okengine 0.23.1 → 0.23.2

package/src/mcp/confirmation.ts

@@ -5,27 +5,82 @@
  * re-validating is how tool poisoning and rug pulls persist. Every write
  * (or otherwise sensitive) tool invocation must carry a fresh confirmation
  * token that was issued for that exact tool + arguments digest.
+ *
+ * The requester and the issuer are different auth sessions (`claims.sid`),
+ * even when they are the same principal. A write without a token returns an
+ * opaque confirmation id bound to the requester. `oke.action.confirm` mints
+ * the token only from another session. Only the requester session can
+ * consume it, and the issuer session cannot.
+ *
+ * Pending rows live in this process only. A token issued on another process
+ * is absent here and fails closed with `"unknown"`. Do not add shared storage.
  */
 
 /** Typed confirmation phrase for irreversible MCP writes. */
 export const MCP_CONFIRM_PHRASE = "CONFIRM" as const;
 
-/** Pending confirmation that has not yet been consumed. */
+/**
+ * Auth session a confirmation is bound to.
+ *
+ * `sid` is `McpRequester.sessionId` (`claims.sid`), not the MCP transport
+ * session id from `initialize`.
+ */
+export interface ConfirmationTarget {
+  /** Operator principal id (`claims.sub`). */
+  readonly principalId: string;
+  /** Auth session id (`claims.sid`). */
+  readonly sid: string;
+}
+
+/**
+ * Confirmation after a different session has issued its token.
+ *
+ * The write rejection that opens a confirmation never carries `token`.
+ */
 export interface PendingConfirmation {
-  /** Cryptographically random token. */
+  /** Opaque id returned to the requester. Not a token. */
+  readonly confirmationId: string;
+  /** Cryptographically random token. Present only after issue. */
   readonly token: string;
   /** Tool name the token authorises. */
   readonly tool: string;
   /** SHA-256 of canonical JSON arguments. */
   readonly argsDigest: string;
-  /** Operator / principal id that requested it. */
-  readonly principalId: string;
+  /** Requester the write is bound to. */
+  readonly target: ConfirmationTarget;
+  /** Auth session that issued the token. Distinct from {@link ConfirmationTarget.sid}. */
+  readonly issuerSid: string;
   /** Expiry epoch-ms. */
   readonly expiresAt: number;
-  /** Human reason recorded at request time. */
+  /** Human reason recorded when the token was issued. */
   readonly reason: string;
 }
 
+/**
+ * Opaque handle for a write that still needs another session to confirm.
+ *
+ * This is not a token and must not be accepted by {@link ConfirmationGate.consume}.
+ */
+export interface OpenConfirmation {
+  /** Id to pass to `oke.action.confirm`. */
+  readonly confirmationId: string;
+  /** Expiry epoch-ms of the pending row. */
+  readonly expiresAt: number;
+}
+
+/** Result of issuing a confirmation token from a second session. */
+export type ConfirmIssueResult =
+  | {
+      readonly ok: true;
+      readonly token: string;
+      readonly tool: string;
+      readonly expiresAt: number;
+    }
+  | {
+      readonly ok: false;
+      readonly reason: "unknown" | "expired" | "same-session" | "reason-short" | "already-issued";
+    };
+
 /** Result of consuming a confirmation. */
 export type ConfirmConsumeResult =
   | { readonly ok: true; readonly pending: PendingConfirmation }
@@ -37,7 +92,8 @@ export type ConfirmConsumeResult =
         | "expired"
         | "tool-mismatch"
         | "args-mismatch"
-        | "principal-mismatch"
+        | "session-mismatch"
+        | "issuer-mismatch"
         | "phrase-mismatch"
         | "reason-short";
     };
@@ -50,51 +106,128 @@ export interface ConfirmationGateOptions {
 }
 
 /**
- * Create a confirmation gate with **no session-level cache**.
- * Tokens are single-use and bound to tool + args + principal.
+ * In-process confirmation gate with **no session-level cache**.
+ *
+ * Tokens are single-use and bound to tool + args digest + target session.
+ * The map is per process: an id or token issued elsewhere fails closed
+ * with `"unknown"`. Do not add shared storage.
  */
-export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
-  readonly request: (input: {
+export interface ConfirmationGate {
+  /**
+   * Bind a write attempt to the requester.
+   *
+   * Returns an opaque confirmation id and never a token.
+   *
+   * @param input - Tool, arguments, and requester session
+   */
+  readonly open: (input: {
     readonly tool: string;
     readonly args: unknown;
-    readonly principalId: string;
+    readonly target: ConfirmationTarget;
+  }) => OpenConfirmation;
+  /**
+   * Issue a single-use token for an open confirmation.
+   *
+   * Succeeds only when `callerSid` is not the target session.
+   *
+   * @param input - Confirmation id, reason, and issuer session
+   */
+  readonly issue: (input: {
+    readonly confirmationId: string;
     readonly reason: string;
-  }) => PendingConfirmation | { readonly error: "reason-short" };
+    readonly callerSid: string;
+  }) => ConfirmIssueResult;
+  /**
+   * Consume a token for one write.
+   *
+   * Requires `consumerSid === target.sid` and `issuerSid !== consumerSid`,
+   * plus single-use, tool, args digest, expiry, and phrase checks.
+   *
+   * @param input - Write attempt presenting the token
+   */
   readonly consume: (input: {
     readonly tool: string;
     readonly args: unknown;
-    readonly principalId: string;
+    readonly consumerSid: string;
     readonly token: string;
     readonly phrase: string;
     readonly reason: string;
   }) => ConfirmConsumeResult;
   /** Test helper — pending count (never used for consent caching). */
   readonly size: () => number;
-} {
+}
+
+/** Mutable row stored in the per-process maps. */
+interface ConfirmationRecord {
+  confirmationId: string;
+  token: string | null;
+  tool: string;
+  argsDigest: string;
+  target: ConfirmationTarget;
+  issuerSid: string | null;
+  expiresAt: number;
+  reason: string;
+}
+
+/**
+ * Create a confirmation gate with **no session-level cache**.
+ *
+ * @param options - Clock and TTL
+ */
+export function createConfirmationGate(options: ConfirmationGateOptions = {}): ConfirmationGate {
   const now = options.now ?? (() => Date.now());
   const ttlMs = options.ttlMs ?? 2 * 60 * 1000;
-  const pending = new Map<string, PendingConfirmation>();
+  // Per-process only. A token issued on another process is not in these maps
+  // and fails closed with "unknown". Do not add shared storage.
+  const byId = new Map<string, ConfirmationRecord>();
+  const byToken = new Map<string, ConfirmationRecord>();
 
   return {
-    request(input) {
-      if (input.reason.trim().length < 3) {
-        return { error: "reason-short" as const };
-      }
-      prune(pending, now());
-      const token = `mcp_c_${cryptoRandomHex(24)}`;
-      const entry: PendingConfirmation = {
-        token,
+    open(input) {
+      prune(byId, byToken, now());
+      const confirmationId = `mcp_id_${cryptoRandomHex(24)}`;
+      const entry: ConfirmationRecord = {
+        confirmationId,
+        token: null,
         tool: input.tool,
         argsDigest: digestArgs(input.args),
-        principalId: input.principalId,
+        target: input.target,
+        issuerSid: null,
         expiresAt: now() + ttlMs,
-        reason: input.reason.trim(),
+        reason: "",
       };
-      pending.set(token, entry);
-      return entry;
+      byId.set(confirmationId, entry);
+      return { confirmationId, expiresAt: entry.expiresAt };
+    },
+    issue(input) {
+      if (input.reason.trim().length < 3) {
+        return { ok: false, reason: "reason-short" };
+      }
+      prune(byId, byToken, now());
+      const entry = byId.get(input.confirmationId);
+      if (!entry) {
+        return { ok: false, reason: "unknown" };
+      }
+      if (entry.expiresAt <= now()) {
+        drop(byId, byToken, entry);
+        return { ok: false, reason: "expired" };
+      }
+      // Same auth session cannot request, confirm, and invoke.
+      if (input.callerSid === entry.target.sid) {
+        return { ok: false, reason: "same-session" };
+      }
+      if (entry.token !== null) {
+        return { ok: false, reason: "already-issued" };
+      }
+      const token = `mcp_c_${cryptoRandomHex(24)}`;
+      entry.token = token;
+      entry.issuerSid = input.callerSid;
+      entry.reason = input.reason.trim();
+      byToken.set(token, entry);
+      return { ok: true, token, tool: entry.tool, expiresAt: entry.expiresAt };
     },
     consume(input) {
-      prune(pending, now());
+      prune(byId, byToken, now());
       if (!input.token) {
         return { ok: false, reason: "missing" };
       }
@@ -104,12 +237,13 @@ export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
       if (input.reason.trim().length < 3) {
         return { ok: false, reason: "reason-short" };
       }
-      const entry = pending.get(input.token);
+      const entry = byToken.get(input.token);
       if (!entry) {
+        // Missing locally — including a token issued on another process.
         return { ok: false, reason: "unknown" };
       }
       // Single-use: remove before further checks so replay fails.
-      pending.delete(input.token);
+      drop(byId, byToken, entry);
       if (entry.expiresAt <= now()) {
         return { ok: false, reason: "expired" };
       }
@@ -119,14 +253,32 @@ export function createConfirmationGate(options: ConfirmationGateOptions = {}): {
       if (entry.argsDigest !== digestArgs(input.args)) {
         return { ok: false, reason: "args-mismatch" };
       }
-      if (entry.principalId !== input.principalId) {
-        return { ok: false, reason: "principal-mismatch" };
+      if (entry.target.sid !== input.consumerSid) {
+        return { ok: false, reason: "session-mismatch" };
       }
-      return { ok: true, pending: entry };
+      if (entry.issuerSid === null || entry.issuerSid === input.consumerSid) {
+        return { ok: false, reason: "issuer-mismatch" };
+      }
+      if (entry.token === null) {
+        return { ok: false, reason: "unknown" };
+      }
+      return {
+        ok: true,
+        pending: {
+          confirmationId: entry.confirmationId,
+          token: entry.token,
+          tool: entry.tool,
+          argsDigest: entry.argsDigest,
+          target: entry.target,
+          issuerSid: entry.issuerSid,
+          expiresAt: entry.expiresAt,
+          reason: entry.reason,
+        },
+      };
     },
     size() {
-      prune(pending, now());
-      return pending.size;
+      prune(byId, byToken, now());
+      return byId.size;
     },
   };
 }
@@ -142,6 +294,15 @@ export function digestArgs(args: unknown): string {
   return hasher.digest("hex");
 }
 
+function drop(
+  byId: Map<string, ConfirmationRecord>,
+  byToken: Map<string, ConfirmationRecord>,
+  entry: ConfirmationRecord,
+): void {
+  byId.delete(entry.confirmationId);
+  if (entry.token !== null) byToken.delete(entry.token);
+}
+
 function cryptoRandomHex(byteLength: number): string {
   const bytes = new Uint8Array(byteLength);
   crypto.getRandomValues(bytes);
@@ -160,8 +321,12 @@ function canonicalJson(value: unknown): string {
   return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
 }
 
-function prune(pending: Map<string, PendingConfirmation>, t: number): void {
-  for (const [token, entry] of pending) {
-    if (entry.expiresAt <= t) pending.delete(token);
+function prune(
+  byId: Map<string, ConfirmationRecord>,
+  byToken: Map<string, ConfirmationRecord>,
+  t: number,
+): void {
+  for (const entry of byId.values()) {
+    if (entry.expiresAt <= t) drop(byId, byToken, entry);
   }
 }

package/src/mcp/docs-server.ts

@@ -11,6 +11,7 @@ import {
   forbiddenResponse,
   resolveAllowedHosts,
 } from "../runtime/security.ts";
+import { HttpBodyRejected, parseBody } from "../compiler/http-parse.ts";
 import { DOCS_MCP_PORT, type ServerHandle } from "../runtime/types.ts";
 import { asData } from "./data.ts";
 import { defaultDocsContentDir, loadDocsIndex, type DocsIndex } from "./docs-index.ts";
@@ -81,8 +82,11 @@ export async function createDocsMcpServer(
 
     let body: unknown;
     try {
-      body = await request.json();
-    } catch {
+      body = await parseBody(request);
+    } catch (err) {
+      if (err instanceof HttpBodyRejected && err.code === "PayloadTooLarge") {
+        return new Response("Payload Too Large", { status: 413 });
+      }
       return jsonRpcHttp(rpcError(null, RpcErrorCode.parse, "invalid JSON body"), 400);
     }
 
@@ -202,6 +206,7 @@ export async function serveDocsMcp(
   const server = Bun.serve({
     hostname,
     port,
+    maxRequestBodySize: 1_048_576,
     fetch: mcp.fetch,
   });
   const boundPort = server.port ?? port;

package/src/mcp/index.ts

@@ -32,8 +32,12 @@ export {
   createConfirmationGate,
   digestArgs,
   MCP_CONFIRM_PHRASE,
+  type ConfirmationGate,
+  type ConfirmationTarget,
   type ConfirmConsumeResult,
+  type ConfirmIssueResult,
   type ConfirmationGateOptions,
+  type OpenConfirmation,
   type PendingConfirmation,
 } from "./confirmation.ts";