okengine 0.23.0 → 0.23.2

package/src/mcp/tools.ts

@@ -12,7 +12,9 @@ import { authorizeToolCall, MCP_TOOL_POLICIES, type McpToolPolicy } from "./auth
 import {
   createConfirmationGate,
   MCP_CONFIRM_PHRASE,
+  type ConfirmationGate,
   type ConfirmationGateOptions,
+  type ConfirmIssueResult,
 } from "./confirmation.ts";
 import { asData, freezeData, type McpDataEnvelope } from "./data.ts";
 import type { McpRequester } from "./session.ts";
@@ -68,6 +70,9 @@ export type ToolCallResult =
 /**
  * Create the tool runtime bound to a context + confirmation gate.
  *
+ * `listTools` receives the requester and omits tools their scopes cannot call.
+ * Confirmation is not required to appear in the list; `callTool` still enforces it.
+ *
  * @param ctx - Manifest / runs / action adapters
  * @param confirmOptions - Confirmation gate options
  */
@@ -75,7 +80,7 @@ export function createToolRuntime(
   ctx: McpContext,
   confirmOptions: ConfirmationGateOptions = {},
 ): {
-  readonly listTools: () => readonly McpToolPolicy[];
+  readonly listTools: (requester: McpRequester) => readonly McpToolPolicy[];
   readonly callTool: (
     requester: McpRequester,
     name: string,
@@ -87,7 +92,14 @@ export function createToolRuntime(
   const confirm = createConfirmationGate(confirmOptions);
 
   return {
-    listTools: () => MCP_TOOL_POLICIES,
+    listTools(requester) {
+      // Same scope check as authorizeToolCall. Listing ignores confirmation;
+      // a later call to a write tool still requires a token.
+      return MCP_TOOL_POLICIES.filter((policy) => {
+        const decision = authorizeToolCall(policy.name, {}, requester.scopes, { confirmed: true });
+        return decision.ok;
+      });
+    },
     confirmationSize: () => confirm.size(),
     async callTool(requester, name, args) {
       const policy = MCP_TOOL_POLICIES.find((p) => p.name === name);
@@ -113,15 +125,42 @@ export function createToolRuntime(
       }
 
       // Write path: consume a fresh per-call confirmation (no session cache).
+      // A call with no token is rejected and returns an opaque confirmationId
+      // bound to this requester — never the token.
       if (policy?.mutability === "write") {
         const token = typeof args.confirmToken === "string" ? args.confirmToken : "";
         const phrase = typeof args.confirmation === "string" ? args.confirmation : "";
         const reason = typeof args.reason === "string" ? args.reason : "";
         const boundArgs = stripConfirmFields(args);
+        if (token.length === 0) {
+          const opened = confirm.open({
+            tool: name,
+            args: boundArgs,
+            target: {
+              principalId: requester.principalId,
+              sid: requester.sessionId,
+            },
+          });
+          return {
+            ok: false,
+            code: "forbidden",
+            message: "write tool requires fresh human confirmation (missing)",
+            data: asData(
+              {
+                tool: name,
+                confirmationId: opened.confirmationId,
+                requiredPhrase: MCP_CONFIRM_PHRASE,
+                confirmVia: "oke.action.confirm",
+                reason: "missing",
+              },
+              "error",
+            ),
+          };
+        }
         const consumed = confirm.consume({
           tool: name,
           args: boundArgs,
-          principalId: requester.principalId,
+          consumerSid: requester.sessionId,
           token,
           phrase,
           reason,
@@ -412,28 +451,23 @@ async function decisionsList(
 }
 
 function actionConfirm(
-  confirm: ReturnType<typeof createConfirmationGate>,
+  confirm: ConfirmationGate,
   requester: McpRequester,
   args: Record<string, unknown>,
 ): ToolCallResult {
-  const tool = String(args.tool ?? "");
-  const reason = String(args.reason ?? "");
-  const toolArgs =
-    args.args !== null && typeof args.args === "object" && !Array.isArray(args.args)
-      ? (args.args as Record<string, unknown>)
-      : {};
-  const issued = confirm.request({
-    tool,
-    args: toolArgs,
-    principalId: requester.principalId,
+  const confirmationId = typeof args.confirmationId === "string" ? args.confirmationId : "";
+  const reason = typeof args.reason === "string" ? args.reason : "";
+  const issued = confirm.issue({
+    confirmationId,
     reason,
+    callerSid: requester.sessionId,
   });
-  if ("error" in issued) {
+  if (!issued.ok) {
     return {
       ok: false,
-      code: "invalid",
-      message: "reason must be at least 3 characters",
-      data: asData({ error: issued.error }, "error"),
+      code: issued.reason === "reason-short" ? "invalid" : "forbidden",
+      message: confirmIssueMessage(issued.reason),
+      data: asData({ error: issued.reason }, "error"),
     };
   }
   return okData(
@@ -443,12 +477,27 @@ function actionConfirm(
       phrase: MCP_CONFIRM_PHRASE,
       expiresAt: issued.expiresAt,
       notice:
-        "Present confirmToken + confirmation phrase on the write call. Tokens are single-use; there is no session consent cache.",
+        "Present confirmToken + confirmation phrase on the write call from the session that requested it. Tokens are single-use; the issuer session cannot consume them.",
     },
     "action-result",
   );
 }
 
+function confirmIssueMessage(reason: Extract<ConfirmIssueResult, { ok: false }>["reason"]): string {
+  switch (reason) {
+    case "reason-short":
+      return "reason must be at least 3 characters";
+    case "same-session":
+      return "confirmation must be issued by a different auth session";
+    case "unknown":
+      return "unknown confirmation";
+    case "expired":
+      return "confirmation expired";
+    case "already-issued":
+      return "confirmation already issued";
+  }
+}
+
 async function actionInvoke(
   ctx: McpContext,
   requester: McpRequester,

package/src/mcp/versions.ts

@@ -0,0 +1,60 @@
+/**
+ * MCP protocol versions.
+ *
+ * The app and docs servers implement `initialize`, `ping`, `tools/list`, and
+ * `tools/call`. That is the 2024-11-05 tools surface, so they advertise
+ * {@link MCP_PROTOCOL_VERSION} and reject any other client version.
+ *
+ * The outbound client is separate. It probes external servers with
+ * {@link MCP_CLIENT_PROTOCOL_VERSION} (`_meta` on each request) and falls
+ * back to a 2024-11-05 `initialize`. That constant is not the server
+ * advertisement.
+ */
+
+/** Versions the app and docs servers implement, newest last. */
+export const MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2024-11-05"] as const;
+
+/** Highest protocol version the servers implement and advertise. */
+export const MCP_PROTOCOL_VERSION: (typeof MCP_SUPPORTED_PROTOCOL_VERSIONS)[number] = "2024-11-05";
+
+/** Version the outbound MCP client probes first. Not the server advertisement. */
+export const MCP_CLIENT_PROTOCOL_VERSION = "2026-07-28";
+
+/** `initialize` dialect the outbound client falls back to. */
+export const MCP_LEGACY_PROTOCOL_VERSION = "2024-11-05";
+
+const ACCEPTED: readonly string[] = MCP_SUPPORTED_PROTOCOL_VERSIONS;
+
+/**
+ * Whether a client-offered protocol version is one this server implements.
+ *
+ * @param version - `initialize` or `tools/call` protocol version
+ */
+export function acceptsMcpProtocolVersion(version: string): boolean {
+  return ACCEPTED.includes(version);
+}
+
+/**
+ * Pick the protocol version for an `initialize` result.
+ *
+ * An omitted client version gets the highest version this server implements.
+ * A supported client version is echoed. Anything else has no overlap.
+ *
+ * @param requested - Client `protocolVersion`, when present
+ */
+export function negotiateMcpProtocolVersion(requested: string | undefined): string | undefined {
+  if (requested === undefined) return MCP_PROTOCOL_VERSION;
+  if (acceptsMcpProtocolVersion(requested)) return requested;
+  return undefined;
+}
+
+/**
+ * Read `params.protocolVersion` when the client sent one.
+ *
+ * @param params - JSON-RPC params
+ */
+export function protocolVersionOf(params: unknown): string | undefined {
+  if (params === null || typeof params !== "object" || Array.isArray(params)) return undefined;
+  const version = (params as { protocolVersion?: unknown }).protocolVersion;
+  return typeof version === "string" && version.length > 0 ? version : undefined;
+}

package/src/plugins/index.ts

@@ -24,6 +24,7 @@ export {
   type MagicLinkOptions,
 } from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
+export { mena, menaChannels, type MenaChannelOptions } from "./mena.ts";
 export {
   createPhoneStore,
   otp,

package/src/plugins/mena.ts

@@ -0,0 +1,56 @@
+/**
+ * MENA channel plugin — Taqnyat, Unifonic, and Msegat behind one plugin.
+ *
+ * Drivers stay the protocol adapters. `fx.sendOtp`, `fx.verifyOtp`, and
+ * `fx.deliverOtp` remain supported Channel methods.
+ */
+
+import { openMsegatChannel } from "../drivers/channel-msegat.ts";
+import { openTaqnyatChannel } from "../drivers/channel-taqnyat.ts";
+import { openTaqnyatMailChannel } from "../drivers/channel-taqnyat-mail.ts";
+import { openTaqnyatWhatsAppChannel } from "../drivers/channel-taqnyat-whatsapp.ts";
+import { openUnifonicChannel } from "../drivers/channel-unifonic.ts";
+import type { ChannelDriver, ChannelOpenOptions } from "../drivers/channel-types.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+
+export {
+  openMsegatChannel,
+  openTaqnyatChannel,
+  openTaqnyatMailChannel,
+  openTaqnyatWhatsAppChannel,
+  openUnifonicChannel,
+};
+
+/** Which MENA providers to open. Omitted providers are skipped. */
+export interface MenaChannelOptions {
+  readonly sms?: ChannelOpenOptions;
+  readonly unifonic?: ChannelOpenOptions;
+  readonly msegat?: ChannelOpenOptions;
+  readonly mail?: ChannelOpenOptions;
+  readonly whatsapp?: ChannelOpenOptions;
+}
+
+/**
+ * Open the MENA drivers that have options.
+ *
+ * @param options - Per-provider credentials (`bearerToken` / `sender` / …)
+ */
+export function menaChannels(options: MenaChannelOptions = {}): ChannelDriver[] {
+  const drivers: ChannelDriver[] = [];
+  if (options.sms) drivers.push(openTaqnyatChannel(options.sms));
+  if (options.unifonic) drivers.push(openUnifonicChannel(options.unifonic));
+  if (options.msegat) drivers.push(openMsegatChannel(options.msegat));
+  if (options.mail) drivers.push(openTaqnyatMailChannel(options.mail));
+  if (options.whatsapp) drivers.push(openTaqnyatWhatsAppChannel(options.whatsapp));
+  return drivers;
+}
+
+/**
+ * Headline plugin. Attach with `.plug(mena())`. Drivers come from
+ * {@link menaChannels}; this registration is the product name.
+ *
+ * @param options - Unused today; reserved for plugin config
+ */
+export function mena(options: MenaChannelOptions = {}): PluginDef {
+  return plugin("mena", { version: "1", config: options });
+}

package/src/runtime/bun.ts

@@ -149,6 +149,7 @@ export function serveBunHttp(options: {
   readonly fetch: (request: Request) => Response | Promise<Response>;
   readonly routes?: Record<string, MethodHandlers>;
   readonly id?: string;
+  readonly maxRequestBodySize?: number;
 }): ReturnType<typeof Bun.serve> {
   const fetch = holdSseIdle(
     typeof options.fetch === "function"
@@ -158,6 +159,7 @@ export function serveBunHttp(options: {
   const base = {
     port: options.port,
     hostname: options.hostname,
+    maxRequestBodySize: options.maxRequestBodySize ?? 1_048_576,
     fetch,
     ...(options.id !== undefined ? { id: options.id } : {}),
   };
@@ -185,6 +187,9 @@ function listenBun(app: FetchApp, options?: ServeOptions): ServerHandle {
     fetch: fetchHandler,
     routes,
     ...(options?.id !== undefined ? { id: options.id } : {}),
+    ...(options?.maxRequestBodySize !== undefined
+      ? { maxRequestBodySize: options.maxRequestBodySize }
+      : {}),
   });
 
   const closeIdle = (

package/src/runtime/types.ts

@@ -72,6 +72,11 @@ export interface ServeOptions {
    * never replaces the mandatory check.
    */
   readonly allowedHosts?: readonly string[];
+  /**
+   * Bun.serve body backstop in bytes. Default 1 MiB. Raise it together with
+   * `maxRequestBodySize` when a route accepts a larger body.
+   */
+  readonly maxRequestBodySize?: number;
 }
 
 /** Handle returned by {@link Runtime.serve}. */