llm-cli-gateway 2.13.1 → 2.13.2

package/dist/index.js

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { randomUUID } from "crypto";
 import { createRequire } from "module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, chmodSync, } from "fs";
-import { dirname, join } from "path";
+import { basename, dirname, isAbsolute, join, relative } from "path";
 import { fileURLToPath } from "url";
 import { z } from "zod/v3";
 import { executeCli, killAllProcessGroups, providerCommandName } from "./executor.js";
@@ -13,7 +13,7 @@ import { parseCodexJsonStream, codexDisplayText, codexFrResponse } from "./codex
 import { parseGeminiJson, parseGeminiStreamJson } from "./gemini-json-parser.js";
 import { parseVibeMetaJson } from "./mistral-meta-json-parser.js";
 import { homedir } from "os";
-import { CLI_TYPES, PROVIDER_TYPES, createSessionManager, } from "./session-manager.js";
+import { CLI_TYPES, PROVIDER_TYPES, createSessionManager, callerIsRemote, remoteSafeSession, } from "./session-manager.js";
 import { createWorktree, createWorktreeSessionCleanupHook, } from "./worktree-manager.js";
 import { ResourceProvider } from "./resources.js";
 import { PerformanceMetrics } from "./metrics.js";
@@ -41,7 +41,9 @@ import { startHttpGateway } from "./http-transport.js";
 import { getRequestContext, resolveOwnerPrincipal, principalCanAccess } from "./request-context.js";
 import { printDoctorJson } from "./doctor.js";
 import { redactDiagnosticUrl } from "./endpoint-exposure.js";
-import { createWorkspace, describeWorkspace, getWorkspace, loadWorkspaceRegistry, registerExistingWorkspace, resolveWorkspaceForProvider, validatePathInsideWorkspace, } from "./workspace-registry.js";
+import { buildRemoteConnectorUrls } from "./remote-url.js";
+import { gatherConnectorSetupPacket, renderConnectorSetupSummary, } from "./connector-setup.js";
+import { createWorkspace, describeWorkspace, describeWorkspaceRemote, getWorkspace, loadWorkspaceRegistry, registerExistingWorkspace, resolveWorkspaceForProvider, validatePathInsideWorkspace, } from "./workspace-registry.js";
 import { generateSecret, hashSecret } from "./oauth.js";
 import { registerValidationTools } from "./validation-tools.js";
 import { currentCaller, resolveValidationReceipt } from "./validation-receipt.js";
@@ -738,7 +740,10 @@ async function resolveWorkspaceAndWorktreeForRequest(args) {
             workspaceAlias: workspace?.alias,
             workspaceRoot: workspace?.root,
         });
-        return { cwd: resolved.cwd, worktreePath: resolved.worktreePath, workspace };
+        const displayWorktreePath = isRemoteTransport
+            ? remoteSafeWorktreePath(resolved.worktreePath, workspace?.root)
+            : resolved.worktreePath;
+        return { cwd: resolved.cwd, worktreePath: displayWorktreePath, workspace };
     }
     if (workspace && args.sessionId) {
         await Promise.resolve(args.runtime.sessionManager.updateSessionMetadata(args.sessionId, {
@@ -751,6 +756,16 @@ async function resolveWorkspaceAndWorktreeForRequest(args) {
 export function formatWorktreePrefix(worktreePath) {
     return worktreePath ? `[gateway] worktree=${worktreePath}\n` : "";
 }
+export function remoteSafeWorktreePath(worktreePath, workspaceRoot) {
+    if (!worktreePath)
+        return worktreePath;
+    if (workspaceRoot) {
+        const rel = relative(workspaceRoot, worktreePath);
+        if (rel && !rel.startsWith("..") && !isAbsolute(rel))
+            return rel;
+    }
+    return basename(worktreePath);
+}
 function workspaceAdminEnabled() {
     const scopes = getRequestContext()?.authScopes ?? [];
     return process.env.LLM_GATEWAY_WORKSPACE_ADMIN === "1" && scopes.includes("workspace:admin");
@@ -780,10 +795,9 @@ function registerWorkspaceTools(server, runtime) {
                             success: true,
                             enabled: registry.enabled,
                             default: registry.defaultAlias,
-                            workspaces: registry.repos.map(describeWorkspace),
+                            workspaces: registry.repos.map(describeWorkspaceRemote),
                             allowed_roots: registry.allowedRoots.map(root => ({
                                 alias: root.alias,
-                                path: root.path,
                                 allow_register_existing_git_repos: root.allowRegisterExistingGitRepos,
                                 allow_create_directories: root.allowCreateDirectories,
                                 allow_init_git_repos: root.allowInitGitRepos,
@@ -812,7 +826,10 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(getWorkspace(registry, alias)) }, null, 2),
+                        text: JSON.stringify({
+                            success: true,
+                            workspace: describeWorkspaceRemote(getWorkspace(registry, alias)),
+                        }, null, 2),
                     },
                 ],
             };
@@ -851,7 +868,7 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(repo) }, null, 2),
+                        text: JSON.stringify({ success: true, workspace: describeWorkspaceRemote(repo) }, null, 2),
                     },
                 ],
             };
@@ -889,7 +906,7 @@ function registerWorkspaceTools(server, runtime) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ success: true, workspace: describeWorkspace(repo) }, null, 2),
+                        text: JSON.stringify({ success: true, workspace: describeWorkspaceRemote(repo) }, null, 2),
                     },
                 ],
             };
@@ -7789,7 +7806,7 @@ export function createGatewayServer(deps = {}) {
                         text: JSON.stringify({
                             success: true,
                             session: {
-                                ...session,
+                                ...(callerIsRemote() ? remoteSafeSession(session) : session),
                                 isActive: activeSession?.id === session.id,
                                 ...(cacheState ? { cacheState } : {}),
                             },
@@ -7981,6 +7998,56 @@ function localBaseUrlForPrint() {
 function printJsonLine(value) {
     process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
+const OAUTH_RESTART_NOTE = "Restart the gateway HTTP transport for this change to take effect (OAuth config is loaded at startup).";
+function validateCliRedirectUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error(`Invalid --redirect-uri "${uri}": it must be an absolute URL with a scheme (e.g. https://chatgpt.com/connector/callback).`);
+    }
+    if (parsed.protocol === "https:")
+        return;
+    if (parsed.protocol === "http:" && hostIsLoopback(parsed.hostname))
+        return;
+    throw new Error(`Invalid --redirect-uri "${uri}": must be https:// (or http:// only for localhost/loopback). The gateway rejects http non-loopback redirect URIs at runtime.`);
+}
+function validateCliClientId(clientId) {
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) {
+        throw new Error(`Invalid client-id "${clientId}": use 1-128 chars of letters, digits, dot, underscore, or hyphen.`);
+    }
+}
+function hostIsLoopback(hostname) {
+    const h = hostname.toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]";
+}
+function redirectLooksLocalhost(uri) {
+    try {
+        return hostIsLoopback(new URL(uri).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function publicUrlIsRemote(env = process.env) {
+    const publicUrl = env.LLM_GATEWAY_PUBLIC_URL;
+    if (!publicUrl)
+        return false;
+    try {
+        return !hostIsLoopback(new URL(publicUrl).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function cliConnectorUrls() {
+    return buildRemoteConnectorUrls({
+        baseOrigin: localBaseUrlForPrint(),
+        mcpPath: process.env.LLM_GATEWAY_HTTP_PATH || "/mcp",
+        oauthEnabled: true,
+    });
+}
 function runOAuthCommand(args) {
     const [scope, action] = args;
     const config = readMutableGatewayConfig();
@@ -7992,7 +8059,16 @@ function runOAuthCommand(args) {
             const clientId = args[2];
             if (!clientId)
                 throw new Error("Usage: llm-cli-gateway oauth client add <client-id> --redirect-uri <uri> [--print-once]");
+            validateCliClientId(clientId);
             const redirectUri = requireArg(args, "--redirect-uri");
+            validateCliRedirectUri(redirectUri);
+            if (clients.some(candidate => candidate.client_id === clientId)) {
+                throw new Error(`OAuth client "${clientId}" already exists. Use \`llm-cli-gateway oauth client rotate ${clientId} --print-once\` to issue a new secret, or revoke it first.`);
+            }
+            const warnings = [];
+            if (redirectLooksLocalhost(redirectUri) && publicUrlIsRemote()) {
+                warnings.push("The redirect URI is localhost but a public URL is configured; remote connectors usually need the provider's public callback URL.");
+            }
             const secret = generateSecret();
             clients.push({
                 client_id: clientId,
@@ -8001,18 +8077,26 @@ function runOAuthCommand(args) {
                 scopes: ["mcp"],
             });
             writeMutableGatewayConfig(config);
+            const printOnce = args.includes("--print-once");
+            const urls = cliConnectorUrls();
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                ...(args.includes("--print-once") ? { client_secret: secret } : {}),
-                oauth: {
-                    issuer: localBaseUrlForPrint(),
-                    authorization_url: `${localBaseUrlForPrint()}/oauth/authorize`,
-                    token_url: `${localBaseUrlForPrint()}/oauth/token`,
+                redirect_uri: redirectUri,
+                ...(printOnce ? { client_secret: secret, client_secret_copy_once: true } : {}),
+                connector: {
+                    mcp_url: urls.mcpUrl,
+                    auth_mode: "oauth",
+                    authorization_url: urls.authorizationUrl,
+                    token_url: urls.tokenUrl,
+                    client_id: clientId,
                 },
-                note: args.includes("--print-once")
-                    ? "client_secret is shown once; it is stored only as a hash."
-                    : "client secret generated and stored only as a hash; rerun rotate --print-once if needed.",
+                ...(warnings.length ? { warnings } : {}),
+                note: printOnce
+                    ? "client_secret is shown once and stored only as a hash. Copy it into the connector UI now; it cannot be recovered later. " +
+                        OAUTH_RESTART_NOTE
+                    : "client secret generated and stored only as a hash. Re-run with --print-once (or `oauth client rotate --print-once`) to reveal a secret. " +
+                        OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8022,6 +8106,7 @@ function runOAuthCommand(args) {
                 clients: clients.map(client => ({
                     client_id: client.client_id,
                     redirect_uris: client.allowed_redirect_uris ?? [],
+                    scopes: client.scopes ?? ["mcp"],
                     secret_configured: Boolean(client.client_secret_hash),
                 })),
             });
@@ -8035,11 +8120,21 @@ function runOAuthCommand(args) {
             const secret = generateSecret();
             client.client_secret_hash = hashSecret(secret);
             writeMutableGatewayConfig(config);
+            const printOnce = args.includes("--print-once");
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                ...(args.includes("--print-once") ? { client_secret: secret } : {}),
-                note: "Future OAuth exchanges use the rotated secret; already-issued opaque access tokens expire by token TTL or server restart.",
+                ...(printOnce ? { client_secret: secret, client_secret_copy_once: true } : {}),
+                client: {
+                    client_id: client.client_id,
+                    redirect_uris: client.allowed_redirect_uris ?? [],
+                    secret_configured: true,
+                },
+                note: (printOnce
+                    ? "New client_secret is shown once; copy it into the connector UI now. "
+                    : "New secret generated and stored only as a hash; re-run with --print-once to reveal it. ") +
+                    "Future OAuth exchanges use the rotated secret; already-issued opaque access tokens expire by token TTL or server restart. " +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8050,7 +8145,8 @@ function runOAuthCommand(args) {
             printJsonLine({
                 ok: true,
                 client_id: clientId,
-                note: "Future OAuth exchanges are revoked; already-issued opaque access tokens expire by token TTL or server restart.",
+                note: "Future OAuth exchanges are revoked; already-issued opaque access tokens expire by token TTL or server restart. " +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8068,10 +8164,13 @@ function runOAuthCommand(args) {
             printJsonLine({
                 ok: true,
                 shared_secret_enabled: true,
-                ...(args.includes("--print-once") ? { shared_secret: secret } : {}),
-                note: args.includes("--print-once")
-                    ? "shared_secret is shown once; it is stored only as a hash."
-                    : "shared secret generated and stored only as a hash.",
+                ...(args.includes("--print-once")
+                    ? { shared_secret: secret, shared_secret_copy_once: true }
+                    : {}),
+                note: (args.includes("--print-once")
+                    ? "shared_secret is shown once; it is stored only as a hash. "
+                    : "shared secret generated and stored only as a hash; re-run with --print-once to reveal it. ") +
+                    OAUTH_RESTART_NOTE,
             });
             return;
         }
@@ -8086,6 +8185,19 @@ function runOAuthCommand(args) {
     }
     throw new Error("Usage: llm-cli-gateway oauth client|shared-secret ...");
 }
+function runConnectorCommand(args) {
+    const [action] = args;
+    if (action !== "setup") {
+        throw new Error("Usage: llm-cli-gateway connector setup [--client-id <id>] [--include-legacy-no-auth]");
+    }
+    const options = {
+        clientId: argValue(args, "--client-id"),
+        includeLegacyNoAuth: args.includes("--include-legacy-no-auth"),
+    };
+    const packet = gatherConnectorSetupPacket(options);
+    process.stderr.write(renderConnectorSetupSummary(packet) + "\n");
+    printJsonLine(packet);
+}
 function runWorkspaceCommand(args) {
     const [action] = args;
     if (action === "list") {
@@ -8148,8 +8260,16 @@ async function main() {
             "Usage:",
             "  llm-cli-gateway [doctor --json|contracts --json|--transport=http|--version]",
             "  llm-cli-gateway oauth client add <id> --redirect-uri <uri> [--print-once]",
+            "  llm-cli-gateway connector setup [--client-id <id>] [--include-legacy-no-auth]",
             "  llm-cli-gateway workspace list|add|create",
             "",
+            "Remote connector (recommended OAuth path):",
+            "  1. Set LLM_GATEWAY_PUBLIC_URL to a public https URL (tunnel/reverse proxy).",
+            "  2. oauth client add <id> --redirect-uri <connector-callback> --print-once",
+            "  3. workspace add <alias> <absolute-repo-path> --default",
+            "  4. connector setup      # copy-safe fields to paste into the connector UI",
+            "  Inspect readiness first: doctor --json  ->  remote_http_oauth.stage",
+            "",
             "Doctor:",
             "  doctor --json                     # environment, providers, declared contracts",
             "  doctor --json --probe-upstream    # + expensive installed --help probe for drift",
@@ -8175,6 +8295,10 @@ async function main() {
         runOAuthCommand(args.slice(1));
         return;
     }
+    if (args[0] === "connector") {
+        runConnectorCommand(args.slice(1));
+        return;
+    }
     if (args[0] === "workspace") {
         runWorkspaceCommand(args.slice(1));
         return;

package/dist/oauth.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from
 import { URLSearchParams } from "node:url";
 import { readCappedRawBody, maxOAuthBodyBytes } from "./request-limits.js";
 import { issueOAuthAccessToken, timingSafeStringEqual, } from "./auth.js";
+import { joinBaseAndPath, OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, OAUTH_PROTECTED_RESOURCE_METADATA_PATH, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH, OPENID_CONFIGURATION_PATH, } from "./remote-url.js";
 export const OAUTH_CODE_TTL_MS = 5 * 60 * 1000;
 const GENERATED_SECRET_BYTES = 32;
 const SCRYPT_N = 32768;
@@ -227,17 +228,17 @@ export class OAuthServer {
         }
     }
     resourceMetadataUrl(baseUrl) {
-        return `${baseUrl}/.well-known/oauth-protected-resource`;
+        return joinBaseAndPath(baseUrl, OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
     }
     isOAuthPath(pathname) {
-        return (pathname.startsWith("/.well-known/oauth-protected-resource") ||
-            pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            pathname === "/.well-known/openid-configuration" ||
+        return (pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH) ||
+            pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            pathname === OPENID_CONFIGURATION_PATH ||
             pathname.startsWith("/oauth/"));
     }
     async handle(ctx) {
         const { req, res, url, baseUrl } = ctx;
-        if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
+        if (url.pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -245,8 +246,8 @@ export class OAuthServer {
             jsonResponse(res, 200, this.protectedResourceMetadata(baseUrl));
             return true;
         }
-        if (url.pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            url.pathname === "/.well-known/openid-configuration") {
+        if (url.pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            url.pathname === OPENID_CONFIGURATION_PATH) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -254,15 +255,15 @@ export class OAuthServer {
             jsonResponse(res, 200, this.authorizationServerMetadata(baseUrl));
             return true;
         }
-        if (url.pathname === "/oauth/register") {
+        if (url.pathname === OAUTH_REGISTER_PATH) {
             await this.handleRegister(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/authorize") {
+        if (url.pathname === OAUTH_AUTHORIZE_PATH) {
             await this.handleAuthorize(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/token") {
+        if (url.pathname === OAUTH_TOKEN_PATH) {
             await this.handleToken(req, res);
             return true;
         }
@@ -270,7 +271,7 @@ export class OAuthServer {
     }
     protectedResourceMetadata(baseUrl) {
         return {
-            resource: `${baseUrl}${this.opts.protectedPath}`,
+            resource: joinBaseAndPath(baseUrl, this.opts.protectedPath),
             authorization_servers: [baseUrl],
             scopes_supported: ["mcp", "workspace:admin"],
             bearer_methods_supported: ["header"],
@@ -279,9 +280,9 @@ export class OAuthServer {
     authorizationServerMetadata(baseUrl) {
         return {
             issuer: baseUrl,
-            authorization_endpoint: `${baseUrl}/oauth/authorize`,
-            token_endpoint: `${baseUrl}/oauth/token`,
-            registration_endpoint: `${baseUrl}/oauth/register`,
+            authorization_endpoint: joinBaseAndPath(baseUrl, OAUTH_AUTHORIZE_PATH),
+            token_endpoint: joinBaseAndPath(baseUrl, OAUTH_TOKEN_PATH),
+            registration_endpoint: joinBaseAndPath(baseUrl, OAUTH_REGISTER_PATH),
             response_types_supported: ["code"],
             grant_types_supported: ["authorization_code"],
             token_endpoint_auth_methods_supported: this.opts.config.allowPublicClients

package/dist/remote-url.d.ts

@@ -0,0 +1,28 @@
+export declare const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export declare const OAUTH_TOKEN_PATH = "/oauth/token";
+export declare const OAUTH_REGISTER_PATH = "/oauth/register";
+export declare const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export declare const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export declare const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export declare const DEFAULT_MCP_PATH = "/mcp";
+export declare function joinBaseAndPath(baseOrigin: string, path: string): string;
+export declare function toOrigin(rawUrl: string | null | undefined): string | null;
+export declare function resolveConfiguredRemoteOrigin(opts: {
+    issuer?: string | null;
+    publicUrl?: string | null;
+}): string | null;
+export interface RemoteConnectorUrls {
+    baseOrigin: string | null;
+    mcpUrl: string | null;
+    issuer: string | null;
+    authorizationUrl: string | null;
+    tokenUrl: string | null;
+    registrationUrl: string | null;
+    protectedResourceMetadataUrl: string | null;
+    authorizationServerMetadataUrl: string | null;
+}
+export declare function buildRemoteConnectorUrls(opts: {
+    baseOrigin: string | null;
+    mcpPath?: string;
+    oauthEnabled: boolean;
+}): RemoteConnectorUrls;

package/dist/remote-url.js

@@ -0,0 +1,61 @@
+export const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export const OAUTH_TOKEN_PATH = "/oauth/token";
+export const OAUTH_REGISTER_PATH = "/oauth/register";
+export const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export const DEFAULT_MCP_PATH = "/mcp";
+export function joinBaseAndPath(baseOrigin, path) {
+    const trimmedBase = baseOrigin.replace(/\/+$/, "");
+    const suffix = path.startsWith("/") ? path : `/${path}`;
+    return `${trimmedBase}${suffix}`;
+}
+export function toOrigin(rawUrl) {
+    if (!rawUrl)
+        return null;
+    try {
+        return new URL(rawUrl).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveConfiguredRemoteOrigin(opts) {
+    if (opts.issuer && opts.issuer !== "auto") {
+        const fromIssuer = toOrigin(opts.issuer);
+        if (fromIssuer)
+            return fromIssuer;
+    }
+    return toOrigin(opts.publicUrl ?? null);
+}
+export function buildRemoteConnectorUrls(opts) {
+    const base = opts.baseOrigin;
+    const mcpPath = opts.mcpPath && opts.mcpPath.length > 0 ? opts.mcpPath : DEFAULT_MCP_PATH;
+    if (!base) {
+        return {
+            baseOrigin: null,
+            mcpUrl: null,
+            issuer: null,
+            authorizationUrl: null,
+            tokenUrl: null,
+            registrationUrl: null,
+            protectedResourceMetadataUrl: null,
+            authorizationServerMetadataUrl: null,
+        };
+    }
+    const oauth = opts.oauthEnabled;
+    return {
+        baseOrigin: base,
+        mcpUrl: joinBaseAndPath(base, mcpPath),
+        issuer: oauth ? base : null,
+        authorizationUrl: oauth ? joinBaseAndPath(base, OAUTH_AUTHORIZE_PATH) : null,
+        tokenUrl: oauth ? joinBaseAndPath(base, OAUTH_TOKEN_PATH) : null,
+        registrationUrl: oauth ? joinBaseAndPath(base, OAUTH_REGISTER_PATH) : null,
+        protectedResourceMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_PROTECTED_RESOURCE_METADATA_PATH)
+            : null,
+        authorizationServerMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH)
+            : null,
+    };
+}

package/dist/resources.js

@@ -1,3 +1,4 @@
+import { callerIsRemote, remoteSafeSession, } from "./session-manager.js";
 import { CLI_TYPES, PROVIDER_TYPES } from "./session-manager.js";
 import { getRequestContext, principalCanAccess, resolveOwnerPrincipal } from "./request-context.js";
 import { getAvailableCliInfo } from "./model-registry.js";
@@ -240,7 +241,8 @@ export class ResourceProvider {
     }
     ownedSessions(sessions) {
         const caller = resolveOwnerPrincipal(getRequestContext());
-        return sessions.filter(s => principalCanAccess(s.ownerPrincipal, caller));
+        const owned = sessions.filter(s => principalCanAccess(s.ownerPrincipal, caller));
+        return callerIsRemote() ? owned.map(remoteSafeSession) : owned;
     }
     async ownedActiveId(provider) {
         const active = await Promise.resolve(this.sessionManager.getActiveSession(provider));

package/dist/session-manager.d.ts

@@ -23,6 +23,8 @@ export interface SessionStorage {
     sessions: Record<string, Session>;
     activeSession: Record<ProviderType, string | null>;
 }
+export declare function remoteSafeSession(session: Session): Session;
+export declare function callerIsRemote(): boolean;
 export type SessionCleanupHook = (session: Session) => void | Promise<void>;
 export declare class FileSessionManager {
     private storagePath;

package/dist/session-manager.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "crypto";
 import { homedir } from "os";
-import { join, dirname } from "path";
+import { join, dirname, relative as pathRelative, isAbsolute as pathIsAbsolute, basename as pathBasename, } from "path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, openSync, fsyncSync, closeSync, chmodSync, } from "fs";
 import { DEFAULT_SESSION_TTL_SECONDS } from "./config.js";
 import { noopLogger } from "./logger.js";
@@ -28,6 +28,25 @@ export function defaultSessionDescription(provider) {
     return KNOWN_SESSION_DESCRIPTIONS[provider] ?? `${provider} Session`;
 }
 const createEmptyActiveSessions = () => Object.fromEntries(PROVIDER_TYPES.map(provider => [provider, null]));
+export function remoteSafeSession(session) {
+    const metadata = session.metadata;
+    if (!metadata)
+        return session;
+    const next = { ...metadata };
+    if (typeof next.worktreePath === "string") {
+        const root = typeof next.workspaceRoot === "string" ? next.workspaceRoot : undefined;
+        const rel = root ? pathRelative(root, next.worktreePath) : "";
+        next.worktreePath =
+            rel && !rel.startsWith("..") && !pathIsAbsolute(rel) ? rel : pathBasename(next.worktreePath);
+    }
+    if (typeof next.workspaceRoot === "string")
+        delete next.workspaceRoot;
+    return { ...session, metadata: next };
+}
+export function callerIsRemote() {
+    const ctx = getRequestContext();
+    return ctx?.transport === "http" || ctx?.authKind === "oauth";
+}
 export class FileSessionManager {
     storagePath;
     storage = { sessions: {}, activeSession: createEmptyActiveSessions() };

package/dist/workspace-registry.d.ts

@@ -60,4 +60,13 @@ export declare function registerExistingWorkspace(input: {
     logger?: Logger;
 }): WorkspaceRepo;
 export declare function createTempWorkspaceConfig(contents: string): string;
+export interface RemoteSafeWorkspaceSummary {
+    ready: boolean;
+    default: string | null;
+    aliases: string[];
+    repo_count: number;
+    allowed_root_count: number;
+}
+export declare function remoteSafeWorkspaceSummary(registry: WorkspaceRegistry): RemoteSafeWorkspaceSummary;
+export declare function describeWorkspaceRemote(repo: WorkspaceRepo): Record<string, unknown>;
 export declare function describeWorkspace(repo: WorkspaceRepo): Record<string, unknown>;

package/dist/workspace-registry.js

@@ -350,13 +350,19 @@ export function registerExistingWorkspace(input) {
     if (registry.repos.some(repo => repo.alias === alias)) {
         throw new WorkspaceRegistryError(`Workspace alias "${alias}" already exists`);
     }
+    const genericDenied = new WorkspaceRegistryError("No allowed root permits registering a Git repository at the requested path.");
+    if (!path.isAbsolute(input.repoPath))
+        throw genericDenied;
+    const candidateReal = path.resolve(expandHome(input.repoPath));
+    const permittingRoot = registry.allowedRoots.find(candidate => candidate.allowRegisterExistingGitRepos && isUnder(candidate.path, candidateReal));
+    if (!permittingRoot)
+        throw genericDenied;
     const real = realExistingPath(input.repoPath);
     if (!isGitRepo(real))
         throw new WorkspaceRegistryError("Existing workspace must be a Git repo");
-    const root = registry.allowedRoots.find(candidate => isUnder(candidate.path, real));
-    if (!root?.allowRegisterExistingGitRepos) {
-        throw new WorkspaceRegistryError("No allowed root permits registering this Git repo");
-    }
+    const root = registry.allowedRoots.find(candidate => candidate.allowRegisterExistingGitRepos && isUnder(candidate.path, real));
+    if (!root)
+        throw genericDenied;
     const workspaces = (raw.workspaces ?? {});
     const repos = (Array.isArray(workspaces.repos) ? workspaces.repos : []);
     repos.push({
@@ -389,6 +395,20 @@ export function createTempWorkspaceConfig(contents) {
     writeFileSync(configPath, contents, { mode: 0o600 });
     return configPath;
 }
+export function remoteSafeWorkspaceSummary(registry) {
+    return {
+        ready: registry.defaultAlias !== null || registry.repos.length > 0,
+        default: registry.defaultAlias,
+        aliases: registry.repos.map(repo => repo.alias),
+        repo_count: registry.repos.length,
+        allowed_root_count: registry.allowedRoots.length,
+    };
+}
+export function describeWorkspaceRemote(repo) {
+    const full = describeWorkspace(repo);
+    delete full.path;
+    return full;
+}
 export function describeWorkspace(repo) {
     let branch = null;
     let dirty = false;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.1",
+  "version": "2.13.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.13.1",
+      "version": "2.13.2",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.1",
+  "version": "2.13.2",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, Mistral Vibe, and Devin CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",