chainlesschain 0.162.197 → 0.162.200

package/src/runtime/mcp-config.js

@@ -16,7 +16,11 @@
 
 import fs from "fs";
 import path from "path";
-import { MCPClient, redactMcpUrl } from "../harness/mcp-client.js";
+import {
+  MCPClient,
+  inferTransport,
+  redactMcpUrl,
+} from "../harness/mcp-client.js";
 import { projectRootBase } from "../lib/project-root.cjs";
 import {
   discoverIdeServer,
@@ -36,6 +40,38 @@ import {
 import { collectPluginMcpServers } from "../lib/plugin-runtime/mcp.js";
 import { EventRuntimeStore } from "../lib/event-runtime-store.js";
 import { mcpEffectDescriptorFields } from "../lib/mcp-effect-contract.js";
+import {
+  admitMcpToolList,
+  isMcpToolMetadataError,
+} from "../lib/mcp-tool-metadata.js";
+import { issueMcpStdioExecutionAuthority } from "../lib/mcp-stdio-execution-authority.js";
+
+function authorizeStdioServers(
+  servers,
+  approvalKind,
+  sourceForServer,
+  { writeErr = () => {}, failFast = false } = {},
+) {
+  for (const [name, config] of Object.entries(servers || {})) {
+    if (!config || typeof config !== "object") continue;
+    if (inferTransport(config) !== "stdio") continue;
+    try {
+      config.mcpStdioExecutionAuthority = issueMcpStdioExecutionAuthority({
+        serverName: name,
+        config,
+        approvalKind,
+        approvalSource: sourceForServer(name, config),
+      });
+    } catch (error) {
+      if (failFast) throw error;
+      delete servers[name];
+      writeErr(
+        `  mcp: SKIPPING stdio server "${name}" because its local-code execution authority could not be issued.\n`,
+      );
+    }
+  }
+  return servers;
+}
 
 function headersHelperField(value) {
   return typeof value === "string" && value.trim()
@@ -64,6 +100,51 @@ export function parseMcpServers(raw) {
       transport: cfg.transport,
       headers:
         cfg.headers && typeof cfg.headers === "object" ? cfg.headers : {},
+      ...(Number.isFinite(cfg.maxPayloadBytes)
+        ? { maxPayloadBytes: cfg.maxPayloadBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxInboundMessagesPerSecond)
+        ? {
+            maxInboundMessagesPerSecond: cfg.maxInboundMessagesPerSecond,
+          }
+        : {}),
+      ...(Number.isFinite(cfg.maxInboundBytesPerMinute)
+        ? { maxInboundBytesPerMinute: cfg.maxInboundBytesPerMinute }
+        : {}),
+      ...(Number.isFinite(cfg.maxJsonDepth)
+        ? { maxJsonDepth: cfg.maxJsonDepth }
+        : {}),
+      ...(Number.isFinite(cfg.maxJsonNodes)
+        ? { maxJsonNodes: cfg.maxJsonNodes }
+        : {}),
+      ...(Number.isFinite(cfg.maxTools) ? { maxTools: cfg.maxTools } : {}),
+      ...(Number.isFinite(cfg.maxToolDescriptionBytes)
+        ? { maxToolDescriptionBytes: cfg.maxToolDescriptionBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolSchemaBytes)
+        ? { maxToolSchemaBytes: cfg.maxToolSchemaBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolSchemaDepth)
+        ? { maxToolSchemaDepth: cfg.maxToolSchemaDepth }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolSchemaNodes)
+        ? { maxToolSchemaNodes: cfg.maxToolSchemaNodes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolDefinitionBytes)
+        ? { maxToolDefinitionBytes: cfg.maxToolDefinitionBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolMetadataBytes)
+        ? { maxToolMetadataBytes: cfg.maxToolMetadataBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolResultBytes)
+        ? { maxToolResultBytes: cfg.maxToolResultBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolResultDepth)
+        ? { maxToolResultDepth: cfg.maxToolResultDepth }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolResultNodes)
+        ? { maxToolResultNodes: cfg.maxToolResultNodes }
+        : {}),
       ...headersHelperField(cfg.headersHelper),
       ...(cfg.configScope ? { configScope: cfg.configScope } : {}),
       ...(cfg.configSource ? { configSource: cfg.configSource } : {}),
@@ -83,6 +164,12 @@ export async function loadManagedMcp(settings, deps = {}) {
     config.configScope = "managed";
     config.configSource = deps.managedFile || "managed-settings";
   }
+  authorizeStdioServers(
+    servers,
+    "managed-settings",
+    (_name, config) => config.configSource,
+    { writeErr: deps.writeErr },
+  );
   if (Object.keys(servers).length === 0) return deps.into || null;
   (deps.writeErr || (() => {}))(
     `  mcp: ${Object.keys(servers).length} managed server(s) from ${deps.managedFile || "managed settings"}\n`,
@@ -210,6 +297,9 @@ export async function setupMcpFromConfig(servers, deps = {}) {
   ) {
     result.instructionsByServer = {};
   }
+  if (!Number.isSafeInteger(result._mcpToolMetadataBytes)) {
+    result._mcpToolMetadataBytes = 0;
+  }
   const {
     mcpClient,
     extraToolDefinitions,
@@ -290,7 +380,18 @@ export async function setupMcpFromConfig(servers, deps = {}) {
       writeErr(line);
       continue;
     }
-    const tools = Array.isArray(res?.tools) ? res.tools : [];
+    let tools = [];
+    let toolMetadataError = null;
+    try {
+      const admitted = admitMcpToolList(name, res?.tools ?? [], cfg, {
+        clientBytesUsed: result._mcpToolMetadataBytes,
+      });
+      tools = admitted.tools;
+      result._mcpToolMetadataBytes += admitted.metadataBytes;
+    } catch (error) {
+      if (!isMcpToolMetadataError(error)) throw error;
+      toolMetadataError = error;
+    }
     const resources = Array.isArray(res?.resources) ? res.resources : [];
     const prompts = Array.isArray(res?.prompts) ? res.prompts : [];
     // A server can connect (initialize OK) yet have its tools/list fail — the
@@ -304,6 +405,11 @@ export async function setupMcpFromConfig(servers, deps = {}) {
       if (hint) line += hint;
       writeErr(line);
     }
+    if (toolMetadataError) {
+      writeErr(
+        `  mcp: "${name}" connected but tool metadata was rejected: ${toolMetadataError.message}\n`,
+      );
+    }
     connected.push({
       server: name,
       tools: tools.length,
@@ -321,6 +427,18 @@ export async function setupMcpFromConfig(servers, deps = {}) {
       if (!p || !p.name) continue;
       result.prompts.push({ ...p, server: name });
     }
+    const toolResultConfig = Object.freeze({
+      ...(Number.isFinite(cfg.maxToolResultBytes)
+        ? { maxToolResultBytes: cfg.maxToolResultBytes }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolResultDepth)
+        ? { maxToolResultDepth: cfg.maxToolResultDepth }
+        : {}),
+      ...(Number.isFinite(cfg.maxToolResultNodes)
+        ? { maxToolResultNodes: cfg.maxToolResultNodes }
+        : {}),
+    });
+    const hasToolResultConfig = Object.keys(toolResultConfig).length > 0;
     for (const t of tools) {
       if (!t || !t.name) continue;
       const full = mcpToolName(name, t.name);
@@ -337,6 +455,7 @@ export async function setupMcpFromConfig(servers, deps = {}) {
         kind: "mcp",
         serverName: name,
         toolName: t.name,
+        ...(hasToolResultConfig ? { toolResultConfig } : {}),
       };
       externalToolDescriptors[full] = {
         name: full,
@@ -510,6 +629,12 @@ export async function loadMcpConfig(filePath, deps = {}) {
         `(expected {"mcpServers": {"name": {"command": "..."}}}).`,
     );
   }
+  authorizeStdioServers(
+    servers,
+    "explicit-config",
+    () => path.resolve(filePath),
+    { failFast: true },
+  );
   return setupMcpFromConfig(servers, deps);
 }
 
@@ -555,6 +680,13 @@ export async function loadRegisteredMcp(rawDb, deps = {}) {
     };
   }
   if (Object.keys(servers).length === 0) return deps.into || null;
+  authorizeStdioServers(
+    servers,
+    "registered-config",
+    (name, config) =>
+      `${config.configScope || "user"}:${config.configSource || "user-database"}:${name}`,
+    { writeErr: deps.writeErr },
+  );
   return setupMcpFromConfig(servers, deps);
 }
 
@@ -786,14 +918,16 @@ export async function loadProjectMcp(opts = {}, deps = {}) {
         config.configScope = "project";
         config.configSource = file;
         config.projectPath = path.dirname(file);
-        if (config.headersHelper) {
-          if (typeof trust.issueProjectMcpWorkspaceAuthority !== "function") {
-            writeErr(
-              `  mcp: SKIPPING project headersHelper "${name}" — project execution authority is unavailable.\n`,
-            );
-            delete parsed[name];
-            continue;
-          }
+        const needsExecutionAuthority =
+          config.headersHelper || inferTransport(config) === "stdio";
+        if (
+          needsExecutionAuthority &&
+          typeof trust.issueProjectMcpWorkspaceAuthority !== "function"
+        ) {
+          delete parsed[name];
+          continue;
+        }
+        if (needsExecutionAuthority) {
           config.projectMcpWorkspaceAuthority =
             trust.issueProjectMcpWorkspaceAuthority({
               file,
@@ -813,6 +947,12 @@ export async function loadProjectMcp(opts = {}, deps = {}) {
     `  mcp: ${Object.keys(servers).length} server(s) from project .mcp.json ` +
       `(${seenFiles.join(", ")}) — loaded via --project-mcp\n`,
   );
+  authorizeStdioServers(
+    servers,
+    "project-config",
+    (name, config) => `${config.configSource}:${name}`,
+    { writeErr },
+  );
   return setupMcpFromConfig(servers, deps);
 }
 
@@ -856,6 +996,13 @@ export async function loadPluginMcp(opts = {}, deps = {}) {
   writeErr(
     `  mcp: ${names.length} server(s) from trusted plugin(s): ${names.join(", ")}\n`,
   );
+  authorizeStdioServers(
+    servers,
+    "trusted-plugin",
+    (name, config) =>
+      `${config.pluginId || "plugin"}@${config.pluginVersion || "unknown"}:${config.pluginSource || "unknown"}:${name}`,
+    { writeErr },
+  );
   return setupMcpFromConfig(servers, deps);
 }
 

package/src/runtime/output-backpressure.js

@@ -0,0 +1,419 @@
+import { Buffer } from "node:buffer";
+
+const DEFAULT_MAX_QUEUED_BYTES = 1024 * 1024;
+const HOST_OUTPUT_DRAIN_TIMEOUT_MS = 30_000;
+
+function normalizeDrainTimeoutMs(value) {
+  return Number.isFinite(value) &&
+    value > 0 &&
+    value <= HOST_OUTPUT_DRAIN_TIMEOUT_MS
+    ? Math.max(1, Math.floor(value))
+    : HOST_OUTPUT_DRAIN_TIMEOUT_MS;
+}
+
+function outputError(code, message, details = {}) {
+  const error = new Error(message);
+  error.code = code;
+  error.isOutputBackpressureFailure = true;
+  Object.assign(error, details);
+  return error;
+}
+
+function chunkBytes(chunk, encoding) {
+  if (Buffer.isBuffer(chunk) || ArrayBuffer.isView(chunk)) {
+    return chunk.byteLength;
+  }
+  return Buffer.byteLength(String(chunk), encoding || "utf8");
+}
+
+/**
+ * Honor Writable.write(false) without forcing every existing output call site
+ * to become async. Once the native stream applies backpressure, later chunks
+ * stay in a bounded host queue until `drain`; producers await `wait()` at their
+ * event boundaries, so model/input consumption stops instead of growing the
+ * native Writable queue without limit.
+ */
+export function createWritableBackpressureGate(
+  stream,
+  {
+    label = "output",
+    maxQueuedBytes = DEFAULT_MAX_QUEUED_BYTES,
+    drainTimeoutMs,
+    onFailure = null,
+  } = {},
+) {
+  if (!stream || typeof stream.write !== "function") {
+    throw new TypeError(`${label} must be a writable stream`);
+  }
+  // Capture the native writer before a caller optionally installs this gate as
+  // `stream.write`. Looking it up dynamically would recurse after installation.
+  const nativeWrite = stream.write.bind(stream);
+  const queueLimit =
+    Number.isSafeInteger(maxQueuedBytes) && maxQueuedBytes > 0
+      ? maxQueuedBytes
+      : DEFAULT_MAX_QUEUED_BYTES;
+  const queue = [];
+  const outputDrainTimeoutMs = normalizeDrainTimeoutMs(drainTimeoutMs);
+  let queuedBytes = 0;
+  let blocked = false;
+  let failure = null;
+  let waitPromise = null;
+  let resolveWait = null;
+  let rejectWait = null;
+  let disposed = false;
+  let backpressureCount = 0;
+  let drainTimer = null;
+  let blockedAt = null;
+
+  const clearDrainDeadline = () => {
+    if (drainTimer !== null) clearTimeout(drainTimer);
+    drainTimer = null;
+    blockedAt = null;
+  };
+
+  const notifyCallback = (callback, error) => {
+    if (typeof callback !== "function") return;
+    queueMicrotask(() => {
+      try {
+        callback(error);
+      } catch {
+        // A write callback is observational and cannot replace gate failure.
+      }
+    });
+  };
+
+  const ensureWait = () => {
+    if (waitPromise) return;
+    waitPromise = new Promise((resolve, reject) => {
+      resolveWait = resolve;
+      rejectWait = reject;
+    });
+    // A caller may rely only on event-driven writes (for example a coalescer
+    // timer) and observe the failure later. Mark the promise handled now while
+    // preserving rejection for every explicit `wait()` caller.
+    waitPromise.catch(() => {});
+  };
+  const finishWait = () => {
+    clearDrainDeadline();
+    const resolve = resolveWait;
+    waitPromise = null;
+    resolveWait = null;
+    rejectWait = null;
+    resolve?.();
+  };
+  const fail = (error) => {
+    if (failure) return;
+    clearDrainDeadline();
+    failure = error;
+    blocked = false;
+    const discarded = queue.splice(0);
+    queuedBytes = 0;
+    for (const entry of discarded) notifyCallback(entry.callback, error);
+    ensureWait();
+    rejectWait?.(error);
+    try {
+      onFailure?.(error);
+    } catch {
+      // Failure notification must never replace the original stream error.
+    }
+  };
+  const startDrainDeadline = () => {
+    if (drainTimer !== null || failure || disposed) return;
+    blockedAt = Date.now();
+    drainTimer = setTimeout(() => {
+      const elapsedMs = Math.max(0, Date.now() - blockedAt);
+      fail(
+        outputError(
+          "CC_OUTPUT_BACKPRESSURE_TIMEOUT",
+          `${label} did not drain within ${outputDrainTimeoutMs} ms`,
+          {
+            timeoutMs: outputDrainTimeoutMs,
+            elapsedMs,
+            queuedBytes,
+            queuedChunks: queue.length,
+          },
+        ),
+      );
+    }, outputDrainTimeoutMs);
+  };
+  const writeNative = (chunk, encoding, callback) => {
+    let accepted;
+    try {
+      accepted =
+        typeof callback === "function"
+          ? encoding != null
+            ? nativeWrite(chunk, encoding, callback)
+            : nativeWrite(chunk, callback)
+          : encoding != null
+            ? nativeWrite(chunk, encoding)
+            : nativeWrite(chunk);
+    } catch (error) {
+      const wrapped = outputError(
+        error?.code === "EPIPE" ? "EPIPE" : "CC_OUTPUT_STREAM_ERROR",
+        `${label} write failed: ${error?.message || error}`,
+        { cause: error },
+      );
+      notifyCallback(callback, wrapped);
+      fail(wrapped);
+      return false;
+    }
+    if (accepted === false) {
+      blocked = true;
+      backpressureCount += 1;
+      ensureWait();
+      startDrainDeadline();
+    }
+    return accepted !== false;
+  };
+  const onDrain = () => {
+    if (disposed || failure) return;
+    blocked = false;
+    while (queue.length > 0 && !blocked && !failure) {
+      const entry = queue.shift();
+      queuedBytes -= entry.bytes;
+      writeNative(entry.chunk, entry.encoding, entry.callback);
+    }
+    if (!blocked && queue.length === 0 && !failure) finishWait();
+  };
+  const onError = (cause) => {
+    fail(
+      outputError(
+        cause?.code === "EPIPE" ? "EPIPE" : "CC_OUTPUT_STREAM_ERROR",
+        `${label} stream failed: ${cause?.message || cause}`,
+        { cause },
+      ),
+    );
+  };
+
+  stream.on?.("drain", onDrain);
+  stream.on?.("error", onError);
+
+  return {
+    write(chunk, encoding, callback) {
+      if (typeof encoding === "function") {
+        callback = encoding;
+        encoding = undefined;
+      }
+      if (disposed || failure) {
+        notifyCallback(
+          callback,
+          failure ||
+            outputError(
+              "CC_OUTPUT_BACKPRESSURE_DISPOSED",
+              `${label} is no longer writable`,
+            ),
+        );
+        return false;
+      }
+      if (!blocked && queue.length === 0) {
+        return writeNative(chunk, encoding, callback);
+      }
+
+      const bytes = chunkBytes(chunk, encoding);
+      if (queuedBytes + bytes > queueLimit) {
+        const overflow = outputError(
+          "CC_OUTPUT_BACKPRESSURE_OVERFLOW",
+          `${label} backpressure queue exceeded ${queueLimit} bytes`,
+          { queuedBytes, incomingBytes: bytes, maxQueuedBytes: queueLimit },
+        );
+        notifyCallback(callback, overflow);
+        fail(overflow);
+        return false;
+      }
+      queue.push({ chunk, encoding, callback, bytes });
+      queuedBytes += bytes;
+      ensureWait();
+      return false;
+    },
+    async wait() {
+      if (failure) throw failure;
+      if (blocked || queue.length > 0) {
+        ensureWait();
+        await waitPromise;
+      }
+      if (failure) throw failure;
+    },
+    snapshot() {
+      return Object.freeze({
+        label,
+        blocked,
+        queuedBytes,
+        queuedChunks: queue.length,
+        backpressureCount,
+        drainTimeoutMs: outputDrainTimeoutMs,
+        blockedForMs:
+          blockedAt === null ? 0 : Math.max(0, Date.now() - blockedAt),
+        failed: failure != null,
+        failureCode: failure?.code || null,
+      });
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      stream.removeListener?.("drain", onDrain);
+      stream.removeListener?.("error", onError);
+      if (!failure && (blocked || queue.length > 0)) {
+        fail(
+          outputError(
+            "CC_OUTPUT_BACKPRESSURE_DISPOSED",
+            `${label} disposed before queued output drained`,
+          ),
+        );
+      }
+    },
+  };
+}
+
+/**
+ * Install a gate directly on a Writable's `write` method. This is intended for
+ * readline/TTY owners whose transitive writers all hold the same stream object
+ * and cannot each be converted to an async writer. The original method shape
+ * is restored exactly when `restore()` runs.
+ */
+export function installWritableBackpressureGate(stream, options = {}) {
+  const hadOwnWrite = Object.prototype.hasOwnProperty.call(stream, "write");
+  const ownWriteDescriptor = hadOwnWrite
+    ? Object.getOwnPropertyDescriptor(stream, "write")
+    : null;
+  const gate = createWritableBackpressureGate(stream, options);
+  const installedWrite = (chunk, encoding, callback) =>
+    gate.write(chunk, encoding, callback);
+  try {
+    Object.defineProperty(stream, "write", {
+      configurable: true,
+      enumerable: ownWriteDescriptor?.enumerable ?? false,
+      writable: true,
+      value: installedWrite,
+    });
+  } catch (cause) {
+    gate.dispose();
+    throw outputError(
+      "CC_OUTPUT_BACKPRESSURE_INSTALL_FAILED",
+      `${options.label || "output"} write method cannot be gated`,
+      { cause },
+    );
+  }
+
+  let restored = false;
+  return {
+    wait: gate.wait,
+    snapshot: gate.snapshot,
+    restore() {
+      if (restored) return;
+      restored = true;
+      if (stream.write === installedWrite) {
+        if (hadOwnWrite) {
+          Object.defineProperty(stream, "write", ownWriteDescriptor);
+        } else {
+          Reflect.deleteProperty(stream, "write");
+        }
+      }
+      gate.dispose();
+    },
+  };
+}
+
+/** Install coordinated gates on stdout and stderr for a long-lived TTY owner. */
+export function installOutputBackpressure({
+  stdout = process.stdout,
+  stderr = process.stderr,
+  maxQueuedBytes,
+  drainTimeoutMs,
+  onFailure,
+} = {}) {
+  if (stdout === stderr) {
+    const shared = installWritableBackpressureGate(stdout, {
+      label: "output",
+      maxQueuedBytes,
+      drainTimeoutMs,
+      onFailure,
+    });
+    return {
+      wait: shared.wait,
+      snapshot: () => {
+        const current = shared.snapshot();
+        return { stdout: current, stderr: current };
+      },
+      restore: shared.restore,
+    };
+  }
+  const out = installWritableBackpressureGate(stdout, {
+    label: "stdout",
+    maxQueuedBytes,
+    drainTimeoutMs,
+    onFailure,
+  });
+  let err;
+  try {
+    err = installWritableBackpressureGate(stderr, {
+      label: "stderr",
+      maxQueuedBytes,
+      drainTimeoutMs,
+      onFailure,
+    });
+  } catch (error) {
+    out.restore();
+    throw error;
+  }
+  let restored = false;
+  return {
+    wait: () => Promise.all([out.wait(), err.wait()]),
+    snapshot: () => ({ stdout: out.snapshot(), stderr: err.snapshot() }),
+    restore() {
+      if (restored) return;
+      restored = true;
+      out.restore();
+      err.restore();
+    },
+  };
+}
+
+function injectedWriter(write) {
+  return {
+    write,
+    wait: async () => {},
+    snapshot: () => null,
+    dispose: () => {},
+  };
+}
+
+/** Create one coordinator for stdout and stderr. */
+export function createHeadlessOutputBackpressure({
+  stdout = process.stdout,
+  stderr = process.stderr,
+  writeOut = null,
+  writeErr = null,
+  maxQueuedBytes,
+  drainTimeoutMs,
+  onFailure,
+} = {}) {
+  const out = writeOut
+    ? injectedWriter(writeOut)
+    : createWritableBackpressureGate(stdout, {
+        label: "stdout",
+        maxQueuedBytes,
+        drainTimeoutMs,
+        onFailure,
+      });
+  const err = writeErr
+    ? injectedWriter(writeErr)
+    : createWritableBackpressureGate(stderr, {
+        label: "stderr",
+        maxQueuedBytes,
+        drainTimeoutMs,
+        onFailure,
+      });
+
+  return {
+    writeOut: (chunk, encoding) => out.write(chunk, encoding),
+    writeErr: (chunk, encoding) => err.write(chunk, encoding),
+    wait: () => Promise.all([out.wait(), err.wait()]),
+    snapshot: () => ({ stdout: out.snapshot(), stderr: err.snapshot() }),
+    dispose() {
+      out.dispose();
+      err.dispose();
+    },
+  };
+}
+
+export const MAX_OUTPUT_DRAIN_TIMEOUT_MS = HOST_OUTPUT_DRAIN_TIMEOUT_MS;