at integer not null
+    );
+
+    create index if not exists oauth_clients_issued_at_idx
+      on oauth_clients(issued_at desc);
+
+    create table if not exists oauth_access_tokens (
+      token_hash text primary key,
+      client_id text not null,
+      scopes_json text not null,
+      expires_at integer not null,
+      resource text,
+      foreign key (client_id) references oauth_clients(client_id) on delete cascade
+    );
+
+    create index if not exists oauth_access_tokens_client_id_idx
+      on oauth_access_tokens(client_id);
+
+    create index if not exists oauth_access_tokens_expires_at_idx
+      on oauth_access_tokens(expires_at);
+
+    create table if not exists oauth_refresh_tokens (
+      token_hash text primary key,
+      client_id text not null,
+      scopes_json text not null,
+      expires_at integer not null,
+      resource text,
+      foreign key (client_id) references oauth_clients(client_id) on delete cascade
+    );
+
+    create index if not exists oauth_refresh_tokens_client_id_idx
+      on oauth_refresh_tokens(client_id);
+
+    create index if not exists oauth_refresh_tokens_expires_at_idx
+      on oauth_refresh_tokens(expires_at);
+  `);
+}
+function addColumnIfMissing(sqlite, table, column, definition) {
+    const columns = sqlite.prepare(`pragma table_info(${table})`).all();
+    if (columns.some((existingColumn) => existingColumn.name === column))
+        return;
+    sqlite.exec(`alter table ${table} add column ${column} ${definition}`);
+}

package/dist/db/schema.js

@@ -1,4 +1,4 @@
-import { index, primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { index, integer, primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
 export const workspaceSessions = sqliteTable("workspace_sessions", {
     id: text("id").primaryKey(),
     root: text("root").notNull(),
@@ -27,3 +27,26 @@ export const loadedAgentFiles = sqliteTable("loaded_agent_files", {
     primaryKey({ columns: [table.workspaceSessionId, table.path] }),
     index("loaded_agent_files_path_idx").on(table.path),
 ]);
+export const oauthClients = sqliteTable("oauth_clients", {
+    clientId: text("client_id").primaryKey(),
+    clientJson: text("client_json").notNull(),
+    issuedAt: integer("issued_at").notNull(),
+});
+export const oauthAccessTokens = sqliteTable("oauth_access_tokens", {
+    tokenHash: text("token_hash").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClients.clientId, { onDelete: "cascade" }),
+    scopesJson: text("scopes_json").notNull(),
+    expiresAt: integer("expires_at").notNull(),
+    resource: text("resource"),
+});
+export const oauthRefreshTokens = sqliteTable("oauth_refresh_tokens", {
+    tokenHash: text("token_hash").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClients.clientId, { onDelete: "cascade" }),
+    scopesJson: text("scopes_json").notNull(),
+    expiresAt: integer("expires_at").notNull(),
+    resource: text("resource"),
+});

package/dist/oauth-provider.js

@@ -1,6 +1,7 @@
 import { timingSafeEqual, randomBytes, randomUUID, createHash } from "node:crypto";
 import { AccessDeniedError, InvalidGrantError, InvalidRequestError, InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+import { SqliteOAuthClientsStore, SqliteOAuthStore } from "./oauth-store.js";
 const CODE_TTL_MS = 5 * 60 * 1000;
 function randomToken() {
     return randomBytes(32).toString("base64url");
@@ -74,55 +75,17 @@ ${hiddenFields}
 function requestedScopesAllowed(requested, supported) {
     return requested.every((scope) => supported.includes(scope));
 }
-function redirectHostAllowed(redirectUri, allowedHosts) {
-    let parsed;
-    try {
-        parsed = new URL(redirectUri);
-    }
-    catch {
-        return false;
-    }
-    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
-        return true;
-    return allowedHosts.includes(parsed.hostname);
-}
-export class InMemoryOAuthClientsStore {
-    allowedRedirectHosts;
-    clients = new Map();
-    constructor(allowedRedirectHosts) {
-        this.allowedRedirectHosts = allowedRedirectHosts;
-    }
-    getClient(clientId) {
-        return this.clients.get(clientId);
-    }
-    registerClient(client) {
-        if (!client.redirect_uris.every((uri) => redirectHostAllowed(uri, this.allowedRedirectHosts))) {
-            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
-        }
-        const now = Math.floor(Date.now() / 1000);
-        const registered = {
-            ...client,
-            client_id: `devspace-${randomUUID()}`,
-            client_id_issued_at: now,
-            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
-            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
-            response_types: client.response_types ?? ["code"],
-        };
-        this.clients.set(registered.client_id, registered);
-        return registered;
-    }
-}
 export class SingleUserOAuthProvider {
     config;
     clientsStore;
     codes = new Map();
-    accessTokens = new Map();
-    refreshTokens = new Map();
+    oauthStore;
     resourceServerUrl;
-    constructor(config, resourceServerUrl) {
+    constructor(config, resourceServerUrl, stateDir) {
         this.config = config;
         this.resourceServerUrl = resourceUrlFromServerUrl(resourceServerUrl);
-        this.clientsStore = new InMemoryOAuthClientsStore(config.allowedRedirectHosts);
+        this.oauthStore = new SqliteOAuthStore(stateDir);
+        this.clientsStore = new SqliteOAuthClientsStore(this.oauthStore, config.allowedRedirectHosts);
     }
     async authorize(client, params, res) {
         if (!params.resource || !checkResourceAllowed({ requestedResource: params.resource, configuredResource: this.resourceServerUrl })) {
@@ -181,7 +144,8 @@ export class SingleUserOAuthProvider {
         return this.issueTokens(client.client_id, record.params.scopes ?? this.config.scopes, record.params.resource);
     }
     async exchangeRefreshToken(client, refreshToken, scopes, resource) {
-        const record = this.refreshTokens.get(hashToken(refreshToken));
+        const refreshTokenHash = hashToken(refreshToken);
+        const record = this.oauthStore.getRefreshToken(refreshTokenHash);
         if (!record || record.clientId !== client.client_id || record.expiresAt < Math.floor(Date.now() / 1000)) {
             throw new InvalidGrantError("Invalid refresh token");
         }
@@ -192,11 +156,10 @@ export class SingleUserOAuthProvider {
         if (!requestedScopes.every((scope) => record.scopes.includes(scope))) {
             throw new AccessDeniedError("Refresh token cannot grant requested scopes");
         }
-        this.refreshTokens.delete(hashToken(refreshToken));
-        return this.issueTokens(client.client_id, requestedScopes, resource ?? record.resource);
+        return this.issueTokens(client.client_id, requestedScopes, resource ?? (record.resource ? new URL(record.resource) : undefined), refreshTokenHash);
     }
     async verifyAccessToken(token) {
-        const record = this.accessTokens.get(hashToken(token));
+        const record = this.oauthStore.getAccessToken(hashToken(token));
         if (!record || record.expiresAt < Math.floor(Date.now() / 1000)) {
             throw new InvalidTokenError("Invalid or expired access token");
         }
@@ -205,13 +168,16 @@ export class SingleUserOAuthProvider {
             clientId: record.clientId,
             scopes: record.scopes,
             expiresAt: record.expiresAt,
-            resource: record.resource,
+            resource: record.resource ? new URL(record.resource) : undefined,
         };
     }
     async revokeToken(_client, request) {
         const hashed = hashToken(request.token);
-        this.accessTokens.delete(hashed);
-        this.refreshTokens.delete(hashed);
+        this.oauthStore.deleteAccessToken(hashed);
+        this.oauthStore.deleteRefreshToken(hashed);
+    }
+    close() {
+        this.oauthStore.close();
     }
     validCodeRecord(client, authorizationCode) {
         const record = this.codes.get(authorizationCode);
@@ -220,26 +186,31 @@ export class SingleUserOAuthProvider {
         }
         return record;
     }
-    issueTokens(clientId, scopes, resource) {
+    issueTokens(clientId, scopes, resource, consumedRefreshTokenHash) {
         const now = Math.floor(Date.now() / 1000);
         const accessToken = randomToken();
         const refreshToken = randomToken();
         const accessExpiresAt = now + this.config.accessTokenTtlSeconds;
         const refreshExpiresAt = now + this.config.refreshTokenTtlSeconds;
-        this.accessTokens.set(hashToken(accessToken), {
-            token: accessToken,
-            clientId,
-            scopes,
-            expiresAt: accessExpiresAt,
-            resource,
-        });
-        this.refreshTokens.set(hashToken(refreshToken), {
-            token: refreshToken,
-            clientId,
-            scopes,
-            expiresAt: refreshExpiresAt,
-            resource,
-        });
+        const saved = this.oauthStore.saveTokenPair({
+            accessTokenHash: hashToken(accessToken),
+            accessToken: {
+                clientId,
+                scopes,
+                expiresAt: accessExpiresAt,
+                resource: resource?.href,
+            },
+            refreshTokenHash: hashToken(refreshToken),
+            refreshToken: {
+                clientId,
+                scopes,
+                expiresAt: refreshExpiresAt,
+                resource: resource?.href,
+            },
+        }, consumedRefreshTokenHash);
+        if (!saved) {
+            throw new InvalidGrantError("Invalid refresh token");
+        }
         return {
             access_token: accessToken,
             token_type: "bearer",

package/dist/oauth-store.js

@@ -0,0 +1,138 @@
+import { randomUUID } from "node:crypto";
+import { InvalidRequestError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { openDatabase } from "./db/client.js";
+function redirectHostAllowed(redirectUri, allowedHosts) {
+    let parsed;
+    try {
+        parsed = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+        return true;
+    return allowedHosts.includes(parsed.hostname);
+}
+export class SqliteOAuthStore {
+    database;
+    constructor(stateDir) {
+        this.database = openDatabase(stateDir);
+        this.deleteExpiredTokens(Math.floor(Date.now() / 1000));
+    }
+    getClient(clientId) {
+        const row = this.database.sqlite
+            .prepare("select client_json from oauth_clients where client_id = ?")
+            .get(clientId);
+        return row ? JSON.parse(row.client_json) : undefined;
+    }
+    registerClient(client, allowedRedirectHosts) {
+        if (!client.redirect_uris.every((uri) => redirectHostAllowed(String(uri), allowedRedirectHosts))) {
+            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const registered = {
+            ...client,
+            client_id: `devspace-${randomUUID()}`,
+            client_id_issued_at: now,
+            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
+            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
+            response_types: client.response_types ?? ["code"],
+        };
+        this.database.sqlite
+            .prepare("insert into oauth_clients (client_id, client_json, issued_at) values (?, ?, ?)")
+            .run(registered.client_id, JSON.stringify(registered), now);
+        return registered;
+    }
+    saveAccessToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_access_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    getAccessToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_access_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToAccessTokenRecord(row) : undefined;
+    }
+    deleteAccessToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where token_hash = ?").run(tokenHash);
+    }
+    saveRefreshToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_refresh_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    saveTokenPair(pair, consumedRefreshTokenHash) {
+        const save = this.database.sqlite.transaction(() => {
+            if (consumedRefreshTokenHash) {
+                const result = this.database.sqlite
+                    .prepare("delete from oauth_refresh_tokens where token_hash = ?")
+                    .run(consumedRefreshTokenHash);
+                if (result.changes !== 1)
+                    return false;
+            }
+            this.saveAccessToken(pair.accessTokenHash, pair.accessToken);
+            this.saveRefreshToken(pair.refreshTokenHash, pair.refreshToken);
+            return true;
+        });
+        return save.immediate();
+    }
+    getRefreshToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_refresh_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToRefreshTokenRecord(row) : undefined;
+    }
+    deleteRefreshToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where token_hash = ?").run(tokenHash);
+    }
+    close() {
+        this.database.close();
+    }
+    deleteExpiredTokens(nowSeconds) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where expires_at < ?").run(nowSeconds);
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where expires_at < ?").run(nowSeconds);
+    }
+}
+export class SqliteOAuthClientsStore {
+    store;
+    allowedRedirectHosts;
+    constructor(store, allowedRedirectHosts) {
+        this.store = store;
+        this.allowedRedirectHosts = allowedRedirectHosts;
+    }
+    getClient(clientId) {
+        return this.store.getClient(clientId);
+    }
+    registerClient(client) {
+        return this.store.registerClient(client, this.allowedRedirectHosts);
+    }
+}
+function rowToAccessTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}
+function rowToRefreshTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}

package/dist/process-platform.js

@@ -0,0 +1,49 @@
+import { basename } from "node:path";
+import { spawnSync } from "node:child_process";
+const defaultProcessTreeRuntime = {
+    platform: process.platform,
+    killGroup: (pid, signal) => process.kill(-pid, signal),
+    killWindowsTree: (pid) => {
+        const result = spawnSync("taskkill.exe", ["/pid", String(pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        return !result.error && result.status === 0;
+    },
+};
+const LOGIN_SHELLS = new Set(["bash", "ksh", "zsh"]);
+const POSIX_SHELLS = new Set(["ash", "dash", "sh"]);
+export function resolveShellCommand(command, platform = process.platform, environment = process.env) {
+    if (platform === "win32") {
+        return {
+            executable: environment.ComSpec ?? environment.COMSPEC ?? "cmd.exe",
+            args: ["/d", "/s", "/c", command],
+        };
+    }
+    const configuredShell = environment.SHELL;
+    const shellName = configuredShell ? basename(configuredShell) : "";
+    if (configuredShell && LOGIN_SHELLS.has(shellName)) {
+        return { executable: configuredShell, args: ["-lc", command] };
+    }
+    if (configuredShell && POSIX_SHELLS.has(shellName)) {
+        return { executable: configuredShell, args: ["-c", command] };
+    }
+    return { executable: "/bin/sh", args: ["-c", command] };
+}
+export function terminateProcessTree(child, signal, detached, runtime = defaultProcessTreeRuntime) {
+    if (runtime.platform === "win32" && child.pid) {
+        if (runtime.killWindowsTree(child.pid))
+            return;
+    }
+    else if (detached && child.pid) {
+        try {
+            runtime.killGroup(child.pid, signal);
+            return;
+        }
+        catch (error) {
+            if (error.code === "ESRCH")
+                return;
+        }
+    }
+    child.kill(signal);
+}