Merge remote-tracking branch 'origin/codex/batch17-cloud-mcp-boundaries' into codex/effect-lint-integration

Rhys Sullivan committed 6 months ago

Commit 3a856292 parents cd10e67 fcae4133 files · +158 −90Browse files

Unified · Split

3 files

apps/cloud/src/mcp-session.ts +27 −13
apps/cloud/src/mcp.ts +28 −24
apps/cloud/src/mcp/response-peek.ts +103 −53

   return {
     sql,
     db: drizzle(sql, { schema: combinedSchema }) as DrizzleDb,
+    // oxlint-disable-next-line executor/no-promise-catch -- boundary: postgres.js close is best-effort during DO/runtime cleanup
     end: () => sql.end({ timeout: 0 }).catch(() => undefined),
   };
 };
       this.transportJsonResponseMode = null;
       await Promise.all([
+        // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation
         this.ctx.storage.delete(TRANSPORT_STATE_KEY).catch(() => false),
+        // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation
         this.ctx.storage.delete(SESSION_META_KEY).catch(() => false),
+        // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation
         this.ctx.storage.delete(LAST_ACTIVITY_KEY).catch(() => false),
+        // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object alarm cleanup is best-effort after session invalidation
         this.ctx.storage.deleteAlarm().catch(() => undefined),
       ]);
     }).pipe(Effect.withSpan("mcp.session.clear_state"));
       }
       if (self.mcpServer) {
         const mcpServer = self.mcpServer;
+        // oxlint-disable-next-line executor/no-promise-catch -- boundary: MCP SDK close failure is ignored during best-effort runtime teardown
         yield* Effect.promise(() => mcpServer.close().catch(() => undefined));
         self.mcpServer = null;
       }
       }
       self.initialized = false;
       self.transportJsonResponseMode = null;
-    }).pipe(Effect.orDie);
+    }).pipe(
+      // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO cleanup has no typed failure surface
+      Effect.orDie,
+    );
   }
   private installRuntime(
           "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"),
         },
       }),
+      // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: cold DO restore is re-entered from Promise-only Durable Object method
       Effect.orDie,
     );
   }
       yield* Effect.annotateCurrentSpan({
         "mcp.session.transport_upgraded_json_response": true,
       });
-    }).pipe(Effect.withSpan("McpSessionDO.ensureJsonResponseTransportForPost"), Effect.orDie);
+    }).pipe(
+      Effect.withSpan("McpSessionDO.ensureJsonResponseTransportForPost"),
+      // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: transport rebuild is internal DO runtime state
+      Effect.orDie,
+    );
   }
   private validateSessionOwner(request: Request): Effect.Effect<Response | null> {
     const self = this;
     return Effect.gen(function* () {
       const dbHandle = makeEphemeralDb();
-      try {
+      return yield* resolveSessionMeta(token.organizationId, token.userId).pipe(
-        const sessionMeta = yield* resolveSessionMeta(token.organizationId, token.userId).pipe(
+        Effect.provide(makeResolveOrganizationServices(dbHandle)),
-          Effect.provide(makeResolveOrganizationServices(dbHandle)),
+        Effect.tap((sessionMeta) =>
-        );
+          Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe(
-        yield* Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe(
+            Effect.withSpan("mcp.session.save_meta"),
-          Effect.withSpan("mcp.session.save_meta"),
+          ),
-        );
+        ),
-        return sessionMeta;
+        Effect.ensuring(Effect.promise(() => dbHandle.end())),
-      } finally {
+      );
-        yield* Effect.promise(() => dbHandle.end());
-      }
     }).pipe(Effect.withSpan("mcp.session.resolve_and_store_meta"));
   }
         }),
         (eff) => withIncomingParent(incoming, eff),
         Effect.provide(DoTelemetryLive),
+        // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: Durable Object init method can only reject its Promise
         Effect.orDie,
       ),
     );
           return yield* Effect.failCause(cause);
         }),
       ),
+      // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: doInit is called only from Promise-only Durable Object init
       Effect.orDie,
     );
   }

apps/cloud/src/mcp.ts+28−24

 import { env } from "cloudflare:workers";
 import { HttpEffect, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { Cause, Context, Effect, Layer, Option, Schema } from "effect";
+import { Cause, Context, Effect, Layer, Option, Predicate, Result, Schema } from "effect";
 import { createCachedRemoteJWKSet } from "./jwks-cache";
 import { captureCause } from "./observability";
       }),
     );
     if (!verified) return mcpUnauthorized("invalid_token", "The access token is invalid");
-    if ("_tag" in verified) return verified;
+    if (Predicate.isTagged(verified, "Unauthorized")) return verified;
     if (!verified.accountId) {
       yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" });
       return mcpUnauthorized("invalid_token", "The access token is invalid");
 const requestWithCf = (request: Request): Request & { cf?: CfRequestMetadata } =>
   request as Request & { cf?: CfRequestMetadata };
-const getCfMeta = (request: Request): CfRequestMetadata =>
+const getCfMeta = (request: Request): CfRequestMetadata => requestWithCf(request).cf ?? {};
-  requestWithCf(request).cf ?? {};
 const HEADERS_TO_DUMP = [
   "accept",
 const NamedParams = Schema.Struct({ name: Schema.optional(Schema.String) });
 const UriParams = Schema.Struct({ uri: Schema.optional(Schema.String) });
-const decodeJsonRpcEnvelope = Schema.decodeUnknownOption(JsonRpcEnvelope);
+const decodeJsonRpcEnvelopeString = Schema.decodeUnknownOption(
+  Schema.fromJsonString(JsonRpcEnvelope),
+);
 const decodeInitializeParams = Schema.decodeUnknownOption(InitializeParams);
 const decodeNamedParams = Schema.decodeUnknownOption(NamedParams);
 const decodeUriParams = Schema.decodeUnknownOption(UriParams);
 const decodeElicitationReplyResult = Schema.decodeUnknownOption(ElicitationReplyResult);
+const isMcpAuthorized = (value: McpAuthResult): value is McpAuthorizedResult =>
+  Predicate.isTagged(value, "Authorized");
+const isMcpUnauthorized = (value: McpAuthResult): value is McpUnauthorizedResult =>
+  Predicate.isTagged(value, "Unauthorized");
 const readJsonRpcEnvelope = (request: Request): Effect.Effect<Option.Option<JsonRpcEnvelope>> =>
-  Effect.promise(async () => {
+  Effect.tryPromise({
-    try {
+    try: () => request.clone().text(),
-      const text = await request.clone().text();
+    catch: () => undefined,
-      if (!text) return Option.none();
+  }).pipe(
-      return decodeJsonRpcEnvelope(JSON.parse(text));
+    Effect.map((text) => (text ? decodeJsonRpcEnvelopeString(text) : Option.none())),
-    } catch {
+    Effect.catchCause(() => Effect.succeed(Option.none())),
-      return Option.none();
+    Effect.withSpan("mcp.request.read_json_rpc"),
-    }
+  );
-  }).pipe(Effect.withSpan("mcp.request.read_json_rpc"));
 const methodAttrs = (envelope: JsonRpcEnvelope): Record<string, unknown> => {
   const params = envelope.params ?? {};
   }),
 );
-const authorizationServerMetadata = Effect.promise(async () => {
+const authorizationServerMetadata = Effect.tryPromise({
-  try {
+  try: async () => {
     const res = await fetch(`${AUTHKIT_DOMAIN}/.well-known/oauth-authorization-server`);
     if (!res.ok) return jsonResponse({ error: "upstream_error" }, 502);
     return jsonResponse(await res.json());
-  } catch {
+  },
-    return jsonResponse({ error: "upstream_error" }, 502);
+  catch: () => undefined,
-  }
+}).pipe(Effect.catchCause(() => Effect.succeed(jsonResponse({ error: "upstream_error" }, 502))));
-});
 // ---------------------------------------------------------------------------
 // DO dispatch
       Effect.catchCause((error) =>
         Effect.gen(function* () {
           yield* Effect.annotateCurrentSpan({
-            "mcp.auth.organization_authorize_error": String(error),
+            "mcp.auth.organization_authorize_error": Cause.pretty(error),
           });
           return false;
         }),
   const auth = yield* McpAuth;
   const authResult = yield* auth.verifyBearer(request).pipe(Effect.result);
-  if (authResult._tag === "Failure") {
+  if (Result.isFailure(authResult)) {
     yield* annotateMcpRequest(request, {
       token: null,
       parseBody: request.method === "POST",
   // POST bodies are JSON-RPC payloads worth parsing; GET (SSE) and DELETE
   // don't carry one.
   yield* annotateMcpRequest(request, {
-    token: authValue._tag === "Authorized" ? authValue.token : null,
+    token: isMcpAuthorized(authValue) ? authValue.token : null,
     parseBody: request.method === "POST",
   });
-  if (authValue._tag === "Unauthorized") {
+  if (isMcpUnauthorized(authValue)) {
     return unauthorized(authValue, PROTECTED_RESOURCE_METADATA_URL);
   }
   const token = authValue.token;

apps/cloud/src/mcp/response-peek.ts+103−53

@@ -1,23 +1,57 @@
1	import * as Sentry from "@sentry/cloudflare";	1	import * as Sentry from "@sentry/cloudflare";
2	import { Effect } from "effect";	2	import { Cause, Data, Effect, Exit, Option, Schema } from "effect";
3		3
4	import { jsonRpcWebResponse } from "./responses";	4	import { jsonRpcWebResponse } from "./responses";
5		5
6	const SSE_PEEK_TIMEOUT_MS = 10_000;	6	const SSE_PEEK_TIMEOUT_MS = 10_000;
7		7
8	type SandboxOutcome = {	8	class ResponseBodyTimeoutError extends Data.TaggedError("ResponseBodyTimeoutError")<{
9	readonly status?: string;	9	readonly timeoutMs: number;
10	readonly error?: { readonly kind?: string; readonly message?: string };	10	}> {}
11	};	11
12		12	class ResponseBodyReadError extends Data.TaggedError("ResponseBodyReadError") {}
13	type JsonRpcResponseBody = {	13
14	readonly jsonrpc?: string;	14	class McpInternalJsonRpcError extends Data.TaggedError("McpInternalJsonRpcError")<{
15	readonly error?: { readonly code?: number; readonly message?: string };	15	readonly message: string;
16	readonly result?: {	16	}> {}
17	readonly isError?: boolean;	17
18	readonly structuredContent?: SandboxOutcome;	18	const ResponseBodyTimeoutErrorData = Schema.Struct({
19	};	19	_tag: Schema.Literal("ResponseBodyTimeoutError"),
20	};	20	timeoutMs: Schema.Number,
		21	});
		22	const decodeResponseBodyTimeoutError = Schema.decodeUnknownOption(ResponseBodyTimeoutErrorData);
		23
		24	const SandboxOutcomeSchema = Schema.Struct({
		25	status: Schema.optional(Schema.String),
		26	error: Schema.optional(
		27	Schema.Struct({
		28	kind: Schema.optional(Schema.String),
		29	message: Schema.optional(Schema.String),
		30	}),
		31	),
		32	});
		33
		34	const JsonRpcResponseBodySchema = Schema.Struct({
		35	jsonrpc: Schema.optional(Schema.String),
		36	error: Schema.optional(
		37	Schema.Struct({
		38	code: Schema.optional(Schema.Number),
		39	message: Schema.optional(Schema.String),
		40	}),
		41	),
		42	result: Schema.optional(
		43	Schema.Struct({
		44	isError: Schema.optional(Schema.Boolean),
		45	structuredContent: Schema.optional(SandboxOutcomeSchema),
		46	}),
		47	),
		48	});
		49
		50	const decodeJsonRpcResponseBody = Schema.decodeUnknownOption(
		51	Schema.fromJsonString(JsonRpcResponseBodySchema),
		52	);
		53
		54	type JsonRpcResponseBody = typeof JsonRpcResponseBodySchema.Type;
21		55
22	const responseBodyShape = (body: string): string => {	56	const responseBodyShape = (body: string): string => {
23	const trimmed = body.trimStart();	57	const trimmed = body.trimStart();
@@ -31,18 +65,18 @@ const responseBodyShape = (body: string): string => { · 7 unmodified lines
31		65
32	const parseFirstJsonRpc = (contentType: string, body: string): JsonRpcResponseBody \| null => {	66	const parseFirstJsonRpc = (contentType: string, body: string): JsonRpcResponseBody \| null => {
33	if (!body) return null;	67	if (!body) return null;
34	try {	68	if (contentType.includes("text/event-stream")) {
35	if (contentType.includes("text/event-stream")) {	69	for (const line of body.split(/\r?\n/)) {
36	for (const line of body.split(/\r?\n/)) {	70	if (line.startsWith("data:")) {
37	if (line.startsWith("data:")) return JSON.parse(line.slice(5).trimStart());	71	return Option.getOrNull(decodeJsonRpcResponseBody(line.slice(5).trimStart()));
38	}	72	}
39	return null;
40	}	73	}
41	if (contentType.includes("application/json")) return JSON.parse(body);
42	return null;
43	} catch {
44	return null;	74	return null;
45	}	75	}
		76	if (contentType.includes("application/json")) {
		77	return Option.getOrNull(decodeJsonRpcResponseBody(body));
		78	}
		79	return null;
46	};	80	};
47		81
48	const jsonRpcResponseAttrs = (payload: JsonRpcResponseBody \| null): Record<string, unknown> => {	82	const jsonRpcResponseAttrs = (payload: JsonRpcResponseBody \| null): Record<string, unknown> => {
@@ -52,8 +86,10 @@ const jsonRpcResponseAttrs = (payload: JsonRpcResponseBody \| null): Record<strin · 3 unmodified lines
52	if (err && typeof err === "object") {	86	if (err && typeof err === "object") {
53	attrs["mcp.rpc.is_error"] = true;	87	attrs["mcp.rpc.is_error"] = true;
54	if (typeof err.code === "number") attrs["mcp.rpc.error.code"] = err.code;	88	if (typeof err.code === "number") attrs["mcp.rpc.error.code"] = err.code;
55	if (typeof err.message === "string") {	89	// oxlint-disable-next-line executor/no-unknown-error-message -- boundary: schema-decoded JSON-RPC error message is protocol telemetry
56	attrs["mcp.rpc.error.message"] = err.message.slice(0, 500);	90	const { message } = err;
		91	if (typeof message === "string") {
		92	attrs["mcp.rpc.error.message"] = message.slice(0, 500);
57	}	93	}
58	}	94	}
59	if (payload.result?.isError === true) attrs["mcp.tool.result.is_error"] = true;	95	if (payload.result?.isError === true) attrs["mcp.tool.result.is_error"] = true;
@@ -61,20 +97,14 @@ const jsonRpcResponseAttrs = (payload: JsonRpcResponseBody \| null): Record<strin · 1 unmodified line
61	if (structured && typeof structured.status === "string") {	97	if (structured && typeof structured.status === "string") {
62	attrs["mcp.tool.sandbox.status"] = structured.status;	98	attrs["mcp.tool.sandbox.status"] = structured.status;
63	if (structured.error?.kind) attrs["mcp.tool.sandbox.error.kind"] = structured.error.kind;	99	if (structured.error?.kind) attrs["mcp.tool.sandbox.error.kind"] = structured.error.kind;
64	if (typeof structured.error?.message === "string") {	100	const message = structured.error?.["message"];
65	attrs["mcp.tool.sandbox.error.message"] = structured.error.message.slice(0, 500);	101	if (typeof message === "string") {
		102	attrs["mcp.tool.sandbox.error.message"] = message.slice(0, 500);
66	}	103	}
67	}	104	}
68	return attrs;	105	return attrs;
69	};	106	};
70		107
71	class ResponseBodyTimeoutError extends Error {
72	constructor(readonly timeoutMs: number) {
73	super(`Timed out waiting for MCP response body after ${timeoutMs}ms`);
74	this.name = "ResponseBodyTimeoutError";
75	}
76	}
77
78	const readResponseText = async (response: Response, timeoutMs: number \| null): Promise<string> => {	108	const readResponseText = async (response: Response, timeoutMs: number \| null): Promise<string> => {
79	if (timeoutMs === null) return await response.text();	109	if (timeoutMs === null) return await response.text();
80		110
@@ -85,11 +115,14 @@ const readResponseText = async (response: Response, timeoutMs: number \| null): P · 4 unmodified lines
85	let timeout: ReturnType<typeof setTimeout> \| undefined;	115	let timeout: ReturnType<typeof setTimeout> \| undefined;
86	const timeoutPromise = new Promise<never>((_, reject) => {	116	const timeoutPromise = new Promise<never>((_, reject) => {
87	timeout = setTimeout(() => {	117	timeout = setTimeout(() => {
		118	// oxlint-disable-next-line executor/no-promise-catch -- boundary: best-effort stream cancellation inside timeout callback
88	void reader.cancel().catch(() => undefined);	119	void reader.cancel().catch(() => undefined);
89	reject(new ResponseBodyTimeoutError(timeoutMs));	120	// oxlint-disable-next-line executor/no-promise-reject -- boundary: Promise.race timeout adapter for Web ReadableStream
		121	reject(new ResponseBodyTimeoutError({ timeoutMs }));
90	}, timeoutMs);	122	}, timeoutMs);
91	});	123	});
92	const readPromise = (async () => {	124	const readPromise = (async () => {
		125	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Web stream reader cleanup must clear host timeout after success or failure
93	try {	126	try {
94	let text = "";	127	let text = "";
95	for (;;) {	128	for (;;) {
@@ -125,9 +158,18 @@ const withoutBodyHeaders = (response: Response) => { · 29 unmodified lines
125	});	158	});
126	};	159	};
127		160
		161	const isResponseBodyTimeoutError = (error: unknown) =>
		162	Option.isSome(decodeResponseBodyTimeoutError(error));
		163
		164	const responsePeekError = (error: unknown): ResponseBodyTimeoutError \| ResponseBodyReadError =>
		165	Option.match(decodeResponseBodyTimeoutError(error), {
		166	onNone: () => new ResponseBodyReadError(),
		167	onSome: ({ timeoutMs }) => new ResponseBodyTimeoutError({ timeoutMs }),
		168	});
		169
128	const responseReadFailure = (error: unknown) =>	170	const responseReadFailure = (error: unknown) =>
129	Effect.gen(function* () {	171	Effect.gen(function* () {
130	const timedOut = error instanceof ResponseBodyTimeoutError;	172	const timedOut = isResponseBodyTimeoutError(error);
131	yield* Effect.annotateCurrentSpan({	173	yield* Effect.annotateCurrentSpan({
132	"mcp.response.status_code": timedOut ? 504 : 500,	174	"mcp.response.status_code": timedOut ? 504 : 500,
133	"mcp.response.content_type": "application/json",	175	"mcp.response.content_type": "application/json",
@@ -135,7 +177,7 @@ const responseReadFailure = (error: unknown) => · 1 unmodified line
135	"mcp.response.body.length": 0,	177	"mcp.response.body.length": 0,
136	"mcp.response.jsonrpc.detected": true,	178	"mcp.response.jsonrpc.detected": true,
137	"mcp.peek_response.timed_out": timedOut,	179	"mcp.peek_response.timed_out": timedOut,
138	"mcp.peek_response.error": String(error),	180	"mcp.peek_response.error": timedOut ? "ResponseBodyTimeoutError" : "ResponseBodyReadError",
139	});	181	});
140	return jsonRpcWebResponse(	182	return jsonRpcWebResponse(
141	timedOut ? 504 : 500,	183	timedOut ? 504 : 500,
@@ -149,8 +191,8 @@ const responseReadFailure = (error: unknown) => · 7 unmodified lines
149	const reportInternalJsonRpcError = (payload: JsonRpcResponseBody \| null) =>	191	const reportInternalJsonRpcError = (payload: JsonRpcResponseBody \| null) =>
150	Effect.sync(() => {	192	Effect.sync(() => {
151	if (payload?.error?.code !== -32603) return;	193	if (payload?.error?.code !== -32603) return;
152	const msg = payload.error.message ?? "unknown";	194	const message = payload.error["message"] ?? "unknown";
153	Sentry.captureException(new Error(`MCP internal error (-32603): ${msg}`));	195	Sentry.captureException(new McpInternalJsonRpcError({ message }));
154	});	196	});
155		197
156	export const peekAndAnnotate = (response: Response): Effect.Effect<Response> =>	198	export const peekAndAnnotate = (response: Response): Effect.Effect<Response> =>
@@ -167,21 +209,29 @@ export const peekAndAnnotate = (response: Response): Effect.Effect<Response> => · 10 unmodified lines
167		209
168	const isSseResponse = contentType.includes("text/event-stream");	210	const isSseResponse = contentType.includes("text/event-stream");
169	const timeoutMs = isSseResponse ? SSE_PEEK_TIMEOUT_MS : null;	211	const timeoutMs = isSseResponse ? SSE_PEEK_TIMEOUT_MS : null;
170	const textResult = yield* Effect.result(Effect.tryPromise({	212	const textExit = yield* Effect.exit(
171	try: () => readResponseText(response, timeoutMs),	213	Effect.tryPromise({
172	catch: (error) => error,	214	try: () => readResponseText(response, timeoutMs),
173	}).pipe(	215	catch: responsePeekError,
174	Effect.withSpan("mcp.peek_response", {	216	}).pipe(
175	attributes: {	217	Effect.withSpan("mcp.peek_response", {
176	"http.response.content_type": contentType,	218	attributes: {
177	"http.response.status_code": response.status,	219	"http.response.content_type": contentType,
178	"mcp.peek_response.timeout_ms": timeoutMs ?? 0,	220	"http.response.status_code": response.status,
179	},	221	"mcp.peek_response.timeout_ms": timeoutMs ?? 0,
180	}),	222	},
181	));	223	}),
182	if (textResult._tag === "Failure") return yield* responseReadFailure(textResult.failure);	224	),
183		225	);
184	const text = textResult.success;	226	if (Exit.isFailure(textExit)) {
		227	const error = Option.getOrElse(
		228	Cause.findErrorOption(textExit.cause),
		229	() => new ResponseBodyReadError(),
		230	);
		231	return yield* responseReadFailure(error);
		232	}
		233
		234	const text = textExit.value;
185	const payload = parseFirstJsonRpc(contentType, text);	235	const payload = parseFirstJsonRpc(contentType, text);
186	yield* Effect.annotateCurrentSpan({	236	yield* Effect.annotateCurrentSpan({
187	"mcp.response.status_code": response.status,	237	"mcp.response.status_code": response.status,