okengine 0.23.0 → 0.23.2

package/src/kernel/pipeline-tenant.ts

@@ -6,7 +6,7 @@
  * including Store-only apps that never enable `gate.auth.tenant`.
  */
 
-import { tenantScopesForMember } from "../auth/tenants.ts";
+import { tenantRoleForMember, tenantScopesForMember } from "../auth/tenants.ts";
 import type { FlowFailure } from "./errors.ts";
 import type { PipelineDeps } from "./pipeline.ts";
 import type { InvocationContext } from "./hooks.ts";
@@ -41,6 +41,10 @@ export function applyPipelineTenant(
     for (const scope of tenantScopesForMember(tenant.store, result.id, userId)) {
       deps.principals.auth.scopes.add(scope);
     }
+    const role = tenantRoleForMember(tenant.store, result.id, userId);
+    deps.principals.cacheRoles = role ? [role] : [];
+  } else {
+    deps.principals.cacheRoles = [];
   }
   return undefined;
 }

package/src/kernel/pipeline.ts

@@ -37,6 +37,11 @@ export interface PrincipalBag {
   readonly tenant: {
     id: string | null;
   };
+  /**
+   * Membership role names for the tier-1 cache key.
+   * Gates do not read this field.
+   */
+  cacheRoles?: string[];
 }
 
 /** Resolved identity from auth middleware / test harness. */

package/src/kernel/signal-tx.ts

@@ -0,0 +1,28 @@
+/**
+ * Ambient signal transaction for `fx.store().transaction`.
+ *
+ * Emits inside the callback stage on {@link SignalTransaction} and publish
+ * only after the SQL transaction commits.
+ */
+
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { SignalTransaction } from "../drivers/signal-types.ts";
+
+const storage = new AsyncLocalStorage<SignalTransaction>();
+
+/**
+ * The signal transaction wrapping the current async frame, if any.
+ */
+export function currentSignalTransaction(): SignalTransaction | undefined {
+  return storage.getStore();
+}
+
+/**
+ * Run `fn` with `tx` as the ambient signal transaction.
+ *
+ * @param tx - Open signal transaction
+ * @param fn - Body
+ */
+export function runInSignalTransaction<T>(tx: SignalTransaction, fn: () => Promise<T>): Promise<T> {
+  return storage.run(tx, fn);
+}

package/src/kernel/store-transaction.test.ts

@@ -0,0 +1,95 @@
+/**
+ * `fx.store().transaction` publishes signal emits only after commit.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { SqlConnection } from "../drivers/types.ts";
+import { memorySignalDriver } from "../drivers/signal-memory.ts";
+import { signal } from "../elements/signal.ts";
+import { store } from "../elements/store.ts";
+import { createSqlStoreHandle } from "../elements/store/sql-session.ts";
+import type { StoreRuntime } from "../elements/store/runtime.ts";
+import { createFxContext } from "./fx.ts";
+import type { SignalRuntime } from "../elements/signal/runtime.ts";
+
+function fakeSql(): SqlConnection {
+  return {
+    driverId: "memory",
+    role: "primary",
+    async query() {
+      return [];
+    },
+    async exec() {
+      return { changes: 1 };
+    },
+    async transaction(fn) {
+      return fn(this);
+    },
+    async close() {},
+  };
+}
+
+describe("fx.store().transaction", () => {
+  test("commit publishes the staged emit; rollback drops it", async () => {
+    const ping = signal.once("ping");
+    const signals = new Map([[ping.name, ping]]);
+    const bus = await memorySignalDriver.open({ signals });
+    const got: unknown[] = [];
+    await bus.subscribe("ping", "c", async (message) => {
+      got.push(message.payload);
+    });
+    const signalRuntime: SignalRuntime = {
+      driverId: "memory",
+      get bus() {
+        return bus;
+      },
+      declarations: signals,
+      register(decl) {
+        signals.set(decl.name, decl);
+      },
+      async start() {
+        return bus;
+      },
+      emit: (name, payload, options) => bus.emit(name, payload, options),
+      deadLetters: (name) => bus.deadLetters(name),
+      live: (name, opts) => bus.live(name, opts),
+      checkLiveResume: (name, afterId) => bus.checkLiveResume(name, afterId),
+      async close() {
+        await bus.close();
+      },
+    };
+    const notes = { name: "notes" };
+    const storeRuntime = {
+      async open() {
+        return createSqlStoreHandle("sql:db", {
+          connection: fakeSql(),
+          classifications: new Map(),
+          routedRole: "primary",
+        });
+      },
+    } as unknown as StoreRuntime;
+    const db = store.sql("db");
+    const { fx } = createFxContext({
+      flow: "notes.write",
+      effects: { writes: ["sql:notes", "sql:db"], emits: ["ping"] },
+      storeRuntime,
+      signalRuntime,
+    });
+
+    await fx.store(db).transaction(async (tx) => {
+      await tx.insert(notes).values({ id: "1" });
+      await fx.emit(ping, { id: "1" });
+    });
+    await bus.drain();
+    expect(got).toEqual([{ id: "1" }]);
+
+    await expect(
+      fx.store(db).transaction(async () => {
+        await fx.emit(ping, { id: "no" });
+        throw new Error("nope");
+      }),
+    ).rejects.toThrow("nope");
+    await bus.drain();
+    expect(got).toEqual([{ id: "1" }]);
+  });
+});

package/src/mcp/authorization.ts

@@ -225,25 +225,19 @@ export const MCP_TOOL_POLICIES: readonly McpToolPolicy[] = [
     name: "oke.action.confirm",
     scopes: ["mcp:action:invoke", "console:flows:invoke"],
     mutability: "read",
-    description: "Request a single-use confirmation token for a write tool (no caching).",
+    description:
+      "Issue a single-use confirmation token for a pending write. The caller must be a different auth session than the requester (no caching).",
     inputSchema: {
       type: "object",
       properties: {
-        tool: {
-          type: "string",
-          enum: ["oke.action.invoke", "oke.action.structural_propose"],
-        },
-        args: { type: "object" },
+        confirmationId: { type: "string", minLength: 1 },
         reason: { type: "string", minLength: 3 },
       },
-      required: ["tool", "args", "reason"],
+      required: ["confirmationId", "reason"],
       additionalProperties: false,
     },
     params: [
-      {
-        name: "tool",
-        enum: ["oke.action.invoke", "oke.action.structural_propose"],
-      },
+      { name: "confirmationId", maxLength: 200 },
       { name: "reason", maxLength: 2000 },
     ],
   },

package/src/mcp/confirmation.ts

@@ -5,27 +5,82 @@
  * re-validating is how tool poisoning and rug pulls persist. Every write
  * (or otherwise sensitive) tool invocation must carry a fresh confirmation
  * token that was issued for that exact tool + arguments digest.
+ *
+ * The requester and the issuer are different auth sessions (`claims.sid`),
+ * even when they are the same principal. A write without a token returns an
+ * opaque confirmation id bound to the requester. `oke.action.confirm` mints
+ * the token only from another session. Only the requester session can
+ * consume it, and the issuer session cannot.
+ *
+ * Pending rows live in this process only. A token issued on another process
+ * is absent here and fails closed with `"unknown"`. Do not add shared storage.
  */
 
 /** Typed confirmation phrase for irreversible MCP writes. */
 export const MCP_CONFIRM_PHRASE = "CONFIRM" as const;
 
-/** Pending confirmation that has not yet been consumed. */
+/**
+ * Auth session a confirmation is bound to.
+ *
+ * `sid` is `McpRequester.sessionId` (`claims.sid`), not the MCP transport
+ * session id from `initialize`.
+ */
+export interface ConfirmationTarget {
+  /** Operator principal id (`claims.sub`). */
+  readonly principalId: string;
+  /** Auth session id (`claims.sid`). */
+  readonly sid: string;
+}
+
+/**
+ * Confirmation after a different session has issued its token.
+ *
+ * The write rejection that opens a confirmation never carries `token`.
+ */
 export interface PendingConfirmation {
-  /** Cryptographically random token. */
+  /** Opaque id returned to the requester. Not a token. */
+  readonly confirmationId: string;
+  /** Cryptographically random token. Present only after issue. */
   readonly token: string;
   /** Tool name the token authorises. */
   readonly tool: string;
   /** SHA-256 of canonical JSON arguments. */
   readonly argsDigest: string;
-  /** Operator / principal id that requested it. */
-  readonly principalId: string;
+  /** Requester the write is bound to. */
+  readonly target: ConfirmationTarget;
+  /** Auth session that issued the token. Distinct from {@link ConfirmationTarget.sid}. */
+  readonly issuerSid: string;
   /** Expiry epoch-ms. */
   readonly expiresAt: number;
-  /** Human reason recorded at request time. */
+  /** Human reason recorded when the token was issued. */
   readonly reason: string;
 }
 
+/**
+ * Opaque handle for a write that still needs another session to confirm.
+ *
+ * This is not a token and must not be accepted by {@link ConfirmationGate.consume}.
+ */
+export interface OpenConfirmation {
+  /** Id to pass to `oke.action.confirm`. */
+  readonly confirmationId: string;
+  /** Expiry epoch-ms of the pending row. */
+  readonly expiresAt: number;
+}
+
+/** Result of issuing a confirmation token from a second session. */
+export type ConfirmIssueResult =
+  | {
+      readonly ok: true;
+      readonly token: string;
+      readonly tool: string;
+      readonly expiresAt: number;
+    }
+  | {
+      readonly ok: false;
+      readonly reason: "unknown" | "expired" | "same-session" | "reason-short" | "already-issued";
+    };
+
 /** Result of consuming a confirmation. */
 export type ConfirmConsumeResult =
   | { readonly ok: true; readonly pending: PendingConfirmation }
@@ -37,7 +92,8 @@ export type ConfirmConsumeResult =
         | "expired"
         | "tool-mismatch"
         | "args-mismatch"
-        | "principal-mismatch"
+        | "session-mismatch"
+        | "issuer-mismatch"
         | "phrase-mismatch"
         | "reason-short";
     };
@@ -50,51 +106,128 @@ export interface ConfirmationGateOptions {
 }
 
 /**
- * Create a confirmation gate with **no session-level cache**.
- * Tokens are single-use and bound to tool + args + principal.
+ * In-process confirmation gate with **no session-level cache**.
+ *
+ * Tokens are single-use and bound to tool + args digest + target session.
+ * The map is per process: an id or token issued elsewhere fails closed
+ * with `"unknown"`. Do not add shared storage.
  */
-export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
-  readonly request: (input: {
+export interface ConfirmationGate {
+  /**
+   * Bind a write attempt to the requester.
+   *
+   * Returns an opaque confirmation id and never a token.
+   *
+   * @param input - Tool, arguments, and requester session
+   */
+  readonly open: (input: {
     readonly tool: string;
     readonly args: unknown;
-    readonly principalId: string;
+    readonly target: ConfirmationTarget;
+  }) => OpenConfirmation;
+  /**
+   * Issue a single-use token for an open confirmation.
+   *
+   * Succeeds only when `callerSid` is not the target session.
+   *
+   * @param input - Confirmation id, reason, and issuer session
+   */
+  readonly issue: (input: {
+    readonly confirmationId: string;
     readonly reason: string;
-  }) => PendingConfirmation | { readonly error: "reason-short" };
+    readonly callerSid: string;
+  }) => ConfirmIssueResult;
+  /**
+   * Consume a token for one write.
+   *
+   * Requires `consumerSid === target.sid` and `issuerSid !== consumerSid`,
+   * plus single-use, tool, args digest, expiry, and phrase checks.
+   *
+   * @param input - Write attempt presenting the token
+   */
   readonly consume: (input: {
     readonly tool: string;
     readonly args: unknown;
-    readonly principalId: string;
+    readonly consumerSid: string;
     readonly token: string;
     readonly phrase: string;
     readonly reason: string;
   }) => ConfirmConsumeResult;
   /** Test helper — pending count (never used for consent caching). */
   readonly size: () => number;
-} {
+}
+
+/** Mutable row stored in the per-process maps. */
+interface ConfirmationRecord {
+  confirmationId: string;
+  token: string | null;
+  tool: string;
+  argsDigest: string;
+  target: ConfirmationTarget;
+  issuerSid: string | null;
+  expiresAt: number;
+  reason: string;
+}
+
+/**
+ * Create a confirmation gate with **no session-level cache**.
+ *
+ * @param options - Clock and TTL
+ */
+export function createConfirmationGate(options: ConfirmationGateOptions = {}): ConfirmationGate {
   const now = options.now ?? (() => Date.now());
   const ttlMs = options.ttlMs ?? 2 * 60 * 1000;
-  const pending = new Map<string, PendingConfirmation>();
+  // Per-process only. A token issued on another process is not in these maps
+  // and fails closed with "unknown". Do not add shared storage.
+  const byId = new Map<string, ConfirmationRecord>();
+  const byToken = new Map<string, ConfirmationRecord>();
 
   return {
-    request(input) {
-      if (input.reason.trim().length < 3) {
-        return { error: "reason-short" as const };
-      }
-      prune(pending, now());
-      const token = `mcp_c_${cryptoRandomHex(24)}`;
-      const entry: PendingConfirmation = {
-        token,
+    open(input) {
+      prune(byId, byToken, now());
+      const confirmationId = `mcp_id_${cryptoRandomHex(24)}`;
+      const entry: ConfirmationRecord = {
+        confirmationId,
+        token: null,
         tool: input.tool,
         argsDigest: digestArgs(input.args),
-        principalId: input.principalId,
+        target: input.target,
+        issuerSid: null,
         expiresAt: now() + ttlMs,
-        reason: input.reason.trim(),
+        reason: "",
       };
-      pending.set(token, entry);
-      return entry;
+      byId.set(confirmationId, entry);
+      return { confirmationId, expiresAt: entry.expiresAt };
+    },
+    issue(input) {
+      if (input.reason.trim().length < 3) {
+        return { ok: false, reason: "reason-short" };
+      }
+      prune(byId, byToken, now());
+      const entry = byId.get(input.confirmationId);
+      if (!entry) {
+        return { ok: false, reason: "unknown" };
+      }
+      if (entry.expiresAt <= now()) {
+        drop(byId, byToken, entry);
+        return { ok: false, reason: "expired" };
+      }
+      // Same auth session cannot request, confirm, and invoke.
+      if (input.callerSid === entry.target.sid) {
+        return { ok: false, reason: "same-session" };
+      }
+      if (entry.token !== null) {
+        return { ok: false, reason: "already-issued" };
+      }
+      const token = `mcp_c_${cryptoRandomHex(24)}`;
+      entry.token = token;
+      entry.issuerSid = input.callerSid;
+      entry.reason = input.reason.trim();
+      byToken.set(token, entry);
+      return { ok: true, token, tool: entry.tool, expiresAt: entry.expiresAt };
     },
     consume(input) {
-      prune(pending, now());
+      prune(byId, byToken, now());
       if (!input.token) {
         return { ok: false, reason: "missing" };
       }
@@ -104,12 +237,13 @@ export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
       if (input.reason.trim().length < 3) {
         return { ok: false, reason: "reason-short" };
       }
-      const entry = pending.get(input.token);
+      const entry = byToken.get(input.token);
       if (!entry) {
+        // Missing locally — including a token issued on another process.
         return { ok: false, reason: "unknown" };
       }
       // Single-use: remove before further checks so replay fails.
-      pending.delete(input.token);
+      drop(byId, byToken, entry);
       if (entry.expiresAt <= now()) {
         return { ok: false, reason: "expired" };
       }
@@ -119,14 +253,32 @@ export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
       if (entry.argsDigest !== digestArgs(input.args)) {
         return { ok: false, reason: "args-mismatch" };
       }
-      if (entry.principalId !== input.principalId) {
-        return { ok: false, reason: "principal-mismatch" };
+      if (entry.target.sid !== input.consumerSid) {
+        return { ok: false, reason: "session-mismatch" };
       }
-      return { ok: true, pending: entry };
+      if (entry.issuerSid === null || entry.issuerSid === input.consumerSid) {
+        return { ok: false, reason: "issuer-mismatch" };
+      }
+      if (entry.token === null) {
+        return { ok: false, reason: "unknown" };
+      }
+      return {
+        ok: true,
+        pending: {
+          confirmationId: entry.confirmationId,
+          token: entry.token,
+          tool: entry.tool,
+          argsDigest: entry.argsDigest,
+          target: entry.target,
+          issuerSid: entry.issuerSid,
+          expiresAt: entry.expiresAt,
+          reason: entry.reason,
+        },
+      };
     },
     size() {
-      prune(pending, now());
-      return pending.size;
+      prune(byId, byToken, now());
+      return byId.size;
     },
   };
 }
@@ -142,6 +294,15 @@ export function digestArgs(args: unknown): string {
   return hasher.digest("hex");
 }
 
+function drop(
+  byId: Map<string, ConfirmationRecord>,
+  byToken: Map<string, ConfirmationRecord>,
+  entry: ConfirmationRecord,
+): void {
+  byId.delete(entry.confirmationId);
+  if (entry.token !== null) byToken.delete(entry.token);
+}
+
 function cryptoRandomHex(byteLength: number): string {
   const bytes = new Uint8Array(byteLength);
   crypto.getRandomValues(bytes);
@@ -160,8 +321,12 @@ function canonicalJson(value: unknown): string {
   return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
 }
 
-function prune(pending: Map<string, PendingConfirmation>, t: number): void {
-  for (const [token, entry] of pending) {
-    if (entry.expiresAt <= t) pending.delete(token);
+function prune(
+  byId: Map<string, ConfirmationRecord>,
+  byToken: Map<string, ConfirmationRecord>,
+  t: number,
+): void {
+  for (const entry of byId.values()) {
+    if (entry.expiresAt <= t) drop(byId, byToken, entry);
   }
 }

package/src/mcp/docs-server.ts

@@ -11,12 +11,15 @@ import {
   forbiddenResponse,
   resolveAllowedHosts,
 } from "../runtime/security.ts";
+import { HttpBodyRejected, parseBody } from "../compiler/http-parse.ts";
 import { DOCS_MCP_PORT, type ServerHandle } from "../runtime/types.ts";
 import { asData } from "./data.ts";
 import { defaultDocsContentDir, loadDocsIndex, type DocsIndex } from "./docs-index.ts";
 import { createDocsToolRuntime } from "./docs-tools.ts";
 import {
-  MCP_PROTOCOL_VERSION,
+  acceptsMcpProtocolVersion,
+  negotiateMcpProtocolVersion,
+  protocolVersionOf,
   parseJsonRpcRequest,
   parseToolsCallParams,
   rpcError,
@@ -79,8 +82,11 @@ export async function createDocsMcpServer(
 
     let body: unknown;
     try {
-      body = await request.json();
-    } catch {
+      body = await parseBody(request);
+    } catch (err) {
+      if (err instanceof HttpBodyRejected && err.code === "PayloadTooLarge") {
+        return new Response("Payload Too Large", { status: 413 });
+      }
       return jsonRpcHttp(rpcError(null, RpcErrorCode.parse, "invalid JSON body"), 400);
     }
 
@@ -94,10 +100,18 @@ export async function createDocsMcpServer(
 
     switch (rpc.method) {
       case "initialize": {
+        const requested = protocolVersionOf(rpc.params);
+        const protocolVersion = negotiateMcpProtocolVersion(requested);
+        if (protocolVersion === undefined) {
+          return jsonRpcHttp(
+            rpcError(id, RpcErrorCode.invalidParams, "unsupported protocol version"),
+            400,
+          );
+        }
         const sessionId = newMcpTransportSessionId();
         transportSessions.add(sessionId);
         const result: McpInitializeResult = {
-          protocolVersion: MCP_PROTOCOL_VERSION,
+          protocolVersion,
           capabilities: { tools: { listChanged: false } },
           serverInfo: { name: "okengine-docs-mcp", version },
           sessionId,
@@ -124,6 +138,13 @@ export async function createDocsMcpServer(
         );
       }
       case "tools/call": {
+        const requested = protocolVersionOf(rpc.params);
+        if (requested !== undefined && !acceptsMcpProtocolVersion(requested)) {
+          return jsonRpcHttp(
+            rpcError(id, RpcErrorCode.invalidParams, "unsupported protocol version"),
+            400,
+          );
+        }
         const call = parseToolsCallParams(rpc.params);
         if (!call.ok) {
           return jsonRpcHttp(rpcError(id, RpcErrorCode.invalidParams, call.message), 400);
@@ -185,6 +206,7 @@ export async function serveDocsMcp(
   const server = Bun.serve({
     hostname,
     port,
+    maxRequestBodySize: 1_048_576,
     fetch: mcp.fetch,
   });
   const boundPort = server.port ?? port;

package/src/mcp/index.ts

@@ -32,8 +32,12 @@ export {
   createConfirmationGate,
   digestArgs,
   MCP_CONFIRM_PHRASE,
+  type ConfirmationGate,
+  type ConfirmationTarget,
   type ConfirmConsumeResult,
+  type ConfirmIssueResult,
   type ConfirmationGateOptions,
+  type OpenConfirmation,
   type PendingConfirmation,
 } from "./confirmation.ts";