@xopcai/xopc 0.0.224 → 0.0.225

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.js

@@ -0,0 +1,103 @@
+import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore } from "./mcp-oauth-store.js";
+//#region src/agent/mcp/oauth/mcp-oauth-provider.ts
+var XopcMcpOAuthClientProvider = class {
+	store;
+	codeVerifierValue;
+	constructor(options) {
+		this.options = options;
+		this.store = options.store ?? new McpOAuthStore();
+	}
+	get redirectUrl() {
+		return this.options.interaction?.redirectUrl ?? new URL("http://127.0.0.1/oauth/callback");
+	}
+	get clientMetadata() {
+		return {
+			client_name: "XOPC",
+			client_uri: "https://xopc.ai",
+			redirect_uris: [this.redirectUrl.toString()],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none"
+		};
+	}
+	state() {
+		return this.options.interaction?.state;
+	}
+	async clientInformation() {
+		if (this.options.clientId) return { client_id: this.options.clientId };
+		return (await this.store.load(this.options.serverUrl))?.clientInformation;
+	}
+	async saveClientInformation(clientInformation) {
+		await this.store.update(this.options.serverUrl, (current) => ({
+			...current,
+			version: 1,
+			serverUrl: this.options.serverUrl.toString(),
+			clientInformation,
+			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+		}));
+	}
+	async tokens() {
+		return (await this.store.load(this.options.serverUrl))?.tokens;
+	}
+	async saveTokens(tokens) {
+		await this.store.update(this.options.serverUrl, (current) => ({
+			...current,
+			version: 1,
+			serverUrl: this.options.serverUrl.toString(),
+			tokens,
+			tokensSavedAt: Date.now(),
+			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+		}));
+	}
+	async redirectToAuthorization(authorizationUrl) {
+		if (!this.options.interaction) throw new McpAuthorizationRequiredError();
+		await this.options.interaction.onRedirect(authorizationUrl);
+	}
+	saveCodeVerifier(codeVerifier) {
+		this.codeVerifierValue = codeVerifier;
+	}
+	codeVerifier() {
+		if (!this.codeVerifierValue) throw new Error("MCP OAuth code verifier is unavailable");
+		return this.codeVerifierValue;
+	}
+	async saveDiscoveryState(discoveryState) {
+		await this.store.update(this.options.serverUrl, (current) => {
+			const authorizationServerChanged = Boolean(current?.discoveryState?.authorizationServerUrl && current.discoveryState.authorizationServerUrl !== discoveryState.authorizationServerUrl);
+			return {
+				...current,
+				version: 1,
+				serverUrl: this.options.serverUrl.toString(),
+				discoveryState,
+				clientInformation: authorizationServerChanged ? void 0 : current?.clientInformation,
+				tokens: authorizationServerChanged ? void 0 : current?.tokens,
+				tokensSavedAt: authorizationServerChanged ? void 0 : current?.tokensSavedAt,
+				updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+			};
+		});
+	}
+	async discoveryState() {
+		return (await this.store.load(this.options.serverUrl))?.discoveryState;
+	}
+	async invalidateCredentials(scope) {
+		if (scope === "verifier") {
+			this.codeVerifierValue = void 0;
+			return;
+		}
+		await this.store.update(this.options.serverUrl, (current) => {
+			if (!current) return void 0;
+			if (scope === "all") return void 0;
+			return {
+				...current,
+				...scope === "client" ? { clientInformation: void 0 } : {},
+				...scope === "tokens" ? {
+					tokens: void 0,
+					tokensSavedAt: void 0
+				} : {},
+				...scope === "discovery" ? { discoveryState: void 0 } : {}
+			};
+		});
+	}
+};
+//#endregion
+export { XopcMcpOAuthClientProvider };

package/dist/src/agent/mcp/oauth/mcp-oauth-session.d.ts

@@ -0,0 +1,29 @@
+import type { McpOAuthSessionSnapshot } from './mcp-oauth-types.js';
+export declare class McpOAuthSession {
+    readonly serverId: string;
+    readonly serverUrl: URL;
+    readonly id: string;
+    readonly state: string;
+    readonly createdAt: number;
+    readonly expiresAt: number;
+    private statusValue;
+    private authorizationUrlValue?;
+    private errorValue?;
+    private callbackServer?;
+    private redirectUrlValue?;
+    private settleCode?;
+    private callbackConsumed;
+    private readonly codePromise;
+    private timeout?;
+    constructor(serverId: string, serverUrl: URL, ttlMs?: number);
+    get redirectUrl(): URL;
+    start(): Promise<void>;
+    setAuthorizationUrl(url: URL): void;
+    waitForCode(): Promise<string>;
+    complete(): void;
+    fail(error: unknown): void;
+    cancel(): void;
+    snapshot(): McpOAuthSessionSnapshot;
+    close(): Promise<void>;
+    private closeServer;
+}

package/dist/src/agent/mcp/oauth/mcp-oauth-session.js

@@ -0,0 +1,169 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+//#region src/agent/mcp/oauth/mcp-oauth-session.ts
+const CALLBACK_PATH = "/oauth/callback";
+const DEFAULT_SESSION_TTL_MS = 600 * 1e3;
+function callbackPage(title, message) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><h1>${title}</h1><p>${message}</p></body></html>`;
+}
+var McpOAuthSession = class {
+	id = `mcp_oauth_${randomUUID()}`;
+	state = randomBytes(24).toString("base64url");
+	createdAt = Date.now();
+	expiresAt;
+	statusValue = "starting";
+	authorizationUrlValue;
+	errorValue;
+	callbackServer;
+	redirectUrlValue;
+	settleCode;
+	callbackConsumed = false;
+	codePromise;
+	timeout;
+	constructor(serverId, serverUrl, ttlMs = DEFAULT_SESSION_TTL_MS) {
+		this.serverId = serverId;
+		this.serverUrl = serverUrl;
+		this.expiresAt = this.createdAt + ttlMs;
+		this.codePromise = new Promise((resolve) => {
+			this.settleCode = resolve;
+		});
+	}
+	get redirectUrl() {
+		if (!this.redirectUrlValue) throw new Error("MCP OAuth callback server has not started");
+		return this.redirectUrlValue;
+	}
+	async start() {
+		if (this.callbackServer) return;
+		const server = createServer((request, response) => {
+			response.setHeader("content-type", "text/html; charset=utf-8");
+			response.setHeader("cache-control", "no-store");
+			response.setHeader("referrer-policy", "no-referrer");
+			response.setHeader("x-content-type-options", "nosniff");
+			try {
+				const callback = new URL(request.url ?? "", "http://127.0.0.1");
+				if (callback.pathname !== CALLBACK_PATH) {
+					response.statusCode = 404;
+					response.end(callbackPage("Not found", "This is not an XOPC OAuth callback."));
+					return;
+				}
+				if (callback.searchParams.get("state") !== this.state) {
+					response.statusCode = 400;
+					response.end(callbackPage("Authorization failed", "MCP OAuth state mismatch"));
+					return;
+				}
+				if (this.callbackConsumed) {
+					response.statusCode = 409;
+					response.end(callbackPage("Authorization already handled", "Return to XOPC to continue."));
+					return;
+				}
+				const oauthError = callback.searchParams.get("error");
+				const code = callback.searchParams.get("code");
+				if (oauthError || !code) {
+					const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "Authorization was denied" : "Authorization code is missing");
+					response.statusCode = 400;
+					response.end(callbackPage("Authorization failed", error.message));
+					this.fail(error);
+					return;
+				}
+				this.callbackConsumed = true;
+				this.statusValue = "exchanging_code";
+				response.statusCode = 200;
+				response.end(callbackPage("Authorization complete", "Return to XOPC to finish connecting the MCP server."));
+				this.settleCode?.({ code });
+				this.settleCode = void 0;
+			} catch {
+				const error = /* @__PURE__ */ new Error("MCP OAuth callback could not be processed");
+				response.statusCode = 500;
+				response.end(callbackPage("Authorization failed", error.message));
+				this.fail(error);
+			}
+		});
+		this.callbackServer = server;
+		try {
+			this.redirectUrlValue = await new Promise((resolve, reject) => {
+				server.once("error", reject);
+				server.listen(0, "127.0.0.1", () => {
+					server.removeListener("error", reject);
+					const address = server.address();
+					if (!address || typeof address === "string") {
+						reject(/* @__PURE__ */ new Error("MCP OAuth callback server did not expose a TCP port"));
+						return;
+					}
+					resolve(new URL(`http://127.0.0.1:${address.port}${CALLBACK_PATH}`));
+				});
+			});
+		} catch (error) {
+			this.callbackServer = void 0;
+			server.close();
+			throw error;
+		}
+		this.timeout = setTimeout(() => {
+			this.statusValue = "expired";
+			this.errorValue = "MCP OAuth session expired";
+			this.settleCode?.({ error: new Error(this.errorValue) });
+			this.settleCode = void 0;
+			this.closeServer();
+		}, Math.max(1, this.expiresAt - Date.now()));
+		this.timeout.unref?.();
+	}
+	setAuthorizationUrl(url) {
+		this.authorizationUrlValue = url.toString();
+		this.statusValue = "waiting_browser";
+	}
+	async waitForCode() {
+		const result = await this.codePromise;
+		if (result.error) throw result.error;
+		if (!result.code) throw new Error("MCP OAuth authorization code is unavailable");
+		return result.code;
+	}
+	complete() {
+		this.statusValue = "connected";
+		this.errorValue = void 0;
+		this.closeServer();
+	}
+	fail(error) {
+		this.statusValue = "failed";
+		this.errorValue = error instanceof Error ? error.message : String(error);
+		this.settleCode?.({ error: error instanceof Error ? error : new Error(String(error)) });
+		this.settleCode = void 0;
+		this.closeServer();
+	}
+	cancel() {
+		if ([
+			"connected",
+			"failed",
+			"expired",
+			"cancelled"
+		].includes(this.statusValue)) return;
+		this.statusValue = "cancelled";
+		this.settleCode?.({ error: /* @__PURE__ */ new Error("MCP OAuth session cancelled") });
+		this.settleCode = void 0;
+		this.closeServer();
+	}
+	snapshot() {
+		return {
+			id: this.id,
+			serverId: this.serverId,
+			serverUrl: this.serverUrl.toString(),
+			status: this.statusValue,
+			authorizationUrl: this.authorizationUrlValue,
+			error: this.errorValue,
+			createdAt: this.createdAt,
+			expiresAt: this.expiresAt
+		};
+	}
+	async close() {
+		this.cancel();
+		await this.closeServer();
+	}
+	async closeServer() {
+		if (this.timeout) clearTimeout(this.timeout);
+		this.timeout = void 0;
+		const server = this.callbackServer;
+		this.callbackServer = void 0;
+		if (!server) return;
+		await new Promise((resolve) => server.close(() => resolve()));
+	}
+};
+//#endregion
+export { McpOAuthSession };

package/dist/src/agent/mcp/oauth/mcp-oauth-store.d.ts

@@ -0,0 +1,9 @@
+import type { McpOAuthRecord } from './mcp-oauth-types.js';
+export declare function canonicalMcpServerUrl(input: string | URL): string;
+export declare function mcpOAuthServerKey(input: string | URL): string;
+export declare class McpOAuthStore {
+    pathFor(serverUrl: string | URL): string;
+    load(serverUrlInput: string | URL): Promise<McpOAuthRecord | undefined>;
+    update(serverUrlInput: string | URL, update: (current: McpOAuthRecord | undefined) => McpOAuthRecord | undefined): Promise<McpOAuthRecord | undefined>;
+    delete(serverUrl: string | URL): Promise<void>;
+}

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -0,0 +1,79 @@
+import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { createHash } from "node:crypto";
+import { readFile, rm } from "node:fs/promises";
+//#region src/agent/mcp/oauth/mcp-oauth-store.ts
+init_paths();
+init_write_file_atomic();
+const writeTails = /* @__PURE__ */ new Map();
+function canonicalMcpServerUrl(input) {
+	const url = input instanceof URL ? new URL(input) : new URL(input);
+	url.hash = "";
+	return url.toString();
+}
+function mcpOAuthServerKey(input) {
+	return createHash("sha256").update(canonicalMcpServerUrl(input)).digest("hex");
+}
+function isStoredRecord(value, serverUrl) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	if (record.version !== 1 || record.serverUrl !== serverUrl || typeof record.updatedAt !== "string") return false;
+	if (record.tokens !== void 0) {
+		const tokens = record.tokens;
+		if (typeof tokens.access_token !== "string" || typeof tokens.token_type !== "string") return false;
+	}
+	return true;
+}
+async function serializeWrite(key, operation) {
+	const previous = writeTails.get(key) ?? Promise.resolve();
+	let release;
+	const gate = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.catch(() => void 0).then(() => gate);
+	writeTails.set(key, tail);
+	await previous.catch(() => void 0);
+	try {
+		return await operation();
+	} finally {
+		release();
+		if (writeTails.get(key) === tail) writeTails.delete(key);
+	}
+}
+var McpOAuthStore = class {
+	pathFor(serverUrl) {
+		return resolveMcpOAuthPath(mcpOAuthServerKey(serverUrl));
+	}
+	async load(serverUrlInput) {
+		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
+		try {
+			const parsed = JSON.parse(await readFile(this.pathFor(serverUrl), "utf8"));
+			return isStoredRecord(parsed, serverUrl) ? parsed : void 0;
+		} catch {
+			return;
+		}
+	}
+	async update(serverUrlInput, update) {
+		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
+		return serializeWrite(mcpOAuthServerKey(serverUrl), async () => {
+			const next = update(await this.load(serverUrl));
+			if (!next) {
+				await rm(this.pathFor(serverUrl), { force: true });
+				return;
+			}
+			const normalized = {
+				...next,
+				version: 1,
+				serverUrl,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			await writeTextAtomic(this.pathFor(serverUrl), JSON.stringify(normalized, null, 2));
+			return normalized;
+		});
+	}
+	async delete(serverUrl) {
+		await this.update(serverUrl, () => void 0);
+	}
+};
+//#endregion
+export { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey };

package/dist/src/agent/mcp/oauth/mcp-oauth-types.d.ts

@@ -0,0 +1,22 @@
+import type { OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+export type McpOAuthRecord = {
+    version: 1;
+    serverUrl: string;
+    clientInformation?: OAuthClientInformationMixed;
+    discoveryState?: OAuthDiscoveryState;
+    tokens?: OAuthTokens;
+    tokensSavedAt?: number;
+    updatedAt: string;
+};
+export type McpOAuthSessionStatus = 'starting' | 'waiting_browser' | 'exchanging_code' | 'connected' | 'failed' | 'expired' | 'cancelled';
+export type McpOAuthSessionSnapshot = {
+    id: string;
+    serverId: string;
+    serverUrl: string;
+    status: McpOAuthSessionStatus;
+    authorizationUrl?: string;
+    error?: string;
+    createdAt: number;
+    expiresAt: number;
+};

package/dist/src/agent/mcp/oauth/mcp-oauth-types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/agent/memory/builtin-provider.js

@@ -1,6 +1,7 @@
 import { init_agent_session_key, normalizeAgentId } from "../../routing/agent-session-key.js";
 import { appendMemorySignal, deleteMemoryRecord, getMemoryRecord, listMemoryRecords, searchMemoryRecords, upsertMemoryRecord } from "../../storage/sqlite/memory-records-repository.js";
 import "../../storage/sqlite/index.js";
+import { resolveMemorySessionKind } from "./turn-provenance.js";
 //#region src/agent/memory/builtin-provider.ts
 init_agent_session_key();
 /**
@@ -44,7 +45,8 @@ var BuiltinMemoryProvider = class {
 			unscopedWorkspaceOnly: request.scope?.workspaceId == null,
 			kinds: request.kinds,
 			maxResults: request.maxResults,
-			minScore: request.minScore
+			minScore: request.minScore,
+			trustedOnly: request.trustedOnly
 		};
 		const [active, shadow] = [searchMemoryRecords(options), searchMemoryRecords({
 			...options,
@@ -90,10 +92,13 @@ var BuiltinMemoryProvider = class {
 		});
 	}
 	async write(request) {
+		const sourceAgentId = normalizeAgentId(request.sourceAgentId ?? "main");
+		const sourceSessionId = request.provenance?.sourceSessionId ?? request.scope?.sessionKey;
+		const originClass = request.confirmed ? "owner" : request.provenance?.originClass ?? "agent";
 		const record = upsertMemoryRecord({
 			providerId: this.id,
 			kind: request.kind,
-			sourceAgentId: normalizeAgentId(request.sourceAgentId ?? "main"),
+			sourceAgentId,
 			workspaceId: request.scope?.workspaceId,
 			sessionKey: request.scope?.sessionKey,
 			projectId: request.scope?.projectId,
@@ -117,7 +122,14 @@ var BuiltinMemoryProvider = class {
 			reviewAfter: request.reviewAfter,
 			expiresAt: request.expiresAt,
 			supersedesRecordId: request.supersedesRecordId,
-			conflictGroupId: request.conflictGroupId
+			conflictGroupId: request.conflictGroupId,
+			originClass,
+			sessionKind: request.provenance?.sessionKind ?? (sourceSessionId ? resolveMemorySessionKind(sourceSessionId) : "unknown"),
+			observedAt: request.provenance?.observedAt,
+			sourceSessionId,
+			sourceTurnId: request.provenance?.sourceTurnId,
+			supersedesKey: request.provenance?.supersedesKey,
+			derivedFromRecalledContext: request.confirmed ? false : request.provenance?.derivedFromRecalledContext
 		});
 		return {
 			success: true,
@@ -164,7 +176,14 @@ var BuiltinMemoryProvider = class {
 				reviewAfter: existing.reviewAfter,
 				expiresAt: existing.expiresAt,
 				supersedesRecordId: existing.supersedesRecordId,
-				conflictGroupId: existing.conflictGroupId
+				conflictGroupId: existing.conflictGroupId,
+				originClass: existing.provenance.originClass,
+				sessionKind: existing.provenance.sessionKind,
+				observedAt: existing.provenance.observedAt,
+				sourceSessionId: existing.provenance.sourceSessionId,
+				sourceTurnId: existing.provenance.sourceTurnId,
+				supersedesKey: existing.provenance.supersedesKey,
+				derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 			})
 		};
 	}

package/dist/src/agent/memory/compaction-promotion.d.ts

@@ -0,0 +1,18 @@
+import type { CompactionAudit, CompactionHandover } from '../../session/compaction-types.js';
+import type { TranscriptSourceEntry } from '../../storage/sqlite/transcript-repository.js';
+export interface PromoteCompactionLedgerInput {
+    sessionKey: string;
+    sessionId: string;
+    sourceAgentId: string;
+    workspaceId: string;
+    projectId?: string;
+    handover: CompactionHandover;
+    audit: CompactionAudit;
+    sourceEntries: readonly TranscriptSourceEntry[];
+}
+export interface PromoteCompactionLedgerResult {
+    episodicRecordIds: string[];
+    durableRecordIds: string[];
+    rejectedRecordIds: string[];
+}
+export declare function promoteCompactionLedger(input: PromoteCompactionLedgerInput): PromoteCompactionLedgerResult;