mcp-for-i 0.1.13 → 0.2.0

package/dist/mcp/confirm.js

@@ -0,0 +1,48 @@
+import { ElicitResultSchema } from "@modelcontextprotocol/sdk/types.js";
+/** How long a confirmation prompt waits for the person before the operation is refused. */
+export const CONFIRMATION_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * Ask the person through the MCP client (elicitation) before a guarded
+ * operation runs. Clients that don't support elicitation get "unsupported",
+ * which refuses the operation.
+ */
+export function createElicitationConfirm(server, timeoutMs = CONFIRMATION_TIMEOUT_MS) {
+    return async (request) => {
+        if (!server.getClientCapabilities()?.elicitation)
+            return "unsupported";
+        const result = await server.request({
+            method: "elicitation/create",
+            params: {
+                mode: "form",
+                message: confirmationMessage(request),
+                requestedSchema: request.allowSession
+                    ? {
+                        type: "object",
+                        properties: {
+                            allowForSession: {
+                                type: "boolean",
+                                title: "Allow this kind of change on this connection until the server restarts",
+                                default: false
+                            }
+                        }
+                    }
+                    : { type: "object", properties: {} }
+            }
+        }, ElicitResultSchema, { timeout: timeoutMs });
+        return {
+            allowed: result.action === "accept",
+            forSession: result.action === "accept" && result.content?.allowForSession === true
+        };
+    };
+}
+export function confirmationMessage(request) {
+    const what = request.operation === "shell.run"
+        ? "run a shell command"
+        : `perform a guarded operation (${request.operation})`;
+    const lines = [`The agent wants to ${what} on IBM i connection "${request.connectionName || "(active)"}".`];
+    if (request.toolName)
+        lines.push(`Tool: ${request.toolName}`);
+    lines.push(...request.details);
+    lines.push("", "Accept to let it run. Decline to stop it.");
+    return lines.join("\n");
+}

package/dist/mcp/context.js

@@ -11,6 +11,13 @@ const DEFAULT_RECONNECT_ATTEMPTS = 2;
 export class McpContext {
     store = new ConfigStore();
     activeName;
+    /**
+     * Asks the person to confirm a guarded operation. Set by the server from
+     * the MCP client's elicitation support; unset means nobody can be asked.
+     */
+    confirm;
+    /** Operations the person allowed for the rest of this session, keyed by connection and operation. */
+    sessionApprovals = new Set();
     sessions = new Map();
     cursors = new Map();
     connectLocks = new Map();
@@ -61,8 +68,9 @@ export class McpContext {
     }
     async ensureActive(name) {
         const sessionName = name || this.activeName;
-        if (!sessionName)
-            throw new Error("Not connected");
+        if (!sessionName) {
+            throw new Error("No active connection. Call ibmi.connect or pass connectionName.");
+        }
         if (!this.sessions.has(sessionName)) {
             await this.connectByName(sessionName);
         }
@@ -70,6 +78,25 @@ export class McpContext {
         this.touchSession(sessionName);
         return this.sessions.get(sessionName).client;
     }
+    /**
+     * Policy for a connection, read from the stored connection when no session
+     * is open yet, so checks that run before connecting still see it.
+     */
+    async resolvePolicy(name) {
+        const sessionName = name || this.activeName;
+        if (!sessionName)
+            return defaultPolicy();
+        const session = this.sessions.get(sessionName);
+        if (session)
+            return session.policy;
+        try {
+            const stored = await this.store.getConnection(sessionName);
+            return normalizePolicy(stored?.policy);
+        }
+        catch {
+            return defaultPolicy();
+        }
+    }
     getPolicy(name) {
         const sessionName = name || this.activeName;
         if (!sessionName)
@@ -108,7 +135,9 @@ export class McpContext {
             lastValidatedAt: session.lastValidatedAt ? new Date(session.lastValidatedAt).toISOString() : undefined,
             expiresAt: new Date(session.expiresAt).toISOString(),
             idleSecondsRemaining: Math.max(0, Math.floor((session.expiresAt - now) / 1000)),
-            lastError: session.lastError
+            lastError: session.lastError,
+            // Persistent SQL job (Mapepire): open, fallen back to QZDFMDB2, or not started yet.
+            sqlJob: session.client.sqlJob?.status?.()
         };
     }
     async keepaliveSession(name) {
@@ -125,6 +154,10 @@ export class McpContext {
             throw new Error("connectionName is required (no active session)");
         await this.disconnect(target);
     }
+    /**
+     * Closes the session, including its persistent SQL job (IBMiClient.disconnect
+     * ends the Mapepire job before closing SSH).
+     */
     async disconnect(name) {
         if (name) {
             const session = this.sessions.get(name);
@@ -142,7 +175,9 @@ export class McpContext {
             }
             this.sessions.delete(name);
             if (this.activeName === name) {
-                this.activeName = this.sessions.keys().next().value;
+                // Never fall back to another open session: later calls without
+                // connectionName must not silently target a different system.
+                this.activeName = undefined;
             }
             await this.persistSessionState(true);
             return;
@@ -188,7 +223,10 @@ export class McpContext {
         const stored = await this.store.getConnection(name);
         if (!stored)
             throw new Error(`Unknown connection: ${name}`);
-        const password = await getPassword(name);
+        // Key-based connections must still work when the keychain is unavailable.
+        const password = stored.privateKeyPath
+            ? await getPassword(name).catch(() => undefined)
+            : await getPassword(name);
         const connection = {
             name: stored.name,
             host: stored.host,

package/dist/mcp/deployMethods.js

@@ -0,0 +1,192 @@
+import crypto from "crypto";
+import { createReadStream } from "fs";
+import fs from "fs/promises";
+import path from "path";
+import { execFile } from "child_process";
+import { Tools } from "../ibmi/Tools.js";
+export const DEPLOY_METHODS = ["all", "changed", "gitChanged", "selection"];
+export function normalizeDeployMethod(value) {
+    if (value === undefined || value === null || value === "")
+        return "all";
+    const method = String(value);
+    if (!DEPLOY_METHODS.includes(method)) {
+        throw new Error(`Invalid method: ${method}. Expected one of ${DEPLOY_METHODS.join(", ")}`);
+    }
+    return method;
+}
+export async function sha256LocalFile(filePath) {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash("sha256");
+        const stream = createReadStream(filePath);
+        stream.on("error", reject);
+        stream.on("data", chunk => hash.update(chunk));
+        stream.on("end", () => resolve(hash.digest("hex")));
+    });
+}
+// Upper bound on the size of one remote hashing command (bytes of quoted
+// paths) and on the number of files hashed per call.
+const REMOTE_HASH_BATCH_BYTES = 24_000;
+const REMOTE_HASH_BATCH_FILES = 200;
+const NO_HASH_TOOL_MARKER = "MCPFORI_NO_SHA256_TOOL";
+/**
+ * Picks sha256sum (PATH or /QOpenSys/pkgs/bin) or openssl, then hashes the
+ * given files. Kept as one shell snippet so detection costs no extra call.
+ */
+function remoteHashCommand(remoteRoot, relPaths) {
+    const quoted = relPaths.map(rel => Tools.shellQuote(`./${rel}`)).join(" ");
+    return [
+        `cd ${Tools.shellQuote(remoteRoot)} || exit 2`,
+        `if command -v sha256sum >/dev/null 2>&1; then H="sha256sum"`,
+        `elif [ -x /QOpenSys/pkgs/bin/sha256sum ]; then H="/QOpenSys/pkgs/bin/sha256sum"`,
+        `elif command -v openssl >/dev/null 2>&1; then H="openssl dgst -sha256 -r"`,
+        `elif [ -x /QOpenSys/usr/bin/openssl ]; then H="/QOpenSys/usr/bin/openssl dgst -sha256 -r"`,
+        `else echo ${NO_HASH_TOOL_MARKER} >&2; exit 127; fi`,
+        `$H ${quoted}`
+    ].join("; ");
+}
+/** Parses sha256sum / `openssl dgst -r` / `openssl dgst` output into rel path -> hex. */
+export function parseRemoteHashOutput(output) {
+    const hashes = new Map();
+    for (const rawLine of String(output || "").split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (!line)
+            continue;
+        let hex;
+        let file;
+        const coreutils = line.match(/^\\?([0-9a-fA-F]{64}) [ *](.+)$/);
+        if (coreutils) {
+            hex = coreutils[1];
+            file = coreutils[2];
+        }
+        else {
+            const bsd = line.match(/^SHA2?-?256\((.+)\)\s*=\s*([0-9a-fA-F]{64})$/);
+            if (bsd) {
+                file = bsd[1];
+                hex = bsd[2];
+            }
+        }
+        if (!hex || !file)
+            continue;
+        hashes.set(file.replace(/^\.\//, ""), hex.toLowerCase());
+    }
+    return hashes;
+}
+/**
+ * Hashes remote files (paths relative to remoteRoot) in batches. Files that
+ * could not be hashed are simply absent from the result. Throws when the
+ * remote system has neither sha256sum nor openssl.
+ */
+export async function sha256RemoteFiles(conn, remoteRoot, relPaths) {
+    const result = new Map();
+    const root = remoteRoot.replace(/\/+$/, "") || "/";
+    const usable = relPaths.filter(rel => !/[\r\n]/.test(rel));
+    let batch = [];
+    let batchBytes = 0;
+    const flush = async () => {
+        if (batch.length === 0)
+            return;
+        const res = await conn.sendCommand({ command: remoteHashCommand(root, batch) });
+        if (String(res?.stderr || "").includes(NO_HASH_TOOL_MARKER)) {
+            throw new Error("No SHA-256 tool (sha256sum or openssl) found on the IBM i; use method \"all\" instead");
+        }
+        if (res?.code === 2 && !String(res?.stdout || "").trim()) {
+            throw new Error(`Remote directory ${root} is not accessible: ${String(res?.stderr || "").trim()}`);
+        }
+        // A non-zero exit with partial output means some files could not be
+        // read; those stay unhashed and are treated as changed by the caller.
+        for (const [file, hex] of parseRemoteHashOutput(res?.stdout || ""))
+            result.set(file, hex);
+        batch = [];
+        batchBytes = 0;
+    };
+    for (const rel of usable) {
+        const size = rel.length + 6;
+        if (batch.length > 0 && (batch.length >= REMOTE_HASH_BATCH_FILES || batchBytes + size > REMOTE_HASH_BATCH_BYTES)) {
+            await flush();
+        }
+        batch.push(rel);
+        batchBytes += size;
+    }
+    await flush();
+    return result;
+}
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", ["-C", cwd, ...args], { maxBuffer: 64 * 1024 * 1024, windowsHide: true, shell: false }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = String(stderr || error.message || "").trim();
+                reject(new Error(`git ${args[0]} failed: ${detail}`));
+                return;
+            }
+            resolve(String(stdout));
+        });
+    });
+}
+/** Parses `git status --porcelain -z` output (paths relative to the repo root). */
+export function parseGitPorcelainZ(output) {
+    const entries = [];
+    const tokens = String(output || "").split("\0");
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.length < 4)
+            continue;
+        const status = token.substring(0, 2);
+        const file = token.substring(3);
+        entries.push({ status, path: file });
+        // Renames and copies are followed by the original path.
+        if (status[0] === "R" || status[0] === "C")
+            i++;
+    }
+    return entries;
+}
+/**
+ * Files changed in the git working tree under localRoot (staged, unstaged
+ * and untracked), as paths relative to localRoot with forward slashes.
+ */
+export async function gitChangedFiles(localRoot) {
+    const prefix = (await runGit(localRoot, ["rev-parse", "--show-prefix"])).trim().replace(/\\/g, "/");
+    const output = await runGit(localRoot, ["status", "--porcelain", "-z", "--untracked-files=all", "--", "."]);
+    const files = new Set();
+    const deleted = new Set();
+    for (const entry of parseGitPorcelainZ(output)) {
+        const repoPath = entry.path.replace(/\\/g, "/");
+        if (prefix && !repoPath.startsWith(prefix))
+            continue;
+        const rel = repoPath.substring(prefix.length);
+        if (!rel || rel.endsWith("/"))
+            continue;
+        const full = path.join(localRoot, rel);
+        const stat = await fs.stat(full).catch(() => undefined);
+        if (stat?.isFile())
+            files.add(rel);
+        else if (!stat)
+            deleted.add(rel);
+    }
+    return {
+        files: Array.from(files).sort((a, b) => a.localeCompare(b)),
+        deleted: Array.from(deleted).sort((a, b) => a.localeCompare(b))
+    };
+}
+/**
+ * Normalizes an explicit file selection: relative paths only, no `..`, with
+ * forward slashes and duplicates removed.
+ */
+export function normalizeDeploySelection(value) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new Error("files must be a non-empty array of paths relative to localPath for method \"selection\"");
+    }
+    const out = new Set();
+    for (const item of value) {
+        const raw = String(item ?? "").trim().replace(/\\/g, "/").replace(/^\.\//, "");
+        if (!raw)
+            throw new Error("files contains an empty path");
+        if (raw.includes("\0") || /[\r\n]/.test(raw))
+            throw new Error(`Invalid file path: ${item}`);
+        if (raw.startsWith("/") || /^[A-Za-z]:/.test(raw))
+            throw new Error(`files must be relative to localPath: ${item}`);
+        if (raw.split("/").some(segment => segment === ".."))
+            throw new Error(`files must not contain '..': ${item}`);
+        out.add(raw.replace(/\/+/g, "/"));
+    }
+    return Array.from(out).sort((a, b) => a.localeCompare(b));
+}

package/dist/mcp/logger.js

@@ -1,4 +1,5 @@
 import fs from "fs";
+import { REDACTED, isSecretKey, redactSecretsInText } from "../security/redact.js";
 const levelOrder = {
     error: 0,
     warn: 1,
@@ -35,25 +36,19 @@ function safeWrite(line) {
     }
 }
 export function redact(value) {
-    const secretKeys = ["password", "pass", "token", "secret", "key", "privatekey"];
     if (Array.isArray(value)) {
         return value.map(redact);
     }
     if (value && typeof value === "object") {
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            const lower = k.toLowerCase();
-            if (secretKeys.some(s => lower.includes(s))) {
-                out[k] = "***";
-            }
-            else {
-                out[k] = redact(v);
-            }
+            out[k] = isSecretKey(k) ? REDACTED : redact(v);
         }
         return out;
     }
-    if (typeof value === "string" && value.length > 500) {
-        return value.substring(0, 500) + "...(truncated)";
+    if (typeof value === "string") {
+        const clean = redactSecretsInText(value);
+        return clean.length > 500 ? clean.substring(0, 500) + "...(truncated)" : clean;
     }
     return value;
 }