shraga 0.1.27 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/engine/claude-code.ts

@@ -14,6 +14,7 @@ import type { WsEvent, AskQuestion, QuestionAnswers, QuestionHandler } from '../
 import type { AgentEngine, EngineStreamOpts, EngineModel } from './types.ts';
 import { getPromptSuffix } from '../prompt-suffix.ts';
 import { APP_ROOT } from '../paths.ts';
+import { writeMcpConfigFile } from './mcp-config-file.ts';
 const IMMUTABLE_SYSTEM_PROMPT = readFileSync(path.resolve(import.meta.dirname, '../../../defaults/system-prompt.md'), 'utf-8');
 const DEFAULT_USER_PROMPT = `You are a helpful assistant with access to MCP tools.`;
 const DEFAULT_ALLOWED_TOOLS = ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'];
@@ -271,7 +272,14 @@ export class ClaudeCodeEngine implements AgentEngine {
     const addonSuffix = getPromptSuffix(opts.turnHints);
     options['systemPrompt'] = `${IMMUTABLE_SYSTEM_PROMPT}\n\n${userPrompt}${addonSuffix ? `\n\n${addonSuffix}` : ''}`;
     if (opts.abortController) options['abortController'] = opts.abortController;
-    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) options['mcpServers'] = opts.mcpServers;
+    // Passed as a FILE, never as `options.mcpServers` — the SDK would put the whole config (every MCP
+    // server's credentials) on the CLI's argv, where `ps` / `/proc` / journald expose it. See
+    // writeMcpConfigFile. Setting both would re-add the argv copy, so it's one or the other.
+    let mcpConfigFile: { path: string; cleanup: () => void } | undefined;
+    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) {
+      mcpConfigFile = writeMcpConfigFile(opts.mcpServers);
+      options['extraArgs'] = { ...(options['extraArgs'] as Record<string, string> | undefined), 'mcp-config': mcpConfigFile.path };
+    }
 
     const mcpNames = opts.mcpServers ? Object.keys(opts.mcpServers) : [];
     const activeModel = (options['model'] as string) || 'default';
@@ -517,6 +525,9 @@ export class ClaudeCodeEngine implements AgentEngine {
       return;
     } finally {
       clearBgTimer();
+      // The CLI has read the file by now (it loads MCP config at startup); holding it any longer just
+      // widens the window in which the credentials sit on disk.
+      mcpConfigFile?.cleanup();
     }
 
     const inferredReason = turnCount >= maxTurns ? 'max_turns_reached' : 'end_turn';

package/src/server/engine/mcp-config-file.ts

@@ -0,0 +1,35 @@
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import type { McpConfig } from '../mcp.ts';
+
+/**
+ * Hands the MCP config to the Claude Code CLI through a private FILE instead of its argv.
+ *
+ * WHY: the SDK serialises `options.mcpServers` straight onto the command line
+ * (`--mcp-config '{"mcpServers":{…}}'`), and an MCP server's `env` block is where every vendor
+ * credential lives. On the Circles box that meant the Stripe live key, a GitHub PAT with destructive
+ * writes, two Firebase service-account private keys, the prod Postgres password + bastion SSH key and
+ * the app-store signing keys were all readable by ANY local process via `ps` / `/proc/<pid>/cmdline`,
+ * and were echoed verbatim into journald (so into anything that ships logs). Argv is not a secret
+ * channel — a file we own with 0600 is.
+ *
+ * HOW: the CLI's `--mcp-config` takes either inline JSON or a path, so we write the same JSON to a
+ * 0600 file inside a 0700 temp dir and pass the path via the SDK's `extraArgs` escape hatch. The
+ * caller must NOT also set `options.mcpServers`, or the SDK appends a second `--mcp-config` with the
+ * secrets back in argv. Safe here because shraga only ships `stdio` + `http` servers; an in-process
+ * `sdk` server would have to stay on `options.mcpServers` (it holds no secrets — it's a live object).
+ */
+export function writeMcpConfigFile(mcpServers: McpConfig): { path: string; cleanup: () => void } {
+  // mkdtemp gives us a 0700 dir with an unguessable name, so the file is unreachable even in the
+  // window before the mode is applied, and two concurrent sessions can never collide.
+  const dir = mkdtempSync(path.join(tmpdir(), 'shraga-mcp-'));
+  const file = path.join(dir, 'mcp-config.json');
+  writeFileSync(file, JSON.stringify({ mcpServers }), { mode: 0o600 });
+  return {
+    path: file,
+    // Best-effort: a leaked temp dir is a much smaller problem than a crash on teardown, and the
+    // 0700/0600 modes mean a leftover file is still unreadable by other users.
+    cleanup: () => { try { rmSync(dir, { recursive: true, force: true }); } catch { /* nothing to do */ } },
+  };
+}