mixdog 1.2.0 → 1.2.2

package/src/runtime/agent/orchestrator/mcp/lazy-output-validator.mjs

@@ -0,0 +1,25 @@
+// The MCP SDK Client compiles every tool's outputSchema with Ajv inside
+// listTools(), synchronously: a server listing ~180 tools held the daemon's
+// event loop for 1-2 s on every connect. This validator compiles each schema
+// on the tool's first structured result instead, and creates the SDK's Ajv
+// validator (same options and error text) on first use too.
+// A schema declaring an `$id` anywhere registers it in the client's Ajv, and a
+// schema referencing anything outside itself resolves against what is
+// registered by then (failing the listing when it is not); both still compile
+// when listed, in listing order, exactly as the SDK does.
+const LISTING_ORDER_SCHEMA = /"\$id"|"\$ref":"(?!#)/;
+
+export function createLazyOutputValidator(AjvJsonSchemaValidator) {
+  let provider = null;
+  const shared = () => (provider ??= new AjvJsonSchemaValidator());
+  return {
+    getValidator(schema) {
+      if (LISTING_ORDER_SCHEMA.test(JSON.stringify(schema))) return shared().getValidator(schema);
+      let validate = null;
+      return (input) => {
+        validate ??= shared().getValidator(schema);
+        return validate(input);
+      };
+    },
+  };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-callback.mjs

@@ -0,0 +1,103 @@
+import { timingSafeEqual } from 'node:crypto';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from '../providers/lib/oauth-page.mjs';
+
+/** Upper bound of a pasted redirect URL (`completeMcpLogin`). */
+export const MCP_OAUTH_CALLBACK_MAX_BYTES = 64 * 1024;
+// Fixed messages: a pasted URL carries the authorization code and is never
+// echoed into an error, a log or a status.
+const INVALID_CALLBACK_PASTE =
+  'The pasted sign-in URL is invalid. Paste the full address the browser was redirected to after signing in.';
+export const MCP_OAUTH_CALLBACK_NOT_PENDING = 'MCP OAuth sign-in is not waiting for a callback';
+const sameState = (supplied, expected) => {
+  const a = Buffer.from(supplied || '');
+  const b = Buffer.from(expected || '');
+  return b.length > 0 && a.length === b.length && timingSafeEqual(a, b);
+};
+
+/**
+ * The outcome of a redirect URL pasted from the browser for a pending login
+ * whose redirect URI is `redirectUrl` and state `state`: `{ code }`, or
+ * `{ denied: true }` for an authorization error. Throws a fixed message (never
+ * the pasted text) for anything that is not exactly that login's callback.
+ */
+export function parsePastedMcpOAuthCallback(pasted, { redirectUrl, state }) {
+  const invalid = () => new Error(INVALID_CALLBACK_PASTE);
+  if (typeof pasted !== 'string' || Buffer.byteLength(pasted) > MCP_OAUTH_CALLBACK_MAX_BYTES) throw invalid();
+  const raw = pasted.trim();
+  let target;
+  let expected;
+  try {
+    target = new URL(raw);
+    expected = new URL(redirectUrl);
+  } catch {
+    throw invalid();
+  }
+  if (
+    raw.includes('#') ||
+    target.username ||
+    target.password ||
+    target.origin !== expected.origin ||
+    target.pathname !== expected.pathname
+  )
+    throw invalid();
+  const seen = new Set();
+  for (const [key, value] of target.searchParams) {
+    if (seen.has(key)) throw invalid();
+    seen.add(key);
+    // The redirect URI's own parameters come back unchanged; any others an
+    // authorization server adds (e.g. Google's scope/authuser/prompt) are
+    // ignored, as in Codex's parse_callback_url.
+    if (expected.searchParams.has(key) && expected.searchParams.get(key) !== value) throw invalid();
+  }
+  for (const key of expected.searchParams.keys()) if (!seen.has(key)) throw invalid();
+  if (!sameState(target.searchParams.get('state'), state)) throw invalid();
+  if (seen.has('code') === seen.has('error')) throw invalid();
+  if (seen.has('error')) return { denied: true };
+  const code = target.searchParams.get('code');
+  if (!code) throw invalid();
+  return { code };
+}
+
+// Answers a request to the loopback redirect URI: only a GET of the exact
+// callback path and host, carrying exactly the pending state (compared in
+// constant time) and either one code or an error, finishes the login.
+export function answerOAuthCallback(req, res, { redirectUrl, state, finish, serverName }) {
+  const page = (status, html) => {
+    res.writeHead(status, {
+      'Content-Type': OAUTH_PAGE_CONTENT_TYPE,
+      'Cache-Control': 'no-store',
+      'Referrer-Policy': 'no-referrer',
+    });
+    res.end(html);
+  };
+  const invalid = () =>
+    page(400, oauthErrorHtml('This sign-in link is invalid or has expired.', 'Start the sign-in again from Mixdog.'));
+  let target;
+  try {
+    target = new URL(req.url || '/', redirectUrl);
+  } catch {
+    invalid();
+    return;
+  }
+  // `finish` is absent once the login was answered (e.g. by a pasted URL).
+  const valid =
+    typeof finish === 'function' &&
+    req.method === 'GET' &&
+    req.headers.host === new URL(redirectUrl).host &&
+    target.pathname === '/oauth/callback' &&
+    target.searchParams.getAll('state').length === 1 &&
+    sameState(target.searchParams.get('state'), state);
+  if (!valid || (!target.searchParams.has('error') && target.searchParams.getAll('code').length !== 1)) {
+    invalid();
+    return;
+  }
+  const server = serverName || 'the MCP server';
+  if (target.searchParams.has('error')) {
+    // The authorization server's error text is never reflected.
+    page(400, oauthErrorHtml(`Sign-in to ${server} was not completed.`, 'Start the sign-in again from Mixdog.'));
+    finish(undefined);
+    return;
+  }
+  page(200, oauthSuccessHtml(server));
+  finish(target.searchParams.get('code'));
+}

package/src/runtime/agent/orchestrator/mcp/oauth-credentials.mjs

@@ -0,0 +1,150 @@
+import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { withFileLock, writeFileAtomicAsync } from '../../../shared/atomic-file.mjs';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { reauthenticationRequired } from './oauth-shared.mjs';
+
+// Same lease as the provider OAuth refresh (openai-oauth-tokens.mjs): a
+// refresh is a network exchange plus keychain persistence. The lock file
+// itself holds no credential (they live in the keychain).
+const CREDENTIAL_LOCK_OPTIONS = Object.freeze({ timeoutMs: 120_000, staleMs: 120_000 });
+
+export const credentialFile = (account, extension) => join(resolvePluginData(), 'mcp-oauth', `${account}.${extension}`);
+
+// Serializes refreshes, logins and log-outs of one account across processes.
+export function withCredentialLock(account, fn) {
+  return withFileLock(credentialFile(account, 'lock'), fn, CREDENTIAL_LOCK_OPTIONS);
+}
+
+// A non-secret marker of the stored entry's revision ('deleted' when there is
+// none) and whether the entry holds tokens (a client registration alone does
+// not sign in), written under the credential lock before every change of the
+// entry. Every process compares it before sending a cached token, so a refresh
+// or log-out elsewhere is observed without reading the keychain per request.
+export const TOKENS_FLAG = '+tokens';
+const markerOf = (revision, hasTokens) => {
+  if (revision === null) return 'deleted';
+  return hasTokens ? `${revision}${TOKENS_FLAG}` : revision;
+};
+export function writeRevisionMarker(account, revision, hasTokens = false) {
+  return writeFileAtomicAsync(credentialFile(account, 'rev'), markerOf(revision, hasTokens));
+}
+// Missing or unreadable (null) never matches: the caller re-reads the keychain.
+function readRevisionMarker(account) {
+  return readFile(credentialFile(account, 'rev'), 'utf8').catch(() => null);
+}
+
+// The stored value as another process may have just written it, not this
+// process's cached copy.
+export function readStoredCredentials(credentialStore, account) {
+  credentialStore.invalidateSecretCache?.(account);
+  return credentialStore.getSecretAsync(account);
+}
+
+// Every write stores a fresh random revision; null stands for no entry.
+const revisionOf = (saved) => (saved ? (JSON.parse(saved).revision ?? '') : null);
+
+/**
+ * One connection's view of its stored OAuth entry. `creds` holds the cached
+ * values: `observed` is the revision of the stored entry this process last
+ * read or wrote (null: there was none, undefined: unknown after a log-out
+ * here); `loaded` is the pending or completed first read.
+ */
+export function createCredentialCache({ url, credentialStore, account }) {
+  const creds = {
+    tokens: undefined,
+    clientInformation: undefined,
+    redirectUrl: undefined,
+    discovery: undefined,
+    observed: undefined,
+    loaded: undefined,
+  };
+  // Every token this connection held: an error or result echoing the token a
+  // request was sent with stays scrubbed after a refresh or log-out.
+  const held = new Set();
+  const hold = () => {
+    for (const token of [creds.tokens?.access_token, creds.tokens?.refresh_token]) if (token) held.add(token);
+  };
+  const adopt = (saved) => {
+    const value = saved ? JSON.parse(saved) : {};
+    if (saved && value.url !== url) throw reauthenticationRequired();
+    ({
+      tokens: creds.tokens,
+      clientInformation: creds.clientInformation,
+      redirectUrl: creds.redirectUrl,
+      discovery: creds.discovery,
+    } = value);
+    creds.observed = revisionOf(saved);
+    hold();
+  };
+  // A failed read (locked keychain) is retried by the next request.
+  const ready = () =>
+    (creds.loaded ??= credentialStore
+      .getSecretAsync(account)
+      .then(adopt)
+      .catch((error) => {
+        creds.loaded = undefined;
+        throw error;
+      }));
+  // The only writer of the stored entry. Under the cross-process lock it
+  // changes the entry only while it still has the revision the caller observed
+  // (by default the one this process last read or wrote); otherwise it adopts
+  // the newer entry, or its deletion by a log-out, and changes nothing.
+  function update(change, { expected = creds.observed, remove = false } = {}) {
+    return withCredentialLock(account, async () => {
+      const saved = await readStoredCredentials(credentialStore, account);
+      if (revisionOf(saved) !== expected) {
+        adopt(saved);
+        return false;
+      }
+      change();
+      hold();
+      if (remove) {
+        await writeRevisionMarker(account, null);
+        if (saved) await credentialStore.deleteSecretAsync(account);
+        creds.observed = null;
+      } else {
+        const revision = randomBytes(16).toString('hex');
+        await writeRevisionMarker(account, revision, Boolean(creds.tokens));
+        const { tokens, clientInformation, redirectUrl, discovery } = creds;
+        await credentialStore.setSecretAsync(
+          account,
+          JSON.stringify({ url, revision, tokens, clientInformation, redirectUrl, discovery })
+        );
+        creds.observed = revision;
+      }
+      return true;
+    });
+  }
+  // Before a cached token is sent: adopt a change another process made (a
+  // refresh, a log-out) since this process last read or wrote the entry.
+  async function observeStoredRevision() {
+    if ((await readRevisionMarker(account)) === markerOf(creds.observed, Boolean(creds.tokens))) return;
+    await withCredentialLock(account, async () => {
+      adopt(await readStoredCredentials(credentialStore, account));
+      // Repair a missing or stale marker (an entry stored before markers or
+      // the tokens flag existed, an interrupted change) so the next request
+      // reads no keychain.
+      if ((await readRevisionMarker(account)) !== markerOf(creds.observed, Boolean(creds.tokens))) {
+        await writeRevisionMarker(account, creds.observed, Boolean(creds.tokens));
+      }
+    });
+  }
+  // Forget the in-memory credentials; the next request re-reads the keychain.
+  function clear() {
+    creds.tokens = creds.clientInformation = creds.redirectUrl = creds.discovery = undefined;
+    creds.loaded = creds.observed = undefined;
+  }
+  return {
+    creds,
+    held,
+    ready,
+    adopt,
+    update,
+    observeStoredRevision,
+    clear,
+    readStored: () => readStoredCredentials(credentialStore, account),
+    withLock: (fn) => withCredentialLock(account, fn),
+  };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-login.mjs

@@ -0,0 +1,111 @@
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { normalizeMcpTransportUrl } from './client-config.mjs';
+import { answerOAuthCallback } from './oauth-callback.mjs';
+import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
+
+/**
+ * The browser login of one connection over its credential `cache` and login
+ * `flow` state: the loopback callback listener and the SDK authorization
+ * (refresh, registration, redirect and code exchange).
+ */
+export function createLoginFlow({ url, cache, flow, provider, lifetimeSignal, openBrowser, fetchImpl, timeoutMs }) {
+  const { creds } = cache;
+  function stopListening() {
+    flow.listener?.close();
+    flow.listener?.closeAllConnections();
+    flow.listener = undefined;
+  }
+  function closeListener() {
+    stopListening();
+    flow.verifier = undefined;
+    flow.state = undefined;
+  }
+  // The login's callback is answered once, by the loopback or a paste.
+  function answerCallback(code) {
+    const finish = flow.finishCallback;
+    flow.finishCallback = undefined;
+    finish?.(code);
+  }
+  async function listenForCallback(serverName) {
+    flow.listener = createServer((req, res) =>
+      answerOAuthCallback(req, res, {
+        redirectUrl: creds.redirectUrl,
+        state: flow.state,
+        finish: flow.finishCallback && answerCallback,
+        serverName,
+      })
+    );
+    await new Promise((resolve, reject) => {
+      flow.listener.once('error', reject);
+      // Retain the registered redirect URI if this connection later needs
+      // refresh or reauthorization; never register a different callback.
+      flow.listener.listen(creds.redirectUrl ? Number(new URL(creds.redirectUrl).port) : 0, '127.0.0.1', resolve);
+    });
+    creds.redirectUrl = `http://127.0.0.1:${flow.listener.address().port}/oauth/callback`;
+  }
+  async function login(challenge, requestSignal, interactive, browser, attemptedToken, serverName) {
+    flow.allowBrowser = interactive;
+    flow.browserOpened = false;
+    flow.launchBrowser = browser || openBrowser;
+    const signal = AbortSignal.any([lifetimeSignal, requestSignal, AbortSignal.timeout(timeoutMs)]);
+    const safeFetch = (input, init = {}) =>
+      fetchImpl(normalizeMcpTransportUrl(input), {
+        ...init,
+        redirect: 'error',
+        signal: anySignal(signal, init.signal),
+      });
+    let abort;
+    const callback = new Promise((resolve, reject) => {
+      const finish = (code) => (code ? resolve(code) : reject(loginFailed()));
+      flow.finishCallback = finish;
+      abort = () => finish();
+      signal.addEventListener('abort', abort, { once: true });
+    });
+    // A discovery/registration error can precede waiting for the callback.
+    callback.catch(() => {});
+    try {
+      signal.throwIfAborted();
+      const { auth } = await import('@modelcontextprotocol/sdk/client/auth.js');
+      const options = { serverUrl: url, ...challenge, fetchFn: safeFetch };
+      // Another process sharing this keychain entry may already have
+      // refreshed (and rotated) the tokens this request was rejected with:
+      // decide on the stored credentials, under the cross-process lock.
+      const result = await cache.withLock(async () => {
+        cache.adopt(await cache.readStored());
+        if (creds.tokens && creds.tokens.access_token !== attemptedToken?.access_token) return 'AUTHORIZED';
+        if (!interactive && (!creds.tokens?.refresh_token || !creds.clientInformation || !creds.redirectUrl)) {
+          throw reauthenticationRequired();
+        }
+        flow.state = randomBytes(32).toString('base64url');
+        if (interactive) await listenForCallback(serverName);
+        signal.throwIfAborted();
+        return auth(provider, options);
+      });
+      if (result === 'REDIRECT') {
+        const code = await callback;
+        signal.throwIfAborted();
+        const exchanged = await cache.withLock(async () => {
+          // The entry this login registered in is gone only after a log-out
+          // since it began, which wins: never recreate it.
+          const saved = await cache.readStored();
+          if (!saved) throw loginFailed();
+          cache.adopt(saved);
+          return auth(provider, { ...options, authorizationCode: code });
+        });
+        if (exchanged !== 'AUTHORIZED') throw loginFailed();
+      }
+      signal.throwIfAborted();
+    } catch (error) {
+      // SDK errors may contain authorization server response bodies/secrets.
+      if (error?.code === 'reauthenticationRequired' || !interactive) throw reauthenticationRequired();
+      throw loginFailed();
+    } finally {
+      flow.allowBrowser = false;
+      signal.removeEventListener('abort', abort);
+      closeListener();
+      flow.finishCallback = undefined;
+    }
+  }
+  return { login, stopListening, closeListener, answerCallback };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-probe.mjs

@@ -0,0 +1,87 @@
+/**
+ * mcp/oauth-probe.mjs — what authentication an HTTP/SSE server (being added or
+ * edited) needs, decided without credentials and without a browser: one
+ * anonymous request, then OAuth discovery (RFC 9728 protected-resource
+ * metadata, RFC 8414 / OIDC authorization-server metadata) on a 401.
+ */
+import {
+  normalizeMcpTransportUrl,
+  resolveMcpOAuthUrl,
+  resolveMcpTransportKind,
+  scrubMcpConnectionMessage,
+} from './client-config.mjs';
+import { hasConfiguredMcpAuth } from './client-transport.mjs';
+
+export const MCP_AUTH_PROBE_TIMEOUT_MS = 10_000;
+
+const INITIALIZE_PROBE = JSON.stringify({
+  jsonrpc: '2.0',
+  id: 0,
+  method: 'initialize',
+  params: {
+    protocolVersion: '2025-03-26',
+    capabilities: {},
+    clientInfo: { name: 'mixdog-auth-probe', version: '1' },
+  },
+});
+
+/**
+ * `cfg = { type: 'http' | 'sse', url, headers?, bearer_token_env_var?, env_http_headers? }`
+ * → `{ auth: 'oauth' | 'none' | 'configured' | 'unreachable', error? }`.
+ * Configured authentication is authoritative and never sent anywhere.
+ */
+export async function probeMcpServerAuth(cfg, { fetchImpl = fetch, timeoutMs = MCP_AUTH_PROBE_TIMEOUT_MS } = {}) {
+  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) throw new TypeError('MCP server config is required');
+  const kind = resolveMcpTransportKind(cfg);
+  if (kind !== 'http' && kind !== 'sse') throw new Error('MCP auth probe needs an http or sse server');
+  const url = resolveMcpOAuthUrl(cfg);
+  if (hasConfiguredMcpAuth(cfg)) return { auth: 'configured' };
+  const deadline = AbortSignal.timeout(timeoutMs);
+  // Same policy as the OAuth login's own requests: normalized URLs, no
+  // redirects, and nothing outlives the probe's budget.
+  const probeFetch = (input, init = {}) =>
+    fetchImpl(normalizeMcpTransportUrl(String(input)), {
+      ...init,
+      redirect: 'error',
+      signal: init.signal ? AbortSignal.any([deadline, init.signal]) : deadline,
+    });
+  const failure = (error) => ({
+    auth: 'unreachable',
+    error: scrubMcpConnectionMessage(
+      deadline.aborted ? `no answer within ${timeoutMs}ms` : String(error?.cause?.message || error?.message || error),
+      cfg
+    ),
+  });
+  let response;
+  try {
+    response =
+      kind === 'http'
+        ? await probeFetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' },
+            body: INITIALIZE_PROBE,
+          })
+        : await probeFetch(url, { headers: { Accept: 'text/event-stream' } });
+  } catch (error) {
+    return failure(error);
+  }
+  // The body is discarded; a failed cancel changes nothing.
+  await response.body?.cancel().catch(() => {});
+  if (response.status === 404 || response.status >= 500)
+    return { auth: 'unreachable', error: `HTTP ${response.status}` };
+  if (response.status !== 401) return { auth: 'none' };
+  try {
+    const { discoverOAuthServerInfo, extractWWWAuthenticateParams } = await import(
+      '@modelcontextprotocol/sdk/client/auth.js'
+    );
+    const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+    const { authorizationServerMetadata } = await discoverOAuthServerInfo(url, {
+      resourceMetadataUrl,
+      fetchFn: probeFetch,
+    });
+    if (authorizationServerMetadata) return { auth: 'oauth' };
+  } catch (error) {
+    if (deadline.aborted) return failure(error);
+  }
+  return { auth: 'none', error: 'HTTP 401: the server requires authentication but offers no OAuth sign-in' };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-provider.mjs

@@ -0,0 +1,95 @@
+import { normalizeMcpTransportUrl } from './client-config.mjs';
+import { loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
+
+/**
+ * The SDK's OAuth client provider over one connection's credential `cache`
+ * and login `flow` state.
+ */
+export function createOAuthProvider({ cache, flow, lifetimeSignal }) {
+  const { creds, ready, update } = cache;
+  // The SDK saves only inside a login, which holds the lock and has just
+  // adopted the stored entry.
+  const save = async (change) => {
+    if (!(await update(change))) throw loginFailed();
+  };
+  return {
+    get redirectUrl() {
+      return creds.redirectUrl;
+    },
+    get clientMetadata() {
+      return {
+        client_name: 'Mixdog',
+        redirect_uris: [creds.redirectUrl],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      };
+    },
+    state: () => flow.state,
+    clientInformation: async () => {
+      await ready();
+      // A connect that cannot open a sign-in never registers a client (the
+      // SDK registers one after dropping a rejected registration): the next
+      // explicit sign-in registers it.
+      if (!creds.clientInformation && !flow.allowBrowser) throw reauthenticationRequired();
+      return creds.clientInformation;
+    },
+    saveClientInformation: (value) =>
+      save(() => {
+        creds.clientInformation = value;
+      }),
+    tokens: async () => {
+      await ready();
+      return creds.tokens;
+    },
+    saveTokens: async (value) => {
+      lifetimeSignal.throwIfAborted();
+      await save(() => {
+        creds.tokens = value;
+      });
+    },
+    saveCodeVerifier: (value) => {
+      flow.verifier = value;
+    },
+    codeVerifier: () => {
+      if (!flow.verifier) throw loginFailed();
+      return flow.verifier;
+    },
+    discoveryState: () => creds.discovery,
+    saveDiscoveryState: (value) =>
+      save(() => {
+        creds.discovery = value;
+      }),
+    // The SDK invalidates 'all' when the token endpoint rejects the client
+    // (invalid_client / unauthorized_client) and 'tokens' when it rejects the
+    // grant (invalid_grant). The registration goes in both cases: an
+    // authorization server that forgot its clients (a restart) may answer the
+    // refresh with invalid_grant, and reusing that registration would fail
+    // every later sign-in at the authorization endpoint; re-registering is cheap.
+    invalidateCredentials: async (scope) => {
+      if (scope === 'all' || scope === 'verifier') flow.verifier = undefined;
+      if (scope === 'discovery') creds.discovery = undefined;
+      if (scope !== 'all' && scope !== 'tokens' && scope !== 'client') return;
+      await update(
+        () => {
+          if (scope !== 'client') creds.tokens = undefined;
+          creds.clientInformation = undefined;
+          if (scope === 'all') creds.discovery = undefined;
+        },
+        { remove: scope === 'all' }
+      );
+    },
+    redirectToAuthorization: async (authorizationUrl) => {
+      if (!flow.allowBrowser || flow.browserOpened) throw reauthenticationRequired();
+      const target = new URL(normalizeMcpTransportUrl(authorizationUrl));
+      if (
+        target.searchParams.get('state') !== flow.state ||
+        target.searchParams.get('code_challenge_method') !== 'S256' ||
+        !flow.verifier
+      )
+        throw loginFailed();
+      flow.browserOpened = true;
+      await flow.launchBrowser(target.href);
+    },
+  };
+}