s-app-scoder-agent 0.0.0-stage → 0.4.0

package/dist/mcp.js

@@ -0,0 +1,189 @@
+/**
+ * Minimal MCP (Model Context Protocol) client for stdio servers.
+ *
+ * Implements JSON-RPC 2.0 over stdin/stdout with line-delimited messages.
+ * Connects to configured stdio servers, exposes their tools as
+ * `mcp__<server>__<tool>` prefixed names in the agent's tool registry.
+ */
+import { spawn } from "node:child_process";
+import { CLIENT_NAME, getVersion } from "./version.js";
+export const MCP_TOOL_PREFIX = "mcp__";
+export function mcpToolKey(serverName, toolName) {
+    return `${MCP_TOOL_PREFIX}${serverName}__${toolName}`;
+}
+/** Expand {env:VAR} references in config env values. */
+function expandEnv(env) {
+    const out = {};
+    for (const [k, v] of Object.entries(env ?? {})) {
+        out[k] = v.replace(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, n) => process.env[n] ?? "");
+    }
+    return out;
+}
+// ── JSON-RPC stdio connection ─────────────────────────────────────────────────
+export class McpConnection {
+    name;
+    cfg;
+    proc = null;
+    nextId = 1;
+    pending = new Map();
+    buf = "";
+    constructor(name, cfg) {
+        this.name = name;
+        this.cfg = cfg;
+    }
+    get alive() {
+        return this.proc !== null && this.proc.exitCode === null;
+    }
+    async connect(timeoutMs = 15_000) {
+        const p = spawn(this.cfg.command, this.cfg.args ?? [], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...expandEnv(this.cfg.env) },
+        });
+        this.proc = p;
+        p.stderr?.on("data", () => { });
+        p.on("error", (e) => this.drain(new Error(`spawn: ${e.message}`)));
+        p.on("exit", () => this.drain(new Error("process exited")));
+        p.stdout?.on("data", (c) => this.onChunk(c));
+        // MCP handshake: initialize + notifications/initialized
+        await this.rpc("initialize", {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: CLIENT_NAME, version: getVersion() },
+        }, timeoutMs);
+        this.send({ jsonrpc: "2.0", method: "notifications/initialized" });
+    }
+    async listTools(timeoutMs = 120_000) {
+        const res = await this.rpc("tools/list", {}, timeoutMs);
+        return (res.tools ?? []).filter((t) => typeof t.name === "string");
+    }
+    async callTool(name, args, timeoutMs = 120_000) {
+        const res = await this.rpc("tools/call", { name, arguments: args }, timeoutMs);
+        const isErr = res.isError === true;
+        const parts = (res.content ?? []).map((c) => c.text ?? "").filter(Boolean);
+        return { ok: !isErr, output: parts.join("\n") || "(empty result)" };
+    }
+    kill() {
+        this.drain(new Error("disconnected"));
+        if (this.proc) {
+            try {
+                this.proc.kill();
+            }
+            catch { /* already dead */ }
+            this.proc = null;
+        }
+    }
+    // ── internals ─────────────────────────────────────────────────────────────
+    send(msg) {
+        if (!this.proc?.stdin?.writable)
+            return;
+        try {
+            this.proc.stdin.write(JSON.stringify(msg) + "\n");
+        }
+        catch { /* ignore */ }
+    }
+    async rpc(method, params, timeoutMs) {
+        if (!this.alive)
+            throw new Error(`MCP server "${this.name}" not connected`);
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`MCP "${method}" timed out after ${(timeoutMs / 1000).toFixed(0)}s`));
+            }, timeoutMs);
+            this.pending.set(id, {
+                resolve: (v) => { clearTimeout(timer); resolve(v); },
+                reject: (e) => { clearTimeout(timer); reject(e); },
+            });
+            this.send({ jsonrpc: "2.0", id, method, params });
+        });
+    }
+    onChunk(chunk) {
+        this.buf += chunk.toString("utf8");
+        let i;
+        while ((i = this.buf.indexOf("\n")) !== -1) {
+            const line = this.buf.slice(0, i).trim();
+            this.buf = this.buf.slice(i + 1);
+            if (!line)
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (msg.id === undefined)
+                continue;
+            const pending = this.pending.get(msg.id);
+            if (!pending)
+                continue;
+            this.pending.delete(msg.id);
+            if (msg.error)
+                pending.reject(new Error(`${msg.error.code}: ${msg.error.message}`));
+            else
+                pending.resolve(msg.result ?? {});
+        }
+    }
+    drain(err) {
+        for (const [, p] of this.pending)
+            p.reject(err);
+        this.pending.clear();
+    }
+}
+export class McpManager {
+    configs;
+    conns = new Map();
+    tools = new Map();
+    constructor(configs) {
+        this.configs = configs;
+    }
+    /** Connect all servers; skip failures with a warning. Returns discovered tool count. */
+    async connectAll() {
+        await Promise.allSettled(Object.entries(this.configs).map(async ([name, cfg]) => {
+            const conn = new McpConnection(name, cfg);
+            await conn.connect();
+            const defs = await conn.listTools();
+            for (const def of defs) {
+                const key = mcpToolKey(name, def.name);
+                if (this.tools.has(key))
+                    throw new Error(`Duplicate MCP tool: ${key}`);
+                this.tools.set(key, { conn, serverName: name, toolName: def.name, def });
+            }
+            this.conns.set(name, conn);
+        })).then((results) => {
+            results.forEach((r, i) => {
+                const name = Object.keys(this.configs)[i];
+                if (r.status === "rejected") {
+                    console.error(`⚠  MCP server "${name}" unavailable: ${String(r.reason?.message).slice(0, 160)}`);
+                }
+                else {
+                    const n = [...this.tools.values()].filter((t) => t.serverName === name).length;
+                    console.error(`✓ MCP "${name}" connected — ${n} tool${n === 1 ? "" : "s"}`);
+                }
+            });
+        });
+        return this.tools.size;
+    }
+    hasTool(name) {
+        return this.tools.has(name);
+    }
+    getTool(name) {
+        return this.tools.get(name);
+    }
+    /** Convert all discovered MCP tools to OpenAI function-calling specs. */
+    toToolSpecs() {
+        return [...this.tools.values()].map(({ conn: _, serverName, toolName, def }) => ({
+            type: "function",
+            function: {
+                name: mcpToolKey(serverName, toolName),
+                description: def.description ?? `MCP tool "${toolName}" from server "${serverName}"`,
+                parameters: def.inputSchema ?? { type: "object", properties: {} },
+            },
+        }));
+    }
+    killAll() {
+        for (const c of this.conns.values())
+            c.kill();
+        this.conns.clear();
+    }
+}

package/dist/permissions.js

@@ -0,0 +1,298 @@
+/**
+ * Permission & Safety System
+ *
+ * Layer giữa LLM tool call và actual execution.
+ * Cung cấp 3 mode: auto (run everything), ask (prompt for shell commands), readonly.
+ * Luôn deny catastrophic commands bất kể mode nào.
+ */
+import { createInterface } from "node:readline";
+// ---------------------------------------------------------------------------
+// Catastrophic command patterns — always denied, no exceptions
+// ---------------------------------------------------------------------------
+const CATASTROPHIC_PATTERNS = [
+    // rm -rf (original) — kept for backwards compatibility
+    /rm\s+-rf\s+[/~"]|(?:rm\s+-rf\s+\/\*)/i,
+    // rm with whitespace/flag variants: "rm  -rf /", "rm -fr /", "rm -r -f /",
+    // "rm --recursive --force /", "rm -rvf /" … i.e. any rm followed by one or
+    // more option flags and then a target at filesystem root or home.
+    // Does NOT match common safe commands: "rm -rf node_modules", "rm file.txt",
+    // "rm ./build" (target must START with / or ~).
+    /\brm\s+(?:-{1,2}[\w-]+\s+)+["']?[/~](?:\s|$|\/)/,
+    // rm with a single flag token containing both r/R and f (e.g. -fr, -Rf, -rvf)
+    // targeting / or ~ — covered above, but also catch "rm -fr --no-preserve-root".
+    /\brm\s+[^|;&>]*--no-preserve-root/i,
+    // base64/sh -c wrappers used to smuggle destructive commands past filters:
+    //   echo cm0gLXJmIC8= | base64 -d | sh
+    //   sh -c "rm -rf /"
+    /base64\s+(?:-d|-D|--decode)\b[^|;&]*\|\s*(?:ba|z|da)?sh\b/i,
+    /\b(?:ba|z|da)?sh\s+-c\s+["'][^"']*\brm\s+[^"']*\s-[a-zA-Z]*[rf]/i,
+    // Filesystem destruction
+    /\bmkfs(?:\.[a-z0-9]+)?\b/i,
+    /dd\s+.*of=\//i,
+    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
+    // chmod -R 777 on / or ~ (any flag spelling: -R, -r, -Rf, --recursive)
+    /\bchmod\s+(?:-{1,2}[\w-]+\s+)+[0-7]{3,4}\s+["']?[/~](?:\s|$|\/)/,
+    // Redirect raw writes to block devices: > /dev/sda, > /dev/nvme0n1, dd > disk...
+    />\s*\/dev\/(?:sd[a-z]+|hd[a-z]+|nvme\d+n\d+(?:p\d+)?|disk\d|rdisk\d)/i,
+    /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i,
+    // curl/wget pipe-to-shell: match any content between command and '| sh'/'| bash'
+    // Handles -qO-, -X POST, etc. flags; URL-like patterns must contain '/' or '.'
+    /curl\s+.*[/.].*\s*\|\s*sh\b/i,
+    /curl\s+.*[/.].*\s*\|\s*bash\b/i,
+    /wget\s+.*[/.].*\s*\|\s*sh\b/i,
+    /wget\s+.*[/.].*\s*\|\s*bash\b/i,
+    // sudo rm with any recursive/force flag combo: "sudo rm -rf x", "sudo rm -fr /usr"
+    /sudo\s+rm\s+[^|;&]*-\w*[rR]/i,
+    /\bshutdown\b|\breboot\b|\binit\s+[06]\b/i,
+    />\s*\/dev\/sda/i,
+    /\|\s*nc\s+-e\s+/i,
+    /\|\s*bash\s+-i/i,
+    /sysctl\s+-w\s+kernel\.panic=/i,
+    /echo\s+[^|]*>\s*\/etc\/sudoers/i,
+];
+function isCatastrophic(command) {
+    return CATASTROPHIC_PATTERNS.some((p) => p.test(command));
+}
+export function isDangerousCommand(command) {
+    return isCatastrophic(command);
+}
+// ---------------------------------------------------------------------------
+// Session allowlist (runtime, in-memory)
+// ---------------------------------------------------------------------------
+export class SessionAllowlist {
+    prefixes = new Set();
+    addPrefix(prefix) {
+        // Normalize to a word-bounded prefix: "git" -> "git " so that allowing
+        // "git" never matches a different binary like "gitx" or "github-cli".
+        const t = prefix.trim().replace(/\s+$/, "");
+        if (t.length === 0)
+            return;
+        this.prefixes.add(`${t} `);
+    }
+    hasMatch(command) {
+        return [...this.prefixes].some((p) => command.startsWith(p));
+    }
+    clear() {
+        this.prefixes.clear();
+    }
+}
+function extractFirstWord(command) {
+    return command.trim().split(/\s+/)[0] ?? "";
+}
+/**
+ * Classify a command given current permission config and session allowlist.
+ */
+export function classifyCommand(command, mode, configAllow, configDeny, sessionAllow) {
+    const safeFirst = extractFirstWord(command);
+    // 1. Catastrophic — always deny
+    if (isCatastrophic(command)) {
+        return { decision: "deny", reason: "matches catastrophic command pattern" };
+    }
+    // 2. Config deny list
+    if (configDeny.some((p) => command.startsWith(p.trim()))) {
+        return { decision: "deny", reason: "matches denyCommands pattern in config" };
+    }
+    // 3. Session allowlist
+    if (sessionAllow.hasMatch(command)) {
+        return { decision: "allow", reason: "allowed by session allowlist" };
+    }
+    // 4. Config allow list
+    if (configAllow.some((p) => command.startsWith(p.trim()))) {
+        return { decision: "allow", reason: "allowed by config allowCommands" };
+    }
+    // 5. Mode-dependent
+    switch (mode) {
+        case "auto":
+            return { decision: "allow", reason: "auto mode — run without confirmation" };
+        case "readonly":
+            return {
+                decision: "deny",
+                reason: "readonly mode — shell commands are disabled",
+            };
+        case "ask":
+            return {
+                decision: "ask",
+                reason: "requires user confirmation",
+                alwaysAllowPrefix: safeFirst + " ",
+            };
+    }
+}
+/**
+ * Prompt user for permission. Returns true/false. "always" is signaled via
+ * the alwaysAllowPrefix callback.
+ * Uses AbortController so timeoutSecs is actually enforced (deny on timeout).
+ */
+export async function promptForPermission(opts, onAlwaysAllow) {
+    const cmd = opts.command.length > 80 ? opts.command.slice(0, 80) + "..." : opts.command;
+    const timeoutMs = (opts.timeoutSecs ?? 60) * 1000;
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    const rl = createInterface({ input: process.stdin, output: process.stdout, signal: ac.signal });
+    // NOTE: Node's rl.question() callback is NOT invoked (and the promise never
+    // settles) when the interface is closed by an aborted signal — so we must
+    // race it against an abort promise or promptForPermission would hang forever.
+    const question = (q) => new Promise((res, _rej) => {
+        rl.question(q, (ans) => res(ans));
+    });
+    let rejectAborted = null;
+    const aborted = new Promise((_res, rej) => {
+        rejectAborted = rej;
+    });
+    ac.signal.addEventListener("abort", () => {
+        const e = new Error("permission prompt timed out");
+        e.name = "AbortError";
+        rejectAborted?.(e);
+    }, { once: true });
+    try {
+        let answer = "";
+        while (true) {
+            const timeoutStr = Math.ceil((opts.timeoutSecs ?? 60)) + "s";
+            let prompt = `⚠  run_command requires approval: ${cmd} (timeout in ${timeoutStr})\n`;
+            if (opts.alwaysAllowPrefix) {
+                prompt += `[y] yes  [a] always allow "${opts.alwaysAllowPrefix}"  [n] no  [q] quit: `;
+            }
+            else {
+                prompt += `[y] yes  [n] no  [q] quit: `;
+            }
+            try {
+                answer = (await Promise.race([question(prompt), aborted])).trim().toLowerCase();
+            }
+            catch {
+                // Timeout — AbortController triggered
+                clearTimeout(timer);
+                rl.close();
+                return false; // safe default: deny on timeout
+            }
+            if (answer === "q") {
+                clearTimeout(timer);
+                rl.close();
+                return false; // caller will abort
+            }
+            if (answer === "y") {
+                clearTimeout(timer);
+                rl.close();
+                return true;
+            }
+            if (answer === "n") {
+                clearTimeout(timer);
+                rl.close();
+                return false;
+            }
+            if (answer === "a" && opts.alwaysAllowPrefix) {
+                clearTimeout(timer);
+                rl.close();
+                onAlwaysAllow?.(opts.alwaysAllowPrefix);
+                return true;
+            }
+            // invalid answer — loop again (timeout still ticking)
+        }
+    }
+    finally {
+        clearTimeout(timer);
+        try {
+            rl.close();
+        }
+        catch { /* already closed */ }
+    }
+}
+export class PermissionChecker {
+    config;
+    sessionAllow = new SessionAllowlist();
+    allowAllEdits = false;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Check if a command should run. Returns null = allowed immediately,
+     * or a PermissionResult if user needs to be consulted.
+     */
+    classify(command) {
+        return classifyCommand(command, this.config.mode, this.config.allowCommands, this.config.denyCommands, this.sessionAllow);
+    }
+    /**
+     * Ask user interactively. Returns true = allowed, false = denied.
+     * In non-interactive mode, always returns false for "ask" decisions.
+     */
+    async confirm(command) {
+        const result = this.classify(command);
+        if (result.decision === "allow")
+            return true;
+        if (result.decision === "deny")
+            return false;
+        // Decision is "ask"
+        if (this.config.nonInteractive) {
+            // In non-interactive (CI), deny commands that need asking
+            return false;
+        }
+        return promptForPermission({
+            command,
+            alwaysAllowPrefix: result.alwaysAllowPrefix,
+        }, (prefix) => this.sessionAllow.addPrefix(prefix));
+    }
+    get sessionAllowlist() {
+        return this.sessionAllow;
+    }
+    /**
+     * Ask user to approve a file write/edit, showing the diff first.
+     * Returns true = approved, false = rejected.
+     * Enforced timeout (default 120s) — deny on timeout (safe default).
+     */
+    async confirmEdit(path, diffText, timeoutSecs = 120) {
+        if (this.allowAllEdits)
+            return true;
+        if (this.config.nonInteractive) {
+            return false;
+        }
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), timeoutSecs * 1000);
+        const rl = createInterface({ input: process.stdin, output: process.stdout, signal: ac.signal });
+        const question = (q) => new Promise((res) => rl.question(q, (ans) => res(ans)));
+        let rejectAborted = null;
+        const aborted = new Promise((_res, rej) => {
+            rejectAborted = rej;
+        });
+        ac.signal.addEventListener("abort", () => {
+            const e = new Error("edit confirmation timed out");
+            e.name = "AbortError";
+            rejectAborted?.(e);
+        }, { once: true });
+        try {
+            for (;;) {
+                let answer;
+                try {
+                    answer = (await Promise.race([
+                        question(`\nApply this change to ${path}? [y]es  [a] always (this session)  [n]o  [q]uit: `),
+                        aborted,
+                    ])).trim().toLowerCase();
+                }
+                catch {
+                    // timeout — deny (safe default)
+                    return false;
+                }
+                if (answer === "y")
+                    return true;
+                if (answer === "a") {
+                    this.allowAllEdits = true;
+                    return true;
+                }
+                if (answer === "n")
+                    return false;
+                if (answer === "q") {
+                    // Graceful abort signal instead of process.exit from library code
+                    this.abortRequested = true;
+                    return false;
+                }
+                // invalid answer — loop again (timeout still ticking)
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            try {
+                rl.close();
+            }
+            catch { /* already closed */ }
+        }
+    }
+    /** Set when the user pressed [q]uit in confirmEdit — the agent should stop. */
+    abortRequested = false;
+}