dsh-atlassian-plugin 0.3.4 → 0.4.0

package/lib/index.js

@@ -193,10 +193,13 @@ var OAuthServer = class {
    */
   toTokenFields = (payload, previous) => {
     const expiresIn = Number(payload.expires_in);
+    const accessToken = payload.access_token;
+    const refreshToken = payload.refresh_token;
+    const tokenType = payload.token_type;
     return {
-      accessToken: typeof payload.access_token === "string" ? payload.access_token : previous.accessToken,
-      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : previous.refreshToken,
-      tokenType: typeof payload.token_type === "string" ? payload.token_type : previous.tokenType,
+      accessToken: typeof accessToken === "string" && accessToken !== "" ? accessToken : previous.accessToken,
+      refreshToken: typeof refreshToken === "string" && refreshToken !== "" ? refreshToken : previous.refreshToken,
+      tokenType: typeof tokenType === "string" && tokenType !== "" ? tokenType : previous.tokenType,
       scope: typeof payload.scope === "string" ? payload.scope : previous.scope,
       expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600) * 1e3
     };
@@ -234,16 +237,28 @@ async function discover(profile) {
   }
   if (metadata === void 0)
     throw new Error(`no OAuth metadata for ${endpoint} (issuer ${issuer})`);
-  const authorizationEndpoint = firstString(metadata.authorization_endpoint);
-  const tokenEndpoint = firstString(metadata.token_endpoint);
+  const authorizationEndpoint = secureEndpoint(
+    firstString(metadata.authorization_endpoint),
+    "the authorization endpoint"
+  );
+  const tokenEndpoint = secureEndpoint(
+    firstString(metadata.token_endpoint),
+    "the token endpoint"
+  );
   if (authorizationEndpoint === void 0 || tokenEndpoint === void 0)
     throw new Error(`incomplete OAuth metadata for ${issuer}`);
   const advertised = stringList(protectedResource?.scopes_supported) ?? stringList(metadata.scopes_supported);
   const scopes = chooseScopes(profile, advertised);
-  const registrationEndpoint = firstString(metadata.registration_endpoint);
-  const revocationEndpoint = firstString(metadata.revocation_endpoint);
+  const registrationEndpoint = secureEndpoint(
+    firstString(metadata.registration_endpoint),
+    "the registration endpoint"
+  );
+  const revocationEndpoint = secureEndpoint(
+    firstString(metadata.revocation_endpoint),
+    "the revocation endpoint"
+  );
   return new OAuthServer({
-    issuer: firstString(metadata.issuer) ?? issuer,
+    issuer: secureEndpoint(firstString(metadata.issuer) ?? issuer, "the issuer") ?? issuer,
     resource: endpoint,
     authorizationEndpoint,
     tokenEndpoint,
@@ -283,6 +298,19 @@ function chooseScopes(profile, advertised) {
   if (chosen.length > 0) return chosen;
   return advertised.includes("offline_access") ? ["offline_access"] : [...profile.oauth.fallbackScopes];
 }
+function secureEndpoint(value, what) {
+  if (value === void 0) return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${what} is not a URL`);
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+    throw new Error(`${what} must use https`);
+  return value;
+}
 function stringList(value) {
   if (!Array.isArray(value)) return void 0;
   const items = value.filter(
@@ -343,6 +371,8 @@ var McpBridge = class {
   names = [];
   ready = false;
   failure;
+  pending;
+  logger;
   /** Public names of the published tools, in discovery order. */
   get toolNames() {
     return this.names;
@@ -367,7 +397,15 @@ var McpBridge = class {
    * @returns whether the bridge is usable; failures are logged, never thrown.
    */
   async ensure(ctx) {
+    this.pending ??= this.connectOnce(ctx).finally(() => {
+      this.pending = void 0;
+    });
+    return await this.pending;
+  }
+  /** One connection attempt, shared by every caller that arrives meanwhile. */
+  async connectOnce(ctx) {
     const { profile, store } = this.options;
+    this.logger = loggerOf(ctx);
     if (needsOAuth(profile)) {
       const grant = await store?.read();
       if (grant === void 0 || !grant.isSignedIn()) return false;
@@ -420,10 +458,18 @@ var McpBridge = class {
       throw new Error(
         `the ${this.options.profile.label} MCP connection is not open`
       );
-    return await client.callTool(
+    const result = await client.callTool(
       { name: name2, arguments: args },
       { timeout: TOOL_CALL_TIMEOUT_MS }
     );
+    if (this.options.profile.debug)
+      this.logger?.info(
+        "[%s] %s answered %s",
+        accountLabel(this.options.profile),
+        name2,
+        JSON.stringify(result)
+      );
+    return result;
   }
   /** The discovered authorization server, remembered across reconnects. */
   async authorizationServer(profile) {
@@ -459,38 +505,49 @@ var McpBridge = class {
     const listed = await client.listTools(void 0, { cacheMode: "refresh" });
     const disposers = /* @__PURE__ */ new Map();
     const names = [];
-    for (const tool of listed.tools) {
-      const name2 = publicToolName(
-        tool.name,
-        this.options.profile.toolNamespace
-      );
-      const base = createMcpToolDefinition(ctx, {
-        name: name2,
-        rawName: tool.name,
-        description: tool.description ?? `MCP tool ${tool.name}`,
-        inputSchema: tool.inputSchema ?? {
-          type: "object",
-          properties: {}
-        },
-        ...tool.outputSchema === void 0 ? {} : { outputSchema: tool.outputSchema },
-        ...tool.execution?.taskSupport === "required" ? { taskRequired: true } : {},
-        call: async (args, execution) => await client.callTool(
-          { name: tool.name, arguments: args },
-          {
-            signal: execution.signal,
-            toolDefinition: tool,
-            timeout: TOOL_CALL_TIMEOUT_MS
-          }
-        )
-      });
-      disposers.set(
-        name2,
-        ctx.tools.register(this.options.decorate?.(base, tool) ?? base)
-      );
-      names.push(name2);
-    }
-    for (const dispose of this.disposers.values()) dispose();
+    const previous = this.disposers;
     this.disposers = disposers;
+    this.names = [];
+    for (const dispose of previous.values()) dispose();
+    try {
+      for (const tool of listed.tools) {
+        const name2 = publicToolName(
+          tool.name,
+          this.options.profile.toolNamespace
+        );
+        const base = createMcpToolDefinition(ctx, {
+          name: name2,
+          rawName: tool.name,
+          description: tool.description ?? `MCP tool ${tool.name}`,
+          inputSchema: tool.inputSchema ?? {
+            type: "object",
+            properties: {}
+          },
+          ...tool.outputSchema === void 0 ? {} : { outputSchema: tool.outputSchema },
+          ...tool.execution?.taskSupport === "required" ? { taskRequired: true } : {},
+          call: async (args, execution) => await client.callTool(
+            { name: tool.name, arguments: args },
+            {
+              signal: execution.signal,
+              toolDefinition: tool,
+              timeout: TOOL_CALL_TIMEOUT_MS
+            }
+          )
+        });
+        disposers.set(
+          name2,
+          ctx.tools.register(
+            this.options.decorate?.(base, tool) ?? base
+          )
+        );
+        names.push(name2);
+      }
+    } catch (error) {
+      for (const dispose of disposers.values()) dispose();
+      this.disposers = /* @__PURE__ */ new Map();
+      this.names = [];
+      throw error;
+    }
     this.names = names;
     return names;
   }
@@ -499,8 +556,8 @@ var McpBridge = class {
 // ../mcp-oauth/src/browser.ts
 import { execFile } from "node:child_process";
 function openBrowser(ctx, url) {
-  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
   execFile(command, args, (error) => {
     if (error !== null)
       loggerOf(ctx).warn(
@@ -681,6 +738,17 @@ var GrantStore = class {
 // ../mcp-oauth/src/loopback.ts
 import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+var HTML_ENTITIES = {
+  "&": "&",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+var escapeHtml = (value) => value.replace(
+  /[&<>"']/gu,
+  (character) => HTML_ENTITIES[character] ?? character
+);
 var LoopbackListener = class _LoopbackListener {
   server;
   port;
@@ -773,7 +841,9 @@ var LoopbackListener = class _LoopbackListener {
     });
   };
   static callbackPage = (title, message) => {
-    return `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px/1.5 system-ui;margin:4rem auto;max-width:32rem;text-align:center"><h1 style="font-size:1.25rem">${title}</h1><p>${message}</p></body>`;
+    const safeTitle = escapeHtml(title);
+    const safeMessage = escapeHtml(message);
+    return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title><body style="font:16px/1.5 system-ui;margin:4rem auto;max-width:32rem;text-align:center"><h1 style="font-size:1.25rem">${safeTitle}</h1><p>${safeMessage}</p></body>`;
   };
 };
 
@@ -844,6 +914,8 @@ var AuthorizationFlow = class {
         redirect_uri: listener.redirectUri,
         code_verifier: verifier
       });
+      if (typeof payload.access_token !== "string" || payload.access_token === "")
+        throw new Error("the token endpoint returned no access token");
       const base = {
         ...existing ?? { version: 1 },
         version: 1,
@@ -875,7 +947,7 @@ var AuthorizationFlow = class {
    * reused only when the resource and the URI both still match.
    */
   async clientFor(oauth, redirectUri, existing) {
-    if (existing !== void 0 && existing.resource === this.profile.endpoint && existing.redirectUri === redirectUri && typeof existing.clientId === "string") {
+    if (existing !== void 0 && existing.issuer === oauth.issuer && existing.resource === this.profile.endpoint && existing.redirectUri === redirectUri && typeof existing.clientId === "string") {
       const tokenAuthMethod = authMethodOf(existing);
       return existing.clientSecret === void 0 ? { clientId: existing.clientId, tokenAuthMethod } : {
         clientId: existing.clientId,
@@ -1107,10 +1179,8 @@ var createIntegrationCommand = (spec, auth) => {
       if (action === "login") {
         void auth.signIn();
         await auth.settleNotice();
-        return {
-          kind: "success",
-          text: auth.loginMessage(await auth.getStatus())
-        };
+        const status2 = await auth.getStatus();
+        return status2.error === null ? { kind: "success", text: auth.loginMessage(status2) } : { kind: "error", text: status2.error };
       }
       if (action === "logout") {
         await auth.signOut();
@@ -1128,11 +1198,17 @@ var createIntegrationCommand = (spec, auth) => {
         };
       }
       const status = await auth.getStatus();
+      if (status.error !== null) return { kind: "error", text: status.error };
       if (!status.signedIn)
         return {
           kind: "success",
           text: `Not signed in to ${spec.label}. Run /${spec.name} login.`
         };
+      if (!status.connected)
+        return {
+          kind: "success",
+          text: `${spec.label} is signed in but not connected. Run /${spec.name} sync.`
+        };
       const until = status.expiresAt === null ? "unknown" : new Date(status.expiresAt).toLocaleString();
       const extra = spec.describe?.(status) ?? "";
       const tail = extra === "" ? "" : ` ${extra}`;
@@ -1243,6 +1319,10 @@ var stripHtmlComments = (markdown) => {
   return kept.join("\n");
 };
 
+// ../integration-host/src/status.ts
+var CLIENT_REQUEST_HEADER = "x-dsh-client";
+var CLIENT_REQUEST_VALUE = "1";
+
 // ../integration-host/src/route.ts
 var MAX_BODY_BYTES = 8 * 1024;
 function mountIntegrationRoute(ctx, spec) {
@@ -1280,7 +1360,7 @@ async function readJson(request) {
     const buffer = chunk;
     size += buffer.length;
     if (size > MAX_BODY_BYTES)
-      throw new Error("request body is larger than this route accepts");
+      throw new BadRequest("request body is larger than this route accepts");
     chunks.push(buffer);
   }
   if (chunks.length === 0) return void 0;
@@ -1291,6 +1371,34 @@ async function readJson(request) {
     return void 0;
   }
 }
+var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+function webOrigin(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function clientRequestRefusal(request) {
+  const method = request.method ?? "GET";
+  if (READ_METHODS.has(method)) return void 0;
+  const headers = request.headers ?? {};
+  if (headers[CLIENT_REQUEST_HEADER] !== CLIENT_REQUEST_VALUE)
+    return "the request did not come from the harness page";
+  const contentType = headers["content-type"];
+  if (typeof contentType !== "string" || !contentType.toLowerCase().startsWith("application/json"))
+    return "an integration write must carry a JSON body";
+  const origin = headers.origin;
+  const host = headers.host;
+  const originUrl = typeof origin === "string" ? webOrigin(origin) : void 0;
+  if (originUrl !== void 0 && typeof host === "string" && originUrl.host !== host)
+    return "the request came from another origin";
+  const site = headers["sec-fetch-site"];
+  if (originUrl !== void 0 && typeof site === "string" && site.toLowerCase() === "cross-site")
+    return "cross-site requests are refused";
+  return void 0;
+}
 function createIntegrationRoute(spec) {
   const { prefix, auth } = spec;
   return async (request, response) => {
@@ -1318,6 +1426,11 @@ function createIntegrationRoute(spec) {
         send(502, { error: errorText(error) });
       }
     };
+    const refusal = clientRequestRefusal(request);
+    if (refusal !== void 0) {
+      send(403, { error: refusal });
+      return;
+    }
     let body;
     const context = {
       url,
@@ -1748,7 +1861,16 @@ var Extractor = class {
   };
   /** Collapse the whitespace a markdown or ADF body is full of. */
   tidy = (value) => {
-    return value.replace(/\r\n?/gu, "\n").replace(/[^\S\n]+/gu, " ").replace(/\n{3,}/gu, "\n\n").trim().slice(0, this.MAX_BODY);
+    const fences = [];
+    const protectedText = value.replace(/(```|~~~)[\s\S]*?\1/gu, (block) => {
+      fences.push(block);
+      return `\uE000${fences.length - 1}\uE000`;
+    });
+    const tidied = protectedText.replace(/\r\n?/gu, "\n").replace(/[^\S\n]+/gu, " ").replace(/\n{3,}/gu, "\n\n").trim().slice(0, this.MAX_BODY);
+    return tidied.replace(
+      /\uE000(\d+)\uE000/gu,
+      (_placeholder, index) => fences[Number(index)] ?? ""
+    );
   };
   asRecord = (value) => {
     return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
@@ -1870,7 +1992,9 @@ var ISSUE_TOOL = "getJiraIssue";
 var ISSUE_FIELDS = ["summary", "status", "assignee", "issuetype", "priority"];
 var nameOf = (value) => typeof value === "string" && value !== "" ? value : pickString(asRecord(value) ?? {}, "displayName", "name", "value");
 var factOf = (key, value, siteUrl) => {
-  const record = asRecord(value) ?? {};
+  const record = mcpJson(value).map((root) => asRecord(root)).find(
+    (candidate) => candidate !== void 0 && (candidate.fields !== void 0 || candidate.key !== void 0)
+  ) ?? {};
   const fields = asRecord(record.fields) ?? record;
   const identity = pickString(record, "key") ?? key;
   const summary = extractor.text(pickString(fields, "summary"));
@@ -2088,7 +2212,7 @@ var PanelApi = class {
       space: pickString(asRecord(record.space) ?? record.space, "name", "key"),
       url: webui === void 0 ? this.deps.state.facts?.siteUrl === void 0 ? void 0 : `${this.deps.state.facts?.siteUrl}/wiki/pages/viewpage.action?pageId=${id}` : this.wikiUrl(webui, this.deps.state.facts?.siteUrl),
       body: extractor.text(record.body),
-      comments: this.commentsOf(asRecord(comments)?.results)
+      comments: this.commentsOf(this.firstRecord(comments)?.results)
     };
   };
   /** People the site matches to one search string. */
@@ -2101,7 +2225,7 @@ var PanelApi = class {
     const users = this.userList(value);
     return users.map((user) => ({
       name: pickString(user, "displayName") ?? "",
-      accountId: pickString(user, "accountId") ?? ""
+      accountId: pickString(user, "accountId", "account_id") ?? ""
     })).filter((person) => person.name !== "" && person.accountId !== "").slice(0, PEOPLE_LIMIT);
   };
   /**
@@ -2162,7 +2286,7 @@ var PanelApi = class {
   };
   personOf = (value) => {
     const record = asRecord(value);
-    const accountId = pickString(record, "accountId");
+    const accountId = pickString(record, "accountId", "account_id");
     const name2 = pickString(record, "displayName", "name");
     if (accountId === void 0 || name2 === void 0) return void 0;
     return { accountId, name: name2 };
@@ -2415,6 +2539,12 @@ ${body}`);
 }
 
 // src/host/tools/present.ts
+function hasMore(value) {
+  return mcpJson(value).some((root) => {
+    const record = asRecord(root);
+    return record?.isLast === false || typeof record?.nextPageToken === "string" && record.nextPageToken !== "";
+  });
+}
 function stringList2(value) {
   if (!Array.isArray(value)) return [];
   return value.filter(
@@ -2521,6 +2651,7 @@ Could not resolve: ${outcome.failed.join(", ")}`;
         ...outcome.title === void 0 ? {} : { title: outcome.title },
         layout: outcome.layout,
         ...outcome.total === void 0 ? {} : { total: outcome.total },
+        ...outcome.truncated ? { truncated: true } : {},
         items: outcome.items
       };
       return {
@@ -2552,9 +2683,13 @@ Could not resolve: ${outcome.failed.join(", ")}`;
       throw new Error(
         "no Atlassian site known yet; run a Jira or Confluence search first, or sign in again"
       );
+    const requested = args.issues.length > 0 || args.pages.length > 0 || args.jql !== void 0 || args.cql !== void 0;
+    if (!requested)
+      throw new Error("nothing to show: pass issues, pages, jql, or cql");
     const items = [];
     const failed = [];
     let matched = 0;
+    let truncated = false;
     const push = (candidate) => {
       for (const item of candidate) {
         if (items.length >= this.MAX_ITEMS) return;
@@ -2585,6 +2720,7 @@ Could not resolve: ${outcome.failed.join(", ")}`;
       const found = this.issuesOf(value, deps.state.facts?.siteUrl);
       push(found.items);
       matched += found.total ?? found.items.length;
+      if (hasMore(value)) truncated = true;
     }
     for (const id of args.pages) {
       try {
@@ -2608,9 +2744,8 @@ Could not resolve: ${outcome.failed.join(", ")}`;
       const found = this.pagesOf(value, deps.state.facts?.siteUrl);
       push(found.items);
       matched += found.total ?? found.items.length;
+      if (hasMore(value)) truncated = true;
     }
-    if (items.length === 0 && failed.length === 0)
-      throw new Error("nothing to show: pass issues, pages, jql, or cql");
     const gists = await this.summarize(deps.ctx, items, exec);
     const projected = items.map(
       (item, index) => item.kind === "issue" ? {
@@ -2626,7 +2761,8 @@ Could not resolve: ${outcome.failed.join(", ")}`;
       layout: this.resolveLayout(args.layout, projected.length),
       items: projected,
       total: matched > projected.length ? matched : void 0,
-      failed
+      failed,
+      truncated
     };
   };
   /**
@@ -2725,6 +2861,12 @@ Could not resolve: ${outcome.failed.join(", ")}`;
   }
   /** The text the model reads: what the card shows, in order. */
   describe(outcome, args) {
+    if (outcome.items.length === 0) {
+      const lines2 = ["No issues or pages matched."];
+      if (args.jql !== void 0) lines2.push(`JQL: ${args.jql}`);
+      if (args.cql !== void 0) lines2.push(`CQL: ${args.cql}`);
+      return lines2.join("\n");
+    }
     const issues = outcome.items.filter((item) => item.kind === "issue");
     const pages = outcome.items.filter((item) => item.kind === "page");
     const counts = [
@@ -2755,6 +2897,8 @@ Could not resolve: ${outcome.failed.join(", ")}`;
     }
     if (args.jql !== void 0) lines.push(`JQL: ${args.jql}`);
     if (args.cql !== void 0) lines.push(`CQL: ${args.cql}`);
+    if (outcome.truncated)
+      lines.push("The search had more results than this card read.");
     return lines.join("\n");
   }
 };