chainlesschain 0.165.5 → 0.165.8

package/src/lib/mcp-oauth.js

@@ -52,6 +52,56 @@ export const _deps = {
   withStoreLock,
 };
 
+/**
+ * Resolve the exact IPv4-loopback redirect used by both the listener and the
+ * OAuth wire exchange. Pre-registered clients need byte-for-byte redirect URI
+ * stability, so explicit values are accepted only in canonical form.
+ */
+export function resolveOAuthLoopbackRedirect({
+  redirectUri,
+  host = "127.0.0.1",
+  port = 53682,
+  redirectPath = "/callback",
+} = {}) {
+  if (redirectUri != null && typeof redirectUri !== "string") {
+    throw new Error("OAuth redirectUri must be a string");
+  }
+  const candidate =
+    redirectUri == null ? `http://${host}:${port}${redirectPath}` : redirectUri;
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new Error("OAuth redirectUri must be a valid loopback URL");
+  }
+  const parsedPort = Number(parsed.port);
+  const canonical = `http://127.0.0.1:${parsed.port}${parsed.pathname}`;
+  if (
+    parsed.protocol !== "http:" ||
+    parsed.hostname !== "127.0.0.1" ||
+    !parsed.port ||
+    !Number.isInteger(parsedPort) ||
+    parsedPort < 1 ||
+    parsedPort > 65535 ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    !parsed.pathname.startsWith("/") ||
+    candidate !== canonical
+  ) {
+    throw new Error(
+      "OAuth redirectUri must be an exact canonical http://127.0.0.1:<port>/<path> URL",
+    );
+  }
+  return {
+    redirectUri: candidate,
+    host: "127.0.0.1",
+    port: parsedPort,
+    redirectPath: parsed.pathname,
+  };
+}
+
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
 const MCP_OAUTH_RETRY_BACKOFF_MS = 300;
 
@@ -434,7 +484,23 @@ export function loadTokenStore() {
 }
 
 export function getStoredToken(serverUrl) {
-  return loadTokenStore()[serverKey(serverUrl)] || null;
+  const record = loadTokenStore()[serverKey(serverUrl)] || null;
+  return record?.revoked === true ? null : record;
+}
+
+function tokenRecordRevision(record) {
+  return Number.isSafeInteger(record?.credential_revision) &&
+    record.credential_revision >= 0
+    ? record.credential_revision
+    : 0;
+}
+
+function tokenRevisionConflict(serverUrl) {
+  const error = new Error(
+    `MCP OAuth credential changed while it was being refreshed: ${serverKey(serverUrl)}`,
+  );
+  error.code = "MCP_TOKEN_STORE_REVISION_CONFLICT";
+  return error;
 }
 
 // The store holds OAuth access + refresh tokens, so it must not be world-
@@ -592,7 +658,7 @@ export function withStoreLock(file, fn) {
   }
 }
 
-export function saveStoredToken(serverUrl, record) {
+export function saveStoredToken(serverUrl, record, options = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const r = _readStore(file); // re-read inside the lock (latest state)
@@ -604,24 +670,56 @@ export function saveStoredToken(serverUrl, record) {
       _warnCorruptStoreOnce(file, r.err, archived);
     }
     const store = r.store;
-    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    const key = serverKey(serverUrl);
+    const current = store[key] || null;
+    if (
+      options.expectedRevision != null &&
+      (tokenRecordRevision(current) !== options.expectedRevision ||
+        current?.revoked === true)
+    ) {
+      throw tokenRevisionConflict(serverUrl);
+    }
+    store[key] = {
+      ...record,
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: false,
+    };
     _writeStoreSecure(file, store);
-    return store[serverKey(serverUrl)];
+    return store[key];
   });
 }
 
-export function deleteStoredToken(serverUrl) {
+function revokeStoredToken(serverUrl, { expectedRevision = null } = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const store = loadTokenStore(); // re-read inside the lock (latest state)
     const key = serverKey(serverUrl);
-    if (!(key in store)) return false;
-    delete store[key];
+    const current = store[key];
+    if (!current || current.revoked === true) return false;
+    if (
+      expectedRevision != null &&
+      tokenRecordRevision(current) !== expectedRevision
+    ) {
+      return false;
+    }
+    // Keep a revision-only tombstone. An in-flight refresh that read the old
+    // credential must not resurrect it after explicit logout/revocation.
+    store[key] = {
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: true,
+      revoked_at: _deps.now(),
+    };
     _writeStoreSecure(file, store);
     return true;
   });
 }
 
+export function deleteStoredToken(serverUrl) {
+  return revokeStoredToken(serverUrl);
+}
+
 /** True when a record's access token is missing or within `skewMs` of expiry. */
 export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
   if (!record || !record.access_token) return true;
@@ -642,6 +740,8 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
  * @param {string} serverUrl
  * @param {{ forceRefresh?: boolean }} [opts]
  */
+const tokenRefreshFlights = new Map();
+
 export async function ensureValidToken(
   serverUrl,
   { forceRefresh = false } = {},
@@ -650,21 +750,52 @@ export async function ensureValidToken(
   if (!record) return null;
   if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    // Can't refresh. On a forced refresh the cached token is known-rejected, so
-    // hand back null (caller should stop retrying and prompt re-login); on the
-    // proactive path keep the existing behaviour of using what we have.
-    return forceRefresh ? null : record.access_token || null;
+    // Reaching this branch means the cached access token is expired (including
+    // the safety skew) or the server already rejected it. Reusing it would
+    // create a deterministic 401/403 loop, so every caller fails closed.
+    return null;
   }
-  try {
-    const tok = await refreshAccessToken(
-      { token_endpoint: record.endpoints.token_endpoint },
-      { refreshToken: record.refresh_token, clientId: record.client_id },
-    );
-    const updated = saveStoredToken(serverUrl, { ...record, ...tok });
-    return updated.access_token;
-  } catch {
-    return forceRefresh ? null : record.access_token || null;
+  const key = serverKey(serverUrl);
+  let refresh = tokenRefreshFlights.get(key);
+  if (!refresh) {
+    refresh = (async () => {
+      try {
+        const tok = await refreshAccessToken(
+          { token_endpoint: record.endpoints.token_endpoint },
+          { refreshToken: record.refresh_token, clientId: record.client_id },
+        );
+        const updated = saveStoredToken(
+          serverUrl,
+          { ...record, ...tok },
+          { expectedRevision: tokenRecordRevision(record) },
+        );
+        return { status: "refreshed", accessToken: updated.access_token };
+      } catch (error) {
+        if ([400, 401, 403].includes(error?.status)) {
+          const revoked = revokeStoredToken(serverUrl, {
+            expectedRevision: tokenRecordRevision(record),
+          });
+          return { status: revoked ? "revoked" : "conflict" };
+        }
+        return {
+          status:
+            error?.code === "MCP_TOKEN_STORE_REVISION_CONFLICT"
+              ? "conflict"
+              : "failed",
+        };
+      } finally {
+        tokenRefreshFlights.delete(key);
+      }
+    })();
+    tokenRefreshFlights.set(key, refresh);
   }
+  const outcome = await refresh;
+  if (outcome.status === "refreshed") return outcome.accessToken;
+  if (outcome.status === "revoked") return null;
+  if (outcome.status === "conflict") {
+    return getStoredToken(serverUrl)?.access_token || null;
+  }
+  return null;
 }
 
 // ── interactive orchestrator ──────────────────────────────────────────────
@@ -794,23 +925,22 @@ export function waitForCallback({
  * Run the full interactive Authorization Code + PKCE flow and persist the token.
  *
  * @param {string} serverUrl
- * @param {object} [opts] { scope, clientId, port=53682, host, redirectPath,
- *                          timeout, writeOut }
+ * @param {object} [opts] { scope, clientId, redirectUri, port=53682, host,
+ *                          redirectPath, timeout, writeOut }
  * @returns {Promise<{server, access_token, ...}>}  the stored record
  */
 export async function authorizeInteractive(serverUrl, opts = {}) {
   const {
     scope,
     clientId: cfgClientId,
-    port = 53682,
-    host = "127.0.0.1",
-    redirectPath = "/callback",
     timeout = 300_000,
     writeOut = (s) => process.stdout.write(s),
   } = opts;
 
+  const { redirectUri, host, port, redirectPath } =
+    resolveOAuthLoopbackRedirect(opts);
+
   const metadata = await discoverAuthMetadata(serverUrl);
-  const redirectUri = `http://${host}:${port}${redirectPath}`;
 
   let clientId = cfgClientId;
   let clientSecret = null;

package/src/lib/mcp-tls.js

@@ -0,0 +1,330 @@
+/** Bounded mTLS material loading for HTTP/WebSocket MCP transports. */
+
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, X509Certificate } from "node:crypto";
+import { createSecureContext } from "node:tls";
+import { isProxy } from "node:util/types";
+import { Agent } from "undici";
+
+export const MCP_TLS_MAX_FILE_BYTES = 1024 * 1024;
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE =
+  "CC_MCP_TLS_MANAGED_SOURCE_REQUIRED";
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE =
+  "MCP TLS configuration is restricted to managed provisioned sources";
+
+// TLS file paths are a privileged configuration capability: merely marking a
+// JSON object as `configScope: "managed"` must never let a project, user, or
+// headless config read certificate material. Keep the provisioned snapshot in
+// a module-private WeakMap so it cannot be recreated by JSON, object spread,
+// or a lookalike field supplied by an MCP config source.
+const MANAGED_MCP_TLS_PROVENANCE = new WeakMap();
+const MANAGED_MCP_TLS_SCOPE = "managed";
+
+const TLS_KEYS = new Set([
+  "certFile",
+  "keyFile",
+  "caFile",
+  "serverName",
+  "rejectUnauthorized",
+]);
+
+function tlsError(code, message, cause = undefined) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  return error;
+}
+
+function managedTlsSourceRequiredError() {
+  // Do not include the claimed scope, source file, certificate path, or any
+  // TLS configuration field here. This error is surfaced by headless and MCP
+  // connection diagnostics, where config values are not safe to disclose.
+  return tlsError(
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE,
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE,
+  );
+}
+
+function plainTlsObject(value) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    isProxy(value)
+  ) {
+    return null;
+  }
+  let prototype;
+  let descriptors;
+  try {
+    prototype = Object.getPrototypeOf(value);
+    descriptors = Object.getOwnPropertyDescriptors(value);
+  } catch {
+    return null;
+  }
+  if (prototype !== Object.prototype && prototype !== null) return null;
+  const keys = Reflect.ownKeys(descriptors);
+  if (
+    keys.some(
+      (key) =>
+        typeof key !== "string" ||
+        !TLS_KEYS.has(key) ||
+        !Object.prototype.hasOwnProperty.call(descriptors[key], "value") ||
+        descriptors[key].enumerable !== true,
+    )
+  ) {
+    return null;
+  }
+  return Object.fromEntries(keys.map((key) => [key, descriptors[key].value]));
+}
+
+function absoluteFile(value, label) {
+  if (value == null || value === "") return null;
+  if (typeof value !== "string" || !path.isAbsolute(value)) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      `MCP TLS ${label} must be an absolute file path`,
+    );
+  }
+  return path.resolve(value);
+}
+
+function validServerName(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 253) {
+    return false;
+  }
+  return value
+    .split(".")
+    .every(
+      (label) =>
+        label.length > 0 &&
+        label.length <= 63 &&
+        /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/u.test(label),
+    );
+}
+
+export function normalizeMcpTlsConfig(value) {
+  if (value == null) return null;
+  const snapshot = plainTlsObject(value);
+  if (!snapshot) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      "MCP TLS configuration must be a plain allowlisted data object",
+    );
+  }
+  const certFile = absoluteFile(snapshot.certFile, "certFile");
+  const keyFile = absoluteFile(snapshot.keyFile, "keyFile");
+  if (Boolean(certFile) !== Boolean(keyFile)) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      "MCP TLS certFile and keyFile must be configured together",
+    );
+  }
+  const caFile = absoluteFile(snapshot.caFile, "caFile");
+  if (!certFile && !caFile) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      "MCP TLS configuration requires a client certificate or CA file",
+    );
+  }
+  const serverName = snapshot.serverName == null ? null : snapshot.serverName;
+  if (serverName != null && !validServerName(serverName)) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      "MCP TLS serverName must be a valid DNS name",
+    );
+  }
+  if (
+    snapshot.rejectUnauthorized != null &&
+    typeof snapshot.rejectUnauthorized !== "boolean"
+  ) {
+    throw tlsError(
+      "CC_MCP_TLS_CONFIG_INVALID",
+      "MCP TLS rejectUnauthorized must be boolean",
+    );
+  }
+  return {
+    certFile,
+    keyFile,
+    caFile,
+    serverName,
+    rejectUnauthorized: snapshot.rejectUnauthorized !== false,
+  };
+}
+
+/**
+ * Convert TLS settings from the organization-managed MCP loader into an
+ * immutable, non-forgeable configuration capability.
+ *
+ * This is deliberately separate from `normalizeMcpTlsConfig`: normalization
+ * validates data, while provisioning records the trusted source provenance
+ * that is required before a certificate/key/CA file can be opened.
+ */
+export function provisionManagedMcpTlsConfig(value) {
+  const config = normalizeMcpTlsConfig(value);
+  if (!config) return null;
+  const provisioned = Object.freeze({ ...config });
+  MANAGED_MCP_TLS_PROVENANCE.set(
+    provisioned,
+    Object.freeze({ configScope: MANAGED_MCP_TLS_SCOPE }),
+  );
+  return provisioned;
+}
+
+/**
+ * Enforce the managed source boundary before any TLS path is normalized or
+ * opened. The private provenance association survives normal config-object
+ * spreads because the provisioned `tls` value itself is preserved, but a
+ * caller cannot manufacture it from JSON or by setting `configScope`.
+ */
+export function assertManagedMcpTlsConfig(value, { configScope } = {}) {
+  if (value == null) return null;
+  const provenance =
+    value && typeof value === "object"
+      ? MANAGED_MCP_TLS_PROVENANCE.get(value)
+      : null;
+  if (
+    !provenance ||
+    configScope !== MANAGED_MCP_TLS_SCOPE ||
+    provenance.configScope !== MANAGED_MCP_TLS_SCOPE
+  ) {
+    throw managedTlsSourceRequiredError();
+  }
+  return value;
+}
+
+function readTlsFile(filePath, label, fsImpl) {
+  if (!filePath) return null;
+  let descriptor = null;
+  let stat;
+  try {
+    const link = fsImpl.lstatSync(filePath);
+    if (link.isSymbolicLink()) {
+      throw tlsError(
+        "CC_MCP_TLS_FILE_UNSAFE",
+        `MCP TLS ${label} must not be a symbolic link`,
+      );
+    }
+    const constants = fsImpl.constants || fs.constants;
+    descriptor = fsImpl.openSync(
+      filePath,
+      constants.O_RDONLY | (constants.O_NOFOLLOW || 0),
+    );
+    stat = fsImpl.fstatSync(descriptor);
+  } catch (cause) {
+    if (descriptor != null) fsImpl.closeSync?.(descriptor);
+    if (cause?.code?.startsWith?.("CC_MCP_TLS_")) throw cause;
+    throw tlsError(
+      "CC_MCP_TLS_FILE_UNAVAILABLE",
+      `MCP TLS ${label} could not be inspected`,
+      cause,
+    );
+  }
+  if (!stat.isFile() || stat.size <= 0 || stat.size > MCP_TLS_MAX_FILE_BYTES) {
+    fsImpl.closeSync?.(descriptor);
+    throw tlsError(
+      "CC_MCP_TLS_FILE_UNSAFE",
+      `MCP TLS ${label} must be a non-empty regular file no larger than ${MCP_TLS_MAX_FILE_BYTES} bytes`,
+    );
+  }
+  if (
+    label === "keyFile" &&
+    process.platform !== "win32" &&
+    (stat.mode & 0o077) !== 0
+  ) {
+    fsImpl.closeSync?.(descriptor);
+    throw tlsError(
+      "CC_MCP_TLS_FILE_UNSAFE",
+      "MCP TLS keyFile must not be readable or writable by group/other users",
+    );
+  }
+  try {
+    return fsImpl.readFileSync(descriptor);
+  } catch (cause) {
+    throw tlsError(
+      "CC_MCP_TLS_FILE_UNAVAILABLE",
+      `MCP TLS ${label} could not be read`,
+      cause,
+    );
+  } finally {
+    fsImpl.closeSync?.(descriptor);
+  }
+}
+
+function updateDigestPart(hash, value) {
+  const bytes = value || Buffer.alloc(0);
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(bytes.length);
+  hash.update(length).update(bytes);
+}
+
+function validateCertificateBytes(bytes) {
+  if (!bytes) return;
+  const text = bytes.toString("utf8");
+  const pemCertificates = text.match(
+    /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/gu,
+  );
+  if (pemCertificates?.length) {
+    for (const certificate of pemCertificates) new X509Certificate(certificate);
+    return;
+  }
+  new X509Certificate(bytes);
+}
+
+export function loadMcpTlsMaterial(
+  value,
+  {
+    configScope,
+    fsImpl = fs,
+    createSecureContextImpl = createSecureContext,
+    validateCertificateImpl = validateCertificateBytes,
+  } = {},
+) {
+  const config = assertManagedMcpTlsConfig(value, { configScope });
+  if (!config) return null;
+  const cert = readTlsFile(config.certFile, "certFile", fsImpl);
+  const key = readTlsFile(config.keyFile, "keyFile", fsImpl);
+  const ca = readTlsFile(config.caFile, "caFile", fsImpl);
+  const connectOptions = {
+    ...(cert ? { cert } : {}),
+    ...(key ? { key } : {}),
+    ...(ca ? { ca } : {}),
+    ...(config.serverName ? { servername: config.serverName } : {}),
+    rejectUnauthorized: config.rejectUnauthorized,
+  };
+  try {
+    // Parse certificates and verify the client cert/key pair before creating a
+    // dispatcher or issuing any outbound request. Node/Undici would otherwise
+    // discover malformed or mismatched material only during a network dial.
+    validateCertificateImpl(cert);
+    validateCertificateImpl(ca);
+    createSecureContextImpl(connectOptions);
+  } catch {
+    // TLS parser diagnostics may quote attacker-controlled PEM text or paths.
+    // Keep the product error fixed and do not retain the parser error as cause.
+    throw tlsError(
+      "CC_MCP_TLS_MATERIAL_INVALID",
+      "MCP TLS certificate material is invalid or the client key does not match",
+    );
+  }
+  const identityHash = createHash("sha256");
+  updateDigestPart(identityHash, cert);
+  updateDigestPart(identityHash, key);
+  updateDigestPart(identityHash, ca);
+  const identityDigest = `sha256:${identityHash.digest("hex")}`;
+  return { connectOptions, identityDigest };
+}
+
+export function createMcpTlsDispatcher(material) {
+  if (!material?.connectOptions) return null;
+  return new Agent({ connect: material.connectOptions });
+}
+
+export async function closeMcpTlsDispatcher(dispatcher) {
+  if (!dispatcher) return;
+  if (typeof dispatcher.close === "function") {
+    await dispatcher.close();
+  } else if (typeof dispatcher.destroy === "function") {
+    dispatcher.destroy();
+  }
+}

package/src/lib/output-styles.js

@@ -33,6 +33,18 @@ export const BUILTIN_OUTPUT_STYLES = Object.freeze({
     body: "",
     builtin: true,
   },
+  concise: {
+    name: "concise",
+    description: "Uses short, direct responses with minimal explanation.",
+    body: [
+      "## Output style: Concise",
+      "Respond directly and briefly. Prefer the smallest complete answer that",
+      "preserves essential context, decisions, verification results, and safety",
+      "warnings. Avoid restating the request, long preambles, and optional",
+      "tangents unless the user asks for more detail.",
+    ].join("\n"),
+    builtin: true,
+  },
   explanatory: {
     name: "explanatory",
     description: "Explains the reasoning and trade-offs behind changes.",