coding-tool-x 3.8.3 → 3.8.5

package/src/server/api/mcp.js

@@ -5,8 +5,149 @@
 const express = require('express');
 const router = express.Router();
 const mcpService = require('../services/mcp-service');
-const MCP_PLATFORMS = ['claude', 'codex', 'gemini', 'opencode', 'omp'];
-const MCP_EXPORT_FORMATS = ['json', 'claude', 'codex', 'gemini', 'opencode', 'omp'];
+const { redactSecrets } = require('../../shared/project-config');
+
+const SENSITIVE_URL_KEY = /^(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key)$/i;
+
+function hasSensitiveUrl(value) {
+  if (typeof value !== 'string') return false;
+  try {
+    const parsed = new URL(value);
+    return Boolean(
+      parsed.username
+      || parsed.password
+      || [...parsed.searchParams.keys()].some(key => SENSITIVE_URL_KEY.test(key))
+    );
+  } catch {
+    return /\/\/[^/@\s:]+:[^@/\s]+@|[?&](?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key)=/i.test(value);
+  }
+}
+
+function sanitizeMcpUrl(value) {
+  if (typeof value !== 'string') return value;
+  try {
+    const parsed = new URL(value);
+    parsed.username = '';
+    parsed.password = '';
+    for (const key of parsed.searchParams.keys()) {
+      if (SENSITIVE_URL_KEY.test(key)) parsed.searchParams.set(key, '[REDACTED]');
+    }
+    return parsed.toString();
+  } catch {
+    return value
+      .replace(/\/\/[^/@\s:]+:[^@/\s]+@/g, '//[REDACTED]@')
+      .replace(/([?&](?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key)=)[^&\s]+/gi, '$1[REDACTED]');
+  }
+}
+
+const SENSITIVE_COMMAND_FLAG = /^(?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)$/i;
+
+function sanitizeCommandLineValue(value) {
+  if (Array.isArray(value)) {
+    let redactNext = false;
+    return value.map(item => {
+      if (redactNext) {
+        redactNext = false;
+        return '[REDACTED]';
+      }
+      if (typeof item !== 'string') return '[REDACTED]';
+      if (SENSITIVE_COMMAND_FLAG.test(item)) {
+        redactNext = true;
+        return item;
+      }
+      const inline = item.match(/^((?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)=).*/i);
+      if (inline) return `${inline[1]}[REDACTED]`;
+      return sanitizeErrorMessage(item);
+    });
+  }
+  if (typeof value !== 'string') return value;
+  return sanitizeErrorMessage(value)
+    .replace(/((?:^|\s)(?:--?|\/)(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key|auth|credential|client[-_]?secret|bearer)(?:=|\s+))\S+/gi, '$1[REDACTED]');
+}
+
+function sanitizeMcpValue(value, key = '') {
+  if (/^url$/i.test(key)) return sanitizeMcpUrl(value);
+  if (/^(?:command|args)$/i.test(key)) return sanitizeCommandLineValue(value);
+  if (/(?:token|secret|password|api[-_]?key|access[_-]?token|authorization|headers?|env(?:ironment)?|envvars|experimentalenvironment|auth|oauth|credential|private[_-]?key)/i.test(key)) {
+    return '[REDACTED]';
+  }
+  if (typeof value === 'string') return sanitizeErrorMessage(value);
+  if (Array.isArray(value)) return value.map(item => sanitizeMcpValue(item));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+    childKey,
+    sanitizeMcpValue(childValue, childKey)
+  ]));
+}
+function sanitizeMcpServer(server) {
+  if (!server || typeof server !== 'object') return server;
+  const safe = sanitizeMcpValue(redactSecrets(server));
+  const env = server.server?.env;
+  const headers = server.server?.headers;
+  const url = server.server?.url;
+  return {
+    ...safe,
+    ...(env || headers || hasSensitiveUrl(url)
+      ? { hasSecret: true }
+      : {})
+  };
+}
+
+function sanitizeErrorMessage(value) {
+  return String(value || '')
+    .replace(/(https?:\/\/[^\s?]+)\?[^\s]+/gi, '$1?[REDACTED]')
+    .replace(/(Bearer\s+)[^\s]+/gi, '$1[REDACTED]')
+    .replace(/([?&](?:token|secret|password|api[-_]?key|access[_-]?token|authorization|key)=)[^&\s]+/gi, '$1[REDACTED]')
+    .replace(/((?:token|secret|password|api[-_]?key|access[_-]?token|authorization)\s*[:=]\s*)[^,\s}]+/gi, '$1[REDACTED]');
+}
+function sanitizeMcpServers(servers) {
+  if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return {};
+  return Object.fromEntries(Object.entries(servers).map(([id, server]) => [id, sanitizeMcpServer(server)]));
+}
+const { resolveCapability, resolveOperation } = require('../../platforms/access');
+
+function normalizePlatformKey(platform) {
+  return String(platform || '').trim().toLowerCase();
+}
+
+function resolveMcpPlatform(platform) {
+  try {
+    const resolved = resolveCapability(platform, 'mcp');
+    const driverId = resolved.manifest?.capabilities?.mcp || null;
+    return { key: resolved.key, driverId, driver: resolved.driver };
+  } catch (error) {
+    return { error };
+  }
+}
+
+function resolveMcpExportPlatform(platform) {
+  try {
+    const resolved = resolveOperation(platform, 'mcp', 'export');
+    return { key: resolved.key, driver: resolved.driver };
+  } catch (error) {
+    return { error };
+  }
+}
+
+
+
+function sendCapabilityError(res, error, fallbackStatus = 400) {
+  const status = ['not_found', 'unsupported'].includes(error?.code)
+    ? 404
+    : error?.code === 'invalid'
+      ? 400
+      : error?.code === 'failed'
+        ? 500
+        : (error?.status === 404 && error?.code ? 404 : fallbackStatus);
+  return res.status(status).json({
+    success: false,
+    error: sanitizeErrorMessage(error.message),
+    code: error.code || undefined,
+    platform: error.platform || undefined,
+    capability: error.capability || undefined,
+    operation: error.operation || undefined
+  });
+}
 
 /**
  * GET /api/mcp/servers
@@ -17,13 +158,13 @@ router.get('/servers', (req, res) => {
     const servers = mcpService.getAllServers();
     res.json({
       success: true,
-      servers
+      servers: sanitizeMcpServers(servers)
     });
   } catch (error) {
-    console.error('[MCP API] Get servers failed:', error);
+    console.error('[MCP API] Get servers failed:', sanitizeErrorMessage(error.message || error));
     res.status(500).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -43,13 +184,13 @@ router.get('/servers/:id', (req, res) => {
     }
     res.json({
       success: true,
-      server
+      server: sanitizeMcpServer(server)
     });
   } catch (error) {
-    console.error('[MCP API] Get server failed:', error);
-    res.status(500).json({
+    console.error('[MCP API] Get server failed:', sanitizeErrorMessage(error.message || error));
+    res.status(400).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -79,13 +220,13 @@ router.post('/servers', async (req, res) => {
     const result = await mcpService.saveServer(server);
     res.json({
       success: true,
-      server: result
+      server: sanitizeMcpServer(result)
     });
   } catch (error) {
-    console.error('[MCP API] Save server failed:', error);
+    console.error('[MCP API] Save server failed:', sanitizeErrorMessage(error.message || error));
     res.status(400).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -107,10 +248,10 @@ router.delete('/servers/:id', async (req, res) => {
       success: true
     });
   } catch (error) {
-    console.error('[MCP API] Delete server failed:', error);
-    res.status(500).json({
+    console.error('[MCP API] Delete server failed:', sanitizeErrorMessage(error.message || error));
+    res.status(400).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -140,13 +281,13 @@ router.post('/servers/:id/toggle', async (req, res) => {
     const server = await mcpService.toggleServerApp(req.params.id, app, enabled);
     res.json({
       success: true,
-      server
+      server: sanitizeMcpServer(server)
     });
   } catch (error) {
-    console.error('[MCP API] Toggle server failed:', error);
+    console.error('[MCP API] Toggle server failed:', sanitizeErrorMessage(error.message || error));
     res.status(400).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -163,10 +304,10 @@ router.get('/presets', (req, res) => {
       presets
     });
   } catch (error) {
-    console.error('[MCP API] Get presets failed:', error);
+    console.error('[MCP API] Get presets failed:', sanitizeErrorMessage(error.message || error));
     res.status(500).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -177,29 +318,20 @@ router.get('/presets', (req, res) => {
  */
 router.post('/import/:platform', async (req, res) => {
   try {
-    const { platform } = req.params;
+    const resolved = resolveMcpPlatform(req.params.platform);
+    if (resolved.error) return sendCapabilityError(res, resolved.error, 404);
 
-    if (!MCP_PLATFORMS.includes(platform)) {
-      return res.status(400).json({
-        success: false,
-        error: `无效的平台: ${platform}`
-      });
-    }
-
-    const count = await mcpService.importFromPlatform(platform);
+    const count = await mcpService.importFromPlatform(resolved.key);
     res.json({
       success: true,
       imported: count,
       message: count > 0
-        ? `成功从 ${platform} 导入 ${count} 个 MCP 服务器`
-        : `${platform} 没有可导入的 MCP 服务器`
+        ? `成功从 ${resolved.key} 导入 ${count} 个 MCP 服务器`
+        : `${resolved.key} 没有可导入的 MCP 服务器`
     });
   } catch (error) {
-    console.error('[MCP API] Import failed:', error);
-    res.status(500).json({
-      success: false,
-      error: error.message
-    });
+    console.error('[MCP API] Import failed:', sanitizeErrorMessage(error.message || error));
+    return sendCapabilityError(res, error, 500);
   }
 });
 
@@ -215,10 +347,10 @@ router.get('/stats', (req, res) => {
       stats
     });
   } catch (error) {
-    console.error('[MCP API] Get stats failed:', error);
+    console.error('[MCP API] Get stats failed:', sanitizeErrorMessage(error.message || error));
     res.status(500).json({
       success: false,
-      error: error.message
+      error: sanitizeErrorMessage(error.message)
     });
   }
 });
@@ -240,12 +372,13 @@ router.post('/servers/:id/test', async (req, res) => {
       result
     });
   } catch (error) {
-    console.error('[MCP API] Test server failed:', error);
-    res.status(500).json({
+    console.error('[MCP API] Test server failed:', sanitizeErrorMessage(error.message || error));
+    const safeError = sanitizeErrorMessage(error.message || error);
+    res.status(error.code === 'MCP_DISABLED' ? 403 : 500).json({
       success: false,
-      error: error.message,
-      message: error.message,
-      hint: error?.data?.hint || null
+      error: safeError,
+      message: safeError,
+      hint: sanitizeMcpValue(error?.data?.hint)
     });
   }
 });
@@ -268,13 +401,14 @@ router.post('/servers/order', (req, res) => {
     const servers = mcpService.updateServerOrder(serverIds);
     res.json({
       success: true,
-      servers
+      servers: sanitizeMcpServers(servers)
     });
   } catch (error) {
-    console.error('[MCP API] Update order failed:', error);
-    res.status(500).json({
+    console.error('[MCP API] Update order failed:', sanitizeErrorMessage(error.message || error));
+    const safeError = sanitizeErrorMessage(error.message || error);
+    res.status(/invalid MCP server ID/i.test(safeError) ? 400 : 500).json({
       success: false,
-      error: error.message
+      error: safeError
     });
   }
 });
@@ -285,13 +419,19 @@ router.post('/servers/order', (req, res) => {
  */
 router.get('/export', (req, res) => {
   try {
-    const format = req.query.format || 'json';
-
-    if (!MCP_EXPORT_FORMATS.includes(format)) {
-      return res.status(400).json({
-        success: false,
-        error: `无效的导出格式: ${format}`
-      });
+    const format = normalizePlatformKey(req.query.format || 'json');
+
+    if (format !== 'json') {
+      const resolved = resolveMcpExportPlatform(format);
+      if (resolved.error) {
+        if (resolved.error.code === 'not_found') {
+          return res.status(400).json({
+            success: false,
+            error: `无效的导出格式: ${format}`
+          });
+        }
+        return sendCapabilityError(res, resolved.error, 404);
+      }
     }
 
     const result = mcpService.exportServers(format);
@@ -300,11 +440,8 @@ router.get('/export', (req, res) => {
       ...result
     });
   } catch (error) {
-    console.error('[MCP API] Export failed:', error);
-    res.status(500).json({
-      success: false,
-      error: error.message
-    });
+    console.error('[MCP API] Export failed:', sanitizeErrorMessage(error.message || error));
+    return sendCapabilityError(res, error, 500);
   }
 });
 
@@ -314,26 +451,29 @@ router.get('/export', (req, res) => {
  */
 router.get('/export/download', (req, res) => {
   try {
-    const format = req.query.format || 'json';
-
-    if (!MCP_EXPORT_FORMATS.includes(format)) {
-      return res.status(400).json({
-        success: false,
-        error: `无效的导出格式: ${format}`
-      });
+    const format = normalizePlatformKey(req.query.format || 'json');
+
+    if (format !== 'json') {
+      const resolved = resolveMcpExportPlatform(format);
+      if (resolved.error) {
+        if (resolved.error.code === 'not_found') {
+          return res.status(400).json({
+            success: false,
+            error: `无效的导出格式: ${format}`
+          });
+        }
+        return sendCapabilityError(res, resolved.error, 404);
+      }
     }
 
     const result = mcpService.exportServers(format);
 
-    res.setHeader('Content-Type', format === 'codex' ? 'application/toml' : 'application/json');
+    res.setHeader('Content-Type', result.contentType || 'application/octet-stream');
     res.setHeader('Content-Disposition', `attachment; filename="${result.filename}"`);
     res.send(result.content);
   } catch (error) {
-    console.error('[MCP API] Export download failed:', error);
-    res.status(500).json({
-      success: false,
-      error: error.message
-    });
+    console.error('[MCP API] Export download failed:', sanitizeErrorMessage(error.message || error));
+    return sendCapabilityError(res, error, 500);
   }
 });
 
@@ -348,20 +488,20 @@ router.get('/servers/:id/tools', async (req, res) => {
     if (result.status === 'error') {
       return res.status(502).json({
         success: false,
-        error: result.error || '获取工具列表失败',
-        message: result.error || '获取工具列表失败',
-        hint: result.hint || null,
+        error: sanitizeErrorMessage(result.error || '获取工具列表失败'),
+        message: sanitizeErrorMessage(result.error || '获取工具列表失败'),
+        hint: sanitizeMcpValue(result.hint || null),
         duration: result.duration,
         tools: []
       });
     }
     res.json({ success: true, ...result });
   } catch (err) {
-    res.status(404).json({
+    res.status(err.code === 'MCP_DISABLED' ? 403 : 404).json({
       success: false,
-      error: err.message,
-      message: err.message,
-      hint: err?.data?.hint || null
+      error: sanitizeErrorMessage(err.message),
+      message: sanitizeErrorMessage(err.message),
+      hint: sanitizeMcpValue(err?.data?.hint || null)
     });
   }
 });
@@ -382,11 +522,11 @@ router.post('/servers/:id/tools/test', async (req, res) => {
     const result = await mcpService.callServerTool(id, toolName, args || {});
     res.json({ success: true, ...result });
   } catch (err) {
-    res.status(500).json({
+    res.status(err.code === 'MCP_DISABLED' ? 403 : 500).json({
       success: false,
-      error: err.message,
-      message: err.message,
-      hint: err?.data?.hint || null
+      error: sanitizeErrorMessage(err.message),
+      message: sanitizeErrorMessage(err.message),
+      hint: sanitizeMcpValue(err?.data?.hint || null)
     });
   }
 });
@@ -416,7 +556,7 @@ router.get('/servers/:id/info', async (req, res) => {
       } : {}
     });
   } catch (err) {
-    res.status(500).json({ success: false, error: err.message });
+    res.status(500).json({ success: false, error: sanitizeErrorMessage(err.message) });
   }
 });
 

package/src/server/api/platform-api-config.js

@@ -0,0 +1,102 @@
+'use strict';
+
+function cloneObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? { ...value } : {};
+}
+
+function normalizeQuery(query) {
+  return cloneObject(query);
+}
+
+function normalizeBody(body) {
+  return body === undefined ? undefined : body;
+}
+
+function requestContext(request, manifest, route, config) {
+  const params = { ...request.params };
+  delete params.platform;
+  if (params.projectHash && !params.projectName) {
+    params.projectName = params.projectHash;
+    delete params.projectHash;
+  }
+  return {
+    platform: manifest.key,
+    manifest,
+    route,
+    config,
+    params,
+    query: normalizeQuery(request.query),
+    body: normalizeBody(request.body),
+    remoteAddress: request.ip || request.socket?.remoteAddress
+  };
+}
+
+function projectPayload(data, context) {
+  if (Array.isArray(data)) {
+    return { projects: data, currentProject: null, meta: {} };
+  }
+  const payload = cloneObject(data);
+  if (!Array.isArray(payload.projects)) payload.projects = [];
+  if (!Object.prototype.hasOwnProperty.call(payload, 'currentProject')) payload.currentProject = null;
+  if (!payload.meta || typeof payload.meta !== 'object' || Array.isArray(payload.meta)) payload.meta = {};
+  return payload;
+}
+
+function sessionPayload(data) {
+  if (Array.isArray(data)) return { sessions: data, meta: {} };
+  const payload = cloneObject(data);
+  if (!Array.isArray(payload.sessions)) payload.sessions = [];
+  if (!payload.meta || typeof payload.meta !== 'object' || Array.isArray(payload.meta)) payload.meta = {};
+  return payload;
+}
+
+const requestCodecs = Object.freeze({
+  default: requestContext,
+  'projects-list': requestContext,
+  'sessions-list': requestContext,
+  json: requestContext
+});
+
+const responseCodecs = Object.freeze({
+  default: value => value,
+  'projects-list': projectPayload,
+  projects: projectPayload,
+  'sessions-list': sessionPayload,
+  sessions: sessionPayload
+});
+
+function hasRequestCodec(codec) {
+  return typeof codec === 'function' || typeof requestCodecs[codec] === 'function';
+}
+
+function hasResponseCodec(codec) {
+  return typeof codec === 'function' || typeof responseCodecs[codec] === 'function';
+}
+
+
+function applyRequestCodec(request, manifest, route, config) {
+  const codec = typeof route.request === 'function' ? route.request : requestCodecs[route.request] || requestCodecs.default;
+  return codec(request, manifest, route, config);
+}
+
+function applyResponseCodec(value, manifest, route, context) {
+  const codec = typeof route.response === 'function' ? route.response : responseCodecs[route.response] || responseCodecs.default;
+  return codec(value, manifest, route, context);
+}
+
+function emptyPayload(route) {
+  if (route.response === 'projects-list' || route.response === 'projects') return { projects: [], currentProject: null, meta: {} };
+  if (route.response === 'sessions-list' || route.response === 'sessions') return { sessions: [], meta: {} };
+  return {};
+}
+
+module.exports = {
+  requestCodecs,
+  responseCodecs,
+  hasRequestCodec,
+  hasResponseCodec,
+  applyRequestCodec,
+  applyResponseCodec,
+  emptyPayload,
+  createRequestContext: requestContext
+};