qa360 2.2.1 → 2.2.13

package/packages/mcp/src/security/manager.ts

@@ -1,242 +0,0 @@
-/**
- * QA360 MCP Security Manager
- * Handles authentication, authorization, rate limiting, and sandboxing
- */
-
-import { resolve, normalize, relative } from 'path';
-import { existsSync } from 'fs';
-import { SecurityRedactor } from 'qa360-core';
-import { MCPServerConfig } from '../types/index.js';
-
-export class SecurityManager {
-  private config: MCPServerConfig;
-  private redactor: SecurityRedactor;
-  private rateLimitMap: Map<string, number[]> = new Map();
-
-  constructor(config: MCPServerConfig) {
-    this.config = config;
-    this.redactor = SecurityRedactor.forReports();
-  }
-
-  /**
-   * Validate tool call permissions and arguments
-   */
-  async validateToolCall(toolName: string, args: any): Promise<void> {
-    // Check tool permissions
-    if (toolName === 'qa360.run' && !this.config.allowRun) {
-      throw new Error('qa360.run tool requires --allow-run flag');
-    }
-
-    if (toolName.startsWith('qa360.secrets.') && !this.config.allowSecrets) {
-      throw new Error('Secrets tools require --allow-secrets flag');
-    }
-
-    // Validate file paths
-    if (args.packPath) {
-      this.validatePath(args.packPath);
-    }
-
-    if (args.bundlePath) {
-      this.validatePath(args.bundlePath);
-    }
-
-    if (args.path) {
-      this.validatePath(args.path);
-    }
-
-    // Check QA360 directory requirement
-    if (this.config.sandbox.requireQA360Dir) {
-      const qa360Dir = resolve(process.cwd(), '.qa360');
-      if (!existsSync(qa360Dir)) {
-        throw new Error('QA360 directory (.qa360) not found. Run a test first to initialize.');
-      }
-    }
-  }
-
-  /**
-   * Validate and normalize file paths
-   */
-  private validatePath(filePath: string): void {
-    const normalizedPath = normalize(resolve(filePath));
-    const cwd = process.cwd();
-
-    // Check if path is within allowed directories
-    const isAllowed = this.config.sandbox.allowedPaths.some(allowedPath => {
-      const resolvedAllowed = resolve(allowedPath);
-      const relativePath = relative(resolvedAllowed, normalizedPath);
-      return !relativePath.startsWith('..') && !relativePath.startsWith('/');
-    });
-
-    if (!isAllowed) {
-      throw new Error(`Path access denied: ${filePath}. Path must be within allowed directories.`);
-    }
-
-    // Prevent dangerous paths
-    const dangerousPaths = [
-      '/etc',
-      '/usr',
-      '/bin',
-      '/sbin',
-      '/System',
-      '/Library',
-      '/Windows',
-      '/Program Files'
-    ];
-
-    if (dangerousPaths.some(dangerous => normalizedPath.startsWith(dangerous))) {
-      throw new Error(`Access to system directory denied: ${filePath}`);
-    }
-
-    // Prevent traversal attacks
-    if (filePath.includes('..') || filePath.includes('~')) {
-      throw new Error(`Path traversal detected: ${filePath}`);
-    }
-  }
-
-  /**
-   * Check rate limiting
-   */
-  async checkRateLimit(): Promise<void> {
-    const now = Date.now();
-    const windowMs = this.config.rateLimit.window * 1000;
-    const key = 'global'; // Could be per-client in the future
-
-    if (!this.rateLimitMap.has(key)) {
-      this.rateLimitMap.set(key, []);
-    }
-
-    const requests = this.rateLimitMap.get(key)!;
-    
-    // Remove old requests outside the window
-    const validRequests = requests.filter(timestamp => now - timestamp < windowMs);
-    
-    if (validRequests.length >= this.config.rateLimit.requests) {
-      throw new Error(`Rate limit exceeded: ${this.config.rateLimit.requests} requests per ${this.config.rateLimit.window}s`);
-    }
-
-    // Add current request
-    validRequests.push(now);
-    this.rateLimitMap.set(key, validRequests);
-  }
-
-  /**
-   * Redact sensitive information from data
-   */
-  redactSensitiveData(data: any): any {
-    if (typeof data === 'string') {
-      return this.redactor.redact(data);
-    }
-
-    if (Array.isArray(data)) {
-      return data.map(item => this.redactSensitiveData(item));
-    }
-
-    if (data && typeof data === 'object') {
-      const redacted: any = {};
-      for (const [key, value] of Object.entries(data)) {
-        // Always redact known sensitive fields
-        if (this.isSensitiveField(key)) {
-          redacted[key] = '***';
-        } else {
-          redacted[key] = this.redactSensitiveData(value);
-        }
-      }
-      return redacted;
-    }
-
-    return data;
-  }
-
-  /**
-   * Check if field name indicates sensitive data
-   */
-  private isSensitiveField(fieldName: string): boolean {
-    const sensitiveFields = [
-      'password',
-      'secret',
-      'token',
-      'key',
-      'auth',
-      'credential',
-      'private',
-      'value' // For secrets.add
-    ];
-
-    const lowerField = fieldName.toLowerCase();
-    return sensitiveFields.some(sensitive => lowerField.includes(sensitive));
-  }
-
-  /**
-   * Validate tool arguments against schema
-   */
-  validateArguments(toolName: string, args: any): void {
-    // Basic validation - could be enhanced with JSON Schema
-    if (!args || typeof args !== 'object') {
-      throw new Error('Tool arguments must be an object');
-    }
-
-    // Tool-specific validation
-    switch (toolName) {
-      case 'qa360.run':
-        if (!args.packPath || typeof args.packPath !== 'string') {
-          throw new Error('qa360.run requires packPath string argument');
-        }
-        break;
-
-      case 'qa360.history.get':
-      case 'qa360.history.pin':
-      case 'qa360.history.unpin':
-        if (!args.runId || typeof args.runId !== 'string') {
-          throw new Error(`${toolName} requires runId string argument`);
-        }
-        if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(args.runId)) {
-          throw new Error('runId must be a valid UUID');
-        }
-        break;
-
-      case 'qa360.history.diff':
-        if (!args.runA || !args.runB || typeof args.runA !== 'string' || typeof args.runB !== 'string') {
-          throw new Error('qa360.history.diff requires runA and runB string arguments');
-        }
-        break;
-
-      case 'qa360.secrets.add':
-        if (!args.name || !args.value || typeof args.name !== 'string' || typeof args.value !== 'string') {
-          throw new Error('qa360.secrets.add requires name and value string arguments');
-        }
-        break;
-    }
-  }
-
-  /**
-   * Check if operation is allowed based on current concurrency
-   */
-  private concurrentOperations = 0;
-
-  async acquireConcurrencySlot(): Promise<void> {
-    if (this.concurrentOperations >= this.config.maxConcurrency) {
-      throw new Error(`Maximum concurrency reached: ${this.config.maxConcurrency}`);
-    }
-    this.concurrentOperations++;
-  }
-
-  releaseConcurrencySlot(): void {
-    if (this.concurrentOperations > 0) {
-      this.concurrentOperations--;
-    }
-  }
-
-  /**
-   * Get current security status
-   */
-  getSecurityStatus(): any {
-    return {
-      allowRun: this.config.allowRun,
-      allowSecrets: this.config.allowSecrets,
-      maxConcurrency: this.config.maxConcurrency,
-      currentConcurrency: this.concurrentOperations,
-      rateLimit: this.config.rateLimit,
-      auditEnabled: this.config.audit.enabled
-    };
-  }
-}

package/packages/mcp/src/server/full-server.ts

@@ -1,212 +0,0 @@
-import { fileURLToPath } from 'url';
-
-/**
- * QA360 MCP Server - Real Implementation
- * Model Context Protocol server exposing QA360 tools to LLMs and IDEs
- */
-
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema,
-  InitializeRequestSchema
-} from '@modelcontextprotocol/sdk/types.js';
-import { Command } from 'commander';
-import chalk from 'chalk';
-import { buildToolsRegistry } from '../tools/registry.js';
-
-interface MCPServerConfig {
-  allowRun: boolean;
-  allowSecrets: boolean;
-  maxConcurrency: number;
-  rateLimit: {
-    requests: number;
-    window: number;
-  };
-  audit: {
-    enabled: boolean;
-    logPath: string;
-  };
-}
-
-const DEFAULT_CONFIG: MCPServerConfig = {
-  allowRun: false,
-  allowSecrets: false,
-  maxConcurrency: 2,
-  rateLimit: {
-    requests: 5,
-    window: 1
-  },
-  audit: {
-    enabled: true,
-    logPath: '~/.qa360/mcp-audit.log'
-  }
-};
-
-class QA360MCPServer {
-  private server: Server;
-  private config: MCPServerConfig;
-  private toolRegistry: ReturnType<typeof buildToolsRegistry>;
-
-  constructor(config: MCPServerConfig) {
-    this.config = config;
-    this.toolRegistry = buildToolsRegistry({
-      allowRun: config.allowRun,
-      allowSecrets: config.allowSecrets
-    });
-
-    this.server = new Server({
-      name: 'qa360-mcp',
-      version: '0.9.0-mcp'
-    });
-
-    this.setupHandlers();
-  }
-
-  private setupHandlers() {
-    // Initialize handler
-    this.server.setRequestHandler(InitializeRequestSchema, async () => ({
-      protocolVersion: '2024-11-05',
-      capabilities: {
-        tools: {}
-      }
-    }));
-
-    // List tools handler
-    this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
-      tools: this.toolRegistry.describe()
-    }));
-
-    // Call tool handler
-    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
-      const { name, arguments: args } = request.params;
-      
-      try {
-        const result = await this.toolRegistry.call(name, args);
-        return {
-          content: [
-            {
-              type: 'text',
-              text: JSON.stringify(result, null, 2)
-            }
-          ]
-        };
-      } catch (error) {
-        throw new Error(`Tool execution failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
-      }
-    });
-  }
-
-  async start() {
-    const transport = new StdioServerTransport();
-    await this.server.connect(transport);
-    
-    console.error(chalk.green('[QA360 MCP Server] Started successfully'));
-    console.error(chalk.blue('[Config]'), JSON.stringify({
-      allowRun: this.config.allowRun,
-      allowSecrets: this.config.allowSecrets,
-      maxConcurrency: this.config.maxConcurrency,
-      rateLimit: this.config.rateLimit
-    }, null, 2));
-  }
-
-  async stop() {
-    await this.server.close();
-  }
-}
-
-// CLI Setup
-const program = new Command();
-
-program
-  .name('qa360-mcp')
-  .description('QA360 Model Context Protocol Server')
-  .version('0.9.0-mcp')
-  .option('--allow-run', 'Allow qa360.run tool execution', false)
-  .option('--allow-secrets', 'Allow secrets management tools', false)
-  .option('--max-concurrency <number>', 'Maximum concurrent operations', '2')
-  .option('--rate-limit <number>', 'Rate limit (requests per second)', '5')
-  .option('--no-audit', 'Disable audit logging')
-  .option('--audit-path <path>', 'Custom audit log path')
-  .option('--dry-run', 'Show configuration without starting server', false)
-  .option('--help-tools', 'Show available tools and exit', false);
-
-program.action(async (options) => {
-  const config: MCPServerConfig = {
-    ...DEFAULT_CONFIG,
-    allowRun: options.allowRun,
-    allowSecrets: options.allowSecrets,
-    maxConcurrency: parseInt(options.maxConcurrency) || DEFAULT_CONFIG.maxConcurrency,
-    rateLimit: {
-      requests: parseInt(options.rateLimit) || DEFAULT_CONFIG.rateLimit.requests,
-      window: DEFAULT_CONFIG.rateLimit.window
-    },
-    audit: {
-      enabled: !options.noAudit,
-      logPath: options.auditPath || DEFAULT_CONFIG.audit.logPath
-    }
-  };
-
-  if (options.dryRun) {
-    console.log(chalk.blue.bold('QA360 MCP Server Configuration:'));
-    console.log(JSON.stringify(config, null, 2));
-    return;
-  }
-
-  if (options.helpTools) {
-    const registry = buildToolsRegistry({
-      allowRun: config.allowRun,
-      allowSecrets: config.allowSecrets
-    });
-    
-    console.log(chalk.blue.bold('QA360 MCP Server - Available Tools:'));
-    console.log('');
-    
-    const tools = registry.describe();
-    tools.forEach(tool => {
-      console.log(chalk.cyan(`    ${(tool as any).name}`), chalk.white((tool as any).name), '-', (tool as any).description);
-    });
-    
-    console.log('');
-    console.log(chalk.yellow('Security flags:'));
-    console.log('  --allow-run Enable qa360.run (requires explicit opt-in)');
-    console.log('  --allow-secrets Enable secrets.* tools (requires explicit opt-in)');
-    console.log('');
-    return;
-  }
-
-  const server = new QA360MCPServer(config);
-
-  // Graceful shutdown
-  process.on('SIGINT', async () => {
-    console.error(chalk.yellow('\nShutting down...'));
-    await server.stop();
-    process.exit(0);
-  });
-
-  process.on('SIGTERM', async () => {
-    await server.stop();
-    process.exit(0);
-  });
-
-  try {
-    await server.start();
-  } catch (error) {
-    console.error(chalk.red('Failed to start MCP server:'), error);
-    process.exit(1);
-  }
-});
-
-// Handle unhandled rejections
-process.on('unhandledRejection', (reason, promise) => {
-  console.error(chalk.red('Unhandled Rejection at:'), promise, chalk.red('reason:'), reason);
-  process.exit(1);
-});
-
-// CLI entrypoint (CommonJS)
-
-/** ESM entrypoint (équivalent de require.main === module) */
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  program.parse();
-}

package/packages/mcp/src/server/minimal-server.ts

@@ -1,134 +0,0 @@
-#!/usr/bin/env node
-/**
- * Minimal MCP Server for QA360 CLI
- * Provides basic health check and validation tools
- */
-
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema,
-} from '@modelcontextprotocol/sdk/types.js';
-
-// Create server instance
-const server = new Server(
-  {
-    name: 'qa360-mcp-minimal',
-    version: '1.0.0',
-  }
-);
-
-// Define available tools
-const tools = [
-  {
-    name: 'qa360.health',
-    description: 'Check QA360 system health',
-    inputSchema: {
-      type: 'object',
-      properties: {},
-    },
-  },
-  {
-    name: 'qa360.pack.validate',
-    description: 'Validate a QA360 test pack',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        packPath: {
-          type: 'string',
-          description: 'Path to the pack YAML file',
-        },
-      },
-      required: ['packPath'],
-    },
-  },
-  {
-    name: 'qa360.history.list',
-    description: 'List recent QA360 test runs',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        limit: {
-          type: 'number',
-          description: 'Maximum number of runs to return',
-          default: 10,
-        },
-      },
-    },
-  },
-];
-
-// Handle tool listing
-server.setRequestHandler(ListToolsRequestSchema, async () => {
-  return { tools };
-});
-
-// Handle tool execution
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-  const { name, arguments: args } = request.params;
-
-  switch (name) {
-    case 'qa360.health':
-      return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify({
-              status: 'healthy',
-              version: '1.0.0',
-              timestamp: new Date().toISOString(),
-              checks: {
-                server: 'ok',
-                tools: 'ok',
-              },
-            }, null, 2),
-          },
-        ],
-      };
-
-    case 'qa360.pack.validate':
-      return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify({
-              valid: true,
-              packPath: args?.packPath || 'unknown',
-              message: 'Pack validation successful (minimal server)',
-            }, null, 2),
-          },
-        ],
-      };
-
-    case 'qa360.history.list':
-      return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify({
-              runs: [],
-              message: 'No runs found (minimal server)',
-            }, null, 2),
-          },
-        ],
-      };
-
-    default:
-      throw new Error(`Unknown tool: ${name}`);
-  }
-});
-
-// Start server
-async function main() {
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  
-  // Log to stderr (stdout is for MCP protocol)
-  console.error('QA360 MCP Minimal Server started');
-}
-
-main().catch((error) => {
-  console.error('Server error:', error);
-  process.exit(1);
-});