triflux 10.0.0 → 10.0.2

package/scripts/mcp-gateway-start.mjs

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+// mcp-gateway-start.mjs — supergateway MCP SSE 영속 서비스 관리
+// Usage: node mcp-gateway-start.mjs          # 시작
+//        node mcp-gateway-start.mjs --stop   # 중지
+//        node mcp-gateway-start.mjs --status # 상태 확인
+
+import { spawn, execSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createConnection } from 'node:net';
+import { isServerEnabled } from './lib/mcp-manifest.mjs';
+
+const PID_FILE = join(tmpdir(), 'tfx-gateway-pids.json');
+const STARTUP_WAIT_MS = 8000;
+const POLL_INTERVAL_MS = 500;
+const HEALTH_TIMEOUT_MS = 3000;
+
+const SERVERS = [
+  { name: 'context7',     port: 8100, cmd: 'npx -y @upstash/context7-mcp@latest',          envVars: [] },
+  { name: 'brave-search', port: 8101, cmd: 'npx -y @brave/brave-search-mcp-server',        envVars: ['BRAVE_API_KEY'] },
+  { name: 'exa',          port: 8102, cmd: 'npx -y exa-mcp-server',                        envVars: ['EXA_API_KEY'] },
+  { name: 'tavily',       port: 8103, cmd: 'npx -y tavily-mcp@latest',                     envVars: ['TAVILY_API_KEY'] },
+  { name: 'jira',         port: 8104, cmd: 'npx -y mcp-jira-cloud@latest',                 envVars: ['JIRA_API_TOKEN', 'JIRA_EMAIL', 'JIRA_INSTANCE_URL'] },
+  { name: 'serena',       port: 8105, cmd: 'uvx --from git+https://github.com/oraios/serena serena start-mcp-server', envVars: [] },
+  { name: 'notion',       port: 8106, cmd: 'npx -y @notionhq/notion-mcp-server',           envVars: ['NOTION_TOKEN'] },
+  { name: 'notion-guest', port: 8107, cmd: 'npx -y @notionhq/notion-mcp-server',           envVars: ['NOTION_TOKEN'] },
+];
+
+export { SERVERS };
+
+// ── 유틸리티 ──
+
+function isPortInUse(port) {
+  return new Promise((resolve) => {
+    const sock = createConnection({ host: '127.0.0.1', port });
+    sock.once('connect', () => { sock.destroy(); resolve(true); });
+    sock.once('error', () => resolve(false));
+    sock.setTimeout(1000, () => { sock.destroy(); resolve(false); });
+  });
+}
+
+async function checkHealth(port) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/healthz`, {
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// ── 시작 ──
+
+function spawnGateway(srv) {
+  // 임시 .cmd 파일로 quoting 문제 회피
+  const cmdContent = `@echo off\nnpx -y supergateway --stdio "${srv.cmd}" --port ${srv.port} --outputTransport sse --healthEndpoint /healthz --cors "http://localhost"`;
+  const cmdFile = join(tmpdir(), `tfx-sg-${srv.name}.cmd`);
+  writeFileSync(cmdFile, cmdContent);
+
+  // PowerShell Start-Process: Windows Job Object에서 벗어나 부모 종료 후 생존
+  execSync(
+    `powershell -NoProfile -Command "Start-Process -WindowStyle Hidden -FilePath cmd.exe -ArgumentList '/c','${cmdFile.replaceAll("'", "''")}'"`
+  , { stdio: 'ignore', timeout: 10000 });
+}
+
+function ensureFirewallRule() {
+  if (process.platform !== 'win32') return;
+  const ports = SERVERS.map((s) => s.port).join(',');
+  const ruleName = 'TFX-MCP-Gateway-Block-External';
+  try {
+    // 기존 규칙 있으면 스킵
+    const check = execSync(
+      `netsh advfirewall firewall show rule name="${ruleName}" 2>&1`,
+      { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 5000 },
+    );
+    if (check.includes(ruleName)) return;
+  } catch { /* 규칙 없음 — 생성 */ }
+
+  try {
+    execSync(
+      `netsh advfirewall firewall add rule name="${ruleName}" dir=in action=block protocol=tcp localport=${ports} remoteip=any profile=any`,
+      { stdio: 'ignore', timeout: 5000 },
+    );
+    console.log(`[SEC] Firewall rule added: block external access to ports ${ports}`);
+  } catch {
+    console.log(`[SEC] WARNING: Could not add firewall rule — run as admin or manually block ports ${ports}`);
+  }
+}
+
+async function startAll() {
+  ensureFirewallRule();
+  const launched = [];
+
+  for (const srv of SERVERS) {
+    // 포트 사용 중이면 스킵
+    if (await isPortInUse(srv.port)) {
+      console.log(`[SKIP] ${srv.name} already running on :${srv.port}`);
+      continue;
+    }
+
+    // 매니페스트 체크 (위저드에서 비활성화한 서버)
+    if (!isServerEnabled(srv.name)) {
+      console.log(`[SKIP] ${srv.name} — manifest에서 비활성`);
+      continue;
+    }
+
+    // 필수 환경변수 체크
+    const missing = srv.envVars.filter((k) => !process.env[k]);
+    if (missing.length > 0) {
+      console.log(`[WARN] ${srv.name} skipped — missing env: ${missing.join(', ')}`);
+      continue;
+    }
+
+    spawnGateway(srv);
+    launched.push(srv);
+    console.log(`[START] ${srv.name} on :${srv.port}`);
+  }
+
+  if (launched.length === 0) {
+    console.log('\n[gateway] No servers started (all running or skipped)');
+    return;
+  }
+
+  // 헬스체크 대기
+  console.log(`\n[gateway] Waiting for ${launched.length} servers...`);
+  const deadline = Date.now() + STARTUP_WAIT_MS;
+  const pending = new Set(launched.map((s) => s.port));
+
+  while (pending.size > 0 && Date.now() < deadline) {
+    await sleep(POLL_INTERVAL_MS);
+    for (const port of [...pending]) {
+      if (await checkHealth(port)) pending.delete(port);
+    }
+  }
+
+  // 결과 출력
+  console.log('\nHealth Check');
+  console.log('='.repeat(50));
+  const pidEntries = [];
+  for (const srv of launched) {
+    const healthy = !pending.has(srv.port);
+    const mark = healthy ? '\u2713' : '\u2717';
+    const status = healthy ? 'ok' : 'down';
+    console.log(`  ${srv.name.padEnd(16)} :${srv.port}  ${mark} ${status}`);
+    if (healthy) pidEntries.push({ name: srv.name, port: srv.port });
+  }
+
+  // PID 파일 대신 포트 매니페스트 저장 (프로세스 찾기는 포트 기반)
+  const existing = loadManifest();
+  const merged = [...existing.filter((e) => !pidEntries.some((p) => p.port === e.port)), ...pidEntries];
+  writeFileSync(PID_FILE, JSON.stringify(merged, null, 2));
+  console.log(`\n[gateway] ${launched.length - pending.size}/${launched.length} healthy. Manifest: ${PID_FILE}`);
+}
+
+// ── 중지 ──
+
+function stopAll() {
+  // supergateway + 하위 MCP 프로세스를 포트 기반으로 찾아 종료
+  try {
+    // temp .ps1 파일로 bash/cmd 쿼팅 충돌 회피
+    const psFile = join(tmpdir(), 'tfx-sg-stop.ps1');
+    writeFileSync(psFile, [
+      `Get-CimInstance Win32_Process -Filter "Name='node.exe' OR Name='cmd.exe'" |`,
+      `  Where-Object { $_.CommandLine -match 'supergateway' } |`,
+      `  ForEach-Object { taskkill /F /T /PID $_.ProcessId 2>$null; Write-Output "[STOP] PID $($_.ProcessId)" }`,
+    ].join('\n'));
+    const output = execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File "${psFile}"`, {
+      encoding: 'utf8',
+      timeout: 10000,
+      stdio: ['pipe', 'pipe', 'ignore'],
+    });
+    if (output.trim()) console.log(output.trim());
+    else console.log('[gateway] No supergateway processes found');
+  } catch {
+    console.log('[gateway] No supergateway processes found');
+  }
+
+  if (existsSync(PID_FILE)) {
+    unlinkSync(PID_FILE);
+    console.log('[gateway] Manifest removed');
+  }
+}
+
+// ── 상태 ──
+
+async function showStatus() {
+  const manifest = loadManifest();
+  if (manifest.length === 0) {
+    console.log('[gateway] No manifest — checking all ports...');
+  }
+
+  console.log('\nMCP Gateway Status');
+  console.log('='.repeat(50));
+  for (const srv of SERVERS) {
+    const healthy = await checkHealth(srv.port);
+    const mark = healthy ? '\u2713' : '\u2717';
+    const status = healthy ? 'ok' : 'down';
+    console.log(`  ${srv.name.padEnd(16)} :${srv.port}  ${mark} ${status}`);
+  }
+}
+
+function loadManifest() {
+  if (!existsSync(PID_FILE)) return [];
+  try {
+    return JSON.parse(readFileSync(PID_FILE, 'utf8'));
+  } catch {
+    return [];
+  }
+}
+
+// ── main ──
+
+const flag = process.argv[2];
+if (flag === '--stop') {
+  stopAll();
+} else if (flag === '--status') {
+  await showStatus();
+} else {
+  await startAll();
+}

package/scripts/mcp-gateway-start.ps1

@@ -0,0 +1,141 @@
+# mcp-gateway-start.ps1 — supergateway MCP SSE 영속 서비스 관리
+# 각 MCP 서버를 supergateway로 래핑하여 SSE 엔드포인트로 노출한다.
+# Usage: .\mcp-gateway-start.ps1          # 시작
+#        .\mcp-gateway-start.ps1 -Stop    # 중지
+
+param(
+  [switch]$Stop
+)
+
+$PidFile = Join-Path $env:TEMP 'tfx-gateway-pids.json'
+
+$Servers = @(
+  @{ Name = 'context7';     Port = 8100; Cmd = 'npx -y @upstash/context7-mcp@latest';          EnvVars = @() }
+  @{ Name = 'brave-search'; Port = 8101; Cmd = 'npx -y @brave/brave-search-mcp-server';        EnvVars = @('BRAVE_API_KEY') }
+  @{ Name = 'exa';          Port = 8102; Cmd = 'npx -y exa-mcp-server';                        EnvVars = @('EXA_API_KEY') }
+  @{ Name = 'tavily';       Port = 8103; Cmd = 'npx -y tavily-mcp@latest';                     EnvVars = @('TAVILY_API_KEY') }
+  @{ Name = 'jira';         Port = 8104; Cmd = 'npx -y mcp-jira-cloud@latest';                 EnvVars = @('JIRA_API_TOKEN', 'JIRA_EMAIL', 'JIRA_INSTANCE_URL') }
+  @{ Name = 'serena';       Port = 8105; Cmd = 'uvx --from git+https://github.com/oraios/serena serena start-mcp-server'; EnvVars = @() }
+  @{ Name = 'notion';       Port = 8106; Cmd = 'npx -y @notionhq/notion-mcp-server';           EnvVars = @('NOTION_TOKEN') }
+  @{ Name = 'notion-guest'; Port = 8107; Cmd = 'npx -y @notionhq/notion-mcp-server';           EnvVars = @('NOTION_TOKEN') }
+)
+
+function Test-PortInUse {
+  param([int]$Port)
+  try {
+    $tcp = New-Object System.Net.Sockets.TcpClient
+    $tcp.Connect('127.0.0.1', $Port)
+    $tcp.Close()
+    return $true
+  }
+  catch {
+    return $false
+  }
+}
+
+function Stop-AllGateways {
+  # WMI CommandLine 기반 — PID 매니페스트 의존 제거 (F-02)
+  $procs = Get-CimInstance Win32_Process -Filter "Name='node.exe' OR Name='cmd.exe'" |
+    Where-Object { $_.CommandLine -match 'supergateway' }
+
+  if ($procs) {
+    foreach ($p in $procs) {
+      try {
+        & taskkill /F /T /PID $p.ProcessId 2>$null | Out-Null
+        Write-Host "[STOP] PID $($p.ProcessId)"
+      }
+      catch {
+        Write-Host "[SKIP] PID $($p.ProcessId) — already gone"
+      }
+    }
+  }
+  else {
+    Write-Host '[gateway] No supergateway processes found'
+  }
+
+  if (Test-Path $PidFile) {
+    Remove-Item $PidFile -Force -ErrorAction SilentlyContinue
+    Write-Host '[gateway] PID file removed'
+  }
+  Write-Host '[gateway] All gateways stopped'
+}
+
+function Start-AllGateways {
+  $pidEntries = @()
+  $started = 0
+
+  foreach ($srv in $Servers) {
+    $name = $srv.Name
+    $port = $srv.Port
+
+    # 포트 사용 중이면 스킵
+    if (Test-PortInUse -Port $port) {
+      Write-Host "[SKIP] $name already running on :$port"
+      continue
+    }
+
+    # 필수 환경변수 체크
+    $missing = @()
+    foreach ($envKey in $srv.EnvVars) {
+      if (-not [Environment]::GetEnvironmentVariable($envKey)) {
+        $missing += $envKey
+      }
+    }
+    if ($missing.Count -gt 0) {
+      Write-Host "[WARN] $name skipped — missing env: $($missing -join ', ')"
+      continue
+    }
+
+    # supergateway 기동 — npx는 .cmd 파일이므로 cmd.exe /c 로 래핑
+    $stdioCmdEscaped = $srv.Cmd -replace '"', '\"'
+    $sgCmd = "npx -y supergateway --stdio `"$stdioCmdEscaped`" --port $port --outputTransport sse --healthEndpoint /healthz"
+
+    try {
+      $proc = Start-Process -FilePath 'cmd.exe' -ArgumentList "/c $sgCmd" `
+        -WindowStyle Hidden -PassThru -ErrorAction Stop
+      $pidEntries += @{ name = $name; port = $port; pid = $proc.Id }
+      $started++
+      Write-Host "[START] $name on :$port (PID $($proc.Id))"
+    }
+    catch {
+      Write-Host "[ERROR] $name failed to start: $_"
+    }
+  }
+
+  # PID 파일 저장
+  if ($pidEntries.Count -gt 0) {
+    $pidEntries | ConvertTo-Json -Depth 3 | Set-Content -Path $PidFile -Encoding UTF8
+    Write-Host "`n[gateway] $started servers started. PID file: $PidFile"
+  }
+  else {
+    Write-Host "`n[gateway] No servers started (all running or skipped)"
+    return
+  }
+
+  # 헬스체크 (3초 대기 후)
+  Write-Host "`n[gateway] Waiting 3s for startup..."
+  Start-Sleep -Seconds 3
+
+  Write-Host "`nHealth Check"
+  Write-Host ('=' * 50)
+  foreach ($entry in $pidEntries) {
+    $url = "http://127.0.0.1:$($entry.port)/healthz"
+    try {
+      $resp = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 3 -ErrorAction Stop
+      $status = if ($resp.StatusCode -eq 200) { 'ok' } else { 'error' }
+      $mark = if ($status -eq 'ok') { [char]0x2713 } else { [char]0x2717 }
+      Write-Host ("  {0,-16} :{1}  {2} {3}" -f $entry.name, $entry.port, $mark, $status)
+    }
+    catch {
+      Write-Host ("  {0,-16} :{1}  {2} down" -f $entry.name, $entry.port, [char]0x2717)
+    }
+  }
+}
+
+# ── main ──
+if ($Stop) {
+  Stop-AllGateways
+}
+else {
+  Start-AllGateways
+}

package/scripts/mcp-gateway-verify.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// mcp-gateway-verify.mjs — supergateway SSE 엔드포인트 헬스체크
+
+import { readManifest } from './lib/mcp-manifest.mjs';
+
+const ALL_ENDPOINTS = [
+  { name: 'context7',     port: 8100 },
+  { name: 'brave-search', port: 8101 },
+  { name: 'exa',          port: 8102 },
+  { name: 'tavily',       port: 8103 },
+  { name: 'jira',         port: 8104 },
+  { name: 'serena',       port: 8105 },
+  { name: 'notion',       port: 8106 },
+  { name: 'notion-guest', port: 8107 },
+];
+
+const manifest = readManifest();
+if (!manifest) {
+  console.log('gateway: not configured (no manifest)');
+  process.exit(0);
+}
+const enabled = new Set(manifest.enabled || []);
+const ENDPOINTS = ALL_ENDPOINTS.filter((e) => enabled.has(e.name));
+if (ENDPOINTS.length === 0) {
+  console.log('gateway: no enabled servers');
+  process.exit(0);
+}
+
+async function checkHealth(name, port) {
+  const start = Date.now();
+  try {
+    const res = await fetch(`http://localhost:${port}/healthz`, {
+      signal: AbortSignal.timeout(3000),
+    });
+    const latencyMs = Date.now() - start;
+    return res.ok
+      ? { name, port, status: 'ok', latencyMs, error: null }
+      : { name, port, status: 'down', latencyMs, error: `HTTP ${res.status}` };
+  } catch (err) {
+    const latencyMs = Date.now() - start;
+    const message = err?.cause?.code || err?.message || 'unknown';
+    return { name, port, status: 'down', latencyMs, error: message };
+  }
+}
+
+async function main() {
+  const results = await Promise.allSettled(
+    ENDPOINTS.map(({ name, port }) => checkHealth(name, port)),
+  );
+
+  const entries = results.map((r) =>
+    r.status === 'fulfilled' ? r.value : { name: '?', port: 0, status: 'down', error: r.reason },
+  );
+
+  console.log('\nMCP Gateway Health Check');
+  console.log('='.repeat(56));
+
+  let downCount = 0;
+  for (const e of entries) {
+    const mark = e.status === 'ok' ? '\u2713' : '\u2717';
+    const detail = e.status === 'ok' ? `(${e.latencyMs}ms)` : `(${e.error})`;
+    const line = `  ${e.name.padEnd(16)} :${String(e.port).padEnd(6)} ${mark} ${e.status.padEnd(6)} ${detail}`;
+    console.log(line);
+    if (e.status !== 'ok') downCount++;
+  }
+
+  console.log('='.repeat(56));
+  console.log(
+    downCount === 0
+      ? `All ${entries.length} gateways healthy`
+      : `${downCount}/${entries.length} gateways down`,
+  );
+
+  process.exitCode = downCount > 0 ? 1 : 0;
+}
+
+main();

package/scripts/mcp-safety-guard.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// mcp-safety-guard.mjs — Gemini stdio MCP 자동 감지 + 치환
+// SessionStart 훅으로 실행. stdio MCP는 Windows에서 spawn EPERM → Gemini stall 유발.
+// 감지 시 공통 guard engine으로 제거/치환하고 백업 파일 생성.
+
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadRegistry, remediate, scanForStdioServers } from "./lib/mcp-guard-engine.mjs";
+
+const GEMINI_SETTINGS = join(homedir(), ".gemini", "settings.json");
+
+function run() {
+  let registry;
+  try {
+    registry = loadRegistry();
+  } catch {
+    return;
+  }
+
+  const stdioServers = scanForStdioServers(GEMINI_SETTINGS);
+
+  if (stdioServers.length === 0) return; // 모두 안전
+
+  const result = remediate(GEMINI_SETTINGS, stdioServers, registry.policies);
+  const names = stdioServers.map((server) => server.name).join(", ");
+
+  if (result.modified) {
+    const actionLabel = result.replacement ? "자동 치환" : "자동 제거";
+    console.log(`[mcp-safety] ${stdioServers.length}개 stdio MCP ${actionLabel}: ${names}`);
+    if (result.replacement?.name && result.replacement?.url) {
+      console.log(`[mcp-safety] 대체 서버: ${result.replacement.name} -> ${result.replacement.url}`);
+    }
+    if (result.backupPath) {
+      console.log(`[mcp-safety] 백업: ${result.backupPath}`);
+    }
+    console.log("[mcp-safety] Gemini는 Hub URL만 사용합니다. stdio MCP는 spawn EPERM을 유발합니다.");
+  }
+
+  for (const warning of result.warnings || []) {
+    console.log(warning);
+  }
+}
+
+run();