@yagni-app/code 1.0.5 → 1.0.6

package/dist/extension/mcp/authStore.js

@@ -0,0 +1,105 @@
+/**
+ * OAuth token + client-credential store for MCP servers, pure file I/O (no
+ * network, no pi imports) so it is shared verbatim between the extension
+ * session and the `yagni mcp` CLI (revoke-on-remove reads it too).
+ *
+ *   ~/.yagni-code/mcp-auth.json   (0600 — access/refresh tokens and any
+ *                                 pre-registered client secret are secrets)
+ *
+ * Entries are keyed `serverName|<sha256(type+url+headers)[:16]>` — the same
+ * key Claude Code derives via `getServerKey`, so a server whose URL/headers
+ * change invalidates its stored credentials automatically. Writes are atomic
+ * (temp + rename) and chmod 0600, exactly like the mcp.json config writes.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { codeStateHome } from "../stateHome.js";
+/** Test seam (same shape as _setMcpHomeForTest in config.ts). */
+let authHomeOverride = null;
+export function _setMcpAuthHomeForTest(dir) {
+    authHomeOverride = dir;
+}
+export function mcpAuthPath() {
+    return join(codeStateHome(authHomeOverride), "mcp-auth.json");
+}
+/**
+ * The stable key for one server's credentials. Hash covers type + url +
+ * headers (NOT the client id, matching Claude Code) so a URL/header change
+ * orphans old tokens rather than silently reusing them against a different
+ * endpoint.
+ */
+export function getServerKey(serverName, config) {
+    const hash = createHash("sha256")
+        .update(JSON.stringify({ type: config.type, url: config.url, headers: config.headers ?? {} }))
+        .digest("hex")
+        .substring(0, 16);
+    return `${serverName}|${hash}`;
+}
+/** Read + parse the auth store; missing/unparseable → empty with error noted. */
+export function readMcpAuth() {
+    const path = mcpAuthPath();
+    if (!existsSync(path))
+        return { file: {}, errors: [] };
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return { file: {}, errors: ["mcp-auth.json is not a JSON object"] };
+        }
+        return { file: parsed, errors: [] };
+    }
+    catch (err) {
+        return { file: {}, errors: [`mcp-auth.json unreadable (${err instanceof Error ? err.message : String(err)})`] };
+    }
+}
+/** Atomic write + chmod 0600 (tokens/secrets must never be world-readable). */
+export function writeMcpAuth(file) {
+    const path = mcpAuthPath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = join(dirname(path), `.mcp-auth.json.tmp-${process.pid}`);
+    writeFileSync(tmp, JSON.stringify(file, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    renameSync(tmp, path);
+    chmodSync(path, 0o600);
+}
+/** Read one entry by server key; undefined when absent. */
+export function getStoredOAuthEntry(serverName, config) {
+    const { file } = readMcpAuth();
+    return file.servers?.[getServerKey(serverName, config)];
+}
+/**
+ * Read-modify-write one entry. `mutate` receives the current entry (or a fresh
+ * one) and may edit it in place; returning `false` deletes it. Used by both
+ * the provider (save tokens/creds) and revocation (clear on remove).
+ */
+export function updateStoredOAuthEntry(serverName, config, mutate) {
+    const { file, errors } = readMcpAuth();
+    if (errors.length > 0)
+        return { errors };
+    const key = getServerKey(serverName, config);
+    const servers = file.servers ?? {};
+    const entry = servers[key] ?? { serverName, serverUrl: config.url };
+    const result = mutate(entry);
+    if (result === false) {
+        delete servers[key];
+    }
+    else {
+        servers[key] = entry;
+    }
+    // Drop the file entirely when every entry is gone, so a fresh dir is clean.
+    if (Object.keys(servers).length > 0)
+        file.servers = servers;
+    else
+        delete file.servers;
+    try {
+        writeMcpAuth(file);
+        return { errors: [] };
+    }
+    catch (err) {
+        return { errors: [`could not write mcp-auth.json (${err instanceof Error ? err.message : String(err)})`] };
+    }
+}
+/** Remove every credential entry (used by revoke-on-remove). */
+export function deleteStoredOAuthEntry(serverName, config) {
+    return updateStoredOAuthEntry(serverName, config, () => false);
+}
+//# sourceMappingURL=authStore.js.map

package/dist/extension/mcp/callbackPage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The loopback OAuth callback page — the only surface a user ever sees served
+ * from the local `127.0.0.1:<port>/callback` listener. Rendered with the same
+ * Glass & Print language as the app: tinted blue field, floating glass card,
+ * one blue accent, three type voices (Instrument Sans interface / Newsreader
+ * authored / IBM Plex Mono fact).
+ *
+ * Self-contained: no external assets, fonts, or network calls — the page must
+ * render offline and never phone home. Tokens are inlined from
+ * packages/frontend/src/styles/tokens.css so this module can't drift a runtime
+ * dependency on the frontend build; token names are kept in comments so a
+ * re-derivation stays mechanical.
+ *
+ * `escapeHtml` is applied by the caller to every provider-controlled value
+ * before interpolation (a local process can hit the loopback with a crafted
+ * ?error=<script> payload — the page never reflects raw input).
+ */
+/** The success page shown after the provider redirects back with a code. */
+export declare function renderAuthSuccessPage(): string;
+/**
+ * The error page shown when the provider bounces the flow. `error` and
+ * `errorDescription` are provider-controlled and already HTML-escaped by the
+ * caller.
+ */
+export declare function renderAuthErrorPage(opts: {
+    error?: string;
+    errorDescription?: string;
+}): string;
+/** The state-mismatch page — a hard failure, shown before the flow aborts. */
+export declare function renderAuthStateMismatchPage(): string;
+//# sourceMappingURL=callbackPage.d.ts.map

package/dist/extension/mcp/callbackPage.js

@@ -0,0 +1,222 @@
+/**
+ * The loopback OAuth callback page — the only surface a user ever sees served
+ * from the local `127.0.0.1:<port>/callback` listener. Rendered with the same
+ * Glass & Print language as the app: tinted blue field, floating glass card,
+ * one blue accent, three type voices (Instrument Sans interface / Newsreader
+ * authored / IBM Plex Mono fact).
+ *
+ * Self-contained: no external assets, fonts, or network calls — the page must
+ * render offline and never phone home. Tokens are inlined from
+ * packages/frontend/src/styles/tokens.css so this module can't drift a runtime
+ * dependency on the frontend build; token names are kept in comments so a
+ * re-derivation stays mechanical.
+ *
+ * `escapeHtml` is applied by the caller to every provider-controlled value
+ * before interpolation (a local process can hit the loopback with a crafted
+ * ?error=<script> payload — the page never reflects raw input).
+ */
+const CSS = `
+  :root {
+    /* tokens.css — field, ink, accent, materials */
+    --field-base: #f4f6fc;
+    --field-tint-blue: #dfe8ff;
+    --field-tint-violet: #e8e4ff;
+    --field-tint-cyan: #e3f0f6;
+    --ink: #23252e;
+    --ink-strong: #181a22;
+    --text-secondary: #565b72;
+    --text-quiet: #8b90a5;
+    --text-label: #7b8098;
+    --accent: #2f56d3;
+    --accent-muted: rgba(47, 86, 211, 0.12);
+    --accent-border: rgba(47, 86, 211, 0.3);
+    --error: #b4452f;
+    --error-muted: rgba(180, 69, 47, 0.07);
+    --glass-bg: rgba(255, 255, 255, 0.55);
+    --glass-border: rgba(255, 255, 255, 0.85);
+    --glass-blur: 18px;
+    --radius-pane: 16px;
+    --shadow-staged: 0 1px 2px rgba(24, 34, 64, 0.07), 0 18px 40px -30px rgba(38, 52, 110, 0.35);
+    --shadow-staged-high: 0 1px 2px rgba(24, 34, 64, 0.08), 0 28px 60px -28px rgba(38, 52, 110, 0.42);
+    --body: "Instrument Sans Variable", "Instrument Sans", system-ui, sans-serif;
+    --prose: "Newsreader", ui-serif, Georgia, serif;
+    --mono: "IBM Plex Mono", ui-monospace, monospace;
+  }
+
+  * { box-sizing: border-box; }
+
+  html, body { height: 100%; }
+
+  body {
+    margin: 0;
+    min-height: 100%;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    font-family: var(--body);
+    color: var(--ink);
+    background:
+      radial-gradient(1200px 700px at 8% -5%, var(--field-tint-blue) 0, rgba(223, 232, 255, 0) 60%),
+      radial-gradient(900px 600px at 95% 0%, var(--field-tint-violet) 0, rgba(232, 228, 255, 0) 55%),
+      radial-gradient(900px 700px at 60% 100%, var(--field-tint-cyan) 0, rgba(227, 240, 246, 0) 60%),
+      var(--field-base);
+  }
+
+  .card {
+    width: 100%;
+    max-width: 400px;
+    text-align: center;
+    padding: 40px 32px 32px;
+    background: var(--glass-bg);
+    -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(1.15);
+    backdrop-filter: blur(var(--glass-blur)) saturate(1.15);
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-pane);
+    box-shadow: var(--shadow-staged-high);
+    animation: rise 420ms cubic-bezier(0.22, 1, 0.36, 1) both;
+  }
+
+  @keyframes rise {
+    from { opacity: 0; transform: translateY(8px); }
+    to { opacity: 1; transform: none; }
+  }
+
+  .wordmark {
+    font-family: var(--mono);
+    font-size: 10px;
+    font-weight: 600;
+    letter-spacing: 0.22em;
+    text-transform: uppercase;
+    color: var(--text-label);
+    margin: 0 0 28px;
+  }
+
+  .badge {
+    width: 52px;
+    height: 52px;
+    margin: 0 auto 20px;
+    display: grid;
+    place-items: center;
+    border-radius: 14px;
+    background: var(--accent-muted);
+    border: 1px solid var(--accent-border);
+    color: var(--accent);
+  }
+
+  .card--error .badge {
+    background: var(--error-muted);
+    border-color: rgba(180, 69, 47, 0.28);
+    color: var(--error);
+  }
+
+  h1 {
+    font-family: var(--prose);
+    font-size: 30px;
+    font-weight: 600;
+    line-height: 1.15;
+    letter-spacing: -0.01em;
+    color: var(--ink-strong);
+    margin: 0 0 10px;
+  }
+
+  .lede {
+    font-size: 14px;
+    line-height: 1.55;
+    color: var(--text-secondary);
+    margin: 0 0 24px;
+  }
+
+  .detail {
+    font-family: var(--mono);
+    font-size: 12px;
+    line-height: 1.5;
+    color: var(--error);
+    background: var(--error-muted);
+    border: 1px solid rgba(180, 69, 47, 0.2);
+    border-radius: 8px;
+    padding: 8px 10px;
+    margin: 0 0 24px;
+    word-break: break-word;
+  }
+
+  .divider {
+    height: 1px;
+    margin: 0 0 20px;
+    background: linear-gradient(90deg, transparent, var(--accent-border), transparent);
+  }
+
+  .hint {
+    font-size: 12.5px;
+    color: var(--text-quiet);
+    margin: 0;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .card { animation: none; }
+  }
+`;
+const CHECK_ICON = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>`;
+const ERROR_ICON = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><line x1="12" y1="8" x2="12" y2="13"/><line x1="12" y1="16.5" x2="12.01" y2="16.5"/></svg>`;
+function shell(opts) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light">
+<title>${opts.title} — YAGNI Code</title>
+<style>${CSS}</style>
+</head>
+<body>
+  <main class="card${opts.error ? " card--error" : ""}">
+    <p class="wordmark">YAGNI Code</p>
+    <div class="badge">${opts.error ? ERROR_ICON : CHECK_ICON}</div>
+    <h1>${opts.heading}</h1>
+    <p class="lede">${opts.lede}</p>
+    ${opts.detail ? `<p class="detail">${opts.detail}</p>` : ""}
+    <div class="divider"></div>
+    <p class="hint">${opts.hint}</p>
+  </main>
+</body>
+</html>`;
+}
+/** The success page shown after the provider redirects back with a code. */
+export function renderAuthSuccessPage() {
+    return shell({
+        title: "Connected",
+        heading: "Connected to YAGNI Code",
+        lede: "Your MCP server is authorized and ready to use.",
+        hint: "You can close this window and return to your session.",
+    });
+}
+/**
+ * The error page shown when the provider bounces the flow. `error` and
+ * `errorDescription` are provider-controlled and already HTML-escaped by the
+ * caller.
+ */
+export function renderAuthErrorPage(opts) {
+    const detail = opts.error
+        ? opts.errorDescription
+            ? `${opts.error}: ${opts.errorDescription}`
+            : opts.error
+        : undefined;
+    return shell({
+        title: "Connection failed",
+        error: true,
+        heading: "Authentication didn't complete",
+        lede: "The provider didn't finish the sign-in flow.",
+        detail,
+        hint: "You can close this window and try again from YAGNI Code.",
+    });
+}
+/** The state-mismatch page — a hard failure, shown before the flow aborts. */
+export function renderAuthStateMismatchPage() {
+    return shell({
+        title: "Connection failed",
+        error: true,
+        heading: "Authentication didn't complete",
+        lede: "The sign-in response didn't match the request, so it was rejected.",
+        hint: "You can close this window and try again from YAGNI Code.",
+    });
+}
+//# sourceMappingURL=callbackPage.js.map

package/dist/extension/mcp/cliConfig.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The extension's MCP config surface, re-exported for the CLI launcher
+ * (`yagni mcp …`, `yagni-code-cli/src/mcpCommand.ts` imports this file by path
+ * from its bundled copy). Pure config I/O — no pi imports, no TUI, no network —
+ * so importing it from the launcher is side-effect-free.
+ */
+export { McpServerConfig, McpScope, PROJECT_CONFIG_FILENAME, ScopedMcpServerConfig, expandEnvVarsInString, expandServerEnv, loadMcpServers, mcpConfigPath, readProjectMcpConfig, readUserMcpConfig, resolveProjectRoot, validateServerConfig, writeUserMcpConfig, } from "./config.js";
+export { ProjectApprovalState, decisionFor, readProjectApproval, recordProjectDecision, resetProjectChoices, undecidedProjectServers, } from "./approval.js";
+export { McpAuthFile, StoredOAuthEntry, deleteStoredOAuthEntry, getServerKey, getStoredOAuthEntry, mcpAuthPath, readMcpAuth, updateStoredOAuthEntry, writeMcpAuth, } from "./authStore.js";
+export { revokeTokensOnRemove } from "./auth.js";
+export { probeServer, McpHealthResult, McpHealthStatus } from "./manager.js";
+//# sourceMappingURL=cliConfig.d.ts.map

package/dist/extension/mcp/cliConfig.js

@@ -0,0 +1,12 @@
+/**
+ * The extension's MCP config surface, re-exported for the CLI launcher
+ * (`yagni mcp …`, `yagni-code-cli/src/mcpCommand.ts` imports this file by path
+ * from its bundled copy). Pure config I/O — no pi imports, no TUI, no network —
+ * so importing it from the launcher is side-effect-free.
+ */
+export { PROJECT_CONFIG_FILENAME, expandEnvVarsInString, expandServerEnv, loadMcpServers, mcpConfigPath, readProjectMcpConfig, readUserMcpConfig, resolveProjectRoot, validateServerConfig, writeUserMcpConfig, } from "./config.js";
+export { decisionFor, readProjectApproval, recordProjectDecision, resetProjectChoices, undecidedProjectServers, } from "./approval.js";
+export { deleteStoredOAuthEntry, getServerKey, getStoredOAuthEntry, mcpAuthPath, readMcpAuth, updateStoredOAuthEntry, writeMcpAuth, } from "./authStore.js";
+export { revokeTokensOnRemove } from "./auth.js";
+export { probeServer } from "./manager.js";
+//# sourceMappingURL=cliConfig.js.map

package/dist/extension/mcp/config.d.ts

@@ -0,0 +1,131 @@
+/**
+ * MCP server configuration for YAGNI Code: three scopes, Claude Code-compatible.
+ *
+ *  - project: `.mcp.json` at the repo root — the exact Claude Code schema
+ *    (`{"mcpServers": {...}}`), VCS-shared, approval-gated (see approval.ts).
+ *    A repo configured for Claude Code works here with zero changes.
+ *  - user: top-level `mcpServers` in `~/.yagni-code/mcp.json`.
+ *  - local: `projects[<absPath>].mcpServers` in the same file, keyed by cwd.
+ *
+ * Merge precedence (Claude Code parity): user < project < local — later wins.
+ * Writes are atomic (temp file + rename) so two concurrent sessions can never
+ * interleave into a corrupt config. Validation errors are collected and
+ * surfaced, never fatal: one malformed server entry must not hide the rest.
+ */
+export type McpScope = "user" | "project" | "local";
+export interface McpStdioServerConfig {
+    type?: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+}
+/** OAuth 2.1 settings for an http/sse server (Claude Code's `oauth` shape). */
+export interface McpOAuthConfig {
+    /** Pre-registered client id (overrides/avoids DCR when present). */
+    clientId?: string;
+    /** Fixed loopback callback port for servers that require a registered redirect URI. */
+    callbackPort?: number;
+}
+export interface McpHttpServerConfig {
+    type: "http" | "sse";
+    url: string;
+    headers?: Record<string, string>;
+    oauth?: McpOAuthConfig;
+}
+export type McpServerConfig = McpStdioServerConfig | McpHttpServerConfig;
+export interface ScopedMcpServerConfig {
+    name: string;
+    config: McpServerConfig;
+    scope: McpScope;
+    /** Where this entry came from (file path) — surfaced in /mcp and `yagni mcp get`. */
+    sourcePath: string;
+}
+export interface McpConfigError {
+    /** File the problem was found in. */
+    sourcePath: string;
+    /** Server name when the error is about one entry; the file itself otherwise. */
+    serverName?: string;
+    message: string;
+}
+export declare const PROJECT_CONFIG_FILENAME = ".mcp.json";
+/**
+ * Expand `${VAR}` / `${VAR:-default}` in a config string (Claude Code parity —
+ * .mcp.json files are VCS-shared, so secrets come from the environment).
+ * Missing vars with no default are reported, left in place, and skipped at
+ * connect time so a half-expanded command never spawns.
+ */
+export declare function expandEnvVarsInString(value: string, env?: NodeJS.ProcessEnv): {
+    expanded: string;
+    missingVars: string[];
+};
+/** Where env expansion applies within one server config (stdio: command,
+ * args, env values; http/sse: url and header values). */
+export declare function expandServerEnv(config: McpServerConfig, env?: NodeJS.ProcessEnv): {
+    config: McpServerConfig;
+    missingVars: string[];
+};
+/**
+ * The `~/.yagni-code/mcp.json` shape. Top-level `mcpServers` is the user scope;
+ * `projects[<absPath>]` holds per-directory local servers plus this project's
+ * `.mcp.json` approval choices (Claude Code's exact key names, so the approval
+ * state reads the same way in both tools).
+ */
+/** Per-project entry inside `~/.yagni-code/mcp.json`. */
+export interface UserMcpProjectEntry {
+    mcpServers?: Record<string, McpServerConfig>;
+    enabledMcpjsonServers?: string[];
+    disabledMcpjsonServers?: string[];
+    enableAllProjectMcpServers?: boolean;
+    /** User/local-scope servers disabled from the /mcp panel for this project. */
+    disabledMcpServers?: string[];
+}
+export interface UserMcpConfigFile {
+    mcpServers?: Record<string, McpServerConfig>;
+    projects?: Record<string, UserMcpProjectEntry>;
+}
+export declare function _setMcpHomeForTest(dir: string | null): void;
+export declare function mcpConfigPath(): string;
+/** Read + parse `~/.yagni-code/mcp.json`; unreadable/missing → empty with error collected. */
+export declare function readUserMcpConfig(): {
+    file: UserMcpConfigFile;
+    errors: McpConfigError[];
+};
+/** Atomic write: temp file in the same directory, then rename over the target. */
+export declare function writeUserMcpConfig(file: UserMcpConfigFile): void;
+/** Read + parse a project `.mcp.json`; missing → empty (not an error). */
+export declare function readProjectMcpConfig(repoRoot: string, read?: (path: string) => string | undefined): {
+    servers: Record<string, McpServerConfig>;
+    errors: McpConfigError[];
+};
+/**
+ * Structural validation of one server entry. Claude Code uses zod; we don't
+ * depend on zod, so this hand-checks the same union: stdio (no type / "stdio",
+ * non-empty command) vs http/sse (type + url).
+ */
+export declare function validateServerConfig(value: unknown): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export interface LoadMcpServersResult {
+    servers: ScopedMcpServerConfig[];
+    errors: McpConfigError[];
+}
+/**
+ * The repo root for project-scope lookup: the nearest ancestor of `cwd` that
+ * looks like a repo (has `.git`, `.mcp.json`, or is a known project root).
+ * Falls back to cwd itself. CC walks ALL ancestors and merges nearest-wins;
+ * we take the nearest repo boundary — same result for the normal case of one
+ * repo, and it keeps the approval prompt anchored to one file.
+ */
+export declare function resolveProjectRoot(cwd: string, exists?: (p: string) => boolean): string;
+/**
+ * Load all three scopes and merge with precedence user < project < local.
+ * Invalid entries are dropped (with errors) rather than failing the load; a
+ * same-name entry in a higher-precedence scope replaces the lower one.
+ * Project servers are returned regardless of approval state — the caller
+ * (session startup, panel, CLI) applies the approval gate via approval.ts.
+ */
+export declare function loadMcpServers(cwd: string, env?: NodeJS.ProcessEnv): LoadMcpServersResult;
+//# sourceMappingURL=config.d.ts.map