zero-config-cli-bridge 1.1.0 → 1.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/executor.d.ts.map +1 -1
- package/dist/executor.js +10 -9
- package/dist/executor.js.map +1 -1
- package/dist/index.js +58 -32
- package/dist/index.js.map +1 -1
- package/dist/schema.d.ts +6 -2
- package/dist/schema.d.ts.map +1 -1
- package/dist/schema.js +43 -41
- package/dist/schema.js.map +1 -1
- package/package.json +1 -1
package/dist/executor.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;
|
|
1
|
+
{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAcD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAgClF"}
|
package/dist/executor.js
CHANGED
|
@@ -1,13 +1,14 @@
|
|
|
1
1
|
import { spawn } from 'child_process';
|
|
2
|
-
//
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
2
|
+
// stdout carries structured JSON — large ceiling so index.ts can apply item-level truncation.
|
|
3
|
+
const MAX_STDOUT_CHARS = 2_000_000; // 2 MB
|
|
4
|
+
// stderr carries error messages and probe text — keep tight.
|
|
5
|
+
const MAX_STDERR_CHARS = 4_096;
|
|
6
|
+
const RAW_TRUNCATION_MSG = '\n...[Output truncated. Use grep/jq to filter]';
|
|
6
7
|
const TIMEOUT_MS = 15_000;
|
|
7
|
-
function truncate(s) {
|
|
8
|
-
if (s.length <=
|
|
8
|
+
function truncate(s, limit) {
|
|
9
|
+
if (s.length <= limit)
|
|
9
10
|
return s;
|
|
10
|
-
return s.slice(0,
|
|
11
|
+
return s.slice(0, limit) + RAW_TRUNCATION_MSG;
|
|
11
12
|
}
|
|
12
13
|
/**
|
|
13
14
|
* Executes a binary directly with an args array.
|
|
@@ -30,8 +31,8 @@ export function executeCommand(bin, args) {
|
|
|
30
31
|
proc.on('close', (code) => {
|
|
31
32
|
clearTimeout(timer);
|
|
32
33
|
resolve({
|
|
33
|
-
stdout: truncate(stdoutBuf),
|
|
34
|
-
stderr: truncate(stderrBuf),
|
|
34
|
+
stdout: truncate(stdoutBuf, MAX_STDOUT_CHARS),
|
|
35
|
+
stderr: truncate(stderrBuf, MAX_STDERR_CHARS),
|
|
35
36
|
exitCode: code ?? 1,
|
|
36
37
|
});
|
|
37
38
|
});
|
package/dist/executor.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,
|
|
1
|
+
{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,OAAO;AAC3C,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,kBAAkB,GAAG,gDAAgD,CAAC;AAC5E,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,SAAS,QAAQ,CAAC,CAAS,EAAE,KAAa;IACxC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,kBAAkB,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAc;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC5B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE;YACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,UAAU,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC,EAAE,UAAU,CAAC,CAAC;QAEf,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACvC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAC7C,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -3,31 +3,55 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
|
|
|
3
3
|
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
|
|
4
4
|
import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
|
|
5
5
|
import { executeCommand } from './executor.js';
|
|
6
|
+
import { validateSubcommand, validateArgs } from './security.js';
|
|
7
|
+
import { buildToolDefinitions, buildGhArgs } from './schema.js';
|
|
6
8
|
const MAX_JSON_ITEMS = 30;
|
|
7
|
-
const
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
* context exhaustion. Falls back to raw text if parsing fails.
|
|
12
|
-
*/
|
|
13
|
-
function toJsonOutput(raw) {
|
|
9
|
+
const MAX_TEXT_CHARS = 2000;
|
|
10
|
+
function toEnvelope(raw) {
|
|
11
|
+
// --- JSON path ---
|
|
12
|
+
let parsed;
|
|
14
13
|
try {
|
|
15
|
-
|
|
16
|
-
if (Array.isArray(parsed)) {
|
|
17
|
-
if (parsed.length > MAX_JSON_ITEMS) {
|
|
18
|
-
return JSON.stringify(parsed.slice(0, MAX_JSON_ITEMS), null, 2) + TRUNCATION_MSG;
|
|
19
|
-
}
|
|
20
|
-
return JSON.stringify(parsed, null, 2);
|
|
21
|
-
}
|
|
22
|
-
return JSON.stringify(parsed, null, 2);
|
|
14
|
+
parsed = JSON.parse(raw);
|
|
23
15
|
}
|
|
24
16
|
catch {
|
|
25
|
-
|
|
17
|
+
// Non-JSON (error messages, plain text)
|
|
18
|
+
const text = raw.length > MAX_TEXT_CHARS
|
|
19
|
+
? raw.slice(0, MAX_TEXT_CHARS) + '...[truncated]'
|
|
20
|
+
: raw;
|
|
21
|
+
return {
|
|
22
|
+
data: null,
|
|
23
|
+
meta: { truncated: raw.length > MAX_TEXT_CHARS, error: text },
|
|
24
|
+
};
|
|
26
25
|
}
|
|
26
|
+
// Array response: truncate at item level
|
|
27
|
+
if (Array.isArray(parsed)) {
|
|
28
|
+
const truncated = parsed.length > MAX_JSON_ITEMS;
|
|
29
|
+
const data = truncated ? parsed.slice(0, MAX_JSON_ITEMS) : parsed;
|
|
30
|
+
return {
|
|
31
|
+
data,
|
|
32
|
+
meta: {
|
|
33
|
+
truncated,
|
|
34
|
+
returnedItems: data.length,
|
|
35
|
+
...(truncated
|
|
36
|
+
? { note: `Showing first ${MAX_JSON_ITEMS} items. Use --limit or filters to narrow results.` }
|
|
37
|
+
: {}),
|
|
38
|
+
},
|
|
39
|
+
};
|
|
40
|
+
}
|
|
41
|
+
// Non-array JSON object: cap by serialised size
|
|
42
|
+
const serialised = JSON.stringify(parsed);
|
|
43
|
+
if (serialised.length > MAX_TEXT_CHARS) {
|
|
44
|
+
return {
|
|
45
|
+
data: null,
|
|
46
|
+
meta: {
|
|
47
|
+
truncated: true,
|
|
48
|
+
error: `Response object too large (${serialised.length} chars). Use filters to narrow results.`,
|
|
49
|
+
},
|
|
50
|
+
};
|
|
51
|
+
}
|
|
52
|
+
return { data: parsed, meta: { truncated: false } };
|
|
27
53
|
}
|
|
28
|
-
|
|
29
|
-
import { buildToolDefinitions, buildGhArgs } from './schema.js';
|
|
30
|
-
const server = new Server({ name: 'zero-config-cli-bridge', version: '1.1.0' }, { capabilities: { tools: {} } });
|
|
54
|
+
const server = new Server({ name: 'zero-config-cli-bridge', version: '1.3.0' }, { capabilities: { tools: {} } });
|
|
31
55
|
let toolRegistry = new Map();
|
|
32
56
|
server.setRequestHandler(ListToolsRequestSchema, async () => ({
|
|
33
57
|
tools: Array.from(toolRegistry.values()).map(({ name, description, inputSchema }) => ({
|
|
@@ -41,10 +65,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
|
|
|
41
65
|
const args = (rawArgs ?? {});
|
|
42
66
|
const tool = toolRegistry.get(toolName);
|
|
43
67
|
if (!tool) {
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
68
|
+
const envelope = {
|
|
69
|
+
data: null,
|
|
70
|
+
meta: { truncated: false, error: `Unknown tool "${toolName}".` },
|
|
47
71
|
};
|
|
72
|
+
return { content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }], isError: true };
|
|
48
73
|
}
|
|
49
74
|
// Security: whitelist subcommand + validate arg values
|
|
50
75
|
try {
|
|
@@ -52,10 +77,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
|
|
|
52
77
|
validateArgs(args);
|
|
53
78
|
}
|
|
54
79
|
catch (err) {
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
80
|
+
const envelope = {
|
|
81
|
+
data: null,
|
|
82
|
+
meta: { truncated: false, error: err instanceof Error ? err.message : String(err) },
|
|
58
83
|
};
|
|
84
|
+
return { content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }], isError: true };
|
|
59
85
|
}
|
|
60
86
|
// Direct spawn — no shell, no injection surface
|
|
61
87
|
const ghArgs = buildGhArgs(tool, args);
|
|
@@ -64,20 +90,20 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
|
|
|
64
90
|
result = await executeCommand('gh', ghArgs);
|
|
65
91
|
}
|
|
66
92
|
catch (err) {
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
93
|
+
const envelope = {
|
|
94
|
+
data: null,
|
|
95
|
+
meta: { truncated: false, error: `Execution error: ${err instanceof Error ? err.message : String(err)}` },
|
|
70
96
|
};
|
|
97
|
+
return { content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }], isError: true };
|
|
71
98
|
}
|
|
72
|
-
const raw = result.stdout || result.stderr ||
|
|
73
|
-
const
|
|
99
|
+
const raw = result.stdout || result.stderr || '';
|
|
100
|
+
const envelope = toEnvelope(raw);
|
|
74
101
|
return {
|
|
75
|
-
content: [{ type: 'text', text:
|
|
102
|
+
content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }],
|
|
76
103
|
isError: result.exitCode !== 0,
|
|
77
104
|
};
|
|
78
105
|
});
|
|
79
106
|
async function main() {
|
|
80
|
-
// Probe local gh binary for available capabilities before accepting requests
|
|
81
107
|
const tools = await buildToolDefinitions();
|
|
82
108
|
toolRegistry = new Map(tools.map((t) => [t.name, t]));
|
|
83
109
|
const transport = new StdioServerTransport();
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAEhF,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,IAAI,CAAC;AAsB5B,SAAS,UAAU,CAAC,GAAW;IAC7B,oBAAoB;IACpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,cAAc;YACtC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG,gBAAgB;YACjD,CAAC,CAAC,GAAG,CAAC;QACR,OAAO;YACL,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,OAAO;YACL,IAAI;YACJ,IAAI,EAAE;gBACJ,SAAS;gBACT,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,GAAG,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,cAAc,mDAAmD,EAAE;oBAC9F,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,IAAI;YACV,IAAI,EAAE;gBACJ,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,8BAA8B,UAAU,CAAC,MAAM,yCAAyC;aAChG;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,IAAI,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;AAErD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI;QACJ,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAExD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,QAAQ,IAAI,EAAE;SACjE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACpF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IAED,gDAAgD;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;SAC1G,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC3C,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/schema.d.ts
CHANGED
|
@@ -11,10 +11,14 @@ export interface ToolDefinition {
|
|
|
11
11
|
};
|
|
12
12
|
/** gh subcommand tokens, e.g. ['issue', 'list'] */
|
|
13
13
|
subcommand: string[];
|
|
14
|
-
/** JSON fields confirmed available in the local gh binary */
|
|
14
|
+
/** JSON fields confirmed available in the local gh binary, filtered to repo-scope-safe set */
|
|
15
15
|
jsonFields: string[];
|
|
16
16
|
}
|
|
17
17
|
export declare function buildToolDefinitions(): Promise<ToolDefinition[]>;
|
|
18
|
-
/**
|
|
18
|
+
/**
|
|
19
|
+
* Builds the gh args array using --flag=value notation throughout.
|
|
20
|
+
* This prevents option injection: a value starting with '-' cannot
|
|
21
|
+
* be misinterpreted as a separate flag by gh's argument parser.
|
|
22
|
+
*/
|
|
19
23
|
export declare function buildGhArgs(tool: ToolDefinition, args: Record<string, unknown>): string[];
|
|
20
24
|
//# sourceMappingURL=schema.d.ts.map
|
package/dist/schema.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,mDAAmD;IACnD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,mDAAmD;IACnD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAoDD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CA8CtE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAWzF"}
|
package/dist/schema.js
CHANGED
|
@@ -1,13 +1,9 @@
|
|
|
1
1
|
import { executeCommand } from './executor.js';
|
|
2
|
-
const FALLBACK_FIELDS = {
|
|
3
|
-
'issue list': ['number', 'title', 'state', 'labels', 'assignees', 'createdAt', 'url'],
|
|
4
|
-
'pr list': ['number', 'title', 'state', 'labels', 'assignees', 'createdAt', 'url', 'baseRefName'],
|
|
5
|
-
};
|
|
6
2
|
/**
|
|
7
|
-
* Fields
|
|
8
|
-
*
|
|
9
|
-
* -
|
|
10
|
-
* - `body`
|
|
3
|
+
* Fields requiring only the standard `repo` OAuth scope.
|
|
4
|
+
* Explicitly excludes:
|
|
5
|
+
* - `id` — requires read:project scope
|
|
6
|
+
* - `body` — unbounded text; breaks JSON item-level truncation
|
|
11
7
|
*/
|
|
12
8
|
const REPO_SCOPE_SAFE_FIELDS = new Set([
|
|
13
9
|
'number', 'title', 'state', 'labels', 'assignees',
|
|
@@ -17,51 +13,52 @@ const REPO_SCOPE_SAFE_FIELDS = new Set([
|
|
|
17
13
|
'baseRefName', 'headRefName', 'headRepository', 'mergedAt', 'mergeCommit',
|
|
18
14
|
'reviewDecision', 'additions', 'deletions', 'changedFiles',
|
|
19
15
|
]);
|
|
16
|
+
const FALLBACK_FIELDS = {
|
|
17
|
+
'issue list': ['number', 'title', 'state', 'labels', 'assignees', 'createdAt', 'url'],
|
|
18
|
+
'pr list': ['number', 'title', 'state', 'labels', 'assignees', 'createdAt', 'url', 'baseRefName'],
|
|
19
|
+
};
|
|
20
20
|
/**
|
|
21
|
-
*
|
|
22
|
-
* subcommand
|
|
23
|
-
*
|
|
24
|
-
*
|
|
25
|
-
* Falls back to a known-safe static list if detection fails.
|
|
21
|
+
* Detects JSON fields available in the local gh binary by calling
|
|
22
|
+
* `gh <subcommand> --json` with no field argument. Recent gh versions
|
|
23
|
+
* output the available field list to stderr in this case — no error
|
|
24
|
+
* injection needed. Falls back to the static list on any failure.
|
|
26
25
|
*/
|
|
27
|
-
async function
|
|
26
|
+
async function detectJsonFields(subcommand) {
|
|
28
27
|
const key = subcommand.join(' ');
|
|
29
28
|
try {
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
const fields = match[1]
|
|
41
|
-
.trim()
|
|
42
|
-
.split(/[\s,]+/)
|
|
29
|
+
// `gh issue list --json` with no fields causes gh to list available fields on stderr.
|
|
30
|
+
// This is documented behaviour, not error scraping.
|
|
31
|
+
const result = await executeCommand('gh', [...subcommand, '--json']);
|
|
32
|
+
const text = result.stderr + result.stdout;
|
|
33
|
+
// Output format: "Use `--json` with one or more of: field1,field2,..."
|
|
34
|
+
// or a newline-separated list after "Available fields:"
|
|
35
|
+
const commaMatch = text.match(/--json`?\s+with[^:]*:\s*([a-zA-Z,\s]+)/i);
|
|
36
|
+
if (commaMatch) {
|
|
37
|
+
const fields = commaMatch[1]
|
|
38
|
+
.split(/[,\s]+/)
|
|
43
39
|
.map((f) => f.trim())
|
|
44
40
|
.filter((f) => /^[a-zA-Z][a-zA-Z0-9]*$/.test(f))
|
|
45
|
-
.filter((f) => REPO_SCOPE_SAFE_FIELDS.has(f));
|
|
41
|
+
.filter((f) => REPO_SCOPE_SAFE_FIELDS.has(f));
|
|
46
42
|
if (fields.length > 0)
|
|
47
43
|
return fields;
|
|
48
44
|
}
|
|
49
45
|
}
|
|
50
46
|
catch {
|
|
51
|
-
// gh not
|
|
47
|
+
// gh not installed or timed out
|
|
52
48
|
}
|
|
53
49
|
return FALLBACK_FIELDS[key] ?? [];
|
|
54
50
|
}
|
|
55
51
|
export async function buildToolDefinitions() {
|
|
56
52
|
const [issueFields, prFields] = await Promise.all([
|
|
57
|
-
|
|
58
|
-
|
|
53
|
+
detectJsonFields(['issue', 'list']),
|
|
54
|
+
detectJsonFields(['pr', 'list']),
|
|
59
55
|
]);
|
|
60
56
|
return [
|
|
61
57
|
{
|
|
62
58
|
name: 'gh_issue_list',
|
|
63
59
|
description: 'List GitHub issues as structured JSON. ' +
|
|
64
|
-
'Uses the local `gh` CLI and its existing authentication — no API key required.'
|
|
60
|
+
'Uses the local `gh` CLI and its existing authentication — no API key required. ' +
|
|
61
|
+
'Read-only. Does not create, edit, or delete issues.',
|
|
65
62
|
subcommand: ['issue', 'list'],
|
|
66
63
|
jsonFields: issueFields,
|
|
67
64
|
inputSchema: {
|
|
@@ -78,7 +75,8 @@ export async function buildToolDefinitions() {
|
|
|
78
75
|
{
|
|
79
76
|
name: 'gh_pr_list',
|
|
80
77
|
description: 'List GitHub pull requests as structured JSON. ' +
|
|
81
|
-
'Uses the local `gh` CLI and its existing authentication — no API key required.'
|
|
78
|
+
'Uses the local `gh` CLI and its existing authentication — no API key required. ' +
|
|
79
|
+
'Read-only. Does not create, edit, merge, or close pull requests.',
|
|
82
80
|
subcommand: ['pr', 'list'],
|
|
83
81
|
jsonFields: prFields,
|
|
84
82
|
inputSchema: {
|
|
@@ -94,21 +92,25 @@ export async function buildToolDefinitions() {
|
|
|
94
92
|
},
|
|
95
93
|
];
|
|
96
94
|
}
|
|
97
|
-
/**
|
|
95
|
+
/**
|
|
96
|
+
* Builds the gh args array using --flag=value notation throughout.
|
|
97
|
+
* This prevents option injection: a value starting with '-' cannot
|
|
98
|
+
* be misinterpreted as a separate flag by gh's argument parser.
|
|
99
|
+
*/
|
|
98
100
|
export function buildGhArgs(tool, args) {
|
|
99
|
-
const parts = [...tool.subcommand,
|
|
101
|
+
const parts = [...tool.subcommand, `--json=${tool.jsonFields.join(',')}`];
|
|
100
102
|
if (args['repo'] !== undefined)
|
|
101
|
-
parts.push(
|
|
103
|
+
parts.push(`--repo=${String(args['repo'])}`);
|
|
102
104
|
if (args['limit'] !== undefined)
|
|
103
|
-
parts.push(
|
|
105
|
+
parts.push(`--limit=${String(args['limit'])}`);
|
|
104
106
|
if (args['state'] !== undefined)
|
|
105
|
-
parts.push(
|
|
107
|
+
parts.push(`--state=${String(args['state'])}`);
|
|
106
108
|
if (args['label'] !== undefined && tool.name === 'gh_issue_list')
|
|
107
|
-
parts.push(
|
|
109
|
+
parts.push(`--label=${String(args['label'])}`);
|
|
108
110
|
if (args['assignee'] !== undefined)
|
|
109
|
-
parts.push(
|
|
111
|
+
parts.push(`--assignee=${String(args['assignee'])}`);
|
|
110
112
|
if (args['base'] !== undefined && tool.name === 'gh_pr_list')
|
|
111
|
-
parts.push(
|
|
113
|
+
parts.push(`--base=${String(args['base'])}`);
|
|
112
114
|
return parts;
|
|
113
115
|
}
|
|
114
116
|
//# sourceMappingURL=schema.js.map
|
package/dist/schema.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgB/C,MAAM,
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgB/C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW;IACjD,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK;IACrD,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ;IAC5C,cAAc;IACd,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa;IACzE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc;CAC3D,CAAC,CAAC;AAEH,MAAM,eAAe,GAA6B;IAChD,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC;IACrF,SAAS,EAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;CACrG,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,UAAoB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,sFAAsF;QACtF,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3C,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC;iBACzB,KAAK,CAAC,QAAQ,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,gBAAgB,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC,CAAC;IAEH,OAAO;QACL;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EACT,yCAAyC;gBACzC,iFAAiF;gBACjF,qDAAqD;YACvD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;oBACxG,KAAK,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;oBACvE,KAAK,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;oBACjF,KAAK,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;oBAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE;iBACvE;aACF;SACF;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EACT,gDAAgD;gBAChD,iFAAiF;gBACjF,kEAAkE;YACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;YAC1B,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;oBACxG,KAAK,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;oBACvE,KAAK,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;oBACpF,IAAI,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE;oBACnE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE;iBACvE;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,IAA6B;IAC7E,MAAM,KAAK,GAAa,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAS,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAQ,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAQ,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAQ,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACpH,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAS,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAK,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAElH,OAAO,KAAK,CAAC;AACf,CAAC"}
|