frizz 0.9.0 → 0.10.0

package/dist/claude-agent-broker.js

@@ -2,7 +2,7 @@ import { createRequire as __frizzCreateRequire } from "node:module"; const requi
 
 // packages/server/src/backend/claude-agent-broker.ts
 import net from "node:net";
-import { readFileSync as readFileSync3, realpathSync as realpathSync2, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { readFileSync as readFileSync4, realpathSync as realpathSync2, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
@@ -20714,10 +20714,12 @@ function startClaudeQuery(executablePath, options) {
       // broker session gets the frizz sub-agent profiles + hooks, mount the frizz MCP server, and
       // pre-approve it. EMPTY is skipped, not passed: since frizz stopped mounting a browser (2026-08-26)
       // a resolved-nothing worker env is a real state, and `{}`/`[]` are truthy — handing the SDK an
-      // empty allowlist is not the same as handing it none. The project's own `.mcp.json` servers are
-      // loaded by settingSources, independently of this.
+      // empty allowlist is not the same as handing it none. The project's own `.mcp.json` servers arrive
+      // INSIDE `mcpServers` — the broker daemon merges them (project-mcp-servers.ts) — because
+      // `strictMcpConfig` stops the CLI discovering any MCP scope by itself.
       ...options.pluginDir ? { plugins: [{ type: "local", path: options.pluginDir }] } : {},
       ...options.mcpServers && Object.keys(options.mcpServers).length > 0 ? { mcpServers: options.mcpServers } : {},
+      ...options.strictMcpConfig ? { strictMcpConfig: true } : {},
       ...options.allowedTools?.length ? { allowedTools: options.allowedTools } : {},
       ...options.disallowedTools?.length ? { disallowedTools: [...options.disallowedTools] } : {},
       persistSession: options.persistSession ?? false,
@@ -21502,6 +21504,130 @@ function objectValue(value, label) {
   return value;
 }
 
+// packages/server/src/backend/project-mcp-servers.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function readJsonObject(path) {
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function objectField(source, key) {
+  const value = source?.[key];
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function stringList(source, key) {
+  const value = source?.[key];
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function stringMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry === "string") out[key] = entry;
+  }
+  return out;
+}
+var ENV_REF = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+function expandMcpEnvRefs(value, env) {
+  let unresolved = false;
+  const out = value.replace(ENV_REF, (_match, name, fallback) => {
+    const resolved = env[name];
+    if (resolved !== void 0) return resolved;
+    if (fallback !== void 0) return fallback;
+    unresolved = true;
+    return "";
+  });
+  return unresolved ? void 0 : out;
+}
+function expandMap(map, env) {
+  if (!map) return void 0;
+  const out = {};
+  for (const [key, value] of Object.entries(map)) {
+    const expanded = expandMcpEnvRefs(value, env);
+    if (expanded === void 0) return null;
+    out[key] = expanded;
+  }
+  return out;
+}
+function normalizeMcpServer(raw, env) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const record = raw;
+  const type = typeof record.type === "string" ? record.type : void 0;
+  if (type === "http" || type === "sse") {
+    if (typeof record.url !== "string") return void 0;
+    const url = expandMcpEnvRefs(record.url, env);
+    const headers = expandMap(stringMap(record.headers), env);
+    if (url === void 0 || headers === null) return void 0;
+    return { type, url, ...headers ? { headers } : {} };
+  }
+  if (type !== void 0 && type !== "stdio") return void 0;
+  if (typeof record.command !== "string") return void 0;
+  const command = expandMcpEnvRefs(record.command, env);
+  if (command === void 0) return void 0;
+  const args = [];
+  for (const entry of Array.isArray(record.args) ? record.args : []) {
+    if (typeof entry !== "string") return void 0;
+    const expanded = expandMcpEnvRefs(entry, env);
+    if (expanded === void 0) return void 0;
+    args.push(expanded);
+  }
+  const serverEnv = expandMap(stringMap(record.env), env);
+  if (serverEnv === null) return void 0;
+  return { command, ...args.length ? { args } : {}, ...serverEnv ? { env: serverEnv } : {} };
+}
+function collectApproval(layers) {
+  const approval = { all: false, enabled: /* @__PURE__ */ new Set(), disabled: /* @__PURE__ */ new Set() };
+  for (const layer of layers) {
+    if (layer?.enableAllProjectMcpServers === true) approval.all = true;
+    for (const name of stringList(layer, "enabledMcpjsonServers")) approval.enabled.add(name);
+    for (const name of stringList(layer, "disabledMcpjsonServers")) approval.disabled.add(name);
+  }
+  return approval;
+}
+function userScopeRemoteServers(account, cwd, env) {
+  const out = {};
+  const maps = [objectField(account, "mcpServers"), objectField(objectField(objectField(account, "projects"), cwd), "mcpServers")];
+  for (const map of maps) {
+    for (const [name, raw] of Object.entries(map ?? {})) {
+      const server = normalizeMcpServer(raw, env);
+      if (server && server.type !== void 0 && server.type !== "stdio") out[name] = server;
+    }
+  }
+  return out;
+}
+function projectMcpServers(cwd, options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? homedir();
+  const configOverride = options.claudeConfigDir ?? (env.CLAUDE_CONFIG_DIR?.trim() ? env.CLAUDE_CONFIG_DIR.trim() : void 0);
+  const accountFile = configOverride ? join(configOverride, ".claude.json") : join(home, ".claude.json");
+  const userSettingsFile = join(configOverride ?? join(home, ".claude"), "settings.json");
+  const account = readJsonObject(accountFile);
+  const out = userScopeRemoteServers(account, cwd, env);
+  const declared = objectField(readJsonObject(join(cwd, ".mcp.json")), "mcpServers");
+  if (!declared) return out;
+  const approval = collectApproval([
+    readJsonObject(join(cwd, ".claude", "settings.json")),
+    readJsonObject(join(cwd, ".claude", "settings.local.json")),
+    readJsonObject(userSettingsFile),
+    objectField(objectField(account, "projects"), cwd)
+  ]);
+  for (const [name, raw] of Object.entries(declared)) {
+    if (approval.disabled.has(name)) continue;
+    if (!approval.all && !approval.enabled.has(name)) continue;
+    const server = normalizeMcpServer(raw, env);
+    if (server) out[name] = server;
+  }
+  return out;
+}
+function workerMcpServers(project, frizz) {
+  return { ...project ?? {}, ...frizz ?? {} };
+}
+
 // packages/server/src/backend/types.ts
 var CLAUDE_WORKER_ENV = {
   CLAUDE_CODE_TOTAL_TOKENS_REMINDER: "infinite",
@@ -21517,12 +21643,12 @@ function claudeCompactionWindowOf(env) {
 }
 
 // packages/server/src/backend/claude-broker-diagnostics.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, statSync as statSync2 } from "node:fs";
-import { join } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 var MAX_BYTES = 4 * 1024 * 1024;
 function appendRecord(path, record) {
   try {
-    mkdirSync2(join(path, ".."), { recursive: true });
+    mkdirSync2(join2(path, ".."), { recursive: true });
     try {
       if (statSync2(path).size > MAX_BYTES) renameSync2(path, `${path}.1`);
     } catch {
@@ -21584,21 +21710,24 @@ function runClaudeBroker(config) {
   const writeDiagnostic = config.diagnosticLogPath ? createClaudeBrokerDiagnosticWriter(config.diagnosticLogPath, { daemonPid: process.pid, generation }) : void 0;
   const writeExit = config.diagnosticLogPath ? createClaudeBrokerExitWriter(config.diagnosticLogPath, { daemonPid: process.pid, generation }) : void 0;
   const factory = createClaudeQueryFactory({ enabled: true, executablePath: config.executablePath });
+  const env = { ...inheritWorkerEnvironment(config.env), ...config.workerEnv ?? {} };
   const handle = factory.start({
     cwd: config.cwd,
     session: config.resume ? { kind: "resume", sessionId: config.sessionId } : { kind: "new", sessionId: config.sessionId },
     permissionMode: config.permissionMode ?? "default",
-    // The worker inherits frizz's environment minus frizz's own control plane (see worker-env.ts). The
-    // frizz worker vars it DOES need (FRIZZ_THREAD, FRIZZ_PERM_DIR) ride workerEnv and are merged on
-    // top — which is also what gives them THIS thread's values instead of the server's.
-    env: { ...inheritWorkerEnvironment(config.env), ...config.workerEnv ?? {} },
+    env,
     persistSession: true,
     // write the tailer-readable transcript JSONL
     appendSystemPrompt: config.appendSystemPrompt,
     model: config.model,
     effort: config.effort,
     pluginDir: config.pluginDir,
-    mcpServers: config.mcpServers,
+    // The WHOLE MCP surface of this thread, and STRICT so the CLI discovers nothing else: the project's
+    // approved `.mcp.json` (and the operator's remote user-scope servers) under the frizz mount, which
+    // wins a name collision. Read at every fork, not once per project, so a `.mcp.json` edit reaches the
+    // next dispatch the way it reaches the next plain `claude`. project-mcp-servers.ts has the reasons.
+    mcpServers: workerMcpServers(projectMcpServers(config.cwd, { env }), config.mcpServers),
+    strictMcpConfig: true,
     allowedTools: config.allowedTools,
     // NO `disallowedTools` here, and the asymmetry with the argv path (WORKER_DISALLOWED_TOOLS →
     // `--disallowedTools=AskUserQuestion`) is DELIBERATE. That flag exists because a worker launched as
@@ -21760,7 +21889,7 @@ function runClaudeBroker(config) {
   const recordOwner = () => {
     if (!config.recordPath) return null;
     try {
-      return JSON.parse(readFileSync3(config.recordPath, "utf8")).daemonPid;
+      return JSON.parse(readFileSync4(config.recordPath, "utf8")).daemonPid;
     } catch {
       return null;
     }