mcp-for-i 0.1.13 → 0.2.0

package/dist/ibmi/knownHosts.js

@@ -0,0 +1,190 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { getConfigDir } from "../config/store.js";
+import { writeFileAtomic } from "../util/atomicWrite.js";
+/**
+ * Trust-on-first-use SSH host key store (also holds pinned TLS certificates
+ * for the Mapepire SQL server, see checkCertificate).
+ *
+ * Fingerprints are kept as OpenSSH-style SHA256 strings ("SHA256:<base64>")
+ * per "host:port" in known_hosts.json in the mcp-for-i config directory.
+ */
+export const ACCEPT_NEW_HOSTKEY_ENV = "MCP_FOR_I_ACCEPT_NEW_HOSTKEY";
+export class HostKeyMismatchError extends Error {
+    hostKey;
+    expected;
+    presented;
+    filePath;
+    constructor(hostKey, expected, presented, filePath) {
+        super(`SSH host key for ${hostKey} has changed. Stored ${expected}, server presented ${presented}. ` +
+            `This can mean a man-in-the-middle attack, so the connection was refused. ` +
+            `If the change is expected (for example the system was rebuilt or its SSH keys were regenerated), ` +
+            `set ${ACCEPT_NEW_HOSTKEY_ENV}=${hostKey} (or =${presented}) and connect again, ` +
+            `or remove the "${hostKey}" entry from ${filePath}.`);
+        this.hostKey = hostKey;
+        this.expected = expected;
+        this.presented = presented;
+        this.filePath = filePath;
+        this.name = "HostKeyMismatchError";
+    }
+}
+export function getKnownHostsPath() {
+    return path.join(getConfigDir(), "known_hosts.json");
+}
+export function hostKeyFingerprint(key) {
+    return `SHA256:${crypto.createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
+}
+/** Reads the key type ("ssh-ed25519", "rsa-sha2-...", ...) from an SSH public key blob. */
+export function hostKeyType(key) {
+    if (key.length < 4)
+        return undefined;
+    const len = key.readUInt32BE(0);
+    if (len <= 0 || len > 64 || 4 + len > key.length)
+        return undefined;
+    const type = key.subarray(4, 4 + len).toString("ascii");
+    return /^[\x21-\x7e]+$/.test(type) ? type : undefined;
+}
+export function knownHostId(host, port) {
+    const h = String(host).trim().toLowerCase();
+    return h.includes(":") && !h.startsWith("[") ? `[${h}]:${port}` : `${h}:${port}`;
+}
+/**
+ * True when the accept setting allows replacing the stored key for this host.
+ * Accepted forms (comma separated): "1"/"true"/"yes"/"all" for any host,
+ * "host", "host:port" or the new "SHA256:..." fingerprint.
+ */
+export function isNewHostKeyAccepted(acceptNew, host, port, fingerprint) {
+    if (!acceptNew)
+        return false;
+    const id = knownHostId(host, port);
+    const bareHost = String(host).trim().toLowerCase();
+    return acceptNew.split(",").map(v => v.trim()).filter(Boolean).some(value => {
+        const lower = value.toLowerCase();
+        if (["1", "true", "yes", "all"].includes(lower))
+            return true;
+        if (value.startsWith("SHA256:"))
+            return value === fingerprint;
+        return lower === id || lower === bareHost;
+    });
+}
+export async function readKnownHosts(filePath) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, "utf8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return { version: 1, hosts: {} };
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // Never silently forget trusted keys: a damaged file must be fixed by hand.
+        throw new Error(`Known hosts file ${filePath} is not valid JSON. Fix or remove it before connecting.`);
+    }
+    const hosts = parsed && typeof parsed.hosts === "object" && parsed.hosts ? parsed.hosts : {};
+    const certificates = parsed && typeof parsed.certificates === "object" && parsed.certificates ? parsed.certificates : undefined;
+    return certificates ? { version: 1, hosts, certificates } : { version: 1, hosts };
+}
+export async function writeKnownHosts(filePath, data) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    // Retries the rename on Windows sharing errors (antivirus, indexer).
+    await writeFileAtomic(filePath, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+}
+let queue = Promise.resolve();
+function serialized(run) {
+    const result = queue.then(run, run);
+    queue = result.catch(() => undefined);
+    return result;
+}
+/**
+ * Checks a presented host key against the store. Adds it on first use,
+ * replaces it only when explicitly accepted, and otherwise throws
+ * HostKeyMismatchError.
+ */
+export function checkHostKey(options) {
+    const run = async () => {
+        const filePath = options.filePath || getKnownHostsPath();
+        const acceptNew = options.acceptNew ?? process.env[ACCEPT_NEW_HOSTKEY_ENV];
+        const id = knownHostId(options.host, options.port);
+        const fingerprint = hostKeyFingerprint(options.key);
+        const keyType = hostKeyType(options.key);
+        const data = await readKnownHosts(filePath);
+        const existing = data.hosts[id];
+        const now = new Date().toISOString();
+        if (existing && existing.fingerprint === fingerprint) {
+            return { status: "trusted", fingerprint };
+        }
+        if (existing && !isNewHostKeyAccepted(acceptNew, options.host, options.port, fingerprint)) {
+            throw new HostKeyMismatchError(id, existing.fingerprint, fingerprint, filePath);
+        }
+        data.hosts[id] = {
+            fingerprint,
+            ...(keyType ? { keyType } : {}),
+            addedAt: existing ? existing.addedAt : now,
+            updatedAt: now
+        };
+        await writeKnownHosts(filePath, data);
+        return { status: existing ? "replaced" : "added", fingerprint };
+    };
+    return serialized(run);
+}
+export class CertificateMismatchError extends Error {
+    hostKey;
+    expected;
+    presented;
+    filePath;
+    constructor(hostKey, expected, presented, filePath) {
+        super(`TLS certificate for ${hostKey} has changed. Stored ${expected}, server presented ${presented}. ` +
+            `This can mean a man-in-the-middle attack, so the connection was refused. ` +
+            `If the change is expected (for example the server certificate was renewed), ` +
+            `set ${ACCEPT_NEW_HOSTKEY_ENV}=${hostKey} (or =${presented}) and connect again, ` +
+            `or remove the "${hostKey}" entry under "certificates" in ${filePath}.`);
+        this.hostKey = hostKey;
+        this.expected = expected;
+        this.presented = presented;
+        this.filePath = filePath;
+        this.name = "CertificateMismatchError";
+    }
+}
+/** SHA-256 fingerprint of a DER certificate, in the same "SHA256:<base64>" form as host keys. */
+export function certificateFingerprint(der) {
+    return hostKeyFingerprint(der);
+}
+/**
+ * Trust-on-first-use check for a TLS certificate, stored next to the SSH host
+ * keys. Same rules as checkHostKey: added on first use, replaced only when
+ * explicitly accepted, otherwise CertificateMismatchError.
+ */
+export function checkCertificate(options) {
+    const run = async () => {
+        const filePath = options.filePath || getKnownHostsPath();
+        const acceptNew = options.acceptNew ?? process.env[ACCEPT_NEW_HOSTKEY_ENV];
+        const id = knownHostId(options.host, options.port);
+        const fingerprint = certificateFingerprint(options.der);
+        const data = await readKnownHosts(filePath);
+        const certificates = data.certificates || {};
+        const existing = certificates[id];
+        const now = new Date().toISOString();
+        if (existing && existing.fingerprint === fingerprint) {
+            return { status: "trusted", fingerprint };
+        }
+        if (existing && !isNewHostKeyAccepted(acceptNew, options.host, options.port, fingerprint)) {
+            throw new CertificateMismatchError(id, existing.fingerprint, fingerprint, filePath);
+        }
+        certificates[id] = {
+            fingerprint,
+            ...(options.subject ? { subject: options.subject } : {}),
+            addedAt: existing ? existing.addedAt : now,
+            updatedAt: now
+        };
+        data.certificates = certificates;
+        await writeKnownHosts(filePath, data);
+        return { status: existing ? "replaced" : "added", fingerprint };
+    };
+    return serialized(run);
+}

package/dist/ibmi/libraryList.js

@@ -0,0 +1,93 @@
+import { Tools } from "./Tools.js";
+const LIBRARY_NAME = /^[A-Z#@$][A-Z0-9#@$._]{0,9}$/;
+export function isLibraryName(name) {
+    return LIBRARY_NAME.test(name);
+}
+export function desiredLibraryList(config) {
+    const names = (Array.isArray(config.libraryList) ? config.libraryList : [])
+        .map(lib => String(lib ?? "").trim().toUpperCase())
+        .filter(Boolean);
+    const current = String(config.currentLibrary ?? "").trim().toUpperCase();
+    const invalid = [...names, ...(current ? [current] : [])].filter(lib => !isLibraryName(lib)).filter(Tools.distinct);
+    const libraries = names.filter(isLibraryName).filter(Tools.distinct);
+    const currentLibrary = current && isLibraryName(current) ? current : undefined;
+    return {
+        libraries,
+        currentLibrary,
+        invalid,
+        signature: JSON.stringify([libraries, currentLibrary ?? null])
+    };
+}
+/**
+ * The CL command that puts a library list in effect. With no user libraries
+ * only the current library is changed, so an empty setting does not wipe the
+ * job's library list.
+ */
+export function libraryListCommand(libraries, currentLibrary) {
+    if (libraries.length > 0)
+        return `CHGLIBL LIBL(${libraries.join(" ")})${currentLibrary ? ` CURLIB(${currentLibrary})` : ""}`;
+    if (currentLibrary)
+        return `CHGCURLIB CURLIB(${currentLibrary})`;
+    return undefined;
+}
+/** All library names a desired list refers to. */
+export function referencedLibraries(desired) {
+    return [...desired.libraries, ...(desired.currentLibrary ? [desired.currentLibrary] : [])].filter(Tools.distinct);
+}
+/** SQL that returns OBJNAME for each of `names` that exists as a library. */
+export function existingLibrariesSql(names, allSimple = true) {
+    const inList = names.map(lib => `'${lib.replace(/'/g, "''")}'`).join(", ");
+    const filter = allSimple ? ", '*ALLSIMPLE'" : "";
+    return `select OBJNAME from table(QSYS2.OBJECT_STATISTICS('QSYS', '*LIB'${filter})) X where OBJNAME in (${inList})`;
+}
+/**
+ * Drops libraries that do not exist (CHGLIBL fails entirely when one is
+ * missing) and describes what was left out.
+ */
+export function resolveAgainstExisting(desired, existing) {
+    const libraries = desired.libraries.filter(lib => existing.has(lib));
+    const currentLibrary = desired.currentLibrary && existing.has(desired.currentLibrary) ? desired.currentLibrary : undefined;
+    const missing = referencedLibraries(desired).filter(lib => !existing.has(lib));
+    const notes = [];
+    if (missing.length > 0)
+        notes.push(`not found, left out of the library list: ${missing.join(", ")}`);
+    if (desired.invalid.length > 0)
+        notes.push(`invalid library name(s) ignored: ${desired.invalid.join(", ")}`);
+    return {
+        command: libraryListCommand(libraries, currentLibrary),
+        libraries,
+        currentLibrary,
+        ...(notes.length ? { warning: `Configured library list: ${notes.join("; ")}` } : {})
+    };
+}
+/** Warning for names in the setting that are not valid library names. */
+export function invalidNamesWarning(desired) {
+    return desired.invalid.length > 0
+        ? `Configured library list: invalid library name(s) ignored: ${desired.invalid.join(", ")}`
+        : undefined;
+}
+/** Rows from existingLibrariesSql to a set of names. */
+export function libraryNamesFromRows(rows) {
+    return new Set(rows.map(row => String(row.OBJNAME ?? "").trim().toUpperCase()).filter(Boolean));
+}
+/**
+ * qsh prefix that puts a library list in effect for the `system` commands that
+ * follow. Each `system` runs in its own job, which inherits the qsh job's
+ * library list as changed by the liblist builtin. Errors (a missing library)
+ * are discarded so they do not mix with the command's output.
+ */
+export function qshLibraryListPrefix(resolved, initialUserLibraries) {
+    const quote = (lib) => Tools.shellQuote(lib);
+    const parts = [];
+    if (resolved.libraries.length > 0) {
+        for (const lib of initialUserLibraries.filter(l => l && l !== "QSYS" && l !== "QTEMP")) {
+            parts.push(`liblist -d ${quote(lib)}`);
+        }
+        // liblist -a adds to the front, so add in reverse order.
+        for (const lib of [...resolved.libraries].reverse())
+            parts.push(`liblist -a ${quote(lib)}`);
+    }
+    if (resolved.currentLibrary)
+        parts.push(`liblist -c ${quote(resolved.currentLibrary)}`);
+    return parts.map(part => `${part} >/dev/null 2>&1`).join("; ");
+}