chainlesschain 0.162.197 → 0.162.200

package/src/commands/mcp.js

@@ -39,6 +39,19 @@ import {
   checkProjectMcpTrust,
   issueProjectMcpWorkspaceAuthority,
 } from "../lib/project-mcp-trust.js";
+import {
+  consumeMcpStdioExecutionAuthority,
+  MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
+  issueMcpStdioExecutionAuthority,
+  materializeApprovedMcpStdioInvocation,
+  resolveMcpStdioExecutionApproval,
+} from "../lib/mcp-stdio-execution-authority.js";
+import { prepareMcpStdioExecutableIdentity } from "../lib/mcp-stdio-executable-identity.js";
+import {
+  materializeMcpStdioNpmPackage,
+  parseExactNpmPackageSpec,
+} from "../lib/mcp-stdio-package-materialization.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 import {
   CATALOG as REGISTRY_CATALOG,
   CATEGORIES as REGISTRY_CATEGORIES,
@@ -77,6 +90,32 @@ export function isHeadlessEnv(env = process.env, platform = process.platform) {
 
 // Singleton MCP client for session reuse
 let mcpClient = null;
+const PROJECT_MCP_FILE_TRUST = Symbol("projectMcpFileTrust");
+
+export function authorizeMcpRowForConnect(row, overrides = {}) {
+  const config = { ...row, ...overrides };
+  if (inferTransport(config) !== "stdio") return config;
+  if (row?.[PROJECT_MCP_FILE_TRUST] === false) {
+    const error = new Error(
+      `Project MCP server "${String(row?.name)}" can execute local code; trust the current .mcp.json before connecting`,
+    );
+    error.code = MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE;
+    throw error;
+  }
+  const approvalKind =
+    row?.configScope === "managed"
+      ? "managed-settings"
+      : row?.configScope === "project"
+        ? "project-config"
+        : "registered-config";
+  config.mcpStdioExecutionAuthority = issueMcpStdioExecutionAuthority({
+    serverName: row.name,
+    config,
+    approvalKind,
+    approvalSource: `${row?.configScope || "user"}:${row?.configSource || "database"}:${row.name}`,
+  });
+  return config;
+}
 
 function commandWorkspaceBinding() {
   return registerHostHooksV2Workspace(projectMcpLocation(process.cwd()).root);
@@ -150,7 +189,7 @@ async function connectForQuery(program, serverName) {
   for (const row of rows) {
     if (!row) continue;
     try {
-      await client.connect(row.name, row);
+      await client.connect(row.name, authorizeMcpRowForConnect(row));
       connected.push(row.name);
     } catch (err) {
       logger.log(
@@ -339,6 +378,7 @@ export function readProjectMcpRows(cwd = process.cwd()) {
         configSource: file,
         projectPath: root,
       };
+      Object.defineProperty(row, PROJECT_MCP_FILE_TRUST, { value: trusted });
       if (trusted && row.headersHelper) {
         row.projectMcpWorkspaceAuthority = issueProjectMcpWorkspaceAuthority({
           file,
@@ -773,6 +813,198 @@ export function registerMcpCommand(program) {
       }
     });
 
+  mcp
+    .command("materialize-package <name>")
+    .description(
+      "Replace one exact JavaScript package launcher with a content-addressed, guarded dependency capsule",
+    )
+    .requiredOption(
+      "--package <name@version>",
+      "Exact npm registry package version to install (ranges and tags are rejected)",
+    )
+    .option(
+      "--bin <name>",
+      "Select one exported bin when the package has several",
+    )
+    .option(
+      "--scope <scope>",
+      `Configuration scope: ${MCP_CONFIG_SCOPES.join(" | ")}`,
+    )
+    .option(
+      "--json",
+      "Output the materialized generation and closure identity as JSON",
+    )
+    .action(async (name, options) => {
+      try {
+        const exact = parseExactNpmPackageSpec(options.package);
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) throw new Error("Database not available");
+        const configStore = new MCPServerConfig(ctx.db.getDatabase());
+        const scope = options.scope
+          ? normalizeMcpConfigScope(options.scope)
+          : undefined;
+        const rows = await effectiveMcpRows(configStore, { scope });
+        const row = rows.find((entry) => entry.name === name);
+        if (!row) {
+          throw new Error(
+            `${notFoundWithSuggestion(
+              name,
+              rows.map((entry) => entry.name),
+              { noun: "Server" },
+            )}. Use 'mcp add' first.`,
+          );
+        }
+        if (inferTransport(row) !== "stdio") {
+          throw new Error(
+            `MCP server "${name}" does not use the stdio transport`,
+          );
+        }
+
+        const authorized = authorizeMcpRowForConnect(row);
+        const approval = consumeMcpStdioExecutionAuthority(
+          authorized.mcpStdioExecutionAuthority,
+          { serverName: name, config: authorized },
+        );
+        const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvalRecord = resolveMcpStdioExecutionApproval(approval);
+        const materialized = materializeMcpStdioNpmPackage({
+          approvalRecord,
+          config: invocation,
+          packageSpec: exact.spec,
+          ...(options.bin ? { binName: options.bin } : {}),
+          env: process.env,
+          processBrokerRunSync: (command, args, spawnOptions) =>
+            executionBroker.spawnSync(command, args, {
+              ...spawnOptions,
+              origin: `mcp:package-materialization:${name}`,
+              policy: "allow",
+              scope: "mcp",
+              shell: false,
+            }),
+        });
+        const prepared = prepareMcpStdioExecutableIdentity({
+          serverName: name,
+          config: invocation,
+          approval,
+          cwd: process.cwd(),
+          env: process.env,
+          retrust: true,
+        });
+        const result = {
+          name,
+          package: exact.spec,
+          generation: materialized.generation,
+          manifestDigest: materialized.manifestDigest,
+          identityDigest: prepared.identityDigest,
+          closure: materialized.identity,
+          command: prepared.identity.command,
+          entrypoints: prepared.identity.entrypoints,
+        };
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          logger.log(
+            chalk.green(
+              `Materialized and trusted ${exact.spec} for MCP server "${name}".`,
+            ),
+          );
+          logger.log(
+            `  ${chalk.gray("Generation:")} ${materialized.generation}`,
+          );
+          logger.log(
+            `  ${chalk.gray("Dependency closure:")} sha256:${materialized.identity.closureDigest} (${materialized.identity.fileCount} files, ${materialized.identity.totalBytes} bytes)`,
+          );
+          logger.log(
+            `  ${chalk.gray("Execution capsule:")} sha256:${materialized.identity.capsule.sha256} (${materialized.identity.capsule.bytes} bytes, ${materialized.identity.capsule.inputCount} bundled inputs)`,
+          );
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+        await shutdown();
+      }
+    });
+
+  mcp
+    .command("trust-executable <name>")
+    .description(
+      "Review and trust the current executable and interpreter-entrypoint bytes for one stdio MCP server",
+    )
+    .option(
+      "--scope <scope>",
+      `Configuration scope: ${MCP_CONFIG_SCOPES.join(" | ")}`,
+    )
+    .option("--json", "Output the trusted paths and SHA-256 identities as JSON")
+    .action(async (name, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) throw new Error("Database not available");
+        const configStore = new MCPServerConfig(ctx.db.getDatabase());
+        const scope = options.scope
+          ? normalizeMcpConfigScope(options.scope)
+          : undefined;
+        const rows = await effectiveMcpRows(configStore, { scope });
+        const row = rows.find((entry) => entry.name === name);
+        if (!row) {
+          throw new Error(
+            `${notFoundWithSuggestion(
+              name,
+              rows.map((entry) => entry.name),
+              { noun: "Server" },
+            )}. Use 'mcp add' first.`,
+          );
+        }
+        if (inferTransport(row) !== "stdio") {
+          throw new Error(
+            `MCP server "${name}" does not use the stdio transport`,
+          );
+        }
+
+        const authorized = authorizeMcpRowForConnect(row);
+        const approval = consumeMcpStdioExecutionAuthority(
+          authorized.mcpStdioExecutionAuthority,
+          { serverName: name, config: authorized },
+        );
+        const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const prepared = prepareMcpStdioExecutableIdentity({
+          serverName: name,
+          config: invocation,
+          approval,
+          cwd: process.cwd(),
+          env: process.env,
+          retrust: true,
+        });
+        const result = {
+          name,
+          status: prepared.trustStatus,
+          identityDigest: prepared.identityDigest,
+          command: prepared.identity.command,
+          entrypoints: prepared.identity.entrypoints,
+        };
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          logger.log(
+            chalk.green(`Trusted MCP stdio executable identity for "${name}".`),
+          );
+          logger.log(
+            `  ${chalk.gray("Command:")} ${result.command.realPath}  sha256:${result.command.sha256}`,
+          );
+          for (const entrypoint of result.entrypoints) {
+            logger.log(
+              `  ${chalk.gray(`${entrypoint.role}:`)} ${entrypoint.realPath}  sha256:${entrypoint.sha256}`,
+            );
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+        await shutdown();
+      }
+    });
+
   // mcp add — add/update a server config
   mcp
     .command("add")
@@ -1207,11 +1439,13 @@ export function registerMcpCommand(program) {
             workspaceBinding: commandWorkspaceBinding(),
           });
           try {
-            const connected = await client.connect(row.name, {
-              ...row,
-              connectTimeoutMs: timeoutMs,
-              requestTimeoutMs: timeoutMs,
-            });
+            const connected = await client.connect(
+              row.name,
+              authorizeMcpRowForConnect(row, {
+                connectTimeoutMs: timeoutMs,
+                requestTimeoutMs: timeoutMs,
+              }),
+            );
             diagnostics.push({
               ...record,
               ok: true,
@@ -1301,7 +1535,10 @@ export function registerMcpCommand(program) {
         const spinner = ora(`Connecting to ${name}...`).start();
         const client = getClient();
 
-        const result = await client.connect(name, serverConfig);
+        const result = await client.connect(
+          name,
+          authorizeMcpRowForConnect(serverConfig),
+        );
         spinner.stop();
 
         if (options.json) {

package/src/commands/serve.js

@@ -41,7 +41,7 @@ export function registerServeCommand(program) {
     )
     .option(
       "--bundle <path>",
-      "Agent bundle directory — applies AGENTS.md, MCP, and approval policy to all sessions",
+      "Agent bundle directory; may execute local MCP commands from mcp.json",
     )
     .action(async (opts) => {
       try {

package/src/commands/session-show.js

@@ -0,0 +1,129 @@
+import chalk from "chalk";
+import { numericOption } from "../lib/cli-numeric.js";
+import { logger } from "../lib/logger.js";
+import { getPrLinks } from "../lib/pr-link-store.js";
+import {
+  getJsonlSessionMetadata,
+  rebuildMessages,
+  resolveSessionAuthority,
+} from "../harness/jsonl-session-store.js";
+
+export function registerSessionShowSubcommand(session, program) {
+  session
+    .command("show")
+    .description("Show a session's messages")
+    .argument("<id>", "Session ID (or prefix)")
+    .option("-n, --limit <n>", "Max messages to show")
+    .option("--json", "Output as JSON")
+    .action(async (id, options) => {
+      let ctx = null;
+      let shutdown = null;
+      try {
+        let sess = null;
+
+        // The feature flag controls creation/migration, not authority. Once a
+        // canonical namespace witness exists it must fence the legacy DB even
+        // if JSONL_SESSION is later disabled.
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
+          logger.error(
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence}).`,
+          );
+          process.exitCode = 1;
+          return;
+        }
+        if (jsonlId) {
+          const metadata = getJsonlSessionMetadata(jsonlId);
+          const messages = rebuildMessages(jsonlId);
+          sess = {
+            id: jsonlId,
+            title: metadata?.title || "Untitled",
+            provider: metadata?.provider || "",
+            model: metadata?.model || "",
+            message_count: messages.length,
+            messages,
+            _store: "jsonl",
+          };
+        }
+
+        // Keep SQLite and the application bootstrap outside the canonical
+        // JSONL read path. Legacy sessions still retain the original fallback.
+        if (!sess) {
+          const runtime = await import("../runtime/bootstrap.js");
+          const sessionManager = await import("../lib/session-manager.js");
+          shutdown = runtime.shutdown;
+          ctx = await runtime.bootstrap({ verbose: program.opts().verbose });
+          if (ctx?.db) {
+            sess = sessionManager.getSession(ctx.db.getDatabase(), id);
+          }
+        }
+
+        if (!sess) {
+          logger.error(`Session not found: ${id}`);
+          process.exitCode = 1;
+          return;
+        }
+
+        try {
+          const prLinks = getPrLinks(sess.id);
+          if (prLinks.length > 0) sess.prLinks = prLinks;
+        } catch {
+          // PR decoration is cosmetic.
+        }
+
+        if (options.json) {
+          console.log(JSON.stringify(sess, null, 2));
+          return;
+        }
+
+        logger.log(chalk.bold(sess.title));
+        logger.log(
+          chalk.gray(
+            `ID: ${sess.id}  Provider: ${sess.provider}  Model: ${sess.model}  Messages: ${sess.message_count}`,
+          ),
+        );
+        if (sess.prLinks) {
+          for (const pr of sess.prLinks) {
+            logger.log(
+              chalk.magenta(
+                `PR: #${pr.number}${pr.state ? ` ${pr.state}` : ""}${pr.url ? `  ${pr.url}` : ""}`,
+              ),
+            );
+          }
+        }
+        logger.log("");
+
+        let messages = sess.messages;
+        if (options.limit) {
+          messages = messages.slice(
+            -numericOption(options.limit, {
+              name: "--limit",
+              integer: true,
+              min: 1,
+            }),
+          );
+        }
+
+        for (const message of messages) {
+          if (message.role === "system") continue;
+          const label =
+            message.role === "user" ? chalk.green("you> ") : chalk.blue("ai> ");
+          logger.log(`${label}${(message.content || "").substring(0, 500)}`);
+          logger.log("");
+        }
+      } catch (error) {
+        logger.error(`Failed: ${error.message}`);
+        process.exitCode = 1;
+      } finally {
+        if (ctx && shutdown) await shutdown();
+      }
+    });
+}
+
+export function registerSessionShowCommand(program) {
+  const session = program
+    .command("session")
+    .description("Conversation session management");
+  registerSessionShowSubcommand(session, program);
+}