mixdog 1.2.0 → 1.2.2

package/src/runtime/agent/orchestrator/mcp/oauth-request.mjs

@@ -0,0 +1,122 @@
+import { anySignal, loginFailed, reauthenticationRequired } from './oauth-shared.mjs';
+
+/**
+ * The authenticated `fetch` of one server over its credential `cache`: it
+ * sends the cached token to the server's own endpoints and, on a challenge,
+ * joins the single login in flight (starting it with `login` when none is).
+ */
+export function createAuthorizedFetch({ url, cache, login, fetchImpl, lifetimeSignal }) {
+  const { creds } = cache;
+  let flight;
+  let waiters = 0;
+  let flightController;
+  // An unreadable (e.g. locked) keychain must not block a server that needs no
+  // authentication; credentials are required only on challenge.
+  const storeReadable = () =>
+    cache.ready().then(
+      () => true,
+      () => false
+    );
+  // One request, carrying the cached token only to the server's own endpoints.
+  // Reports the revision and token it was sent with, and whether the cached
+  // token could not be verified.
+  async function sendRequest(input, options, signal, sameOrigin) {
+    let unreadable = false;
+    if (creds.tokens && sameOrigin) {
+      try {
+        await cache.observeStoredRevision();
+      } catch {
+        // Unverifiable (e.g. locked keychain): never send the cached token.
+        creds.tokens = creds.loaded = undefined;
+        unreadable = true;
+      }
+    }
+    signal.throwIfAborted();
+    const { observed: revision, tokens } = creds;
+    const headers = new Headers(options.headers);
+    if (tokens && sameOrigin) headers.set('Authorization', `Bearer ${tokens.access_token}`);
+    else headers.delete('Authorization');
+    const response = await fetchImpl(input, { ...options, headers, signal, redirect: 'error' });
+    return { response, revision, tokens, unreadable };
+  }
+  function startLogin(challenge, requestLogin, browser, attemptedToken, serverName) {
+    flightController = new AbortController();
+    flight = login(challenge, flightController.signal, requestLogin(), browser, attemptedToken, serverName).finally(
+      () => {
+        flight = undefined;
+      }
+    );
+  }
+  // Wait for the login in flight; the last waiter to leave cancels it.
+  async function awaitLogin(signal, onAuthorized) {
+    waiters++;
+    let abort;
+    try {
+      await Promise.race([
+        flight,
+        new Promise((_, reject) => {
+          abort = () => reject(loginFailed());
+          signal.addEventListener('abort', abort, { once: true });
+          if (signal.aborted) abort();
+        }),
+      ]);
+      // The login settled with tokens stored, before the retry is sent.
+      onAuthorized();
+    } finally {
+      signal.removeEventListener('abort', abort);
+      if (--waiters === 0 && flight) {
+        flightController.abort();
+        // The cancelled login's own failure is not this request's.
+        await flight.catch(() => {});
+      }
+    }
+  }
+  async function authorizedFetch(
+    input,
+    options = {},
+    requestLogin = () => false,
+    browser,
+    isTransportEndpoint = () => false,
+    serverName = undefined,
+    onAuthorized = () => {}
+  ) {
+    let storeUnreadable = !(await storeReadable());
+    lifetimeSignal.throwIfAborted();
+    const signal = anySignal(lifetimeSignal, options.signal);
+    const target = new URL(input);
+    const server = new URL(url);
+    const sameOrigin = target.href === server.href || (target.origin === server.origin && isTransportEndpoint(input));
+    const sent = await sendRequest(input, options, signal, sameOrigin);
+    const { response } = sent;
+    const attemptedToken = sent.tokens;
+    storeUnreadable ||= sent.unreadable;
+    if (!sameOrigin || ![401, 403].includes(response.status)) return response;
+    const { extractWWWAuthenticateParams } = await import('@modelcontextprotocol/sdk/client/auth.js');
+    const challenge = extractWWWAuthenticateParams(response);
+    if (response.status === 403 && challenge.error !== 'insufficient_scope') return response;
+    await response.body?.cancel();
+    if (storeUnreadable) throw reauthenticationRequired();
+    if (!flight && creds.tokens === attemptedToken) {
+      startLogin(challenge, requestLogin, browser, attemptedToken, serverName);
+    }
+    if (flight) await awaitLogin(signal, onAuthorized);
+    lifetimeSignal.throwIfAborted();
+    signal.throwIfAborted();
+    const retry = await sendRequest(input, options, signal, sameOrigin);
+    const retried = retry.response;
+    if (retried.status === 401 || retried.status === 403) {
+      await retried.body?.cancel();
+      // Forget the rejected tokens unless a refresh (here or in another
+      // process) or a log-out replaced them since this retry was sent.
+      await cache.update(
+        () => {
+          creds.tokens = undefined;
+        },
+        { expected: retry.revision }
+      );
+      throw reauthenticationRequired();
+    }
+    return retried;
+  }
+  return { fetch: authorizedFetch, cancelLogin: () => flightController?.abort() };
+}

package/src/runtime/agent/orchestrator/mcp/oauth-shared.mjs

@@ -0,0 +1,9 @@
+export const REAUTHENTICATION_REQUIRED_MESSAGE = 'MCP OAuth reauthenticationRequired: sign in to connect';
+export const reauthenticationRequired = () =>
+  Object.assign(new Error(REAUTHENTICATION_REQUIRED_MESSAGE), {
+    code: 'reauthenticationRequired',
+  });
+export const loginFailed = () => new Error('MCP OAuth login failed, cancelled, or timed out');
+
+// `signal`, also aborted by the caller's optional `other` signal.
+export const anySignal = (signal, other) => AbortSignal.any(other ? [signal, other] : [signal]);

package/src/runtime/agent/orchestrator/mcp/oauth.mjs

@@ -0,0 +1,229 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import keychain from '../../../../lib/keychain-cjs.cjs';
+import { openInBrowser } from '../../../shared/open-url.mjs';
+import { normalizeMcpTransportUrl } from './client-config.mjs';
+import {
+  MCP_OAUTH_CALLBACK_MAX_BYTES,
+  MCP_OAUTH_CALLBACK_NOT_PENDING,
+  parsePastedMcpOAuthCallback,
+} from './oauth-callback.mjs';
+import {
+  TOKENS_FLAG,
+  createCredentialCache,
+  credentialFile,
+  readStoredCredentials,
+  withCredentialLock,
+  writeRevisionMarker,
+} from './oauth-credentials.mjs';
+import { createLoginFlow } from './oauth-login.mjs';
+import { createOAuthProvider } from './oauth-provider.mjs';
+import { createAuthorizedFetch } from './oauth-request.mjs';
+import { REAUTHENTICATION_REQUIRED_MESSAGE, anySignal } from './oauth-shared.mjs';
+
+export { MCP_OAUTH_CALLBACK_MAX_BYTES, MCP_OAUTH_CALLBACK_NOT_PENDING, parsePastedMcpOAuthCallback };
+
+export const MCP_OAUTH_TIMEOUT_MS = 5 * 60_000;
+
+const scopes = new WeakMap();
+
+/** Whether a connect failed only because the server needs an (explicit) OAuth
+ *  sign-in. Transports may wrap the error (SSE re-raises it as an event
+ *  message), so the message and cause chain count too. */
+export function isMcpOAuthReauthenticationRequired(error) {
+  for (let current = error, depth = 0; current && depth < 5; current = current.cause, depth++) {
+    if (current.code === 'reauthenticationRequired') return true;
+    if (String(current.message ?? current).includes(REAUTHENTICATION_REQUIRED_MESSAGE)) return true;
+  }
+  return false;
+}
+
+// One keychain entry per exact server URL. Windows stores each account as a
+// file name, so the account is a hash of the URL and nothing else.
+export function mcpOAuthAccount(url) {
+  return `mcp-oauth.${createHash('sha256').update(url).digest('hex')}`;
+}
+
+/** Whether OAuth tokens are stored for one server URL, read from the
+ *  non-secret revision marker without touching the keychain. */
+export function hasStoredMcpOAuthTokens(url) {
+  try {
+    const marker = readFileSync(credentialFile(mcpOAuthAccount(normalizeMcpTransportUrl(url)), 'rev'), 'utf8');
+    return marker.endsWith(TOKENS_FLAG);
+  } catch {
+    return false;
+  }
+}
+
+/** Log out of one MCP server URL: delete its stored tokens and client
+ *  registration and drop them from live connections, which then need an
+ *  explicit reconnect to log in again. */
+export async function clearMcpOAuth({ url, credentialStore = keychain }) {
+  url = normalizeMcpTransportUrl(url);
+  const account = mcpOAuthAccount(url);
+  await withCredentialLock(account, async () => {
+    await writeRevisionMarker(account, null);
+    if ((await readStoredCredentials(credentialStore, account)) != null)
+      await credentialStore.deleteSecretAsync(account);
+  });
+  scopes.get(credentialStore)?.get(url)?.oauth.clear();
+}
+
+// The keychain is the only durable store. Exact URLs, including query strings,
+// partition clients and tokens even when servers share an authorization issuer.
+export function createMcpOAuth({
+  url,
+  credentialStore = keychain,
+  interactive = false,
+  isTransportEndpoint = () => false,
+  serverName,
+  ...options
+}) {
+  url = normalizeMcpTransportUrl(url);
+  let entries = scopes.get(credentialStore);
+  if (!entries) {
+    entries = new Map();
+    scopes.set(credentialStore, entries);
+  }
+  let entry = entries.get(url);
+  if (!entry) {
+    entry = { oauth: createSharedOAuth({ url, credentialStore, ...options }), users: 0 };
+    entries.set(url, entry);
+  }
+  entry.users++;
+  const lifetime = new AbortController();
+  let onStart = () => {};
+  let loginAllowed = interactive === true;
+  let loginStarted = false;
+  let loginCompleted = false;
+  return {
+    provider: entry.oauth.provider,
+    signal: lifetime.signal,
+    set onStart(value) {
+      onStart = value;
+    },
+    /** Whether this connection was opened by an explicit sign-in. */
+    get interactive() {
+      return interactive === true;
+    },
+    /** Whether this connection started an interactive (browser) login. */
+    get loginStarted() {
+      return loginStarted;
+    },
+    /** Whether that login obtained tokens (the sign-in itself completed). */
+    get loginCompleted() {
+      return loginCompleted;
+    },
+    finishConnect() {
+      loginAllowed = false;
+    },
+    /** Every OAuth token this connection held, for scrubbing errors and results. */
+    secrets: () => entry.oauth.secrets(),
+    /** Answer the browser login this connection started with the redirect URL
+     *  pasted from the browser, exactly as the loopback callback would. */
+    completeCallback(pasted) {
+      if (!loginStarted || loginCompleted || lifetime.signal.aborted) throw new Error(MCP_OAUTH_CALLBACK_NOT_PENDING);
+      entry.oauth.completeCallback(pasted);
+    },
+    async fetch(input, init = {}) {
+      const signal = anySignal(lifetime.signal, init.signal);
+      let startedHere = false;
+      return entry.oauth.fetch(
+        input,
+        { ...init, signal },
+        () => {
+          if (!loginAllowed) return false;
+          loginAllowed = false;
+          loginStarted = startedHere = true;
+          onStart();
+          return true;
+        },
+        options.openBrowser,
+        isTransportEndpoint,
+        serverName,
+        // The login this request started stored tokens (a cancel, denial,
+        // timeout or failed exchange never gets here); the retry after it may
+        // still fail on its own.
+        () => {
+          if (startedHere) loginCompleted = true;
+        }
+      );
+    },
+    close() {
+      if (lifetime.signal.aborted) return;
+      lifetime.abort();
+      if (--entry.users === 0) {
+        entry.oauth.close();
+        entries.delete(url);
+      }
+    },
+  };
+}
+
+function createSharedOAuth({
+  url,
+  credentialStore,
+  openBrowser = openInBrowser,
+  fetchImpl = fetch,
+  timeoutMs = MCP_OAUTH_TIMEOUT_MS,
+}) {
+  const lifetime = new AbortController();
+  const cache = createCredentialCache({ url, credentialStore, account: mcpOAuthAccount(url) });
+  const { creds } = cache;
+  const flow = {
+    listener: undefined,
+    state: undefined,
+    verifier: undefined,
+    allowBrowser: false,
+    browserOpened: false,
+    launchBrowser: openBrowser,
+    finishCallback: undefined,
+  };
+  const provider = createOAuthProvider({ cache, flow, lifetimeSignal: lifetime.signal });
+  const { login, stopListening, closeListener, answerCallback } = createLoginFlow({
+    url,
+    cache,
+    flow,
+    provider,
+    lifetimeSignal: lifetime.signal,
+    openBrowser,
+    fetchImpl,
+    timeoutMs,
+  });
+  const requests = createAuthorizedFetch({
+    url,
+    cache,
+    login,
+    fetchImpl,
+    lifetimeSignal: lifetime.signal,
+  });
+  return {
+    provider,
+    signal: lifetime.signal,
+    fetch: requests.fetch,
+    secrets: () => [...cache.held],
+    /** Answer the pending browser login with a pasted redirect URL: the same
+     *  state check, PKCE exchange and persistence as the loopback callback,
+     *  whose listener closes. An invalid paste leaves the login pending. */
+    completeCallback(pasted) {
+      if (!flow.finishCallback || !flow.browserOpened || !flow.state || !creds.redirectUrl) {
+        throw new Error(MCP_OAUTH_CALLBACK_NOT_PENDING);
+      }
+      const { code } = parsePastedMcpOAuthCallback(pasted, { redirectUrl: creds.redirectUrl, state: flow.state });
+      stopListening();
+      // A denial (no code) fails the login without echoing its description.
+      answerCallback(code);
+    },
+    /** Forget in-memory credentials (after a log-out) and cancel a login in
+     *  progress; the next request re-reads the keychain. */
+    clear() {
+      requests.cancelLogin();
+      cache.clear();
+    },
+    close() {
+      lifetime.abort();
+      flow.finishCallback?.();
+      closeListener();
+    },
+  };
+}

package/src/runtime/agent/orchestrator/mcp/plugin-placeholders.mjs

@@ -0,0 +1,54 @@
+/**
+ * mcp/plugin-placeholders.mjs — plugin root/data placeholders in an MCP server
+ * config. Pure: no filesystem access; the caller supplies the directories.
+ */
+
+const ROOT_NAMES = ['CLAUDE_PLUGIN_ROOT', 'CODEX_PLUGIN_ROOT', 'PLUGIN_ROOT', 'MIXDOG_PLUGIN_ROOT'];
+const DATA_NAMES = ['CLAUDE_PLUGIN_DATA', 'PLUGIN_DATA', 'MIXDOG_PLUGIN_DATA'];
+const PLACEHOLDER_RE = new RegExp(`\\$\\{(${[...ROOT_NAMES, ...DATA_NAMES].join('|')})\\}`, 'g');
+const CONFIG_FIELDS = ['command', 'args', 'env', 'url', 'headers', 'cwd'];
+
+// Substituted paths use forward slashes on Windows so a path that lands in a
+// command line or argument is not read as backslash escapes; Windows accepts
+// them everywhere.
+function normalizePath(path, platform) {
+  return platform === 'win32' ? path.replace(/\\/g, '/') : path;
+}
+
+function substitute(value, replacements) {
+  if (typeof value === 'string') {
+    // Function replacement: `$` sequences in paths are inserted literally.
+    return value.replace(PLACEHOLDER_RE, (match, name) => replacements.get(name) ?? match);
+  }
+  if (Array.isArray(value)) return value.map((v) => substitute(v, replacements));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = substitute(v, replacements);
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Returns a copy of `config` with plugin root/data placeholders replaced in
+ * command, args, env, url, headers and cwd. A placeholder whose directory is
+ * not supplied is left as written. Run before ordinary env expansion.
+ */
+export function resolvePluginPlaceholders(config, { root, data, platform = process.platform } = {}) {
+  const replacements = new Map();
+  if (root) for (const name of ROOT_NAMES) replacements.set(name, normalizePath(String(root), platform));
+  if (data) for (const name of DATA_NAMES) replacements.set(name, normalizePath(String(data), platform));
+  const out = { ...config };
+  for (const field of CONFIG_FIELDS) {
+    if (out[field] !== undefined) out[field] = substitute(out[field], replacements);
+  }
+  return out;
+}
+
+/** Environment variables a plugin-owned server process receives (raw paths). */
+export function pluginServerEnv({ root, data } = {}) {
+  const env = {};
+  if (root) for (const name of ['CLAUDE_PLUGIN_ROOT', 'MIXDOG_PLUGIN_ROOT', 'PLUGIN_ROOT']) env[name] = String(root);
+  if (data) for (const name of ['CLAUDE_PLUGIN_DATA', 'MIXDOG_PLUGIN_DATA', 'PLUGIN_DATA']) env[name] = String(data);
+  return env;
+}