spacecode 2.5.5 → 2.5.7

package/dist/repl.mjs

@@ -4988,6 +4988,76 @@ var init_skill_file = __esm({
   }
 });
 
+// ../agent/src/import/claude-json-mcp.ts
+function normalizeClaudeJsonMcp(text, projectPaths) {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    if (!(err instanceof SyntaxError)) throw err;
+    return { servers: [], errors: ["not valid JSON"] };
+  }
+  const root = asObject(parsed) ?? {};
+  const serverMap = /* @__PURE__ */ new Map();
+  const processEntry = (name, raw, scope) => {
+    const entry = asObject(raw);
+    if (!entry) {
+      errors.push(`${name}: not an object`);
+      return;
+    }
+    const hasUrl = typeof entry.url === "string";
+    const hasCommand = typeof entry.command === "string";
+    let transport;
+    let url = "";
+    let command = "";
+    let args = [];
+    if (hasUrl && !hasCommand) {
+      transport = "http";
+      url = entry.url;
+    } else if (hasCommand) {
+      transport = "stdio";
+      command = entry.command;
+      if (Array.isArray(entry.args)) args = entry.args.filter((a) => typeof a === "string");
+    } else {
+      errors.push(`${name}: needs a command or a url`);
+      return;
+    }
+    const rawEnv = transport === "http" ? asObject(entry.headers) : asObject(entry.env);
+    const env3 = {};
+    const literalKeys = /* @__PURE__ */ new Set();
+    if (rawEnv) {
+      for (const [k2, v2] of Object.entries(rawEnv)) {
+        if (typeof v2 !== "string") continue;
+        if (v2.includes("${")) {
+          env3[k2] = v2;
+        } else {
+          env3[k2] = "${" + literalVarName(name, k2) + "}";
+          literalKeys.add(k2);
+        }
+      }
+    }
+    serverMap.set(name, { name, scope, transport, command, args, url, env: env3, literalKeys: [...literalKeys].sort() });
+  };
+  for (const [name, raw] of Object.entries(asObject(root.mcpServers) ?? {})) processEntry(name, raw, "user");
+  const projects = asObject(root.projects) ?? {};
+  for (const p of projectPaths) {
+    const servers = asObject(asObject(projects[p])?.mcpServers);
+    if (!servers) continue;
+    for (const [name, raw] of Object.entries(servers)) processEntry(name, raw, "project");
+  }
+  return { servers: [...serverMap.values()].sort((a, b2) => a.name < b2.name ? -1 : a.name > b2.name ? 1 : 0), errors };
+}
+var sanitize, literalVarName, asObject;
+var init_claude_json_mcp = __esm({
+  "../agent/src/import/claude-json-mcp.ts"() {
+    "use strict";
+    sanitize = (s) => s.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+    literalVarName = (server, key) => `MCP_${sanitize(server)}_${sanitize(key)}`;
+    asObject = (v2) => v2 && typeof v2 === "object" && !Array.isArray(v2) ? v2 : void 0;
+  }
+});
+
 // ../agent/src/import/tool-names.ts
 function translateToolNames(text) {
   const counts = /* @__PURE__ */ new Map();
@@ -5169,6 +5239,7 @@ async function readClaudeAssets({ fs: fs6, home, projectDirs }) {
   }
   await readCommands(fs6, home, report);
   await readSkills(fs6, home, report);
+  await readMcpServers(fs6, home, projectDirs, report);
   for (const dir of projectDirs) {
     const memDir = `${home}/.claude/projects/${claudeProjectSlug(dir)}/memory`;
     let entries;
@@ -5311,12 +5382,51 @@ async function readSkills(fs6, home, report) {
     report.assets.push({ kind: "skill", name: parsed.name, description: parsed.description, content: text, source: skillPath }, ...siblings);
   }
 }
+async function readMcpServers(fs6, home, projectDirs, report) {
+  const path12 = `${home}/.claude.json`;
+  const text = await readOptional(fs6, path12, report);
+  if (text === null) return;
+  const { servers, errors } = normalizeClaudeJsonMcp(text, projectDirs);
+  for (const e of errors) report.errors.push({ path: path12, message: e });
+  const seen = /* @__PURE__ */ new Set();
+  for (const s of servers) {
+    if (!NAME_RE3.test(s.name)) {
+      report.errors.push({ path: path12, message: `MCP server name "${s.name}" must use only letters, digits, . _ - (max 100)` });
+      continue;
+    }
+    if (seen.has(s.name.toLowerCase())) {
+      report.errors.push({ path: path12, message: `MCP server name collision on "${s.name}" (names are case-insensitive)` });
+      continue;
+    }
+    seen.add(s.name.toLowerCase());
+    const { literalKeys, ...def } = s;
+    const content = JSON.stringify(def, null, 2);
+    if (Buffer.byteLength(content, "utf8") > MAX_ASSET_BYTES) {
+      report.errors.push({ path: path12, message: `MCP server "${s.name}" skipped: over the ${MAX_ASSET_BYTES} byte asset limit` });
+      continue;
+    }
+    if (literalKeys.length > 0) {
+      report.notes.push(`MCP server "${s.name}": literal values for ${literalKeys.join(", ")} were NOT imported; set ${literalKeys.map((k2) => literalVarName(s.name, k2)).join(", ")} in your environment`);
+    }
+    if (s.transport === "http" && /[?@]/.test(s.url.replace(/^https?:\/\//, ""))) {
+      report.notes.push(`MCP server "${s.name}": its url contains a query string or credentials, which are stored as written; move any token into a header or environment variable`);
+    }
+    report.assets.push({
+      kind: "mcp",
+      name: s.name,
+      description: s.transport === "stdio" ? `stdio: ${s.command}` : `http: ${s.url}`,
+      content,
+      source: `${path12} (${s.scope})`
+    });
+  }
+}
 var MAX_ASSET_BYTES, NAME_RE3, COMMAND_NAME_RE, SKILL_NAME_RE, MAX_SKILL_FILES;
 var init_claude_sources = __esm({
   "../agent/src/import/claude-sources.ts"() {
     "use strict";
     init_command_file();
     init_skill_file();
+    init_claude_json_mcp();
     init_skill_source();
     MAX_ASSET_BYTES = 256 * 1024;
     NAME_RE3 = /^[A-Za-z0-9._-]{1,100}$/;
@@ -6103,6 +6213,45 @@ var init_skill_prompt = __esm({
   }
 });
 
+// ../agent/src/import/mcp-json-summary.ts
+function listMcpSpawns(text) {
+  const result = [];
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    return result;
+  }
+  if (typeof data !== "object" || data === null) return result;
+  const mcpServers = data["mcpServers"];
+  if (typeof mcpServers !== "object" || mcpServers === null) return result;
+  for (const [name, value] of Object.entries(mcpServers)) {
+    if (typeof value !== "object" || value === null) continue;
+    const entry = value;
+    const command = entry["command"];
+    if (typeof command !== "string") continue;
+    const argsRaw = entry["args"];
+    const args = Array.isArray(argsRaw) ? argsRaw.filter((a) => typeof a === "string") : [];
+    const envRaw = entry["env"];
+    const envNames = typeof envRaw === "object" && envRaw !== null ? Object.keys(envRaw).sort() : [];
+    result.push({ name, command, args, envNames });
+  }
+  result.sort((a, b2) => a.name.localeCompare(b2.name));
+  return result;
+}
+var init_mcp_json_summary = __esm({
+  "../agent/src/import/mcp-json-summary.ts"() {
+    "use strict";
+  }
+});
+
+// ../agent/src/import/mcp-env-expand.ts
+var init_mcp_env_expand = __esm({
+  "../agent/src/import/mcp-env-expand.ts"() {
+    "use strict";
+  }
+});
+
 // ../agent/src/index.ts
 var init_src = __esm({
   "../agent/src/index.ts"() {
@@ -6151,6 +6300,9 @@ var init_src = __esm({
     init_skill_prompt();
     init_skill_tool();
     init_skill_source();
+    init_mcp_json_summary();
+    init_mcp_env_expand();
+    init_claude_json_mcp();
   }
 });
 
@@ -6192,6 +6344,16 @@ var init_api_key = __esm({
 });
 
 // src/import-gate.ts
+var import_gate_exports = {};
+__export(import_gate_exports, {
+  REPO_SOURCE_FILES: () => REPO_SOURCE_FILES,
+  createNodeTrustStore: () => createNodeTrustStore,
+  importGateStatus: () => importGateStatus,
+  nodeTrustFs: () => nodeTrustFs,
+  readRepoSources: () => readRepoSources,
+  sha256: () => sha256,
+  writeTextAtomic: () => writeTextAtomic
+});
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, readdir, realpath, rename, writeFile } from "node:fs/promises";
 import { dirname as dirname3, join as join2 } from "node:path";
@@ -6260,7 +6422,12 @@ function nodeTrustFs() {
   return { readText: readOrNull, writeTextAtomic, realPath: (p) => realpath(p) };
 }
 function createNodeTrustStore(configDir) {
-  return new TrustStore({ fs: nodeTrustFs(), path: join2(configDir, "trust.json"), hash: sha256 });
+  let store = trustStores.get(configDir);
+  if (!store) {
+    store = new TrustStore({ fs: nodeTrustFs(), path: join2(configDir, "trust.json"), hash: sha256 });
+    trustStores.set(configDir, store);
+  }
+  return store;
 }
 async function importGateStatus(deps) {
   const lines2 = [];
@@ -6289,7 +6456,7 @@ async function importGateStatus(deps) {
   }
   return lines2;
 }
-var REPO_SOURCE_FILES, MAX_REPO_SKILL_FILES, MAX_REPO_SKILL_BYTES, sha256;
+var REPO_SOURCE_FILES, MAX_REPO_SKILL_FILES, MAX_REPO_SKILL_BYTES, sha256, trustStores;
 var init_import_gate = __esm({
   "src/import-gate.ts"() {
     "use strict";
@@ -6298,6 +6465,7 @@ var init_import_gate = __esm({
     MAX_REPO_SKILL_FILES = 200;
     MAX_REPO_SKILL_BYTES = 256 * 1024;
     sha256 = (text) => createHash("sha256").update(text).digest("hex");
+    trustStores = /* @__PURE__ */ new Map();
   }
 });
 
@@ -6706,6 +6874,86 @@ var init_import_claude = __esm({
   }
 });
 
+// src/repo-trust-prompt.ts
+var repo_trust_prompt_exports = {};
+__export(repo_trust_prompt_exports, {
+  describeRepoSources: () => describeRepoSources,
+  promptRepoTrust: () => promptRepoTrust
+});
+function ruleLists(path12, text, lines2, warnings) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (err) {
+    if (!(err instanceof SyntaxError)) throw err;
+    warnings.push(`${path12}: not valid JSON, nothing from it loads`);
+    return;
+  }
+  const perms = typeof data === "object" && data !== null ? data.permissions : void 0;
+  if (typeof perms !== "object" || perms === null) return;
+  for (const effect of ["allow", "deny", "ask"]) {
+    const list2 = perms[effect];
+    if (!Array.isArray(list2)) continue;
+    for (const rule of list2) if (typeof rule === "string") lines2.push(`  ${effect}: ${show(rule)}  (${path12})`);
+  }
+}
+function describeRepoSources(files) {
+  const out = [];
+  const warnings = [];
+  if (files[".mcp.json"] !== void 0) {
+    let valid = true;
+    try {
+      JSON.parse(files[".mcp.json"]);
+    } catch (err) {
+      if (!(err instanceof SyntaxError)) throw err;
+      valid = false;
+      warnings.push(".mcp.json: not valid JSON, nothing from it loads");
+    }
+    for (const s of valid ? listMcpSpawns(files[".mcp.json"]) : []) {
+      const env3 = s.envNames.length ? `  env: ${s.envNames.join(", ")}` : "";
+      out.push(`  spawn: ${show(s.command)} ${s.args.map(show).join(" ")}  [server ${show(s.name)}]${env3}`);
+    }
+  }
+  for (const p of [".claude/settings.json", ".claude/settings.local.json"]) {
+    if (files[p] !== void 0) ruleLists(p, files[p], out, warnings);
+  }
+  const names = Object.keys(files).sort();
+  for (const k2 of names) {
+    const m2 = /^\.claude\/commands\/([^/]+)\.md$/.exec(k2);
+    if (m2) out.push(`  command: /${show(m2[1]).slice(1, -1)}`);
+  }
+  const skills = /* @__PURE__ */ new Set();
+  for (const k2 of names) {
+    const m2 = /^\.claude\/skills\/([^/]+)\//.exec(k2);
+    if (m2) skills.add(m2[1]);
+  }
+  for (const s of [...skills].sort()) out.push(`  skill: ${show(s)}`);
+  if (files["CLAUDE.local.md"] !== void 0) out.push("  instructions: CLAUDE.local.md");
+  return [...warnings.map((w2) => `  warning: ${w2}`), ...out];
+}
+async function promptRepoTrust(cwd2, files, io) {
+  io.write(`
+This repository has Claude Code sources that can run code or change permissions:
+  ${cwd2}
+${describeRepoSources(files).join("\n")}
+
+`);
+  io.write("  1) Trust (remembered until these files change)\n  2) Trust for this session only\n  3) Never trust this repo\n  4) Skip (load nothing, ask again next time)\n");
+  const answer = (await io.ask("Choose 1-4 [4]: "))?.trim() ?? "";
+  if (answer === "1") return "trusted";
+  if (answer === "2") return "session";
+  if (answer === "3") return "never";
+  return "skip";
+}
+var show;
+var init_repo_trust_prompt = __esm({
+  "src/repo-trust-prompt.ts"() {
+    "use strict";
+    init_src();
+    show = (s) => JSON.stringify(s);
+  }
+});
+
 // ../../node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = void 0;
@@ -103221,6 +103469,40 @@ var rawCount = process.env.LAUNCH_COUNT ? parseInt(process.env.LAUNCH_COUNT, 10)
 var launchCount = rawCount !== void 0 && Number.isNaN(rawCount) ? void 0 : rawCount;
 var yolo = process.argv.includes("--yolo");
 var resumeLatest = process.argv.includes("--continue");
+if (process.stdin.isTTY && process.stdout.isTTY) {
+  try {
+    const { readRepoSources: readRepoSources2, createNodeTrustStore: createNodeTrustStore2 } = await Promise.resolve().then(() => (init_import_gate(), import_gate_exports));
+    const { promptRepoTrust: promptRepoTrust2 } = await Promise.resolve().then(() => (init_repo_trust_prompt(), repo_trust_prompt_exports));
+    const files = await readRepoSources2(process.cwd());
+    if (Object.keys(files).length > 0) {
+      const store = createNodeTrustStore2(process.env.SPACECODE_CONFIG_DIR?.trim() || path11.join(os5.homedir(), ".spacecode"));
+      if (await store.repoStatus(process.cwd(), files) === "untrusted") {
+        const { createInterface } = await import("node:readline/promises");
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+          const decision = await promptRepoTrust2(process.cwd(), files, {
+            write: (t) => {
+              process.stdout.write(t);
+            },
+            ask: async (q2) => {
+              try {
+                return await rl.question(q2);
+              } catch {
+                return null;
+              }
+            }
+          });
+          if (decision !== "skip") await store.setRepo(process.cwd(), files, decision);
+        } finally {
+          rl.close();
+        }
+      }
+    }
+  } catch (err) {
+    process.stderr.write(`Repo trust check failed (${err instanceof Error ? err.message : String(err)}); repo sources stay untrusted.
+`);
+  }
+}
 var restoreCiVariables = hideCiVariables(process.env, Boolean(process.stdout.isTTY));
 var render2;
 var App3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spacecode",
-  "version": "2.5.5",
+  "version": "2.5.7",
   "description": "SpaceCode - launch cloud dev environments with AI coding agents",
   "license": "MIT",
   "type": "commonjs",