one-code-extension 0.4.1 → 0.5.0

package/extensions/mcp/trust.ts

@@ -5,8 +5,9 @@
  * server found in .mcp.json" and remembers the answer in
  * `enabledMcpjsonServers` / `disabledMcpjsonServers` /
  * `enableAllProjectMcpServers`. One Code honours those three keys READ-ONLY
- * (user and `.claude/settings.local.json` scopes — never the checked-in
- * project `settings.json`, which would let a repo approve itself) and keeps its
+ * (the approving two from the user's settings only, the disable list from
+ * `.claude/settings.local.json` too — never the checked-in project
+ * `settings.json`, which would let a repo approve itself) and keeps its
  * own answers under `~/.onecode`, keyed to a hash of each server's config so a
  * changed command re-prompts (CC keys by name alone). Servers from
  * `~/.claude.json` and plugins never prompt: the user wrote the first, and
@@ -14,8 +15,9 @@
  * ARE prompted (that file can be checked in — `git clone && onecode` would
  * otherwise spawn its servers with no consent, review H1); CC never reads
  * `mcpServers` from that file at all. Its `enableAll*`/`enabledMcpjsonServers`
- * policy keys are honoured only when the file is not git-tracked, for the same
- * reason.
+ * policy keys are never honoured, for the same reason: git provenance cannot
+ * tell a user's file from one shipped with a copied checkout
+ * (`readClaudeMcpjsonPolicy`).
  *
  * A "No" is persisted as a project-scope disable (`lib/mcp-overrides.ts`), so
  * the server shows as disabled in `/mcp` and Enable there brings it back —
@@ -23,17 +25,15 @@
  * only. Same shape as `hooks/trust.ts`.
  */
 
-import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { promisify } from "node:util";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { readSettingsFile, settingsPaths } from "../lib/claude-settings.ts";
+import { readSettingsFile, type SettingsSource, settingsSources } from "../lib/claude-settings.ts";
+import { claudeSourcesOn } from "../lib/config-mode.ts";
 import { boundConsentItems } from "../lib/consent-preview.ts";
-import { oneCodeStateDir } from "../lib/paths.ts";
+import { consentStorePath } from "../lib/consent-stores.ts";
 import type { McpServer } from "./config.ts";
-
-const execFileAsync = promisify(execFile);
+import { escapeControlText } from "../lib/terminal-text.ts";
 
 interface ProjectApprovals {
 	/** "Use this and all future MCP servers in this project" was chosen. */
@@ -47,19 +47,42 @@ interface ApprovalStore {
 }
 
 export function approvalStorePath(): string {
-	return join(oneCodeStateDir(), "mcp", "project-approvals.json");
+	return consentStorePath("mcp");
 }
 
 /**
- * A server whose config a repository can ship (a project `.mcp.json` or a
- * checked-in `.claude/settings.local.json`) — so it is consent-gated. A
- * plugin's `.mcp.json` (also named `.mcp.json`) is excluded: installing the
- * plugin was the consent.
+ * A server whose config a repository can ship (a project `.mcp.json`, a
+ * checked-in `.claude/settings.local.json`, or pi's project `.pi/mcp.json`) —
+ * so it is consent-gated. A plugin's `.mcp.json` (also named `.mcp.json`) is
+ * excluded: installing the plugin was the consent. pi's user file
+ * (`<agentDir>/mcp.json`) is the user's own, like `~/.claude.json`.
  */
 export function isProjectScopedServer(server: McpServer, pluginConfigPaths: ReadonlySet<string>): boolean {
 	if (pluginConfigPaths.has(server.source)) return false;
 	const base = basename(server.source);
-	return base === ".mcp.json" || base === "settings.local.json";
+	return base === ".mcp.json" || base === "settings.local.json" || server.piOrigin === "project";
+}
+
+/** A server from a project `.mcp.json`: the only kind Claude Code's own answers approve. */
+function definedInMcpjson(server: McpServer): boolean {
+	return basename(server.source) === ".mcp.json";
+}
+
+/** The project file a consent-gated server comes from, as the dialog names it. */
+function configLabel(server: McpServer): string {
+	if (definedInLocalSettings(server)) return ".claude/settings.local.json";
+	// pi's project file is `<dir>/<pi's config dir>/mcp.json`, `.pi/mcp.json` unless pi is rebranded.
+	return server.piOrigin === "project" ? `${basename(dirname(server.source))}/mcp.json` : ".mcp.json";
+}
+
+/** "a and b" for the distinct config files of `servers`. */
+function configLabels(servers: McpServer[]): string {
+	return [...new Set(servers.map(configLabel))].join(" and ");
+}
+
+/** A server defined in `.claude/settings.local.json` rather than a `.mcp.json`. */
+function definedInLocalSettings(server: McpServer): boolean {
+	return basename(server.source) === "settings.local.json";
 }
 
 /** The directory the `.mcp.json` lives in — approvals are per config file, not per cwd. */
@@ -79,12 +102,15 @@ function canonicalize(value: unknown): unknown {
 	return value;
 }
 
-/** Everything that decides what the server runs or talks to; `source`/`missingEnv` are not part of it. */
+/**
+ * Everything that decides what the server runs or talks to; `source`/`missingEnv` are not part of it.
+ * A stdio `cwd` (pi's files only) joins the material only when set, so existing approvals keep their hash.
+ */
 export function hashServerConfig(server: McpServer): string {
 	const material =
 		server.kind === "stdio"
-			? { kind: "stdio", command: server.command, args: server.args, env: server.env ?? {} }
-			: { kind: "http", url: server.url, headers: server.headers ?? {} };
+			? { kind: "stdio", command: server.command, args: server.args, env: server.env ?? {}, ...(server.cwd ? { cwd: server.cwd } : {}) }
+			: { kind: "http", url: server.url, headers: server.headers ?? {}, ...(server.transport ? { transport: server.transport } : {}) };
 	return createHash("sha256").update(JSON.stringify(canonicalize(material))).digest("hex");
 }
 
@@ -100,45 +126,36 @@ function stringArray(value: unknown): string[] {
 }
 
 /**
- * Whether `.claude/settings.local.json`'s policy keys may be trusted: true ONLY
- * when git ran to a verdict and the file is not a tracked file (untracked in a
- * repo, or no repo at all — either way not something a `git clone` shipped).
- * FAILS CLOSED: git missing, a timeout, or any result we cannot interpret
- * returns false, so a checked-in file that we could not prove untracked is not
- * trusted (review H1 — a fail-open here silently re-opens the self-approval
- * hole). Async so it never blocks the event loop from the connect path
- * (findings §15: never do slow synchronous work on the startup path).
+ * Claude Code's answers that One Code honours. The approving keys
+ * (`enableAllProjectMcpServers`, `enabledMcpjsonServers`) count only from the
+ * user's `~/.claude/settings.json`. Until 2026-09-27 they also counted from a
+ * `.claude/settings.local.json` that git reported untracked, but a directory
+ * that carries its own `.git` (a tarball of a working copy, a copied or
+ * synced checkout) makes a shipped file untracked too, so its servers
+ * connected with no prompt, headless included. No check of the local file
+ * can tell who wrote it, so it no longer approves anything: its servers go
+ * through One Code's own dialog and hash-keyed store. Its
+ * `disabledMcpjsonServers` only tightens, so it is still honoured. Async for
+ * its callers; nothing here shells out any more.
  */
-async function localPolicyFileIsTrusted(cwd: string, path: string): Promise<boolean> {
-	try {
-		await execFileAsync("git", ["ls-files", "--error-unmatch", "--", path], { cwd, timeout: 5_000 });
-		return false; // exit 0 → tracked → do not trust its policy keys
-	} catch (error) {
-		// execFile rejects with `code` = the numeric exit code on a non-zero exit
-		// (1 = untracked in a repo, 128 = not a repo — both mean "not tracked, safe
-		// to trust"); a spawn failure gives a string code (e.g. "ENOENT") and a
-		// timeout gives a non-numeric code — those are "could not decide" → closed.
-		return typeof (error as { code?: unknown }).code === "number";
-	}
-}
-
 export async function readClaudeMcpjsonPolicy(cwd: string, home: string): Promise<ClaudeMcpjsonPolicy> {
-	const paths = settingsPaths(cwd, home);
+	// Independent mode (lib/config-mode.ts) reads the same keys from One Code's
+	// user file, and only the tightening one from its per-repo file.
+	const claude = claudeSourcesOn();
+	const userScope: SettingsSource = claude ? "claude-user" : "onecode-user";
+	const localScope: SettingsSource = claude ? "project-local" : "onecode-project";
 	const policy: ClaudeMcpjsonPolicy = { enableAll: false, enabled: new Set(), disabled: new Set() };
-	// Deliberately not `paths.project`: a checked-in settings.json granting
+	// Deliberately not the project file: a checked-in settings.json granting
 	// enableAllProjectMcpServers would be the repo approving its own servers.
-	// The local file is read only when it is provably not git-tracked (an
-	// untracked, user-authored file), for the same reason — a checked-in
-	// settings.local.json would otherwise approve the repo's own .mcp.json
-	// servers (review H1).
-	const sources = [paths.user];
-	if (await localPolicyFileIsTrusted(cwd, paths.local)) sources.push(paths.local);
-	for (const path of sources) {
+	// The local file is in the checkout too, whatever git says about it.
+	for (const [source, path] of settingsSources(cwd, home)) {
+		if (source !== userScope && source !== localScope) continue;
 		const file = readSettingsFile(path);
 		if (!file) continue;
+		for (const name of stringArray(file.disabledMcpjsonServers)) policy.disabled.add(name);
+		if (source === localScope) continue;
 		if (typeof file.enableAllProjectMcpServers === "boolean") policy.enableAll = file.enableAllProjectMcpServers;
 		for (const name of stringArray(file.enabledMcpjsonServers)) policy.enabled.add(name);
-		for (const name of stringArray(file.disabledMcpjsonServers)) policy.disabled.add(name);
 	}
 	return policy;
 }
@@ -182,25 +199,81 @@ export function persistEnableAll(projectRoot: string, storePath = approvalStoreP
 	writeStore(storePath, store);
 }
 
+/**
+ * Why `/mcp`'s Reconnect must not connect a server, or undefined. A server
+ * whose config references an unset variable is never connected (startup
+ * skips it and never asks for consent), so Reconnect must not either: it
+ * would spawn the command with the variable expanded to nothing, and a
+ * project server would run with no consent.
+ */
+export function reconnectRefusal(server: McpServer): string | undefined {
+	if (!server.missingEnv?.length) return undefined;
+	const names = server.missingEnv.join(", ");
+	return `"${server.name}" needs ${names} set in the environment. Set ${server.missingEnv.length === 1 ? "it" : "them"} and restart One Code.`;
+}
+
 export const CHOICE_ALL = "Use this and all future MCP servers in this project";
 export const CHOICE_THIS = "Use this MCP server";
 export const CHOICE_THESE = "Use these MCP servers";
 export const CHOICE_NO = "No";
 
-/** Claude Code's dialog title for one or several newly found servers. */
-export function promptTitle(names: string[]): string {
+/** Claude Code's dialog title for one or several newly found servers; `file` names where they were found. */
+export function promptTitle(names: string[], file = ".mcp.json"): string {
 	return names.length === 1
-		? `New MCP server found in .mcp.json: ${names[0]}`
-		: `${names.length} new MCP servers found in .mcp.json`;
+		? `New MCP server found in ${file}: ${escapeControlText(names[0])}`
+		: `${names.length} new MCP servers found in ${file}`;
+}
+
+/**
+ * Environment variables that change what a stdio server's command runs, or
+ * where it loads code from: an interpreter's preload and search paths, the
+ * dynamic loader's, `PATH`, and npm's config. Matched case-insensitively
+ * (Windows environment names are). The consent dialog shows these values in
+ * full, because `npx -y some-mcp` with `NODE_OPTIONS=--require ./x.js` is not
+ * the command it looks like.
+ */
+const EXECUTION_ENV = new Set([
+	"PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PYTHONHOME",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"BASH_ENV",
+	"ENV",
+	"JAVA_TOOL_OPTIONS",
+	"_JAVA_OPTIONS",
+	"JDK_JAVA_OPTIONS",
+	"ELECTRON_RUN_AS_NODE",
+	"GIT_SSH_COMMAND",
+	"GIT_EXEC_PATH",
+	"COMSPEC",
+	"PATHEXT",
+]);
+const EXECUTION_ENV_PREFIXES = ["DYLD_", "NPM_CONFIG_"];
+
+/** Whether an env key changes what a server's command executes (`EXECUTION_ENV`). */
+export function changesExecution(key: string): boolean {
+	const upper = key.toUpperCase();
+	return EXECUTION_ENV.has(upper) || EXECUTION_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
 }
 
 /**
  * One line per server naming what would run, for the dialog body. Commands and
- * URLs are shown in full (a truncated one hides where a padded attack lives),
- * env values are never echoed, but the variable NAMES a server's
- * command/args/env/headers reference are listed (from `referencedEnv`, captured
- * before expansion) — approving a URL should not silently ship a credential the
- * header interpolates (review M5).
+ * URLs are shown in full (a truncated one hides where a padded attack lives).
+ * Every `env` key a stdio server sets is named; the values of the keys that
+ * change what executes (`changesExecution`) are shown in full, quoted, and the
+ * rest are not echoed, since they are usually credentials. The variable NAMES
+ * a server's command/args/env/headers reference are listed too (from
+ * `referencedEnv`, captured before expansion) — approving a URL should not
+ * silently ship a credential the header interpolates (review M5).
  */
 export function describeServers(servers: McpServer[]): string {
 	const lines = servers.map((server) => {
@@ -210,14 +283,17 @@ export function describeServers(servers: McpServer[]): string {
 				: `${server.name}: ${server.url}`;
 		const vars = server.referencedEnv ?? [];
 		const headerNames = server.kind === "http" ? Object.keys(server.headers ?? {}) : [];
+		const env = server.kind === "stdio" ? Object.entries(server.env ?? {}) : [];
 		const notes = [
+			server.kind === "stdio" && server.cwd ? `cwd: ${server.cwd}` : "",
+			env.length ? `env: ${env.map(([key, value]) => (changesExecution(key) ? `${key}=${JSON.stringify(value)}` : key)).join(", ")}` : "",
 			vars.length ? `uses ${vars.map((v) => `$${v}`).join(", ")}` : "",
 			headerNames.length ? `headers: ${headerNames.join(", ")}` : "",
 		].filter(Boolean);
 		return notes.length ? `${what}\n    (${notes.join("; ")})` : what;
 	});
 	// Bound the modal: a very long command/url or many servers cannot flood it.
-	return boundConsentItems(lines, "review .mcp.json before approving");
+	return boundConsentItems(lines, `review ${configLabels(servers)} before approving`);
 }
 
 export interface McpTrustDeps {
@@ -255,9 +331,8 @@ export async function approveMcpServers(
 	const approved: McpServer[] = [];
 	const withheld: McpTrustOutcome["withheld"] = [];
 	const pending: McpServer[] = [];
-	// Reading CC's policy shells out to git (localPolicyFileIsTrusted), so only
-	// do it when a server actually needs consent — a session with only
-	// user-scope or plugin servers must not pay a git spawn at connect.
+	// Reading CC's policy reads two settings files, so only do it when a
+	// server actually needs consent.
 	const anyProjectScoped = servers.some((s) => isProjectScopedServer(s, pluginConfigPaths));
 	const claude: ClaudeMcpjsonPolicy = anyProjectScoped
 		? await readClaudeMcpjsonPolicy(cwd, home)
@@ -272,7 +347,12 @@ export async function approveMcpServers(
 			withheld.push({ server, reason: "disabled-by-claude-settings" });
 			continue;
 		}
-		if (claude.enableAll || claude.enabled.has(server.name)) {
+		// Claude Code's own answers approve `.mcp.json` servers only. A server
+		// DEFINED in settings.local.json must never be approved by that same
+		// file's `enableAllProjectMcpServers` (SECURITY-REVIEW-2026-09-23 H4), and
+		// one from pi's `.pi/mcp.json` is not a file those answers were about: both
+		// go through One Code's hash-keyed consent below, like any other.
+		if (definedInMcpjson(server) && (claude.enableAll || claude.enabled.has(server.name))) {
 			approved.push(server);
 			continue;
 		}
@@ -293,8 +373,12 @@ export async function approveMcpServers(
 
 	if (!deps.hasUI) {
 		for (const server of pending) withheld.push({ server, reason: "not-approved" });
+		// enabledMcpjsonServers approves `.mcp.json` servers only (above), so the
+		// hint names it only when one of those is waiting.
+		const fromMcpjson = pending.some(definedInMcpjson);
+		const sources = configLabels(pending);
 		deps.notify(
-			`Skipped ${pending.length} MCP server${pending.length === 1 ? "" : "s"} from .mcp.json (${pending.map((s) => s.name).join(", ")}): not yet approved and no UI to ask. Approve once in an interactive session, or set enabledMcpjsonServers in .claude/settings.local.json.`,
+			`Skipped ${pending.length} MCP server${pending.length === 1 ? "" : "s"} from ${sources} (${pending.map((s) => s.name).join(", ")}): not yet approved and no UI to ask. Approve once in an interactive session${fromMcpjson ? ", or set enabledMcpjsonServers in ~/.claude/settings.json" : ""}.`,
 		);
 		return { approved, withheld };
 	}
@@ -306,7 +390,7 @@ export async function approveMcpServers(
 	if (!prompt) {
 		const useLabel = pending.length === 1 ? CHOICE_THIS : CHOICE_THESE;
 		prompt = deps
-			.select(`${promptTitle(names)}\n\n${describeServers(pending)}\n\nThese run on your machine.`, [CHOICE_ALL, useLabel, CHOICE_NO])
+			.select(`${promptTitle(names, configLabels(pending))}\n\n${describeServers(pending)}\n\nThese run on your machine.`, [CHOICE_ALL, useLabel, CHOICE_NO])
 			.finally(() => pendingPrompts.delete(key));
 		pendingPrompts.set(key, prompt);
 	}
@@ -328,7 +412,7 @@ export async function approveMcpServers(
 		}
 	}
 	if (choice !== CHOICE_ALL && choice !== CHOICE_THIS && choice !== CHOICE_THESE) {
-		deps.notify(`MCP server${pending.length === 1 ? "" : "s"} from .mcp.json not connected (${names.join(", ")}); enable in /mcp.`);
+		deps.notify(`MCP server${pending.length === 1 ? "" : "s"} from ${configLabels(pending)} not connected (${names.join(", ")}); enable in /mcp.`);
 	}
 	return { approved, withheld };
 }

package/extensions/memory/entries.ts

@@ -24,6 +24,7 @@ import {
 	ONECODE_DESCRIPTOR,
 	ONECODE_GLOBAL_DESCRIPTOR,
 	PROJECT_DESCRIPTOR,
+	instructionRule,
 } from "../lib/claude-context.ts";
 import { forwardSlashes, isRelativeInside, tildify } from "../lib/paths.ts";
 import { tryReadFile } from "../lib/plugins.ts";
@@ -69,12 +70,16 @@ export function buildMemoryEntries(opts: {
 	home: string;
 	homeClaudeDir: string;
 	homeOneCodeDir: string;
-	memoryDir: string;
+	/** The auto-memory folder; undefined while auto-memory is off (no folder row, as in Claude Code). */
+	memoryDir: string | undefined;
 }): MemoryEntry[] {
 	const { cwd, home, homeClaudeDir, homeOneCodeDir, memoryDir } = opts;
-	// agentsFallback so a directory's AGENTS.md (when it has no CLAUDE.md) is in the
-	// list, matching what the # claudeMd block sends.
-	const discovered = discoverContextFilePaths({ cwd, homeClaudeDir, homeOneCodeDir, agentsFallback: true });
+	// The same rule the # claudeMd block uses, so the list matches what it sends.
+	const rule = instructionRule(home);
+	// Independent mode (lib/config-mode.ts) reads no CLAUDE.md: its always-offered
+	// files are the global ONECODE.md and the project's AGENTS.md instead.
+	const independent = rule === "agents-md";
+	const discovered = discoverContextFilePaths({ cwd, homeClaudeDir, homeOneCodeDir, rule });
 	const referenced = referencedImports(discovered, home);
 	// (descriptor, dir) → the discovered path, so per-dir lookups reuse the real
 	// on-disk casing discovery already resolved (no second stat/readdir here).
@@ -91,15 +96,15 @@ export function buildMemoryEntries(opts: {
 	const disp = (path: string) => displayPath(path, cwd, home);
 
 	// Global user instructions — always offered, matching CC (created on save).
-	const globalClaude = join(homeClaudeDir, "CLAUDE.md");
+	const globalOneCode = found.get(`${ONECODE_GLOBAL_DESCRIPTOR}\0${homeOneCodeDir}`);
+	const globalUser = independent ? (globalOneCode ?? join(homeOneCodeDir, "ONECODE.md")) : join(homeClaudeDir, "CLAUDE.md");
 	add({
 		title: "User instructions",
-		description: `Saved in ${disp(globalClaude)}`,
-		path: globalClaude,
+		description: `Saved in ${disp(globalUser)}`,
+		path: globalUser,
 		kind: "file",
-		exists: found.has(`${GLOBAL_DESCRIPTOR}\0${homeClaudeDir}`),
+		exists: independent ? globalOneCode !== undefined : found.has(`${GLOBAL_DESCRIPTOR}\0${homeClaudeDir}`),
 	});
-	const globalOneCode = found.get(`${ONECODE_GLOBAL_DESCRIPTOR}\0${homeOneCodeDir}`);
 	if (globalOneCode) {
 		add({
 			title: "One Code user instructions",
@@ -114,13 +119,14 @@ export function buildMemoryEntries(opts: {
 		const isCwd = d === cwd;
 		const claude = join(d, "CLAUDE.md");
 		if (isCwd) {
-			// Project instructions — always offered (created on save).
+			// Project instructions — always offered (created on save): AGENTS.md in independent mode.
+			const [name, descriptor] = independent ? ["AGENTS.md", AGENTS_DESCRIPTOR] : ["CLAUDE.md", PROJECT_DESCRIPTOR];
 			add({
 				title: "Project instructions",
-				description: `Checked in at ${disp(claude)}`,
-				path: claude,
+				description: `Checked in at ${disp(join(d, name))}`,
+				path: join(d, name),
 				kind: "file",
-				exists: found.has(`${PROJECT_DESCRIPTOR}\0${d}`),
+				exists: found.has(`${descriptor}\0${d}`),
 			});
 		} else if (found.has(`${PROJECT_DESCRIPTOR}\0${d}`)) {
 			add({ title: disp(claude), path: claude, kind: "file", exists: true });
@@ -143,6 +149,9 @@ export function buildMemoryEntries(opts: {
 				exists: true,
 			});
 		}
+		// `.claude/AGENTS.md`, which the AGENTS.md fallback loads too.
+		const dotClaudeAgents = found.get(`${AGENTS_DESCRIPTOR}\0${join(d, ".claude")}`);
+		if (dotClaudeAgents) add({ title: disp(dotClaudeAgents), path: dotClaudeAgents, kind: "file", exists: true });
 
 		const oneCode = found.get(`${ONECODE_DESCRIPTOR}\0${d}`);
 		if (oneCode) {
@@ -156,7 +165,7 @@ export function buildMemoryEntries(opts: {
 		}
 	}
 
-	add({ title: "Open auto-memory folder", path: memoryDir, kind: "folder", exists: true });
+	if (memoryDir) add({ title: "Open auto-memory folder", path: memoryDir, kind: "folder", exists: true });
 	return entries;
 }