@zoer7788/mcp-nexus-node 0.1.6 → 0.1.7

package/vendor/devspace/dist/oauth-store.js

@@ -0,0 +1,138 @@
+import { randomUUID } from "node:crypto";
+import { InvalidRequestError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { openDatabase } from "./db/client.js";
+function redirectHostAllowed(redirectUri, allowedHosts) {
+    let parsed;
+    try {
+        parsed = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+        return true;
+    return allowedHosts.includes(parsed.hostname);
+}
+export class SqliteOAuthStore {
+    database;
+    constructor(stateDir) {
+        this.database = openDatabase(stateDir);
+        this.deleteExpiredTokens(Math.floor(Date.now() / 1000));
+    }
+    getClient(clientId) {
+        const row = this.database.sqlite
+            .prepare("select client_json from oauth_clients where client_id = ?")
+            .get(clientId);
+        return row ? JSON.parse(row.client_json) : undefined;
+    }
+    registerClient(client, allowedRedirectHosts) {
+        if (!client.redirect_uris.every((uri) => redirectHostAllowed(String(uri), allowedRedirectHosts))) {
+            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const registered = {
+            ...client,
+            client_id: `devspace-${randomUUID()}`,
+            client_id_issued_at: now,
+            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
+            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
+            response_types: client.response_types ?? ["code"],
+        };
+        this.database.sqlite
+            .prepare("insert into oauth_clients (client_id, client_json, issued_at) values (?, ?, ?)")
+            .run(registered.client_id, JSON.stringify(registered), now);
+        return registered;
+    }
+    saveAccessToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_access_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    getAccessToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_access_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToAccessTokenRecord(row) : undefined;
+    }
+    deleteAccessToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where token_hash = ?").run(tokenHash);
+    }
+    saveRefreshToken(tokenHash, record) {
+        this.database.sqlite
+            .prepare(`insert into oauth_refresh_tokens (token_hash, client_id, scopes_json, expires_at, resource)
+         values (?, ?, ?, ?, ?)
+         on conflict(token_hash) do update set
+           client_id = excluded.client_id,
+           scopes_json = excluded.scopes_json,
+           expires_at = excluded.expires_at,
+           resource = excluded.resource`)
+            .run(tokenHash, record.clientId, JSON.stringify(record.scopes), record.expiresAt, record.resource ?? null);
+    }
+    saveTokenPair(pair, consumedRefreshTokenHash) {
+        const save = this.database.sqlite.transaction(() => {
+            if (consumedRefreshTokenHash) {
+                const result = this.database.sqlite
+                    .prepare("delete from oauth_refresh_tokens where token_hash = ?")
+                    .run(consumedRefreshTokenHash);
+                if (result.changes !== 1)
+                    return false;
+            }
+            this.saveAccessToken(pair.accessTokenHash, pair.accessToken);
+            this.saveRefreshToken(pair.refreshTokenHash, pair.refreshToken);
+            return true;
+        });
+        return save.immediate();
+    }
+    getRefreshToken(tokenHash) {
+        const row = this.database.sqlite
+            .prepare("select client_id, scopes_json, expires_at, resource from oauth_refresh_tokens where token_hash = ?")
+            .get(tokenHash);
+        return row ? rowToRefreshTokenRecord(row) : undefined;
+    }
+    deleteRefreshToken(tokenHash) {
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where token_hash = ?").run(tokenHash);
+    }
+    close() {
+        this.database.close();
+    }
+    deleteExpiredTokens(nowSeconds) {
+        this.database.sqlite.prepare("delete from oauth_access_tokens where expires_at < ?").run(nowSeconds);
+        this.database.sqlite.prepare("delete from oauth_refresh_tokens where expires_at < ?").run(nowSeconds);
+    }
+}
+export class SqliteOAuthClientsStore {
+    store;
+    allowedRedirectHosts;
+    constructor(store, allowedRedirectHosts) {
+        this.store = store;
+        this.allowedRedirectHosts = allowedRedirectHosts;
+    }
+    getClient(clientId) {
+        return this.store.getClient(clientId);
+    }
+    registerClient(client) {
+        return this.store.registerClient(client, this.allowedRedirectHosts);
+    }
+}
+function rowToAccessTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}
+function rowToRefreshTokenRecord(row) {
+    return {
+        clientId: row.client_id,
+        scopes: JSON.parse(row.scopes_json),
+        expiresAt: row.expires_at,
+        resource: row.resource ?? undefined,
+    };
+}

package/vendor/devspace/dist/pi-tools.js

@@ -0,0 +1,81 @@
+import { createBashTool, createEditTool, createFindTool, createGrepTool, createLsTool, createReadTool, createWriteTool, } from "@earendil-works/pi-coding-agent";
+import { resolveAllowedPath } from "./roots.js";
+function toMcpContent(result) {
+    return result.content.map((content) => {
+        if (content.type === "text") {
+            return { type: "text", text: content.text };
+        }
+        return {
+            type: "image",
+            data: content.data,
+            mimeType: content.mimeType,
+        };
+    });
+}
+function formatToolError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return [{ type: "text", text: message }];
+}
+async function runTool(execute, input, context) {
+    try {
+        const result = await execute(input);
+        return {
+            content: toMcpContent(result),
+            details: result.details,
+        };
+    }
+    catch (error) {
+        return { content: formatToolError(error), isError: true };
+    }
+}
+export async function readFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, context.readRoots ?? [context.root]);
+    const tool = createReadTool(context.cwd);
+    return runTool((params) => tool.execute("read_file", params), {
+        path,
+        offset: input.offset,
+        limit: input.limit,
+    }, context);
+}
+export async function writeFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createWriteTool(context.cwd);
+    return runTool((params) => tool.execute("write_file", params), {
+        path,
+        content: input.content,
+    }, context);
+}
+export async function editFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createEditTool(context.cwd);
+    return runTool((params) => tool.execute("edit_file", params), {
+        path,
+        edits: input.edits,
+    }, context);
+}
+export async function grepFilesTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createGrepTool(context.cwd);
+    return runTool((params) => tool.execute("grep_files", params), input, context);
+}
+export async function findFilesTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createFindTool(context.cwd);
+    return runTool((params) => tool.execute("find_files", params), input, context);
+}
+export async function listDirectoryTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createLsTool(context.cwd);
+    return runTool((params) => tool.execute("list_directory", params), input, context);
+}
+export async function runShellTool(input, context) {
+    const tool = createBashTool(context.cwd);
+    const timeout = input.timeout === undefined ? 30 : Math.min(input.timeout, 300);
+    return runTool((params) => tool.execute("run_shell", params), {
+        command: input.command,
+        timeout,
+    }, context);
+}

package/vendor/devspace/dist/review-checkpoints.js

@@ -0,0 +1,142 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { git, getGitEligibility, safeWorkspaceRefSegment } from "./git.js";
+const REVIEW_REF_PREFIX = "refs/devspace/review";
+export function createReviewCheckpointManager() {
+    const states = new Map();
+    return {
+        async initializeWorkspace({ workspaceId, root }) {
+            const refs = reviewRefs(workspaceId);
+            const state = { root, ...refs };
+            states.set(workspaceId, state);
+            try {
+                const eligibility = await getGitEligibility(root);
+                if (!eligibility.ok || !eligibility.gitRoot) {
+                    state.diagnostic = eligibility.message ?? "show_changes requires a Git workspace in this version.";
+                    return;
+                }
+                state.gitRoot = eligibility.gitRoot;
+                const commit = await createWorkingTreeSnapshot(eligibility.gitRoot);
+                await git(eligibility.gitRoot, ["update-ref", state.openRef, commit]);
+                await git(eligibility.gitRoot, ["update-ref", state.baselineRef, commit]);
+            }
+            catch (error) {
+                state.diagnostic = error instanceof Error ? error.message : String(error);
+            }
+        },
+        async reviewChanges({ workspaceId, root, since = "last_shown", markReviewed = true }) {
+            let state = states.get(workspaceId);
+            if (!state) {
+                await this.initializeWorkspace({ workspaceId, root });
+                state = states.get(workspaceId);
+            }
+            if (!state?.gitRoot) {
+                throw new Error(state?.diagnostic ?? "show_changes requires a Git workspace in this version.");
+            }
+            const baselineRef = since === "workspace_open" ? state.openRef : state.baselineRef;
+            const baseline = (await git(state.gitRoot, ["rev-parse", "--verify", `${baselineRef}^{commit}`])).stdout.trim();
+            const current = await createWorkingTreeSnapshot(state.gitRoot);
+            const patch = (await git(state.gitRoot, ["diff", "--binary", "--no-color", baseline, current], {
+                maxBuffer: 50 * 1024 * 1024,
+            })).stdout;
+            const numstat = (await git(state.gitRoot, ["diff", "--numstat", "-z", baseline, current], {
+                maxBuffer: 50 * 1024 * 1024,
+            })).stdout;
+            const files = parseNumstat(numstat);
+            const summary = summarizeFiles(files);
+            if (markReviewed) {
+                await git(state.gitRoot, ["update-ref", state.baselineRef, current]);
+            }
+            return {
+                result: summary.files === 0
+                    ? `No changes since ${since === "workspace_open" ? "workspace open" : "last shown changes"}.`
+                    : `Changed ${summary.files} ${summary.files === 1 ? "file" : "files"} (+${summary.additions} -${summary.removals}).`,
+                summary,
+                files,
+                patch,
+            };
+        },
+    };
+}
+function reviewRefs(workspaceId) {
+    const segment = safeWorkspaceRefSegment(workspaceId);
+    return {
+        openRef: `${REVIEW_REF_PREFIX}/${segment}/open`,
+        baselineRef: `${REVIEW_REF_PREFIX}/${segment}/baseline`,
+    };
+}
+async function createWorkingTreeSnapshot(gitRoot) {
+    const tempDir = await mkdtemp(join(tmpdir(), "devspace-review-index-"));
+    const indexPath = join(tempDir, "index");
+    const env = checkpointEnv(indexPath);
+    try {
+        await git(gitRoot, ["read-tree", "HEAD"], { env });
+        await git(gitRoot, ["add", "-A", "--", "."], { env });
+        const tree = (await git(gitRoot, ["write-tree"], { env })).stdout.trim();
+        const parent = (await git(gitRoot, ["rev-parse", "--verify", "HEAD^{commit}"])).stdout.trim();
+        return (await git(gitRoot, ["commit-tree", tree, "-p", parent, "-m", "DevSpace review snapshot"], { env })).stdout.trim();
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+function checkpointEnv(indexPath) {
+    return {
+        GIT_INDEX_FILE: indexPath,
+        GIT_AUTHOR_NAME: "DevSpace",
+        GIT_AUTHOR_EMAIL: "devspace@users.noreply.local",
+        GIT_COMMITTER_NAME: "DevSpace",
+        GIT_COMMITTER_EMAIL: "devspace@users.noreply.local",
+    };
+}
+function parseNumstat(output) {
+    const fields = output.split("\0").filter((field) => field.length > 0);
+    const files = [];
+    for (let index = 0; index < fields.length;) {
+        const header = fields[index++] ?? "";
+        const parts = header.split("\t");
+        const additions = parseStatNumber(parts[0]);
+        const removals = parseStatNumber(parts[1]);
+        if (parts.length >= 3) {
+            const path = parts[2] ?? "";
+            if (path)
+                files.push({ path, type: fileType(path, undefined, additions, removals), additions, removals });
+            continue;
+        }
+        const previousPath = fields[index++];
+        const path = fields[index++];
+        if (!path)
+            continue;
+        files.push({
+            path,
+            previousPath,
+            type: fileType(path, previousPath, additions, removals),
+            additions,
+            removals,
+        });
+    }
+    return files;
+}
+function parseStatNumber(value) {
+    if (!value || value === "-")
+        return 0;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+function fileType(path, previousPath, additions, removals) {
+    if (previousPath)
+        return additions === 0 && removals === 0 ? "rename-pure" : "rename-changed";
+    if (additions > 0 && removals === 0)
+        return "new";
+    if (additions === 0 && removals > 0)
+        return "deleted";
+    return "change";
+}
+function summarizeFiles(files) {
+    return files.reduce((summary, file) => ({
+        files: summary.files + 1,
+        additions: summary.additions + file.additions,
+        removals: summary.removals + file.removals,
+    }), { files: 0, additions: 0, removals: 0 });
+}

package/vendor/devspace/dist/roots.js

@@ -0,0 +1,34 @@
+import { homedir } from "node:os";
+import { relative, resolve, sep } from "node:path";
+export class AccessDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AccessDeniedError";
+    }
+}
+export function expandHomePath(path) {
+    if (path === "~")
+        return homedir();
+    if (path.startsWith("~/") || path.startsWith("~\\")) {
+        return resolve(homedir(), path.slice(2));
+    }
+    return path;
+}
+export function isPathInsideRoot(path, root) {
+    const resolvedPath = resolve(expandHomePath(path));
+    const resolvedRoot = resolve(expandHomePath(root));
+    const relationship = relative(resolvedRoot, resolvedPath);
+    return (relationship === "" ||
+        (!relationship.startsWith("..") && relationship !== ".." && !relationship.includes(`..${sep}`)));
+}
+export function assertAllowedPath(path, allowedRoots) {
+    const resolvedPath = resolve(expandHomePath(path));
+    if (allowedRoots.some((root) => isPathInsideRoot(resolvedPath, root))) {
+        return resolvedPath;
+    }
+    throw new AccessDeniedError(`Path is outside allowed roots: ${path}`);
+}
+export function resolveAllowedPath(inputPath, cwd, allowedRoots) {
+    const absolutePath = resolve(cwd, inputPath);
+    return assertAllowedPath(absolutePath, allowedRoots);
+}