d365fo-mcp 1.8.3 → 1.8.4

package/dist/tools/createD365File.js

@@ -10,6 +10,7 @@ import { getConfigManager, fallbackPackagePath } from '../utils/configManager.js
 import { describePackagesRootScan } from '../utils/packagesRoot.js';
 import { registerCustomModel, resolveObjectPrefix, applyObjectPrefix, getObjectSuffix, applyObjectSuffix, getExtensionNamingStyle } from '../utils/modelClassifier.js';
 import { PackageResolver } from '../utils/packageResolver.js';
+import { crossModelWriteRefusal } from '../utils/crossModelWriteGuard.js';
 import { ensureXppDocComment, ensureBlankLineBeforeClosingBrace } from '../utils/xppDocGen.js';
 import { reindentXppSource } from '../utils/xppFormat.js';
 import { decodeXmlEntitiesFromXppSource } from './modifyD365File.js';
@@ -3796,6 +3797,24 @@ export async function handleCreateD365File(request, context) {
                 isError: true,
             };
         }
+        // Cross-model guard: creating INTO a custom model other than the one this
+        // workspace targets is the same mistake as modifying one — the object lands
+        // outside this project's version control and inside code other models inherit.
+        // `actualModelName` is what the write will actually use (caller's modelName, or
+        // the workspace's), so the check sits after every fallback has been applied.
+        const crossModelCreateRefusal = crossModelWriteRefusal({
+            objectName: args.objectName,
+            objectType: args.objectType,
+            owningModel: actualModelName,
+            activeModel: getConfigManager().getModelName() ?? '',
+            action: 'create',
+        });
+        if (crossModelCreateRefusal) {
+            return {
+                content: [{ type: 'text', text: crossModelCreateRefusal }],
+                isError: true,
+            };
+        }
         // Apply extension prefix to object name
         const objectPrefix = resolveObjectPrefix(actualModelName);
         const namingStyle = getExtensionNamingStyle();

package/dist/tools/createLabel.js

@@ -17,6 +17,7 @@ import * as path from 'path';
 import { getConfigManager } from '../utils/configManager.js';
 import { defaultPackagesRoot } from '../utils/packagesRoot.js';
 import { PackageResolver } from '../utils/packageResolver.js';
+import { crossModelWriteRefusal } from '../utils/crossModelWriteGuard.js';
 import { detectEol } from '../utils/eolUtils.js';
 import { isExtensionLabelFile } from '../metadata/labelParser.js';
 import { ProjectFileManager, ProjectFileFinder } from './createD365File.js';
@@ -445,6 +446,25 @@ export async function createLabelTool(request, context) {
             resolvedPackagePath = packagePath || configManager.getPackagePath() || defaultPackagesRoot();
             resolvedPackageName = model;
         }
+        // Cross-model guard: a label file belongs to exactly one model, so writing a
+        // label into another model's file has the same consequences as editing that
+        // model's objects — and labels are usually the first thing an agent adds when
+        // it drifts into the wrong model. `model` is the model directory the write
+        // resolves to, so this compares the real target, not the caller's intent.
+        const crossModelLabelRefusal = crossModelWriteRefusal({
+            objectName: `@${args.labelFileId}:${args.labelId}`,
+            objectType: 'label',
+            owningModel: model,
+            owningPackage: resolvedPackageName,
+            activeModel: configManager.getModelName() ?? '',
+            action: 'create',
+        });
+        if (crossModelLabelRefusal) {
+            return {
+                content: [{ type: 'text', text: crossModelLabelRefusal }],
+                isError: true,
+            };
+        }
         const modelDir = path.join(resolvedPackagePath, resolvedPackageName, model);
         const axLabelDir = path.join(modelDir, 'AxLabelFile');
         const labelResourcesDir = path.join(axLabelDir, 'LabelResources');

package/dist/tools/modifyD365File.js

@@ -1464,7 +1464,7 @@ export async function modifyD365FileTool(request, context) {
             owningModel,
             owningPackage: containment.packageSegment ?? resolvedModelFromPath,
             activeModel,
-            explicitModelName: modelName,
+            action: 'modify',
             existingExtensions: findExtensionsInModel(symbolIndex, baseObjectOf(objectName, objectType), activeModel),
         });
         if (crossModelRefusal) {

package/dist/utils/crossModelWriteGuard.d.ts

@@ -16,13 +16,24 @@
  * other country model inherits — instead of the one thing that was wanted, a
  * table extension in the active model.
  *
- * So a write whose resolved file lives in a model other than the active one is
- * refused by default, with the extension route spelled out. Two deliberate
- * escape hatches, mirroring the standard-model guard's "explicit modelName =
- * you know what you're doing":
- *   - `modelName="<owning model>"` on the call — a per-call, per-model opt-in,
- *   - `D365FO_ALLOW_CROSS_MODEL_WRITE=true` — an environment-wide opt-out for
- *     setups where one server really does serve several models.
+ * ## Consent cannot be self-served
+ *
+ * The first version of this guard accepted `modelName="<owning model>"` on the
+ * call as consent, mirroring the standard-model guard's "explicit modelName =
+ * you know what you're doing". For a human that reasoning holds. For an agent it
+ * does not: the refusal text told it which parameter to add, so it added the
+ * parameter and wrote into the shared model anyway — with a well-argued
+ * explanation afterwards. A bypass the caller can mint for itself is not a
+ * bypass, it is a speed bump.
+ *
+ * So consent lives ONLY in server configuration, which a human edits and which
+ * takes a restart:
+ *   - `D365FO_CROSS_MODEL_WRITE_MODELS=ModelA,ModelB` — allow these models,
+ *   - `D365FO_ALLOW_CROSS_MODEL_WRITE=true`           — allow any model.
+ *
+ * And the refusal deliberately does NOT hand the caller a workaround: it names
+ * the extension route, and says the alternative is the user's decision to make
+ * in configuration.
  */
 /** An extension of the target object that already exists in the active model. */
 export interface ExistingExtension {
@@ -34,7 +45,7 @@ export interface CrossModelWriteCheck {
     objectName: string;
     /** d365fo_file objectType, e.g. 'table', 'table-extension', 'class'. */
     objectType: string;
-    /** Model that owns the resolved file (the `<Model>` path segment). */
+    /** Model that owns the write target (the `<Model>` path segment, or the model asked for). */
     owningModel: string | null | undefined;
     /**
      * `<Package>` segment of the same path. A match on EITHER segment counts as
@@ -46,11 +57,17 @@ export interface CrossModelWriteCheck {
     owningPackage?: string | null;
     /** Model the workspace targets (.rnrproj / D365FO_MODEL_NAME). */
     activeModel: string | null | undefined;
-    /** `modelName` as passed by the caller — the per-call opt-in. */
-    explicitModelName?: string | null;
     /** Extensions of the base object that already exist in the active model. */
     existingExtensions?: ExistingExtension[];
+    /** Wording only — what the caller was about to do. */
+    action?: 'modify' | 'create';
 }
+/**
+ * True when the OPERATOR has allowed writes into `owningModel` from another
+ * workspace — a blanket opt-out, or an explicit per-model allow-list. Both live
+ * in the environment: a caller cannot grant this to itself mid-conversation.
+ */
+export declare function crossModelWriteAllowedByConfig(owningModel: string): boolean;
 /** The base object an extension extends: "CustTable.FooExtension" → "CustTable". */
 export declare function baseObjectOf(objectName: string, objectType: string): string;
 /**

package/dist/utils/crossModelWriteGuard.js

@@ -16,13 +16,24 @@
  * other country model inherits — instead of the one thing that was wanted, a
  * table extension in the active model.
  *
- * So a write whose resolved file lives in a model other than the active one is
- * refused by default, with the extension route spelled out. Two deliberate
- * escape hatches, mirroring the standard-model guard's "explicit modelName =
- * you know what you're doing":
- *   - `modelName="<owning model>"` on the call — a per-call, per-model opt-in,
- *   - `D365FO_ALLOW_CROSS_MODEL_WRITE=true` — an environment-wide opt-out for
- *     setups where one server really does serve several models.
+ * ## Consent cannot be self-served
+ *
+ * The first version of this guard accepted `modelName="<owning model>"` on the
+ * call as consent, mirroring the standard-model guard's "explicit modelName =
+ * you know what you're doing". For a human that reasoning holds. For an agent it
+ * does not: the refusal text told it which parameter to add, so it added the
+ * parameter and wrote into the shared model anyway — with a well-argued
+ * explanation afterwards. A bypass the caller can mint for itself is not a
+ * bypass, it is a speed bump.
+ *
+ * So consent lives ONLY in server configuration, which a human edits and which
+ * takes a restart:
+ *   - `D365FO_CROSS_MODEL_WRITE_MODELS=ModelA,ModelB` — allow these models,
+ *   - `D365FO_ALLOW_CROSS_MODEL_WRITE=true`           — allow any model.
+ *
+ * And the refusal deliberately does NOT hand the caller a workaround: it names
+ * the extension route, and says the alternative is the user's decision to make
+ * in configuration.
  */
 import { resolveObjectPrefix, applyObjectPrefix } from './modelClassifier.js';
 /** Base object type → the d365fo_file objectType used to extend it. */
@@ -41,10 +52,18 @@ const EXTENSION_TYPE_OF = {
 function eq(a, b) {
     return !!a && !!b && a.trim().toLowerCase() === b.trim().toLowerCase();
 }
-/** True when the operator has opted out of the guard environment-wide. */
-function guardDisabled() {
-    const v = process.env.D365FO_ALLOW_CROSS_MODEL_WRITE?.trim().toLowerCase();
-    return v === 'true' || v === '1' || v === 'yes';
+/**
+ * True when the OPERATOR has allowed writes into `owningModel` from another
+ * workspace — a blanket opt-out, or an explicit per-model allow-list. Both live
+ * in the environment: a caller cannot grant this to itself mid-conversation.
+ */
+export function crossModelWriteAllowedByConfig(owningModel) {
+    const blanket = process.env.D365FO_ALLOW_CROSS_MODEL_WRITE?.trim().toLowerCase();
+    if (blanket === 'true' || blanket === '1' || blanket === 'yes')
+        return true;
+    return (process.env.D365FO_CROSS_MODEL_WRITE_MODELS ?? '')
+        .split(',')
+        .some(m => eq(m, owningModel));
 }
 /** The base object an extension extends: "CustTable.FooExtension" → "CustTable". */
 export function baseObjectOf(objectName, objectType) {
@@ -76,19 +95,17 @@ export function suggestedExtensionName(baseObject, baseType, activeModel) {
  * when the write is allowed.
  */
 export function crossModelWriteRefusal(check) {
-    const { objectName, objectType, owningModel, activeModel, explicitModelName } = check;
+    const { objectName, objectType, owningModel, activeModel } = check;
+    const verb = check.action ?? 'modify';
     // Nothing to compare against — an unconfigured workspace or a path whose model
     // segment could not be determined. Never block on a guess.
     if (!owningModel || !activeModel)
         return null;
     if (eq(owningModel, activeModel) || eq(check.owningPackage, activeModel))
         return null;
-    // Per-call opt-in: the caller named the owning model (or its package) outright.
-    if (eq(explicitModelName, owningModel) || eq(explicitModelName, check.owningPackage))
-        return null;
-    if (guardDisabled()) {
-        console.error(`[crossModelWriteGuard] D365FO_ALLOW_CROSS_MODEL_WRITE — allowing write to "${objectName}" ` +
-            `in model "${owningModel}" (active model "${activeModel}")`);
+    if (crossModelWriteAllowedByConfig(owningModel)) {
+        console.error(`[crossModelWriteGuard] configuration allows cross-model writes to "${owningModel}" ` +
+            `— proceeding with ${verb} of "${objectName}" (active model "${activeModel}")`);
         return null;
     }
     const isExtension = objectType.endsWith('-extension');
@@ -96,8 +113,8 @@ export function crossModelWriteRefusal(check) {
     const baseType = isExtension ? objectType.slice(0, -'-extension'.length) : objectType;
     const extType = EXTENSION_TYPE_OF[baseType];
     const lines = [
-        `⛔ Refusing to modify "${objectName}" — it belongs to model "${owningModel}", ` +
-            `not to this workspace's model "${activeModel}".`,
+        `⛔ Refusing to ${verb} "${objectName}" in model "${owningModel}" — this workspace ` +
+            `targets model "${activeModel}".`,
         '',
         `"${owningModel}" is a different model: the change would land in code that "${activeModel}" ` +
             `only consumes, it would not appear in this workspace's project or version control, and every ` +
@@ -116,7 +133,12 @@ export function crossModelWriteRefusal(check) {
         }
         lines.push('');
     }
-    lines.push(`If editing "${owningModel}" in place is genuinely what you want, say so explicitly:`, `  • pass modelName="${owningModel}" on this call, or`, `  • switch the workspace to that model: get_workspace_info(projectName="${owningModel}"), or`, `  • set D365FO_ALLOW_CROSS_MODEL_WRITE=true to disable this guard for the whole server.`);
+    lines.push(`Do NOT route around this guard: no retry with a different modelName, filePath, ` +
+        `packagePath or project. Half-finished pieces of this very feature sitting in ` +
+        `"${owningModel}" — a matching enum, field, label or scaffold — are evidence that an ` +
+        `earlier run made this same mistake, NOT evidence that the feature belongs there.`, '', `Writing into "${owningModel}" is the user's decision, not yours. If they want it, they ` +
+        `set D365FO_CROSS_MODEL_WRITE_MODELS=${owningModel} (or D365FO_ALLOW_CROSS_MODEL_WRITE=true) ` +
+        `in the server configuration and restart. Ask them; report this refusal instead of working past it.`);
     return lines.join('\n');
 }
 //# sourceMappingURL=crossModelWriteGuard.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "d365fo-mcp",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "MCP Server for X++ Code Completion in D365 Finance & Operations",
   "type": "module",
   "main": "dist/index.js",