spacecode 2.5.5 → 2.5.6

package/dist/repl.mjs

@@ -6103,6 +6103,38 @@ var init_skill_prompt = __esm({
   }
 });
 
+// ../agent/src/import/mcp-json-summary.ts
+function listMcpSpawns(text) {
+  const result = [];
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    return result;
+  }
+  if (typeof data !== "object" || data === null) return result;
+  const mcpServers = data["mcpServers"];
+  if (typeof mcpServers !== "object" || mcpServers === null) return result;
+  for (const [name, value] of Object.entries(mcpServers)) {
+    if (typeof value !== "object" || value === null) continue;
+    const entry = value;
+    const command = entry["command"];
+    if (typeof command !== "string") continue;
+    const argsRaw = entry["args"];
+    const args = Array.isArray(argsRaw) ? argsRaw.filter((a) => typeof a === "string") : [];
+    const envRaw = entry["env"];
+    const envNames = typeof envRaw === "object" && envRaw !== null ? Object.keys(envRaw).sort() : [];
+    result.push({ name, command, args, envNames });
+  }
+  result.sort((a, b2) => a.name.localeCompare(b2.name));
+  return result;
+}
+var init_mcp_json_summary = __esm({
+  "../agent/src/import/mcp-json-summary.ts"() {
+    "use strict";
+  }
+});
+
 // ../agent/src/index.ts
 var init_src = __esm({
   "../agent/src/index.ts"() {
@@ -6151,6 +6183,7 @@ var init_src = __esm({
     init_skill_prompt();
     init_skill_tool();
     init_skill_source();
+    init_mcp_json_summary();
   }
 });
 
@@ -6192,6 +6225,16 @@ var init_api_key = __esm({
 });
 
 // src/import-gate.ts
+var import_gate_exports = {};
+__export(import_gate_exports, {
+  REPO_SOURCE_FILES: () => REPO_SOURCE_FILES,
+  createNodeTrustStore: () => createNodeTrustStore,
+  importGateStatus: () => importGateStatus,
+  nodeTrustFs: () => nodeTrustFs,
+  readRepoSources: () => readRepoSources,
+  sha256: () => sha256,
+  writeTextAtomic: () => writeTextAtomic
+});
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, readdir, realpath, rename, writeFile } from "node:fs/promises";
 import { dirname as dirname3, join as join2 } from "node:path";
@@ -6260,7 +6303,12 @@ function nodeTrustFs() {
   return { readText: readOrNull, writeTextAtomic, realPath: (p) => realpath(p) };
 }
 function createNodeTrustStore(configDir) {
-  return new TrustStore({ fs: nodeTrustFs(), path: join2(configDir, "trust.json"), hash: sha256 });
+  let store = trustStores.get(configDir);
+  if (!store) {
+    store = new TrustStore({ fs: nodeTrustFs(), path: join2(configDir, "trust.json"), hash: sha256 });
+    trustStores.set(configDir, store);
+  }
+  return store;
 }
 async function importGateStatus(deps) {
   const lines2 = [];
@@ -6289,7 +6337,7 @@ async function importGateStatus(deps) {
   }
   return lines2;
 }
-var REPO_SOURCE_FILES, MAX_REPO_SKILL_FILES, MAX_REPO_SKILL_BYTES, sha256;
+var REPO_SOURCE_FILES, MAX_REPO_SKILL_FILES, MAX_REPO_SKILL_BYTES, sha256, trustStores;
 var init_import_gate = __esm({
   "src/import-gate.ts"() {
     "use strict";
@@ -6298,6 +6346,7 @@ var init_import_gate = __esm({
     MAX_REPO_SKILL_FILES = 200;
     MAX_REPO_SKILL_BYTES = 256 * 1024;
     sha256 = (text) => createHash("sha256").update(text).digest("hex");
+    trustStores = /* @__PURE__ */ new Map();
   }
 });
 
@@ -6706,6 +6755,86 @@ var init_import_claude = __esm({
   }
 });
 
+// src/repo-trust-prompt.ts
+var repo_trust_prompt_exports = {};
+__export(repo_trust_prompt_exports, {
+  describeRepoSources: () => describeRepoSources,
+  promptRepoTrust: () => promptRepoTrust
+});
+function ruleLists(path12, text, lines2, warnings) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (err) {
+    if (!(err instanceof SyntaxError)) throw err;
+    warnings.push(`${path12}: not valid JSON, nothing from it loads`);
+    return;
+  }
+  const perms = typeof data === "object" && data !== null ? data.permissions : void 0;
+  if (typeof perms !== "object" || perms === null) return;
+  for (const effect of ["allow", "deny", "ask"]) {
+    const list2 = perms[effect];
+    if (!Array.isArray(list2)) continue;
+    for (const rule of list2) if (typeof rule === "string") lines2.push(`  ${effect}: ${show(rule)}  (${path12})`);
+  }
+}
+function describeRepoSources(files) {
+  const out = [];
+  const warnings = [];
+  if (files[".mcp.json"] !== void 0) {
+    let valid = true;
+    try {
+      JSON.parse(files[".mcp.json"]);
+    } catch (err) {
+      if (!(err instanceof SyntaxError)) throw err;
+      valid = false;
+      warnings.push(".mcp.json: not valid JSON, nothing from it loads");
+    }
+    for (const s of valid ? listMcpSpawns(files[".mcp.json"]) : []) {
+      const env3 = s.envNames.length ? `  env: ${s.envNames.join(", ")}` : "";
+      out.push(`  spawn: ${show(s.command)} ${s.args.map(show).join(" ")}  [server ${show(s.name)}]${env3}`);
+    }
+  }
+  for (const p of [".claude/settings.json", ".claude/settings.local.json"]) {
+    if (files[p] !== void 0) ruleLists(p, files[p], out, warnings);
+  }
+  const names = Object.keys(files).sort();
+  for (const k2 of names) {
+    const m2 = /^\.claude\/commands\/([^/]+)\.md$/.exec(k2);
+    if (m2) out.push(`  command: /${show(m2[1]).slice(1, -1)}`);
+  }
+  const skills = /* @__PURE__ */ new Set();
+  for (const k2 of names) {
+    const m2 = /^\.claude\/skills\/([^/]+)\//.exec(k2);
+    if (m2) skills.add(m2[1]);
+  }
+  for (const s of [...skills].sort()) out.push(`  skill: ${show(s)}`);
+  if (files["CLAUDE.local.md"] !== void 0) out.push("  instructions: CLAUDE.local.md");
+  return [...warnings.map((w2) => `  warning: ${w2}`), ...out];
+}
+async function promptRepoTrust(cwd2, files, io) {
+  io.write(`
+This repository has Claude Code sources that can run code or change permissions:
+  ${cwd2}
+${describeRepoSources(files).join("\n")}
+
+`);
+  io.write("  1) Trust (remembered until these files change)\n  2) Trust for this session only\n  3) Never trust this repo\n  4) Skip (load nothing, ask again next time)\n");
+  const answer = (await io.ask("Choose 1-4 [4]: "))?.trim() ?? "";
+  if (answer === "1") return "trusted";
+  if (answer === "2") return "session";
+  if (answer === "3") return "never";
+  return "skip";
+}
+var show;
+var init_repo_trust_prompt = __esm({
+  "src/repo-trust-prompt.ts"() {
+    "use strict";
+    init_src();
+    show = (s) => JSON.stringify(s);
+  }
+});
+
 // ../../node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = void 0;
@@ -103221,6 +103350,40 @@ var rawCount = process.env.LAUNCH_COUNT ? parseInt(process.env.LAUNCH_COUNT, 10)
 var launchCount = rawCount !== void 0 && Number.isNaN(rawCount) ? void 0 : rawCount;
 var yolo = process.argv.includes("--yolo");
 var resumeLatest = process.argv.includes("--continue");
+if (process.stdin.isTTY && process.stdout.isTTY) {
+  try {
+    const { readRepoSources: readRepoSources2, createNodeTrustStore: createNodeTrustStore2 } = await Promise.resolve().then(() => (init_import_gate(), import_gate_exports));
+    const { promptRepoTrust: promptRepoTrust2 } = await Promise.resolve().then(() => (init_repo_trust_prompt(), repo_trust_prompt_exports));
+    const files = await readRepoSources2(process.cwd());
+    if (Object.keys(files).length > 0) {
+      const store = createNodeTrustStore2(process.env.SPACECODE_CONFIG_DIR?.trim() || path11.join(os5.homedir(), ".spacecode"));
+      if (await store.repoStatus(process.cwd(), files) === "untrusted") {
+        const { createInterface } = await import("node:readline/promises");
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+          const decision = await promptRepoTrust2(process.cwd(), files, {
+            write: (t) => {
+              process.stdout.write(t);
+            },
+            ask: async (q2) => {
+              try {
+                return await rl.question(q2);
+              } catch {
+                return null;
+              }
+            }
+          });
+          if (decision !== "skip") await store.setRepo(process.cwd(), files, decision);
+        } finally {
+          rl.close();
+        }
+      }
+    }
+  } catch (err) {
+    process.stderr.write(`Repo trust check failed (${err instanceof Error ? err.message : String(err)}); repo sources stay untrusted.
+`);
+  }
+}
 var restoreCiVariables = hideCiVariables(process.env, Boolean(process.stdout.isTTY));
 var render2;
 var App3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spacecode",
-  "version": "2.5.5",
+  "version": "2.5.6",
   "description": "SpaceCode - launch cloud dev environments with AI coding agents",
   "license": "MIT",
   "type": "commonjs",