// ---------------------------------------------------------------------------// Stdio transport factory — loaded only on demand// ---------------------------------------------------------------------------//// Kept in its own module so `connection.ts` never imports it eagerly at// module load. The v2 `@modelcontextprotocol/client/stdio` entry still eagerly// evaluates Node-only process/stream imports and `cross-spawn` (which loads// `node:child_process`); under `@cloudflare/vitest-pool-workers`// that crashes workerd at module instantiation with SIGSEGV (prod bundles// tree-shake it away when `dangerouslyAllowStdioMCP: false`, tests do not).//// Callers that actually need stdio transport reach it via a dynamic import// in `connection.ts`. Remote-only consumers (cloud/marketing) never execute// the import and therefore never touch `node:child_process`.// --------------------------------------------------------------------------- import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/client/stdio"; export type StdioTransportConfig = {  readonly command: string;  readonly args?: ReadonlyArray<string>;  readonly env?: Record<string, string>;  readonly cwd?: string;}; /** * Host variables a stdio server inherits, on top of the SDK's own safe-list. * * Same reasoning and same list as the TLS pass-through `service install` bakes * into a supervised unit's minimal environment (`apps/cli/src/service.ts`): a * stdio server sits behind the same corporate proxy and the same intercepting * CA as the process that spawned it, and those paths commonly live outside the * OS trust store. Dropping them makes every HTTPS call from every stdio server * fail on such a network. None of them carries a credential. * * Deliberately short and closed. Anything else a server needs — an API key * above all — is declared on the source config's `env`, which is the mechanism * that already exists for exactly that, and which wins on a key collision. */const inheritedEnvKeys = [  "HTTP_PROXY",  "HTTPS_PROXY",  "NO_PROXY",  // Lowercase spellings are not aliases: libcurl and most Unix tooling read  // these, while Node reads the uppercase ones. Both are in real use.  "http_proxy",  "https_proxy",  "no_proxy",  "NODE_EXTRA_CA_CERTS",  "SSL_CERT_FILE",  "SSL_CERT_DIR",] as const; /** Read at spawn time, not module load: the host's proxy configuration can be *  set after this module is first imported. */const inheritedEnv = (): Record<string, string> =>  Object.fromEntries(    inheritedEnvKeys.flatMap((key) => {      const value = process.env[key];      return value ? [[key, value] as const] : [];    }),  ); /** * Combine the inherited allowlist with the source config's declared `env`, * using the key identity the target platform actually has. * * On Windows an environment key is case-insensitive: `Path` and `PATH` name one * variable. A JavaScript spread is case-sensitive on every platform, so a plain * merge can emit two spellings of the same variable — inherited `HTTP_PROXY` * beside a declared `http_proxy`, or the SDK's `PATH` beside a declared `Path`. * Both then reach the child's environment block, and the child reads whichever * Windows resolves first rather than the one the config declared. Precedence * that reads correctly in the source is silently lost at the boundary. * * So on `win32` this merges by case-insensitive key identity. The declared env * still wins, and the losing spelling is dropped instead of travelling beside * the winner. A key that collides with one the SDK sets is emitted with the * SDK's spelling, because the SDK spreads its own safe-list underneath this * result: matching its spelling replaces that entry, while a different spelling * would only add an alias next to it. * * On every other platform the keys are genuinely case-sensitive, and this is a * plain merge. */export const mergeStdioEnv = ({  platform,  inherited,  declared,  sdkKeys = [],}: {  readonly platform: NodeJS.Platform;  readonly inherited: Record<string, string>;  readonly declared?: Record<string, string>;  /** Keys the SDK's own safe-list will place underneath this result. */  readonly sdkKeys?: ReadonlyArray<string>;}): Record<string, string> => {  if (platform !== "win32") return { ...inherited, ...declared };   const sdkSpelling = new Map(sdkKeys.map((key) => [key.toLowerCase(), key] as const));  // Keyed by the case-insensitive identity; insertion order follows first  // sight of a variable, and a later source overwrites the entry in place.  const merged = new Map<string, readonly [string, string]>();   for (const source of [inherited, declared]) {    for (const [key, value] of Object.entries(source ?? {})) {      const identity = key.toLowerCase();      merged.set(identity, [sdkSpelling.get(identity) ?? key, value]);    }  }   return Object.fromEntries(merged.values());}; /** The exact child environment `createStdioTransport` produces: the SDK's *  sudo-style safe-list underneath the inherited infrastructure allowlist and *  the declared env. Exported for the app-server bridge, which manages its own *  child process (the SDK transport validates every incoming line against MCP *  schemas, and app-server traffic is not MCP-shaped) but must spawn with the *  same environment rules. */export const stdioSpawnEnv = (declared?: Record<string, string>): Record<string, string> => ({  ...getDefaultEnvironment(),  ...mergeStdioEnv({    platform: process.platform,    inherited: inheritedEnv(),    declared,    sdkKeys: Object.keys(getDefaultEnvironment()),  }),}); export const createStdioTransport = (config: StdioTransportConfig) =>  new StdioClientTransport({    command: config.command,    args: config.args ? [...config.args] : undefined,    // Pass the declared env plus the infrastructure allowlist above, and    // nothing else. The SDK merges this over `getDefaultEnvironment()`, a    // sudo-style safe-list (HOME, LOGNAME, PATH, SHELL, TERM, USER) that    // deliberately excludes everything else and skips function-shaped values    // as a security risk.    //    // Spreading `process.env` here did not add to that safe-list, it defeated    // it: the child received every variable this process holds, which for a    // server that spawns one includes `EXECUTOR_SECRET_KEY` (the key that    // decrypts the secret store), `EXECUTOR_AUTH_TOKEN`, `DATABASE_URL` and    // whatever else the operator exported.    env: mergeStdioEnv({      platform: process.platform,      inherited: inheritedEnv(),      declared: config.env,      sdkKeys: Object.keys(getDefaultEnvironment()),    }),    cwd: config.cwd,  });