scalix 1.5.1 → 1.6.0

package/dist/keychain.js

@@ -1,4 +1,4 @@
-import { execFile } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -159,6 +159,30 @@ export async function getApiKeyFromKeychain(account = ACCOUNT) {
     }
     return null;
 }
+/**
+ * `security add-generic-password` with the secret delivered over stdin.
+ *
+ * Returns false rather than throwing; the caller treats that as "no keychain"
+ * and falls back to the config file. There is deliberately no argv fallback —
+ * that is the thing this exists to avoid.
+ */
+function addGenericPasswordViaStdin(apiKey, account) {
+    return new Promise((resolve) => {
+        const child = spawn('security', [
+            'add-generic-password',
+            '-s', SERVICE,
+            '-a', account,
+            '-U',
+            '-w',
+        ], { stdio: ['pipe', 'ignore', 'ignore'] });
+        const timer = setTimeout(() => child.kill('SIGKILL'), KEYCHAIN_TIMEOUT_MS);
+        child.once('error', () => { clearTimeout(timer); resolve(false); });
+        child.once('close', (code) => { clearTimeout(timer); resolve(code === 0); });
+        // EPIPE if security exits before reading — already covered by the exit code.
+        child.stdin.on('error', () => { });
+        child.stdin.end(`${apiKey}\n${apiKey}\n`);
+    });
+}
 export async function setApiKeyInKeychain(apiKey, account = ACCOUNT) {
     if (keychainDisabled())
         return false;
@@ -178,14 +202,15 @@ export async function setApiKeyInKeychain(apiKey, account = ACCOUNT) {
             catch {
                 // entry didn't exist
             }
-            await exec('security', [
-                'add-generic-password',
-                '-s', SERVICE,
-                '-a', account,
-                '-w', apiKey,
-                '-U',
-            ]);
-            return true;
+            // `-w <key>` puts the API key in this process's argv, where every other
+            // user on the machine can read it out of `ps -ef` for as long as the call
+            // runs. `security` reads the secret from stdin when -w is given no value,
+            // so hand it over that way instead. Some releases prompt twice (enter,
+            // then confirm); writing the key on two lines satisfies both, and a
+            // single-read build simply ignores the trailing line.
+            if (await addGenericPasswordViaStdin(apiKey, account))
+                return true;
+            return false;
         }
         if (await isLinuxWithSecretTool()) {
             const child = exec('secret-tool', [

package/dist/marketplace.js

@@ -0,0 +1,400 @@
+/**
+ * Scalix Marketplace client — the curated plugin catalog.
+ *
+ * Coder/Editor/IDE all install the same artifacts (`mcp-services.json`,
+ * `.scalix/skills/`, `.scalix/rules/`, `.scalix/agents/`), and this module is
+ * the one place Coder learns about what the catalog offers and writes it to
+ * disk. The catalog is SERVER data: everything it returns is untrusted input
+ * until validated here, which is why every payload is re-checked client-side
+ * (path traversal, transport shape, credential-looking values) before a
+ * single byte touches the workspace. A compromised backend must not be able
+ * to write outside this project's own config directory.
+ *
+ * Contract: scalix-cloud/docs/MARKETPLACE.md (the crate that serves this is
+ * crates/marketplace). When one changes, the other changes.
+ */
+import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import { normalizeMcpConfig, validateMcpUrl } from './mcp.js';
+import { logger } from './logger.js';
+/** Same env override the IDE/Editor clients accept, so one variable redirects all three. */
+const DEFAULT_MARKETPLACE_URL = 'https://api.scalix.world/v1/marketplace';
+export function marketplaceBaseUrl(env = process.env) {
+    const override = env.SCALIX_MARKETPLACE_URL?.trim();
+    return (override || DEFAULT_MARKETPLACE_URL).replace(/\/+$/, '');
+}
+const KINDS = ['mcp', 'skill', 'rule', 'subagent'];
+const TRUSTS = ['official', 'verified', 'community'];
+const SURFACES = ['coder', 'ide', 'editor', 'console'];
+/** Size mirror of the server's caps — a listing bigger than this is a bug upstream. */
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_FILES = 10;
+// ── Client-side validation (server already enforced these; we re-check) ─────
+const LISTING_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+([-+][A-Za-z0-9.-_]{0,32})?$/;
+const ENV_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
+const BARE_COMMAND_RE = /^[A-Za-z0-9._@-]{1,64}$/;
+/** Relative path under a listing's install dir: no roots, no traversal, no backslashes. */
+export function isSafeMarketplacePath(rel) {
+    if (!rel || rel.length > 256)
+        return false;
+    if (rel.startsWith('/') || rel.startsWith('\\') || rel.includes('\\'))
+        return false;
+    if (rel.includes('..'))
+        return false;
+    const segments = rel.split('/');
+    if (segments.length > 6)
+        return false;
+    return segments.every(s => s.length > 0 &&
+        s !== '.' &&
+        !s.startsWith('-') &&
+        /^[A-Za-z0-9._ -]+$/.test(s));
+}
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Parse + narrow one API payload into the discriminated union, or null. */
+export function parsePayload(raw) {
+    if (!isPlainRecord(raw))
+        return null;
+    const kind = raw.kind;
+    if (kind === 'mcp') {
+        const transport = raw.transport;
+        if (transport !== 'http' && transport !== 'stdio')
+            return null;
+        if (typeof raw.serverLabel !== 'string' || raw.serverLabel.length < 2)
+            return null;
+        const payload = { kind: 'mcp', transport, serverLabel: raw.serverLabel };
+        if (transport === 'http') {
+            // Catalog contract is STRICTER than a hand-written config: https only
+            // (validateMcpUrl itself allows plain http for local servers), plus the
+            // shared SSRF/private-host guard — a compromised backend must not be
+            // able to aim a "curated" entry at 169.254.169.254 with our headers.
+            if (typeof raw.serverUrl !== 'string')
+                return null;
+            if (!raw.serverUrl.startsWith('https://'))
+                return null;
+            const blocked = validateMcpUrl(raw.serverUrl);
+            if (blocked)
+                return null;
+            payload.serverUrl = raw.serverUrl;
+            if (raw.authorizationEnv !== undefined) {
+                if (typeof raw.authorizationEnv !== 'string' || !ENV_RE.test(raw.authorizationEnv))
+                    return null;
+                payload.authorizationEnv = raw.authorizationEnv;
+            }
+        }
+        else {
+            if (typeof raw.command !== 'string' || !BARE_COMMAND_RE.test(raw.command))
+                return null;
+            payload.command = raw.command;
+            if (raw.args !== undefined) {
+                if (!Array.isArray(raw.args) || raw.args.some(a => typeof a !== 'string' || a.length > 512))
+                    return null;
+                payload.args = raw.args;
+            }
+        }
+        if (raw.headers !== undefined) {
+            if (!isPlainRecord(raw.headers))
+                return null;
+            const headers = {};
+            for (const [k, v] of Object.entries(raw.headers)) {
+                if (typeof v !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(k))
+                    return null;
+                headers[k] = v;
+            }
+            payload.headers = headers;
+        }
+        if (raw.requiredEnv !== undefined) {
+            if (!Array.isArray(raw.requiredEnv))
+                return null;
+            const names = [];
+            for (const name of raw.requiredEnv) {
+                if (typeof name !== 'string' || !ENV_RE.test(name))
+                    return null;
+                names.push(name);
+            }
+            payload.requiredEnv = names;
+        }
+        return payload;
+    }
+    if (kind === 'skill') {
+        if (typeof raw.name !== 'string' || raw.name.length < 2)
+            return null;
+        if (!Array.isArray(raw.files) || raw.files.length === 0 || raw.files.length > MAX_FILES)
+            return null;
+        const files = [];
+        for (const file of raw.files) {
+            if (!isPlainRecord(file) || typeof file.path !== 'string' || typeof file.content !== 'string')
+                return null;
+            if (!isSafeMarketplacePath(file.path))
+                return null;
+            if (file.content.length > MAX_FILE_BYTES)
+                return null;
+            files.push({ path: file.path, content: file.content });
+        }
+        if (!files.some(f => f.path === 'SKILL.md'))
+            return null;
+        return { kind: 'skill', name: raw.name, files };
+    }
+    if (kind === 'rule' || kind === 'subagent') {
+        if (typeof raw.fileName !== 'string' || !raw.fileName.endsWith('.md'))
+            return null;
+        if (!isSafeMarketplacePath(raw.fileName))
+            return null;
+        if (typeof raw.content !== 'string' || !raw.content || raw.content.length > MAX_FILE_BYTES)
+            return null;
+        return { kind, fileName: raw.fileName, content: raw.content };
+    }
+    return null;
+}
+function parseSummary(raw) {
+    if (!isPlainRecord(raw))
+        return null;
+    const { id, kind, name, summary } = raw;
+    if (typeof id !== 'string' || !LISTING_ID_RE.test(id))
+        return null;
+    if (typeof kind !== 'string' || !KINDS.includes(kind))
+        return null;
+    if (typeof name !== 'string' || !name)
+        return null;
+    if (typeof summary !== 'string')
+        return null;
+    const trust = typeof raw.trust === 'string' && TRUSTS.includes(raw.trust)
+        ? raw.trust
+        : 'community';
+    const arrayOf = (value) => Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+    return {
+        id,
+        kind: kind,
+        name,
+        summary,
+        author: typeof raw.author === 'string' ? raw.author : '',
+        trust,
+        install_count: typeof raw.install_count === 'number' ? raw.install_count : 0,
+        version: typeof raw.version === 'string' ? raw.version : '',
+        featured: raw.featured === true,
+        categories: arrayOf(raw.categories),
+        tags: arrayOf(raw.tags),
+    };
+}
+// ── API ─────────────────────────────────────────────────────────────────────
+async function fetchJson(url, timeoutMs = 10_000) {
+    const response = await fetch(url, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!response.ok) {
+        throw new Error(`marketplace responded ${response.status}`);
+    }
+    return response.json();
+}
+export async function listMarketplaceListings(options = {}) {
+    const base = options.baseUrl ?? marketplaceBaseUrl();
+    const params = new URLSearchParams();
+    if (options.q)
+        params.set('q', options.q);
+    if (options.kind)
+        params.set('kind', options.kind);
+    params.set('limit', String(Math.min(Math.max(options.limit ?? 50, 1), 100)));
+    if (options.offset)
+        params.set('offset', String(options.offset));
+    const body = await fetchJson(`${base}/listings?${params.toString()}`);
+    if (!isPlainRecord(body) || !Array.isArray(body.listings)) {
+        throw new Error('marketplace returned an unexpected listings payload');
+    }
+    const parsed = [];
+    for (const entry of body.listings) {
+        const summary = parseSummary(entry);
+        if (summary)
+            parsed.push(summary);
+    }
+    return parsed;
+}
+export async function getMarketplaceListing(id, baseUrl) {
+    if (!LISTING_ID_RE.test(id))
+        throw new Error(`invalid marketplace listing id: ${id}`);
+    const base = baseUrl ?? marketplaceBaseUrl();
+    const raw = await fetchJson(`${base}/listings/${encodeURIComponent(id)}`);
+    const summary = parseSummary(raw);
+    if (!summary || !isPlainRecord(raw))
+        throw new Error('marketplace returned an unexpected listing payload');
+    const detail = {
+        ...summary,
+        description: typeof raw.description === 'string' ? raw.description : '',
+        homepage_url: typeof raw.homepage_url === 'string' ? raw.homepage_url : '',
+        icon_url: typeof raw.icon_url === 'string' ? raw.icon_url : '',
+        payload: parsePayload(raw.payload),
+    };
+    return detail;
+}
+/** Best-effort anonymous telemetry. Never fails an install. */
+export async function reportMarketplaceInstall(detail, surface = 'coder') {
+    try {
+        if (!SURFACES.includes(surface))
+            return;
+        if (!LISTING_ID_RE.test(detail.id) || !VERSION_RE.test(detail.version))
+            return;
+        await fetch(`${marketplaceBaseUrl()}/installs`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ listing_id: detail.id, version: detail.version, surface }),
+            signal: AbortSignal.timeout(5_000),
+        });
+    }
+    catch (err) {
+        logger.debug(`marketplace install telemetry skipped: ${err?.message ?? err}`);
+    }
+}
+// ── Install ─────────────────────────────────────────────────────────────────
+const MCP_CONFIG = 'mcp-services.json';
+async function readWorkspaceFile(rel) {
+    try {
+        return await fs.readFile(path.resolve(rel), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Merge one MCP entry into `mcp-services.json`, preserving every existing
+ * server (through normalizeMcpConfig, so the object-map dialect the IDE panel
+ * writes survives). Returns the relative path touched.
+ */
+async function installMcpEntry(payload, options) {
+    const configPath = path.resolve(options.cwd ?? process.cwd(), MCP_CONFIG);
+    let config = { mcpServers: [] };
+    const existing = await readWorkspaceFile(configPath);
+    if (existing) {
+        const parsed = normalizeMcpConfig(JSON.parse(existing));
+        config.mcpServers = Array.isArray(parsed?.mcpServers) ? parsed.mcpServers : [];
+    }
+    const entry = { serverLabel: payload.serverLabel };
+    if (payload.transport === 'http') {
+        const blocked = validateMcpUrl(payload.serverUrl);
+        if (blocked) {
+            return { success: false, message: '', paths: [], error: `refused marketplace MCP URL: ${blocked}` };
+        }
+        entry.serverUrl = payload.serverUrl;
+        if (payload.authorizationEnv)
+            entry.authorizationEnv = payload.authorizationEnv;
+        if (payload.headers && Object.keys(payload.headers).length > 0)
+            entry.headers = payload.headers;
+    }
+    else {
+        // A stdio entry spawns a local process — the caller must have confirmed
+        // explicitly (the slash command asks; the agent tool refuses without it).
+        if (!options.confirmStdio) {
+            return {
+                success: false,
+                message: '',
+                paths: [],
+                error: 'this listing installs a local MCP server (stdio) — re-run with explicit confirmation',
+            };
+        }
+        entry.command = payload.command;
+        entry.args = payload.args ?? [];
+    }
+    if (config.mcpServers.some(s => s?.serverLabel === payload.serverLabel)) {
+        return {
+            success: false,
+            message: '',
+            paths: [],
+            error: `an MCP server labelled "${payload.serverLabel}" is already configured`,
+        };
+    }
+    config.mcpServers.push(entry);
+    config.mcpServers = config.mcpServers.filter((s) => Boolean(s));
+    await fs.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf-8');
+    const envNote = payload.requiredEnv?.length
+        ? ` Set ${payload.requiredEnv.join(', ')} in your environment before restarting the session.`
+        : '';
+    return {
+        success: true,
+        message: `Added MCP server ${payload.serverLabel} to ${MCP_CONFIG} (restart or /mcp to connect).${envNote}`,
+        paths: [MCP_CONFIG],
+    };
+}
+/** Write a listing's files under its install directory, re-validating every path. */
+async function writeListingFiles(files, targetDir, workspaceCwd) {
+    const written = [];
+    const resolvedTarget = path.resolve(targetDir);
+    for (const file of files) {
+        if (!isSafeMarketplacePath(file.path)) {
+            throw new Error(`refusing unsafe install path: ${file.path}`);
+        }
+        const target = path.resolve(resolvedTarget, file.path);
+        if (!target.startsWith(resolvedTarget + path.sep)) {
+            throw new Error(`refusing path outside the install directory: ${file.path}`);
+        }
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        await fs.writeFile(target, file.content, 'utf-8');
+        written.push(path.relative(workspaceCwd, target));
+    }
+    return written;
+}
+/**
+ * Install one listing into the current workspace. Nothing here can write
+ * outside the workspace: every path is re-validated, and every target lives
+ * under the project's own `.scalix/` directory or the root MCP config.
+ */
+export async function installMarketplaceListing(detail, options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    if (!detail.payload) {
+        return { success: false, message: '', paths: [], error: 'listing has no installable payload' };
+    }
+    try {
+        switch (detail.payload.kind) {
+            case 'mcp':
+                return await installMcpEntry(detail.payload, { ...options, cwd });
+            case 'skill': {
+                if (!detail.payload.files.some(f => f.path === 'SKILL.md')) {
+                    return { success: false, message: '', paths: [], error: 'skill payload has no SKILL.md' };
+                }
+                const dir = path.join(cwd, '.scalix', 'skills', detail.payload.name);
+                const paths = await writeListingFiles(detail.payload.files, dir, cwd);
+                return { success: true, message: `Installed skill ${detail.payload.name} (${paths.join(', ')})`, paths };
+            }
+            case 'rule':
+            case 'subagent': {
+                const subdir = detail.payload.kind === 'rule' ? 'rules' : 'agents';
+                const dir = path.join(cwd, '.scalix', subdir);
+                await fs.mkdir(dir, { recursive: true });
+                const paths = await writeListingFiles([{ path: detail.payload.fileName, content: detail.payload.content }], dir, cwd);
+                return {
+                    success: true,
+                    message: `Installed ${detail.payload.kind} ${detail.payload.fileName} (${paths.join(', ')})`,
+                    paths,
+                };
+            }
+        }
+    }
+    catch (err) {
+        return { success: false, message: '', paths: [], error: err?.message ?? String(err) };
+    }
+}
+/** Convenience: fetch a listing, install it, and report telemetry (best effort). */
+export async function installFromMarketplace(listingId, options = {}) {
+    const detail = await getMarketplaceListing(listingId);
+    const result = await installMarketplaceListing(detail, options);
+    if (result.success)
+        await reportMarketplaceInstall(detail);
+    return result;
+}
+export { KINDS as MARKETPLACE_KINDS, TRUSTS as MARKETPLACE_TRUSTS };
+/** True when the workspace already has an MCP server under this label. */
+export function hasMcpLabel(cwd, label) {
+    const configPath = path.resolve(cwd, MCP_CONFIG);
+    if (!fsSync.existsSync(configPath))
+        return false;
+    try {
+        const parsed = normalizeMcpConfig(JSON.parse(fsSync.readFileSync(configPath, 'utf-8')));
+        if (!Array.isArray(parsed?.mcpServers))
+            return false;
+        return parsed.mcpServers.some((s) => s?.serverLabel === label);
+    }
+    catch {
+        return false;
+    }
+}