llm-cli-gateway 2.13.0 → 2.13.2

package/dist/index.js

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { randomUUID } from "crypto";
 import { createRequire } from "module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, chmodSync, } from "fs";
-import { dirname, join } from "path";
+import { basename, dirname, isAbsolute, join, relative } from "path";
 import { fileURLToPath } from "url";
 import { z } from "zod/v3";
 import { executeCli, killAllProcessGroups, providerCommandName } from "./executor.js";
@@ -13,7 +13,7 @@ import { parseCodexJsonStream, codexDisplayText, codexFrResponse } from "./codex
 import { parseGeminiJson, parseGeminiStreamJson } from "./gemini-json-parser.js";
 import { parseVibeMetaJson } from "./mistral-meta-json-parser.js";
 import { homedir } from "os";
-import { CLI_TYPES, PROVIDER_TYPES, createSessionManager, } from "./session-manager.js";
+import { CLI_TYPES, PROVIDER_TYPES, createSessionManager, callerIsRemote, remoteSafeSession, } from "./session-manager.js";
 import { createWorktree, createWorktreeSessionCleanupHook, } from "./worktree-manager.js";
 import { ResourceProvider } from "./resources.js";
 import { PerformanceMetrics } from "./metrics.js";
@@ -21,6 +21,7 @@ import { estimateTokens, optimizePrompt as optimizePromptText, optimizeResponse
 import { loadConfig, loadPersistenceConfig, loadCacheAwarenessConfig, loadProvidersConfig, loadAcpConfig, loadLimitsConfig, defaultGatewayConfigPath, isXaiProviderEnabled, enabledApiProviders, minStableTokensForModel, } from "./config.js";
 import { runAcpRequest } from "./acp/runtime.js";
 import { isAcpError } from "./acp/errors.js";
+import { redactSecrets } from "./secret-redaction.js";
 import { createApiProvider, runApiRequest, apiProviderBreakerState, } from "./api-provider.js";
 import { prepareApiRequest, apiProviderCatalogEntry, ApiModelNotAllowedError, } from "./api-request.js";
 import { checkHealth } from "./health.js";
@@ -40,29 +41,74 @@ import { startHttpGateway } from "./http-transport.js";
 import { getRequestContext, resolveOwnerPrincipal, principalCanAccess } from "./request-context.js";
 import { printDoctorJson } from "./doctor.js";
 import { redactDiagnosticUrl } from "./endpoint-exposure.js";
-import { createWorkspace, describeWorkspace, getWorkspace, loadWorkspaceRegistry, registerExistingWorkspace, resolveWorkspaceForProvider, validatePathInsideWorkspace, } from "./workspace-registry.js";
+import { buildRemoteConnectorUrls } from "./remote-url.js";
+import { gatherConnectorSetupPacket, renderConnectorSetupSummary, } from "./connector-setup.js";
+import { createWorkspace, describeWorkspace, describeWorkspaceRemote, getWorkspace, loadWorkspaceRegistry, registerExistingWorkspace, resolveWorkspaceForProvider, validatePathInsideWorkspace, } from "./workspace-registry.js";
 import { generateSecret, hashSecret } from "./oauth.js";
 import { registerValidationTools } from "./validation-tools.js";
 import { currentCaller, resolveValidationReceipt } from "./validation-receipt.js";
 import { assertUpstreamCliArgs, assertUpstreamCliEnv, buildProviderSubcommandsCompactCatalog, buildUpstreamContractReport, getCliSubcommandContract, probeInstalledCliContract, serializeCliSubcommandContract, UPSTREAM_CLI_CONTRACTS, } from "./upstream-contracts.js";
 import { buildArgvFromGeneration, deriveZodShapeFromGeneration, GROK_FLAG_GENERATION, GROK_GEN_OUTPUT_FORMAT, GROK_GEN_MAIN, GROK_GEN_PROMPT_FILE, GROK_GEN_SINGLE, GROK_GEN_TAIL, } from "./provider-codegen.js";
 import { entrypointFileURL } from "./entrypoint-url.js";
-const logger = {
+export const logger = {
     info: (message, ...args) => {
-        console.error(`[INFO] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("INFO", message), ...args.map(sanitizeLogArg));
     },
     warn: (message, ...args) => {
-        console.error(`[WARN] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("WARN", message), ...args.map(sanitizeLogArg));
     },
     error: (message, ...args) => {
-        console.error(`[ERROR] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("ERROR", message), ...args.map(sanitizeLogArg));
     },
     debug: (message, ...args) => {
         if (process.env.DEBUG) {
-            console.error(`[DEBUG] ${new Date().toISOString()} - ${message}`, ...args);
+            console.error(formatLogLine("DEBUG", message), ...args.map(sanitizeLogArg));
         }
     },
 };
+function formatLogLine(level, message) {
+    return `[${level}] ${new Date().toISOString()} - ${redactSecrets(message)}`;
+}
+function sanitizeLogArg(value) {
+    return sanitizeLogValue(value, new WeakSet(), 0);
+}
+function sanitizeLogValue(value, seen, depth) {
+    if (typeof value === "string") {
+        return redactSecrets(value);
+    }
+    if (value instanceof Error) {
+        return sanitizeLogError(value);
+    }
+    if (Array.isArray(value)) {
+        if (depth >= 4)
+            return "[Array]";
+        return value.map(item => sanitizeLogValue(item, seen, depth + 1));
+    }
+    if (value !== null && typeof value === "object") {
+        if (seen.has(value))
+            return "[Circular]";
+        if (depth >= 4)
+            return "[Object]";
+        seen.add(value);
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = sanitizeLogValue(inner, seen, depth + 1);
+        }
+        seen.delete(value);
+        return out;
+    }
+    return value;
+}
+function sanitizeLogError(error) {
+    const out = {
+        name: redactSecrets(error.name),
+        message: redactSecrets(error.message),
+    };
+    if (error.stack) {
+        out.stack = redactSecrets(error.stack);
+    }
+    return out;
+}
 function startWindowsBootstrapperSelfHeal() {
     if (process.platform !== "win32")
         return;
@@ -694,7 +740,10 @@ async function resolveWorkspaceAndWorktreeForRequest(args) {
             workspaceAlias: workspace?.alias,
             workspaceRoot: workspace?.root,
         });
-        return { cwd: resolved.cwd, worktreePath: resolved.worktreePath, workspace };
+        const displayWorktreePath = isRemoteTransport
+            ? remoteSafeWorktreePath(resolved.worktreePath, workspace?.root)
+            : resolved.worktreePath;
+        return { cwd: resolved.cwd, worktreePath: displayWorktreePath, workspace };
     }
     if (workspace && args.sessionId) {
         await Promise.resolve(args.runtime.sessionManager.updateSessionMetadata(args.sessionId, {
@@ -707,6 +756,16 @@ async function resolveWorkspaceAndWorktreeForRequest(args) {
 export function formatWorktreePrefix(worktreePath) {
     return worktreePath ? `[gateway] worktree=${worktreePath}\n` : "";
 }
+export function remoteSafeWorktreePath(worktreePath, workspaceRoot) {
+    if (!worktreePath)
+        return worktreePath;
+    if (workspaceRoot) {
+        const rel = relative(workspaceRoot, worktreePath);
+        if (rel && !rel.startsWith("..") && !isAbsolute(rel))
+            return rel;
+    }
+    return basename(worktreePath);
+}
 function workspaceAdminEnabled() {
     const scopes = getRequestContext()?.authScopes ?? [];
     return process.env.LLM_GATEWAY_WORKSPACE_ADMIN === "1" && scopes.includes("workspace:admin");
@@ -736,10 +795,9 @@ function registerWorkspaceTools(server, runtime) {
                             success: true,
                             enabled: registry.enabled,
                             default: registry.defaultAlias,
-                            workspaces: registry.repos.map(describeWorkspace),
+                            workspaces: registry.repos.map(describeWorkspaceRemote),
                             allowed_roots: registry.allowedRoots.map(root => ({
                                 alias: root.alias,
-                                path: root.path,
                                 allow_register_existing_git_repos: root.allowRegisterExistingGitRepos,
                                 allow_create_directories: root.allowCreateDirectories,
                                 allow_init_git_repos: root.allowInitGitRepos,
@@ -768,7 +826,10 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(getWorkspace(registry, alias)) }, null, 2),
+                        text: JSON.stringify({
+                            success: true,
+                            workspace: describeWorkspaceRemote(getWorkspace(registry, alias)),
+                        }, null, 2),
                     },
                 ],
             };
@@ -807,7 +868,7 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(repo) }, null, 2),
+                        text: JSON.stringify({ success: true, workspace: describeWorkspaceRemote(repo) }, null, 2),
                     },
                 ],
             };
@@ -845,7 +906,7 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(repo) }, null, 2),
+                        text: JSON.stringify({ success: true, workspace: describeWorkspaceRemote(repo) }, null, 2),
                     },
                 ],
             };
@@ -2415,7 +2476,7 @@ export async function handleGrokApiRequest(deps, params) {
     }
     const apiKey = process.env[xaiConfig.apiKeyEnv]?.trim();
     if (!apiKey) {
-        return createErrorResponse("grok_api_request", 1, "", corrId, new Error(`xAI API key env var ${xaiConfig.apiKeyEnv} is not set`));
+        return createErrorResponse("grok_api_request", 1, "", corrId, new Error("xAI API key is not configured"));
     }
     safeFlightStart({
         correlationId: corrId,
@@ -7745,7 +7806,7 @@ export function createGatewayServer(deps = {}) {
                         text: JSON.stringify({
                             success: true,
                             session: {
-                                ...session,
+                                ...(callerIsRemote() ? remoteSafeSession(session) : session),
                                 isActive: activeSession?.id === session.id,
                                 ...(cacheState ? { cacheState } : {}),
                             },
@@ -7937,6 +7998,56 @@ function localBaseUrlForPrint() {
 function printJsonLine(value) {
     process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
+const OAUTH_RESTART_NOTE = "Restart the gateway HTTP transport for this change to take effect (OAuth config is loaded at startup).";
+function validateCliRedirectUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error(`Invalid --redirect-uri "${uri}": it must be an absolute URL with a scheme (e.g. https://chatgpt.com/connector/callback).`);
+    }
+    if (parsed.protocol === "https:")
+        return;
+    if (parsed.protocol === "http:" && hostIsLoopback(parsed.hostname))
+        return;
+    throw new Error(`Invalid --redirect-uri "${uri}": must be https:// (or http:// only for localhost/loopback). The gateway rejects http non-loopback redirect URIs at runtime.`);
+}
+function validateCliClientId(clientId) {
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) {
+        throw new Error(`Invalid client-id "${clientId}": use 1-128 chars of letters, digits, dot, underscore, or hyphen.`);
+    }
+}
+function hostIsLoopback(hostname) {
+    const h = hostname.toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]";
+}
+function redirectLooksLocalhost(uri) {
+    try {
+        return hostIsLoopback(new URL(uri).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function publicUrlIsRemote(env = process.env) {
+    const publicUrl = env.LLM_GATEWAY_PUBLIC_URL;
+    if (!publicUrl)
+        return false;
+    try {
+        return !hostIsLoopback(new URL(publicUrl).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function cliConnectorUrls() {
+    return buildRemoteConnectorUrls({
+        baseOrigin: localBaseUrlForPrint(),
+        mcpPath: process.env.LLM_GATEWAY_HTTP_PATH || "/mcp",
+        oauthEnabled: true,
+    });
+}
 function runOAuthCommand(args) {
     const [scope, action] = args;
     const config = readMutableGatewayConfig();
@@ -7948,7 +8059,16 @@ function runOAuthCommand(args) {
             const clientId = args[2];
             if (!clientId)
                 throw new Error("Usage: llm-cli-gateway oauth client add <client-id> --redirect-uri <uri> [--print-once]");
+            validateCliClientId(clientId);
             const redirectUri = requireArg(args, "--redirect-uri");
+            validateCliRedirectUri(redirectUri);
+            if (clients.some(candidate => candidate.client_id === clientId)) {
+                throw new Error(`OAuth client "${clientId}" already exists. Use \`llm-cli-gateway oauth client rotate ${clientId} --print-once\` to issue a new secret, or revoke it first.`);
+            }
+            const warnings = [];
+            if (redirectLooksLocalhost(redirectUri) && publicUrlIsRemote()) {
+                warnings.push("The redirect URI is localhost but a public URL is configured; remote connectors usually need the provider's public callback URL.");
+            }
             const secret = generateSecret();
             clients.push({
                 client_id: clientId,
@@ -7957,18 +8077,26 @@ function runOAuthCommand(args) {
                 scopes: ["mcp"],
             });
             writeMutableGatewayConfig(config);
+            const printOnce = args.includes("--print-once");
+            const urls = cliConnectorUrls();
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                ...(args.includes("--print-once") ? { client_secret: secret } : {}),
-                oauth: {
-                    issuer: localBaseUrlForPrint(),
-                    authorization_url: `${localBaseUrlForPrint()}/oauth/authorize`,
-                    token_url: `${localBaseUrlForPrint()}/oauth/token`,
+                redirect_uri: redirectUri,
+                ...(printOnce ? { client_secret: secret, client_secret_copy_once: true } : {}),
+                connector: {
+                    mcp_url: urls.mcpUrl,
+                    auth_mode: "oauth",
+                    authorization_url: urls.authorizationUrl,
+                    token_url: urls.tokenUrl,
+                    client_id: clientId,
                 },
-                note: args.includes("--print-once")
-                    ? "client_secret is shown once; it is stored only as a hash."
-                    : "client secret generated and stored only as a hash; rerun rotate --print-once if needed.",
+                ...(warnings.length ? { warnings } : {}),
+                note: printOnce
+                    ? "client_secret is shown once and stored only as a hash. Copy it into the connector UI now; it cannot be recovered later. " +
+                        OAUTH_RESTART_NOTE
+                    : "client secret generated and stored only as a hash. Re-run with --print-once (or `oauth client rotate --print-once`) to reveal a secret. " +
+                        OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -7978,6 +8106,7 @@ function runOAuthCommand(args) {
                 clients: clients.map(client => ({
                     client_id: client.client_id,
                     redirect_uris: client.allowed_redirect_uris ?? [],
+                    scopes: client.scopes ?? ["mcp"],
                     secret_configured: Boolean(client.client_secret_hash),
                 })),
             });
@@ -7991,11 +8120,21 @@ function runOAuthCommand(args) {
             const secret = generateSecret();
             client.client_secret_hash = hashSecret(secret);
             writeMutableGatewayConfig(config);
+            const printOnce = args.includes("--print-once");
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                ...(args.includes("--print-once") ? { client_secret: secret } : {}),
-                note: "Future OAuth exchanges use the rotated secret; already-issued opaque access tokens expire by token TTL or server restart.",
+                ...(printOnce ? { client_secret: secret, client_secret_copy_once: true } : {}),
+                client: {
+                    client_id: client.client_id,
+                    redirect_uris: client.allowed_redirect_uris ?? [],
+                    secret_configured: true,
+                },
+                note: (printOnce
+                    ? "New client_secret is shown once; copy it into the connector UI now. "
+                    : "New secret generated and stored only as a hash; re-run with --print-once to reveal it. ") +
+                    "Future OAuth exchanges use the rotated secret; already-issued opaque access tokens expire by token TTL or server restart. " +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8006,7 +8145,8 @@ function runOAuthCommand(args) {
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                note: "Future OAuth exchanges are revoked; already-issued opaque access tokens expire by token TTL or server restart.",
+                note: "Future OAuth exchanges are revoked; already-issued opaque access tokens expire by token TTL or server restart. " +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8024,10 +8164,13 @@ function runOAuthCommand(args) {
             printJsonLine({
                 ok: true,
                 shared_secret_enabled: true,
-                ...(args.includes("--print-once") ? { shared_secret: secret } : {}),
-                note: args.includes("--print-once")
-                    ? "shared_secret is shown once; it is stored only as a hash."
-                    : "shared secret generated and stored only as a hash.",
+                ...(args.includes("--print-once")
+                    ? { shared_secret: secret, shared_secret_copy_once: true }
+                    : {}),
+                note: (args.includes("--print-once")
+                    ? "shared_secret is shown once; it is stored only as a hash. "
+                    : "shared secret generated and stored only as a hash; re-run with --print-once to reveal it. ") +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8042,6 +8185,19 @@ function runOAuthCommand(args) {
     }
     throw new Error("Usage: llm-cli-gateway oauth client|shared-secret ...");
 }
+function runConnectorCommand(args) {
+    const [action] = args;
+    if (action !== "setup") {
+        throw new Error("Usage: llm-cli-gateway connector setup [--client-id <id>] [--include-legacy-no-auth]");
+    }
+    const options = {
+        clientId: argValue(args, "--client-id"),
+        includeLegacyNoAuth: args.includes("--include-legacy-no-auth"),
+    };
+    const packet = gatherConnectorSetupPacket(options);
+    process.stderr.write(renderConnectorSetupSummary(packet) + "\n");
+    printJsonLine(packet);
+}
 function runWorkspaceCommand(args) {
     const [action] = args;
     if (action === "list") {
@@ -8104,8 +8260,16 @@ async function main() {
             "Usage:",
             "  llm-cli-gateway [doctor --json|contracts --json|--transport=http|--version]",
             "  llm-cli-gateway oauth client add <id> --redirect-uri <uri> [--print-once]",
+            "  llm-cli-gateway connector setup [--client-id <id>] [--include-legacy-no-auth]",
             "  llm-cli-gateway workspace list|add|create",
             "",
+            "Remote connector (recommended OAuth path):",
+            "  1. Set LLM_GATEWAY_PUBLIC_URL to a public https URL (tunnel/reverse proxy).",
+            "  2. oauth client add <id> --redirect-uri <connector-callback> --print-once",
+            "  3. workspace add <alias> <absolute-repo-path> --default",
+            "  4. connector setup      # copy-safe fields to paste into the connector UI",
+            "  Inspect readiness first: doctor --json  ->  remote_http_oauth.stage",
+            "",
             "Doctor:",
             "  doctor --json                     # environment, providers, declared contracts",
             "  doctor --json --probe-upstream    # + expensive installed --help probe for drift",
@@ -8131,6 +8295,10 @@ async function main() {
         runOAuthCommand(args.slice(1));
         return;
     }
+    if (args[0] === "connector") {
+        runConnectorCommand(args.slice(1));
+        return;
+    }
     if (args[0] === "workspace") {
         runWorkspaceCommand(args.slice(1));
         return;

package/dist/oauth.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from
 import { URLSearchParams } from "node:url";
 import { readCappedRawBody, maxOAuthBodyBytes } from "./request-limits.js";
 import { issueOAuthAccessToken, timingSafeStringEqual, } from "./auth.js";
+import { joinBaseAndPath, OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, OAUTH_PROTECTED_RESOURCE_METADATA_PATH, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH, OPENID_CONFIGURATION_PATH, } from "./remote-url.js";
 export const OAUTH_CODE_TTL_MS = 5 * 60 * 1000;
 const GENERATED_SECRET_BYTES = 32;
 const SCRYPT_N = 32768;
@@ -77,6 +78,10 @@ function readCookie(req, name) {
     }
     return null;
 }
+function oauthCsrfCookie(csrf) {
+    const maxAgeSeconds = Math.floor(OAUTH_CODE_TTL_MS / 1000);
+    return `gw_oauth_csrf=${csrf}; HttpOnly; Secure; SameSite=Lax; Path=/oauth; Max-Age=${maxAgeSeconds}`;
+}
 function methodNotAllowed(res) {
     res.writeHead(405, { allow: "GET, POST", "content-type": "application/json" });
     res.end(JSON.stringify({ error: "Method not allowed" }));
@@ -223,17 +228,17 @@ export class OAuthServer {
         }
     }
     resourceMetadataUrl(baseUrl) {
-        return `${baseUrl}/.well-known/oauth-protected-resource`;
+        return joinBaseAndPath(baseUrl, OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
     }
     isOAuthPath(pathname) {
-        return (pathname.startsWith("/.well-known/oauth-protected-resource") ||
-            pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            pathname === "/.well-known/openid-configuration" ||
+        return (pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH) ||
+            pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            pathname === OPENID_CONFIGURATION_PATH ||
             pathname.startsWith("/oauth/"));
     }
     async handle(ctx) {
         const { req, res, url, baseUrl } = ctx;
-        if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
+        if (url.pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -241,8 +246,8 @@ export class OAuthServer {
             jsonResponse(res, 200, this.protectedResourceMetadata(baseUrl));
             return true;
         }
-        if (url.pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            url.pathname === "/.well-known/openid-configuration") {
+        if (url.pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            url.pathname === OPENID_CONFIGURATION_PATH) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -250,15 +255,15 @@ export class OAuthServer {
             jsonResponse(res, 200, this.authorizationServerMetadata(baseUrl));
             return true;
         }
-        if (url.pathname === "/oauth/register") {
+        if (url.pathname === OAUTH_REGISTER_PATH) {
             await this.handleRegister(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/authorize") {
+        if (url.pathname === OAUTH_AUTHORIZE_PATH) {
             await this.handleAuthorize(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/token") {
+        if (url.pathname === OAUTH_TOKEN_PATH) {
             await this.handleToken(req, res);
             return true;
         }
@@ -266,7 +271,7 @@ export class OAuthServer {
     }
     protectedResourceMetadata(baseUrl) {
         return {
-            resource: `${baseUrl}${this.opts.protectedPath}`,
+            resource: joinBaseAndPath(baseUrl, this.opts.protectedPath),
             authorization_servers: [baseUrl],
             scopes_supported: ["mcp", "workspace:admin"],
             bearer_methods_supported: ["header"],
@@ -275,9 +280,9 @@ export class OAuthServer {
     authorizationServerMetadata(baseUrl) {
         return {
             issuer: baseUrl,
-            authorization_endpoint: `${baseUrl}/oauth/authorize`,
-            token_endpoint: `${baseUrl}/oauth/token`,
-            registration_endpoint: `${baseUrl}/oauth/register`,
+            authorization_endpoint: joinBaseAndPath(baseUrl, OAUTH_AUTHORIZE_PATH),
+            token_endpoint: joinBaseAndPath(baseUrl, OAUTH_TOKEN_PATH),
+            registration_endpoint: joinBaseAndPath(baseUrl, OAUTH_REGISTER_PATH),
             response_types_supported: ["code"],
             grant_types_supported: ["authorization_code"],
             token_endpoint_auth_methods_supported: this.opts.config.allowPublicClients
@@ -466,7 +471,7 @@ ${errorBlock}
 <p class="muted">Only approve if you initiated this connection.</p></div></body></html>`;
         res.writeHead(200, {
             "content-type": "text/html; charset=utf-8",
-            "set-cookie": `gw_oauth_csrf=${csrf}; HttpOnly; SameSite=Lax; Path=/oauth`,
+            "set-cookie": oauthCsrfCookie(csrf),
             "cache-control": "no-store",
         });
         res.end(html);

package/dist/remote-url.d.ts

@@ -0,0 +1,28 @@
+export declare const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export declare const OAUTH_TOKEN_PATH = "/oauth/token";
+export declare const OAUTH_REGISTER_PATH = "/oauth/register";
+export declare const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export declare const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export declare const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export declare const DEFAULT_MCP_PATH = "/mcp";
+export declare function joinBaseAndPath(baseOrigin: string, path: string): string;
+export declare function toOrigin(rawUrl: string | null | undefined): string | null;
+export declare function resolveConfiguredRemoteOrigin(opts: {
+    issuer?: string | null;
+    publicUrl?: string | null;
+}): string | null;
+export interface RemoteConnectorUrls {
+    baseOrigin: string | null;
+    mcpUrl: string | null;
+    issuer: string | null;
+    authorizationUrl: string | null;
+    tokenUrl: string | null;
+    registrationUrl: string | null;
+    protectedResourceMetadataUrl: string | null;
+    authorizationServerMetadataUrl: string | null;
+}
+export declare function buildRemoteConnectorUrls(opts: {
+    baseOrigin: string | null;
+    mcpPath?: string;
+    oauthEnabled: boolean;
+}): RemoteConnectorUrls;

package/dist/remote-url.js

@@ -0,0 +1,61 @@
+export const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export const OAUTH_TOKEN_PATH = "/oauth/token";
+export const OAUTH_REGISTER_PATH = "/oauth/register";
+export const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export const DEFAULT_MCP_PATH = "/mcp";
+export function joinBaseAndPath(baseOrigin, path) {
+    const trimmedBase = baseOrigin.replace(/\/+$/, "");
+    const suffix = path.startsWith("/") ? path : `/${path}`;
+    return `${trimmedBase}${suffix}`;
+}
+export function toOrigin(rawUrl) {
+    if (!rawUrl)
+        return null;
+    try {
+        return new URL(rawUrl).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveConfiguredRemoteOrigin(opts) {
+    if (opts.issuer && opts.issuer !== "auto") {
+        const fromIssuer = toOrigin(opts.issuer);
+        if (fromIssuer)
+            return fromIssuer;
+    }
+    return toOrigin(opts.publicUrl ?? null);
+}
+export function buildRemoteConnectorUrls(opts) {
+    const base = opts.baseOrigin;
+    const mcpPath = opts.mcpPath && opts.mcpPath.length > 0 ? opts.mcpPath : DEFAULT_MCP_PATH;
+    if (!base) {
+        return {
+            baseOrigin: null,
+            mcpUrl: null,
+            issuer: null,
+            authorizationUrl: null,
+            tokenUrl: null,
+            registrationUrl: null,
+            protectedResourceMetadataUrl: null,
+            authorizationServerMetadataUrl: null,
+        };
+    }
+    const oauth = opts.oauthEnabled;
+    return {
+        baseOrigin: base,
+        mcpUrl: joinBaseAndPath(base, mcpPath),
+        issuer: oauth ? base : null,
+        authorizationUrl: oauth ? joinBaseAndPath(base, OAUTH_AUTHORIZE_PATH) : null,
+        tokenUrl: oauth ? joinBaseAndPath(base, OAUTH_TOKEN_PATH) : null,
+        registrationUrl: oauth ? joinBaseAndPath(base, OAUTH_REGISTER_PATH) : null,
+        protectedResourceMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_PROTECTED_RESOURCE_METADATA_PATH)
+            : null,
+        authorizationServerMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH)
+            : null,
+    };
+}

package/dist/resources.js

@@ -1,3 +1,4 @@
+import { callerIsRemote, remoteSafeSession, } from "./session-manager.js";
 import { CLI_TYPES, PROVIDER_TYPES } from "./session-manager.js";
 import { getRequestContext, principalCanAccess, resolveOwnerPrincipal } from "./request-context.js";
 import { getAvailableCliInfo } from "./model-registry.js";
@@ -240,7 +241,8 @@ export class ResourceProvider {
     }
     ownedSessions(sessions) {
         const caller = resolveOwnerPrincipal(getRequestContext());
-        return sessions.filter(s => principalCanAccess(s.ownerPrincipal, caller));
+        const owned = sessions.filter(s => principalCanAccess(s.ownerPrincipal, caller));
+        return callerIsRemote() ? owned.map(remoteSafeSession) : owned;
     }
     async ownedActiveId(provider) {
         const active = await Promise.resolve(this.sessionManager.getActiveSession(provider));

package/dist/session-manager.d.ts

@@ -23,6 +23,8 @@ export interface SessionStorage {
     sessions: Record<string, Session>;
     activeSession: Record<ProviderType, string | null>;
 }
+export declare function remoteSafeSession(session: Session): Session;
+export declare function callerIsRemote(): boolean;
 export type SessionCleanupHook = (session: Session) => void | Promise<void>;
 export declare class FileSessionManager {
     private storagePath;

package/dist/session-manager.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "crypto";
 import { homedir } from "os";
-import { join, dirname } from "path";
+import { join, dirname, relative as pathRelative, isAbsolute as pathIsAbsolute, basename as pathBasename, } from "path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, openSync, fsyncSync, closeSync, chmodSync, } from "fs";
 import { DEFAULT_SESSION_TTL_SECONDS } from "./config.js";
 import { noopLogger } from "./logger.js";
@@ -28,6 +28,25 @@ export function defaultSessionDescription(provider) {
     return KNOWN_SESSION_DESCRIPTIONS[provider] ?? `${provider} Session`;
 }
 const createEmptyActiveSessions = () => Object.fromEntries(PROVIDER_TYPES.map(provider => [provider, null]));
+export function remoteSafeSession(session) {
+    const metadata = session.metadata;
+    if (!metadata)
+        return session;
+    const next = { ...metadata };
+    if (typeof next.worktreePath === "string") {
+        const root = typeof next.workspaceRoot === "string" ? next.workspaceRoot : undefined;
+        const rel = root ? pathRelative(root, next.worktreePath) : "";
+        next.worktreePath =
+            rel && !rel.startsWith("..") && !pathIsAbsolute(rel) ? rel : pathBasename(next.worktreePath);
+    }
+    if (typeof next.workspaceRoot === "string")
+        delete next.workspaceRoot;
+    return { ...session, metadata: next };
+}
+export function callerIsRemote() {
+    const ctx = getRequestContext();
+    return ctx?.transport === "http" || ctx?.authKind === "oauth";
+}
 export class FileSessionManager {
     storagePath;
     storage = { sessions: {}, activeSession: createEmptyActiveSessions() };