triflux 9.6.0 → 9.7.1

package/hooks/hook-orchestrator.mjs

@@ -23,6 +23,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
+import { PLUGIN_ROOT } from "./lib/resolve-root.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REGISTRY_PATH =
@@ -50,10 +51,10 @@ function loadRegistry() {
 // ── 경로 변수 치환 ──────────────────────────────────────────
 function resolveCommand(cmd) {
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || __dirname.replace(/[\\/]hooks$/, "");
 
   return cmd
-    .replace(/\$\{PLUGIN_ROOT\}/g, pluginRoot)
+    .replace(/\$\{PLUGIN_ROOT\}/g, PLUGIN_ROOT)
+    .replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, PLUGIN_ROOT)
     .replace(/\$\{HOME\}/g, home)
     .replace(/\$HOME\b/g, home);
 }

package/hooks/hook-registry.json

@@ -65,6 +65,17 @@
         "timeout": 3,
         "blocking": false,
         "description": "파일 수정 추적 → 교차 리뷰 nudge"
+      },
+      {
+        "id": "tfx-mcp-config-watcher",
+        "source": "triflux",
+        "matcher": "Edit|Write",
+        "command": "node \"${PLUGIN_ROOT}/hooks/mcp-config-watcher.mjs\"",
+        "priority": 1,
+        "enabled": true,
+        "timeout": 3,
+        "blocking": false,
+        "description": "감시 대상 MCP 설정 변경 감지 → stdio MCP 자동 치환"
       }
     ],
     "PostToolUseFailure": [
@@ -105,12 +116,23 @@
         "blocking": false,
         "description": "triflux 환경 초기화"
       },
+      {
+        "id": "tfx-mcp-safety-guard",
+        "source": "triflux",
+        "matcher": "*",
+        "command": "node \"${PLUGIN_ROOT}/scripts/mcp-safety-guard.mjs\"",
+        "priority": 1,
+        "enabled": true,
+        "timeout": 3,
+        "blocking": false,
+        "description": "Gemini stdio MCP 자동 감지 + 제거 (spawn EPERM 방지)"
+      },
       {
         "id": "tfx-hub-ensure",
         "source": "triflux",
         "matcher": "*",
         "command": "node \"${PLUGIN_ROOT}/scripts/hub-ensure.mjs\"",
-        "priority": 1,
+        "priority": 2,
         "enabled": true,
         "timeout": 8,
         "blocking": false,
@@ -121,7 +143,7 @@
         "source": "triflux",
         "matcher": "*",
         "command": "node \"${PLUGIN_ROOT}/scripts/preflight-cache.mjs\"",
-        "priority": 2,
+        "priority": 3,
         "enabled": true,
         "timeout": 5,
         "blocking": false,
@@ -133,7 +155,7 @@
         "matcher": "*",
         "command": "${HOME}/Desktop/Projects/cli/session-vault/scripts/start_hook.sh",
         "priority": 100,
-        "enabled": true,
+        "enabled": false,
         "timeout": 10,
         "blocking": false,
         "description": "세션 볼트 로깅 시작"
@@ -157,7 +179,7 @@
         "matcher": "*",
         "command": "${HOME}/Desktop/Projects/cli/session-vault/scripts/export_hook.sh",
         "priority": 100,
-        "enabled": true,
+        "enabled": false,
         "timeout": 30,
         "blocking": false,
         "description": "세션 트랜스크립트 내보내기"
@@ -168,7 +190,7 @@
         "matcher": "*",
         "command": "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \"${HOME}/.claude/scripts/mcp-cleanup.ps1\"",
         "priority": 100,
-        "enabled": true,
+        "enabled": false,
         "timeout": 8,
         "blocking": false,
         "description": "MCP 고아 프로세스 정리"

package/hooks/lib/resolve-root.mjs

@@ -0,0 +1,59 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const BREADCRUMB_PATH = join(homedir(), ".claude", "scripts", ".tfx-pkg-root");
+
+function normalizeCandidate(candidate) {
+  if (typeof candidate !== "string") return null;
+  const value = candidate.trim();
+  if (!value) return null;
+  return value;
+}
+
+function isValidPluginRoot(candidate) {
+  const root = normalizeCandidate(candidate);
+  if (!root) return false;
+  return existsSync(join(root, "hooks", "hook-orchestrator.mjs"));
+}
+
+function toPluginRootFromUrl(url) {
+  if (typeof url !== "string" || !url) return null;
+  try {
+    const sourceDir = dirname(fileURLToPath(url));
+    const hookScoped = sourceDir.match(/^(.*?)[\\/]hooks(?:[\\/].*)?$/);
+    if (hookScoped?.[1]) return hookScoped[1];
+    return resolve(sourceDir, "..");
+  } catch {
+    return null;
+  }
+}
+
+function readBreadcrumbRoot() {
+  if (!existsSync(BREADCRUMB_PATH)) return null;
+  try {
+    return normalizeCandidate(readFileSync(BREADCRUMB_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function resolvePluginRoot(callerUrl) {
+  const breadcrumbRoot = readBreadcrumbRoot();
+  if (isValidPluginRoot(breadcrumbRoot)) return breadcrumbRoot;
+
+  const envRoot = normalizeCandidate(process.env.CLAUDE_PLUGIN_ROOT);
+  if (isValidPluginRoot(envRoot)) return envRoot;
+
+  const callerFallback = toPluginRootFromUrl(callerUrl);
+  if (isValidPluginRoot(callerFallback)) return callerFallback;
+
+  const moduleFallback = toPluginRootFromUrl(import.meta.url) || process.cwd();
+  process.stderr.write(
+    `[resolve-root] warning: failed to resolve plugin root from breadcrumb/env/caller; fallback=${moduleFallback}\n`
+  );
+  return moduleFallback;
+}
+
+export const PLUGIN_ROOT = resolvePluginRoot(import.meta.url);

package/hooks/mcp-config-watcher.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// hooks/mcp-config-watcher.mjs — PostToolUse:Edit|Write 훅
+//
+// 감시 대상 MCP 설정 파일 변경을 감지해 stdio 서버를 즉시 차단/치환한다.
+// 경로가 watched_paths와 매칭되지 않으면 바로 종료해 일반 편집 성능에 영향이 없도록 한다.
+
+import { readFileSync } from "node:fs";
+import {
+  isWatchedPath,
+  loadRegistry,
+  remediate,
+  scanForStdioServers,
+} from "../scripts/lib/mcp-guard-engine.mjs";
+
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function buildSystemMessage(filePath, stdioServers, result) {
+  const lines = [`[mcp-guard] 감시 대상 MCP 설정 변경 감지: ${filePath}`];
+
+  if (result.modified) {
+    const actionLabel = result.replacement ? "자동 치환" : "자동 제거";
+    lines.push(`[mcp-guard] stdio MCP ${actionLabel}: ${stdioServers.map((server) => server.name).join(", ")}`);
+
+    if (result.replacement?.name && result.replacement?.url) {
+      lines.push(`[mcp-guard] 대체 서버: ${result.replacement.name} -> ${result.replacement.url}`);
+    }
+
+    if (result.backupPath) {
+      lines.push(`[mcp-guard] 백업: ${result.backupPath}`);
+    }
+  }
+
+  for (const warning of result.warnings || []) {
+    lines.push(warning);
+  }
+
+  return lines.length > 0 ? lines.join("\n") : "";
+}
+
+function main() {
+  const raw = readStdin();
+  if (!raw.trim()) process.exit(0);
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    process.exit(0);
+  }
+
+  const toolName = input.tool_name || "";
+  if (toolName !== "Edit" && toolName !== "Write") process.exit(0);
+
+  const filePath = input.tool_input?.file_path || "";
+  if (!filePath || !isWatchedPath(filePath)) process.exit(0);
+
+  let registry;
+  try {
+    registry = loadRegistry();
+  } catch {
+    process.exit(0);
+  }
+
+  const stdioServers = scanForStdioServers(filePath);
+  if (stdioServers.length === 0) process.exit(0);
+
+  const result = remediate(filePath, stdioServers, registry.policies);
+  const systemMessage = buildSystemMessage(filePath, stdioServers, result);
+
+  if (systemMessage) {
+    process.stdout.write(JSON.stringify({ systemMessage }));
+  }
+}
+
+try {
+  main();
+} catch {
+  process.exit(0);
+}

package/hooks/pipeline-stop.mjs

@@ -6,20 +6,23 @@
 // 파이프라인이 없으면 정상 종료를 허용한다.
 
 import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { PLUGIN_ROOT } from "./lib/resolve-root.mjs";
 
 let getPipelineStateDbPath;
+let ensurePipelineTable;
+let listPipelineStates;
 try {
-  const stateModule = await import("../hub/pipeline/state.mjs");
-  getPipelineStateDbPath = stateModule.getPipelineStateDbPath;
+  ({
+    getPipelineStateDbPath,
+    ensurePipelineTable,
+    listPipelineStates,
+  } = await import("../hub/pipeline/state.mjs"));
 } catch {
   // hub/pipeline 모듈 없으면 훅 무동작
   process.exit(0);
 }
 
-const PROJECT_ROOT = fileURLToPath(new URL("..", import.meta.url));
-const HUB_DB_PATH = getPipelineStateDbPath(PROJECT_ROOT);
+const HUB_DB_PATH = getPipelineStateDbPath(PLUGIN_ROOT);
 const TERMINAL = new Set(["complete", "failed"]);
 
 async function checkActivePipelines() {
@@ -27,14 +30,6 @@ async function checkActivePipelines() {
 
   try {
     const { default: Database } = await import("better-sqlite3");
-    const { ensurePipelineTable, listPipelineStates } = await import(
-      join(
-        process.env.CLAUDE_PLUGIN_ROOT || PROJECT_ROOT,
-        "hub",
-        "pipeline",
-        "state.mjs"
-      )
-    );
 
     const db = new Database(HUB_DB_PATH, { readonly: true });
     ensurePipelineTable(db);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triflux",
-  "version": "9.6.0",
+  "version": "9.7.1",
   "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Gemini, and Claude",
   "type": "module",
   "bin": {

package/scripts/__tests__/mcp-guard-engine.test.mjs

@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { describe, it, afterEach } from "node:test";
+import { fileURLToPath } from "node:url";
+
+import {
+  isWatchedPath,
+  loadRegistry,
+  remediate,
+  resolveHubUrl,
+  scanForStdioServers,
+} from "../lib/mcp-guard-engine.mjs";
+
+const TEST_DIR = dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = resolve(TEST_DIR, "..", "..");
+const originalHome = {
+  HOME: process.env.HOME,
+  USERPROFILE: process.env.USERPROFILE,
+  TFX_HUB_PORT: process.env.TFX_HUB_PORT,
+};
+
+function createHomeDir(prefix = "mcp-guard-") {
+  const base = join(tmpdir(), `${prefix}${Date.now()}-${Math.random().toString(16).slice(2)}`);
+  mkdirSync(base, { recursive: true });
+  mkdirSync(join(base, ".gemini"), { recursive: true });
+  mkdirSync(join(base, ".claude", "cache", "tfx-hub"), { recursive: true });
+  mkdirSync(join(base, ".codex"), { recursive: true });
+  return base;
+}
+
+function withHome(homeDir) {
+  process.env.HOME = homeDir;
+  process.env.USERPROFILE = homeDir;
+}
+
+afterEach(() => {
+  if (originalHome.HOME === undefined) delete process.env.HOME;
+  else process.env.HOME = originalHome.HOME;
+
+  if (originalHome.USERPROFILE === undefined) delete process.env.USERPROFILE;
+  else process.env.USERPROFILE = originalHome.USERPROFILE;
+
+  if (originalHome.TFX_HUB_PORT === undefined) delete process.env.TFX_HUB_PORT;
+  else process.env.TFX_HUB_PORT = originalHome.TFX_HUB_PORT;
+});
+
+describe("mcp guard engine", () => {
+  it("loads the MCP registry", () => {
+    const registry = loadRegistry();
+    assert.equal(registry.version, 1);
+    assert.equal(registry.servers["tfx-hub"].url, "http://127.0.0.1:27888/mcp");
+    assert.equal(registry.policies.watched_paths.length, 5);
+  });
+
+  it("matches watched paths for Gemini and local .mcp.json", () => {
+    const homeDir = createHomeDir();
+    withHome(homeDir);
+
+    assert.equal(isWatchedPath(join(homeDir, ".gemini", "settings.json")), true);
+    assert.equal(isWatchedPath(join(PROJECT_ROOT, "nested", ".mcp.json")), true);
+    assert.equal(isWatchedPath(join(PROJECT_ROOT, "nested", "settings.yaml")), false);
+  });
+
+  it("detects stdio MCP servers from JSON config", () => {
+    const homeDir = createHomeDir();
+    withHome(homeDir);
+
+    const settingsPath = join(homeDir, ".gemini", "settings.json");
+    writeFileSync(settingsPath, JSON.stringify({
+      mcpServers: {
+        "unsafe-stdio": { command: "node", args: ["server.js"] },
+        "safe-url": { url: "http://127.0.0.1:27888/mcp" },
+      },
+    }, null, 2));
+
+    const found = scanForStdioServers(settingsPath);
+    assert.deepEqual(found.map((server) => server.name), ["unsafe-stdio"]);
+  });
+
+  it("replaces stdio MCP entries with tfx-hub and writes a backup", () => {
+    const homeDir = createHomeDir();
+    withHome(homeDir);
+
+    const pidPath = join(homeDir, ".claude", "cache", "tfx-hub", "hub.pid");
+    writeFileSync(pidPath, JSON.stringify({ host: "127.0.0.1", port: 30123 }), "utf8");
+
+    const settingsPath = join(homeDir, ".gemini", "settings.json");
+    writeFileSync(settingsPath, JSON.stringify({
+      mcpServers: {
+        "unsafe-stdio": { command: "node", args: ["server.js"] },
+      },
+    }, null, 2));
+
+    const result = remediate(settingsPath, scanForStdioServers(settingsPath), { stdio_action: "replace-with-hub" });
+    const updated = JSON.parse(readFileSync(settingsPath, "utf8"));
+
+    assert.equal(result.modified, true);
+    assert.equal(existsSync(`${settingsPath}.bak`), true);
+    assert.deepEqual(result.removedServers, ["unsafe-stdio"]);
+    assert.equal(updated.mcpServers["tfx-hub"].url, "http://127.0.0.1:30123/mcp");
+    assert.equal(Object.hasOwn(updated.mcpServers, "unsafe-stdio"), false);
+  });
+
+  it("uses hub.pid port before registry fallback when resolving Hub URL", () => {
+    const homeDir = createHomeDir();
+    withHome(homeDir);
+
+    writeFileSync(
+      join(homeDir, ".claude", "cache", "tfx-hub", "hub.pid"),
+      JSON.stringify({ host: "127.0.0.1", port: 29991 }),
+      "utf8",
+    );
+
+    assert.equal(resolveHubUrl(), "http://127.0.0.1:29991/mcp");
+  });
+});