fullstackgtm 0.48.0 → 0.49.0

package/src/marketSourcing.ts

@@ -16,7 +16,7 @@
  *    Sitemaps / redirects / logo bytes are plain resources — they never need a
  *    headless browser, so the default fetch is sufficient even in the hosted layer.
  */
-import { assertPublicUrl } from "./market.ts";
+import { publicHttpGet } from "./publicHttp.ts";
 import { DEFAULT_MODELS, forcedToolCall, type LlmCallOptions } from "./llm.ts";
 
 const USER_AGENT = "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)";
@@ -161,27 +161,9 @@ export function extractLogoUrl(html: string, baseUrl: string): string | null {
 
 /** Manual-redirect fetch that re-validates every hop against the SSRF guard. */
 async function guardedFetch(url: string): Promise<Response | null> {
-  let current = url;
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicUrl(current);
-    const res = await fetch(current, {
-      redirect: "manual",
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      headers: { "User-Agent": USER_AGENT },
-    });
-    const location = res.headers.get("location");
-    if (res.status >= 300 && res.status < 400 && location) {
-      try {
-        await res.body?.cancel();
-      } catch {
-        /* ignore */
-      }
-      current = new URL(location, current).toString();
-      continue;
-    }
-    return res;
-  }
-  return null;
+  const res = await publicHttpGet(url, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+    headers: { "User-Agent": USER_AGENT } });
+  return new Response(res.body.length ? Buffer.from(res.body) : null, { status: res.status, headers: res.headers });
 }
 
 const defaultFetchText: FetchText = async (url) => {
@@ -210,27 +192,9 @@ const defaultFetchBytes: FetchBytes = async (url) => {
  * + status WITHOUT downloading the body. Used to detect identity drift.
  */
 export const resolveFinalUrl: ResolveUrl = async (rawUrl) => {
-  let current = rawUrl;
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicUrl(current);
-    const res = await fetch(current, {
-      redirect: "manual",
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      headers: { "User-Agent": USER_AGENT },
-    });
-    try {
-      await res.body?.cancel();
-    } catch {
-      /* ignore */
-    }
-    const location = res.headers.get("location");
-    if (res.status >= 300 && res.status < 400 && location) {
-      current = new URL(location, current).toString();
-      continue;
-    }
-    return { finalUrl: current, status: res.status };
-  }
-  return { finalUrl: current, status: 0 };
+  const res = await publicHttpGet(rawUrl, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+    maxBytes: 0, headers: { "User-Agent": USER_AGENT } });
+  return { finalUrl: res.finalUrl, status: res.status };
 };
 
 // ── Fetching helpers ─────────────────────────────────────────────────────────

package/src/mcp.ts

@@ -55,11 +55,12 @@ import { generateDemoSnapshot } from "./demo.ts";
 import type { FieldMappings } from "./mappings.ts";
 import { formatPatchPlanRun, patchPlanToMarkdown } from "./format.ts";
 import { verifyApprovalDigests } from "./integrity.ts";
-import { createFilePlanStore, type StoredPlan } from "./planStore.ts";
+import { createFilePlanStore } from "./planStore.ts";
 import { builtinAuditRules } from "./rules.ts";
 import { sampleSnapshot } from "./sampleData.ts";
 import { normalizeTranscript, parseCall } from "./calls.ts";
 import { extractInsightsLlm, resolveLlmCredential } from "./llm.ts";
+
 import {
   computeFrontStates,
   createFileObservationStore,
@@ -204,10 +205,19 @@ const toolDefinitions: ToolDefinition[] = [
     },
     handler: async ({ provider, inputPath, configPath, rules, output, today, staleDealDays }) => {
       const loaded = configPath ? loadConfig(configPath) : null;
+      if (loaded?.config.rulePackages?.length) {
+        throw new Error(
+          "MCP refuses executable rulePackages from tool-call configPath. " +
+            "MCP plugin execution is disabled because mutable tool-call paths are not a durable code-trust boundary. " +
+            "Run reviewed plugins through the CLI with --config <path> --allow-plugins instead.",
+        );
+      }
       const policy = mergePolicy(defaultPolicy(today), loaded?.config);
       if (today) policy.today = today;
       if (staleDealDays !== undefined) policy.staleDealDays = staleDealDays;
-      const ruleSet = await resolveConfiguredRules(loaded);
+      const ruleSet = await resolveConfiguredRules(loaded, undefined, {
+        disableRulePackages: true,
+      });
       const selected = rules?.length
         ? ruleSet.filter((rule: { id: string }) => rules.includes(rule.id))
         : ruleSet;
@@ -327,143 +337,104 @@ const toolDefinitions: ToolDefinition[] = [
     config: {
       title: "Apply Approved Patch Operations",
       description:
-        "Apply explicitly approved operations from a patch plan through a provider " +
-        "connector. Operations not listed in approvedOperationIds are never written, " +
-        "and requires_human_* placeholders need a value override. When the plan is in " +
-        "the local plan store (saved via `audit --save`), approvals are verified against " +
-        "the store's HMAC approval digests — ids not approved with `plans approve` are " +
-        "refused — and the run is recorded onto the stored plan so `plans show` and " +
+        "Apply a stored, human-approved patch plan through a provider connector. The plan, " +
+        "approved operation ids, and concrete placeholder values are loaded exclusively from " +
+        "the local plan store and verified against its HMAC approval digests. Callers cannot " +
+        "supply or widen approvals. Every apply run is recorded so `plans show` and " +
         "`audit-log export` include it.",
       inputSchema: strictSchema({
         provider: z.enum(["hubspot", "salesforce"]),
-        planPath: z.string(),
-        approvedOperationIds: z.array(z.string()).min(1),
-        valueOverrides: z.record(z.string(), z.string()).optional(),
+        planId: z.string().regex(/^[\w.-]+$/),
         output: z.enum(["json", "markdown"]).optional(),
       }),
     },
-    handler: async ({ provider, planPath, approvedOperationIds, valueOverrides, output }) => {
-      // The file may be a raw PatchPlan (audit --out) or a StoredPlan envelope
-      // (a file straight out of the plan-store directory).
-      const parsed = JSON.parse(readFileSync(resolve(process.cwd(), planPath), "utf8")) as unknown;
-      const filePlan = isStoredPlanFile(parsed) ? parsed.plan : (parsed as PatchPlan);
-      if (!filePlan || !Array.isArray(filePlan.operations)) {
-        throw new Error(`${planPath} is not a patch plan (expected { id, operations: [...] }).`);
-      }
-
-      // Governance parity with CLI apply: when this plan id exists in the local
-      // plan store, the STORE is the source of truth — the approved-id set must
-      // come from `plans approve` (which HMAC-signed each approved op), the
-      // signatures are re-verified here, and the run is recorded back onto the
-      // plan so audit-log export sees MCP applies exactly like CLI applies.
+    handler: async ({ provider, planId, output }) => {
+      // The store is the only authority accepted over MCP. In particular, do
+      // not accept a plan body/path, approval ids, or value overrides from the
+      // agent call: combining proposal and approval in one call defeats the
+      // human approval boundary the plan lifecycle is meant to enforce.
       const store = createFilePlanStore();
-      const stored =
-        typeof filePlan.id === "string" && /^[\w.-]+$/.test(filePlan.id)
-          ? await store.get(filePlan.id)
-          : null;
-
-      let plan: PatchPlan;
-      let effectiveOverrides: Record<string, unknown>;
-      if (stored) {
-        if (stored.status !== "approved") {
-          throw new Error(
-            `Plan ${filePlan.id} is ${stored.status}; approve operations first with ` +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids|all>\`.`,
-          );
-        }
-        // Downgrade guard (same as CLI apply): an approved plan with no
-        // signatures either predates 0.26 or had approvalDigests stripped to
-        // skip the integrity check. Refuse rather than trust the file.
-        if (stored.approvedOperationIds.length > 0 && !stored.approvalDigests) {
-          throw new Error(
-            `Refusing to apply plan ${filePlan.id}: it was approved without integrity signatures ` +
-              "(approved before 0.26.0, or its signatures were removed). Re-approve it with " +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids|all>\`.`,
-          );
-        }
-        // Never widen: every id the tool wants applied must already be
-        // store-approved. (A subset is fine — narrowing never writes more.)
-        const storeApproved = new Set(stored.approvedOperationIds);
-        const unapproved = approvedOperationIds.filter((id: string) => !storeApproved.has(id));
-        if (unapproved.length > 0) {
-          throw new Error(
-            `Refusing to apply plan ${filePlan.id}: operation(s) ${unapproved.join(", ")} were never ` +
-              "approved in the plan store. Approve them first with " +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids>\`.`,
-          );
-        }
-        // Integrity gate: verify against the EFFECTIVE overrides (stored ∪ tool
-        // args), so a tool-supplied value that changes what the human approved
-        // is treated as tamper, not a live override — what gets written must
-        // equal what was signed.
-        effectiveOverrides = { ...stored.valueOverrides, ...(valueOverrides ?? {}) };
-        const verification = verifyApprovalDigests(
-          stored.plan.operations,
-          stored.approvedOperationIds,
-          effectiveOverrides,
-          stored.approvalDigests,
+      const stored = await store.get(planId);
+      if (!stored) {
+        throw new Error(
+          `No stored plan with id ${planId}. Save it with \`fullstackgtm audit --save\`, then approve it with \`fullstackgtm plans approve\`.`,
         );
-        if (!verification.ok) {
-          const detail =
-            verification.reason === "no_key"
-              ? "the plan-signing key is missing (was this plan approved on another machine?). Re-approve it here with `fullstackgtm plans approve`."
-              : `these operations differ from what was approved: ${verification.tampered.join(", ")}. ` +
-                "If you want a different value, set it at approval (`plans approve --value <op>=<v>`) and re-approve; " +
-                "otherwise the plan was edited after approval — review and re-approve.";
-          throw new Error(`Refusing to apply plan ${filePlan.id}: ${detail}`);
-        }
-        plan = stored.plan; // apply what was signed, not what the file says now
-      } else {
-        // External plan file, not in the store: no digests exist to verify, but
-        // approvals must still reference real operations in the plan content.
-        plan = filePlan;
-        const known = new Set(plan.operations.map((operation) => operation.id));
-        const unknown = approvedOperationIds.filter((id: string) => !known.has(id));
-        if (unknown.length > 0) {
-          throw new Error(
-            `Plan ${planPath} has no operation(s) ${unknown.join(", ")} — approvedOperationIds ` +
-              "must reference operations in the plan.",
-          );
-        }
-        effectiveOverrides = valueOverrides ?? {};
+      }
+      if (stored.status !== "approved") {
+        throw new Error(
+          `Plan ${planId} is ${stored.status}; approve operations first with ` +
+            `\`fullstackgtm plans approve ${planId} --operations <ids|all>\`.`,
+        );
+      }
+      if (stored.approvedOperationIds.length === 0) {
+        throw new Error(`Plan ${planId} has no approved operations.`);
+      }
+      if (!stored.approvalDigests) {
+        throw new Error(
+          `Refusing to apply plan ${planId}: it was approved without integrity signatures ` +
+            "(approved before 0.26.0, or its signatures were removed). Re-approve it with " +
+            `\`fullstackgtm plans approve ${planId} --operations <ids|all>\`.`,
+        );
+      }
+      const verification = verifyApprovalDigests(
+        stored.plan.operations,
+        stored.approvedOperationIds,
+        stored.valueOverrides,
+        stored.approvalDigests,
+      );
+      if (!verification.ok) {
+        const detail =
+          verification.reason === "no_key"
+            ? "the plan-signing key is missing (was this plan approved on another machine?). Re-approve it here with `fullstackgtm plans approve`."
+            : `these operations differ from what was approved: ${verification.tampered.join(", ")}. ` +
+              "The stored plan or approved values changed after approval — review and re-approve.";
+        throw new Error(`Refusing to apply plan ${planId}: ${detail}`);
       }
 
-      const run = await applyPatchPlan(await connectorFor(provider), plan, {
-        approvedOperationIds,
-        valueOverrides: effectiveOverrides,
-      });
-
-      // Persist the run (same data the CLI records) so runs[] and plan status
-      // update and audit-log export includes MCP applies. External plan files
-      // have no store entry to update — say so instead of silently dropping it.
-      let runRecorded = false;
-      if (stored) {
-        await store.recordRun(plan.id, run);
-        runRecorded = true;
+      const connector = await connectorFor(provider);
+      // Claim only after all preflight checks and credential resolution. The
+      // atomic store transition prevents a second CLI/MCP process from
+      // applying the same approval concurrently.
+      const claimed = await store.claimApply(planId, { provider, source: "mcp" });
+      const claimedVerification = verifyApprovalDigests(
+        claimed.stored.plan.operations,
+        claimed.stored.approvedOperationIds,
+        claimed.stored.valueOverrides,
+        claimed.stored.approvalDigests,
+      );
+      if (!claimedVerification.ok) {
+        await store.abortApplyPreflight(
+          planId,
+          claimed.claimId,
+          "Approval integrity verification failed after the claim and before provider I/O.",
+        );
+        throw new Error(
+          `Refusing to apply plan ${planId}: the claimed plan differs from what was approved: ` +
+            `${claimedVerification.tampered.join(", ") || "signing key unavailable"}.`,
+        );
+      }
+      let run;
+      try {
+        run = await applyPatchPlan(connector, claimed.stored.plan, {
+          approvedOperationIds: claimed.stored.approvedOperationIds,
+          valueOverrides: claimed.stored.valueOverrides,
+        });
+      } catch (error) {
+        await store.markApplyUncertain(planId, claimed.claimId);
+        throw error;
       }
+      await store.recordRun(claimed.stored.plan.id, run, claimed.claimId);
       const governance = {
-        planSource: stored ? ("store" as const) : ("external" as const),
-        approvalDigestsVerified: stored !== null,
-        runRecorded,
-        ...(stored
-          ? {}
-          : {
-              note:
-                "Plan file is not in the local plan store: approvals came from tool arguments " +
-                "(verified against the plan content only — no approval-digest check) and the run " +
-                "was not recorded. Use `fullstackgtm audit --save` + `plans approve` for " +
-                "store-backed governance.",
-            }),
+        planSource: "store" as const,
+        approvalDigestsVerified: true,
+        runRecorded: true,
       };
       if (output === "markdown") {
         return content(
           `${formatPatchPlanRun(run)}\n\nGovernance: plan source ${governance.planSource}; ` +
-            (runRecorded
-              ? "approval digests verified; run recorded on the stored plan (audit-log export includes it)."
-              : governance.note!),
+            "approval digests verified; run recorded on the stored plan (audit-log export includes it).",
         );
       }
-      // Backward compatible: the run's own fields stay top-level; governance is additive.
       return content({ ...run, governance });
     },
   },
@@ -551,7 +522,7 @@ toolDefinitions.unshift({
       })),
       safety:
         "Only tools flagged writesCrm can reach a CRM; fullstackgtm_apply writes only operations " +
-        "listed in approvedOperationIds and never writes requires_human_* placeholders without a value override.",
+        "from a stored plan whose ids and values were human-approved and HMAC-verified.",
       server: { command: "npx -y fullstackgtm-mcp" },
       cli: {
         command: "npx fullstackgtm <command> [--json]",
@@ -582,20 +553,6 @@ export async function startMcpServer() {
   await server.connect(transport);
 }
 
-/**
- * A plan-store file is a StoredPlan envelope ({ plan, status, runs, ... });
- * `audit --out` writes a bare PatchPlan. fullstackgtm_apply accepts either.
- */
-function isStoredPlanFile(value: unknown): value is StoredPlan {
-  if (typeof value !== "object" || value === null || !("plan" in value)) return false;
-  const plan = (value as { plan?: unknown }).plan;
-  return (
-    typeof plan === "object" &&
-    plan !== null &&
-    Array.isArray((plan as { operations?: unknown }).operations)
-  );
-}
-
 function loadMarketConfigOrHint(path: string): ReturnType<typeof loadMarketConfig> {
   try {
     return loadMarketConfig(path);