shraga 0.1.26 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/claude.ts

@@ -74,7 +74,7 @@ export type WsEvent =
   | { type: 'text_delta'; text: string }
   | { type: 'tool_use'; tool: string; toolUseId: string; input: unknown }
   | { type: 'tool_use_input'; toolUseId: string; input: unknown }
-  | { type: 'tool_result'; toolUseId: string; output: string }
+  | { type: 'tool_result'; toolUseId: string; output: string; isError?: boolean }
   | { type: 'tool_result_image'; toolUseId: string; dataUrl: string }
   | { type: 'permission_request'; id: string; tool: string; input: Record<string, unknown> }
   | { type: 'question_request'; id: string; questions: AskQuestion[] }

package/src/server/engine/claude-code.ts

@@ -14,6 +14,7 @@ import type { WsEvent, AskQuestion, QuestionAnswers, QuestionHandler } from '../
 import type { AgentEngine, EngineStreamOpts, EngineModel } from './types.ts';
 import { getPromptSuffix } from '../prompt-suffix.ts';
 import { APP_ROOT } from '../paths.ts';
+import { writeMcpConfigFile } from './mcp-config-file.ts';
 const IMMUTABLE_SYSTEM_PROMPT = readFileSync(path.resolve(import.meta.dirname, '../../../defaults/system-prompt.md'), 'utf-8');
 const DEFAULT_USER_PROMPT = `You are a helpful assistant with access to MCP tools.`;
 const DEFAULT_ALLOWED_TOOLS = ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'];
@@ -271,7 +272,14 @@ export class ClaudeCodeEngine implements AgentEngine {
     const addonSuffix = getPromptSuffix(opts.turnHints);
     options['systemPrompt'] = `${IMMUTABLE_SYSTEM_PROMPT}\n\n${userPrompt}${addonSuffix ? `\n\n${addonSuffix}` : ''}`;
     if (opts.abortController) options['abortController'] = opts.abortController;
-    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) options['mcpServers'] = opts.mcpServers;
+    // Passed as a FILE, never as `options.mcpServers` — the SDK would put the whole config (every MCP
+    // server's credentials) on the CLI's argv, where `ps` / `/proc` / journald expose it. See
+    // writeMcpConfigFile. Setting both would re-add the argv copy, so it's one or the other.
+    let mcpConfigFile: { path: string; cleanup: () => void } | undefined;
+    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) {
+      mcpConfigFile = writeMcpConfigFile(opts.mcpServers);
+      options['extraArgs'] = { ...(options['extraArgs'] as Record<string, string> | undefined), 'mcp-config': mcpConfigFile.path };
+    }
 
     const mcpNames = opts.mcpServers ? Object.keys(opts.mcpServers) : [];
     const activeModel = (options['model'] as string) || 'default';
@@ -446,7 +454,9 @@ export class ClaudeCodeEngine implements AgentEngine {
               const output = contentArr.length > 0
                 ? contentArr.filter((c: any) => c.type === 'text').map((c: any) => c.text ?? '').join('')
                 : String(block.content ?? '');
-              yield { type: 'tool_result', toolUseId: String(block.tool_use_id), output };
+              // `is_error` is the ONLY signal that a tool failed — the text alone is indistinguishable
+              // from a successful result. Scheduled `bash` tasks rely on it to notice a non-zero exit.
+              yield { type: 'tool_result', toolUseId: String(block.tool_use_id), output, isError: block.is_error === true };
 
               let foundImage = false;
               for (const c of contentArr) {
@@ -515,6 +525,9 @@ export class ClaudeCodeEngine implements AgentEngine {
       return;
     } finally {
       clearBgTimer();
+      // The CLI has read the file by now (it loads MCP config at startup); holding it any longer just
+      // widens the window in which the credentials sit on disk.
+      mcpConfigFile?.cleanup();
     }
 
     const inferredReason = turnCount >= maxTurns ? 'max_turns_reached' : 'end_turn';

package/src/server/engine/mcp-config-file.ts

@@ -0,0 +1,35 @@
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import type { McpConfig } from '../mcp.ts';
+
+/**
+ * Hands the MCP config to the Claude Code CLI through a private FILE instead of its argv.
+ *
+ * WHY: the SDK serialises `options.mcpServers` straight onto the command line
+ * (`--mcp-config '{"mcpServers":{…}}'`), and an MCP server's `env` block is where every vendor
+ * credential lives. On the Circles box that meant the Stripe live key, a GitHub PAT with destructive
+ * writes, two Firebase service-account private keys, the prod Postgres password + bastion SSH key and
+ * the app-store signing keys were all readable by ANY local process via `ps` / `/proc/<pid>/cmdline`,
+ * and were echoed verbatim into journald (so into anything that ships logs). Argv is not a secret
+ * channel — a file we own with 0600 is.
+ *
+ * HOW: the CLI's `--mcp-config` takes either inline JSON or a path, so we write the same JSON to a
+ * 0600 file inside a 0700 temp dir and pass the path via the SDK's `extraArgs` escape hatch. The
+ * caller must NOT also set `options.mcpServers`, or the SDK appends a second `--mcp-config` with the
+ * secrets back in argv. Safe here because shraga only ships `stdio` + `http` servers; an in-process
+ * `sdk` server would have to stay on `options.mcpServers` (it holds no secrets — it's a live object).
+ */
+export function writeMcpConfigFile(mcpServers: McpConfig): { path: string; cleanup: () => void } {
+  // mkdtemp gives us a 0700 dir with an unguessable name, so the file is unreachable even in the
+  // window before the mode is applied, and two concurrent sessions can never collide.
+  const dir = mkdtempSync(path.join(tmpdir(), 'shraga-mcp-'));
+  const file = path.join(dir, 'mcp-config.json');
+  writeFileSync(file, JSON.stringify({ mcpServers }), { mode: 0o600 });
+  return {
+    path: file,
+    // Best-effort: a leaked temp dir is a much smaller problem than a crash on teardown, and the
+    // 0700/0600 modes mean a leftover file is still unreadable by other users.
+    cleanup: () => { try { rmSync(dir, { recursive: true, force: true }); } catch { /* nothing to do */ } },
+  };
+}

package/src/server/scheduler/runner.ts

@@ -194,12 +194,21 @@ export async function runSchedule(
   let status: ScheduleRunSummary['status'] = 'ok';
   let error: string | undefined;
 
+  // A `bash` task is not exec'd — it's handed to the agent as a prompt, so the command's exit code
+  // reaches nobody: the agent reports the failure in prose, its own turn succeeds, the run is stored
+  // `ok`, and the failure notifier never fires. Track the tool_result of the task's OWN Bash call and
+  // fail the run with it, so a broken scheduled script alerts like a `job` does.
+  const taskBashToolUseIds = new Set<string>();
+  let bashFailure: string | undefined;
+
   onEvent({ type: 'schedule:run_started', scheduleId: schedule.id, sessionId, at: now });
 
   try {
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
       status = 'ok';
       error = undefined;
+      bashFailure = undefined;
+      taskBashToolUseIds.clear();
       try {
         for await (const ev of streamChat({
           prompt,
@@ -217,10 +226,12 @@ export async function runSchedule(
           } else if (ev.type === 'tool_use') {
             if (assistantText) { assistantBlocks.push({ type: 'text', text: assistantText }); assistantText = ''; }
             assistantBlocks.push({ type: 'tool_use', tool: ev.tool, toolUseId: ev.toolUseId, input: ev.input });
+            if (allowedCmd && ev.tool === 'Bash' && (ev.input as any)?.command === allowedCmd) taskBashToolUseIds.add(ev.toolUseId);
           } else if (ev.type === 'thinking_delta') {
             producedThinking = true;
           } else if (ev.type === 'tool_result') {
             assistantBlocks.push({ type: 'tool_result', toolUseId: ev.toolUseId, output: ev.output });
+            if (ev.isError && taskBashToolUseIds.has(ev.toolUseId)) bashFailure = ev.output;
           } else if (ev.type === 'done') {
             break;
           } else if (ev.type === 'error') {
@@ -238,6 +249,12 @@ export async function runSchedule(
         }
       }
 
+      // The agent turn can succeed while the command it was asked to run failed — that's the run failing.
+      if (status === 'ok' && bashFailure) {
+        status = 'error';
+        error = `Scheduled command failed:\n${bashFailure.slice(0, 4000)}`;
+      }
+
       if (status !== 'error') break;
 
       // The side-effect boundary. This is NOT an exact `ttft=-1` test — the engine emits events we