lael-labs/t3code

apps/server/src/mcp/ProjectMcpService.test.ts+58−0

@@ -11,6 +11,7 @@ import { · 10 unmodified lines
11	ProviderInstanceId,	11	ProviderInstanceId,
12	type ServerSettings,	12	type ServerSettings,
13	ServerSettingsError,	13	ServerSettingsError,
		14	SourceControlRepositoryError,
14	ThreadId,	15	ThreadId,
15	} from "@t3tools/contracts";	16	} from "@t3tools/contracts";
16	import * as Deferred from "effect/Deferred";	17	import * as Deferred from "effect/Deferred";
@@ -222,11 +223,68 @@ it.effect("loads response settings before committing project mutations", () => · 205 unmodified lines
222	})	223	})
223	.pipe(Effect.flip);	224	.pipe(Effect.flip);
224	expect(error.code).toBe("operation_failed");	225	expect(error.code).toBe("operation_failed");
		226	expect(error.message).toBe("Unable to read project defaults.");
		227	expect(error.message).not.toMatch(/settings unavailable\|settings\.json/);
225	expect(yield* Ref.get(createCalls)).toBe(0);	228	expect(yield* Ref.get(createCalls)).toBe(0);
226	}).pipe(Effect.provide(testLayer));	229	}).pipe(Effect.provide(testLayer));
227	}),	230	}),
228	);	231	);
229		232
		233	it.effect("redacts repository failures from public project MCP results", () =>
		234	Effect.gen(function* () {
		235	const secretRemote = "https://oauth-token@example.com/private/repo.git";
		236	const testLayer = ProjectMcp.layer.pipe(
		237	Layer.provide(
		238	Layer.mock(ProjectService.ProjectService)({
		239	getById: () => Effect.succeed(Option.none()),
		240	}),
		241	),
		242	Layer.provide(Layer.mock(T3ProjectFileLoader.T3ProjectFileLoader)({})),
		243	Layer.provide(
		244	Layer.mock(ServerSettingsService.ServerSettingsService)({
		245	getSettings: Effect.succeed({ defaultThreadEnvMode: "local" } as ServerSettings),
		246	}),
		247	),
		248	Layer.provide(
		249	Layer.mock(SourceControlRepositoryService.SourceControlRepositoryService)({
		250	cloneRepository: () =>
		251	Effect.fail(
		252	new SourceControlRepositoryError({
		253	provider: "unknown",
		254	operation: "cloneRepository",
		255	detail: `fatal: authentication failed for ${secretRemote}`,
		256	}),
		257	),
		258	}),
		259	),
		260	Layer.provide(Layer.mock(ThreadManagement.ThreadManagementService)({})),
		261	Layer.provide(NodeServices.layer),
		262	);
		263
		264	const error = yield* Effect.gen(function* () {
		265	const service = yield* ProjectMcp.ProjectMcpService;
		266	return yield* service
		267	.create(scope, {
		268	title: "Private clone",
		269	source: {
		270	type: "clone",
		271	destinationPath: "/work/private-clone",
		272	remoteUrl: secretRemote,
		273	},
		274	clientRequestId: "private-clone",
		275	})
		276	.pipe(Effect.flip);
		277	}).pipe(Effect.provide(testLayer));
		278
		279	expect(error).toMatchObject({
		280	code: "operation_failed",
		281	message: "Unable to clone the requested repository.",
		282	});
		283	expect(error.message).not.toMatch(/oauth-token\|example\.com\|fatal\|authentication/i);
		284	expect(error).not.toHaveProperty("cause");
		285	}),
		286	);
		287
230	it.effect("clones before registration and requires explicit cascading for nonempty projects", () =>	288	it.effect("clones before registration and requires explicit cascading for nonempty projects", () =>
231	Effect.gen(function* () {	289	Effect.gen(function* () {
232	const projectId = ProjectId.make("project:mcp:provider-session-project-mcp:clone-and-delete");	290	const projectId = ProjectId.make("project:mcp:provider-session-project-mcp:clone-and-delete");

apps/server/src/mcp/ProjectMcpService.ts+34−45

   return new ProjectMcpFailure({ code, message });
 }
-function errorMessage(error: unknown): string {
+function redactOperationFailure(operation: string, publicMessage: string) {
-  return error instanceof Error ? error.message : String(error);
+  return <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, ProjectMcpFailure, R> =>
+    effect.pipe(
+      Effect.tapError((error) =>
+        Effect.logWarning("Project MCP operation failed.", { operation, error }),
+      ),
+      Effect.mapError(() => failure("operation_failed", publicMessage)),
+    );
 }
 function stablePart(value: string): string {
           );
   const loadSettings = serverSettings.getSettings.pipe(
-    Effect.mapError((error) =>
+    redactOperationFailure("read-server-settings", "Unable to read project defaults."),
-      failure("operation_failed", `Unable to read server settings: ${errorMessage(error)}`),
-    ),
   );
   const projectWorkspaceDefaults = Effect.fn("ProjectMcpService.projectWorkspaceDefaults")(
   const loadProject = Effect.fn("ProjectMcpService.loadProject")(function* (projectId: ProjectId) {
     const project = yield* projects
       .getById(projectId)
-      .pipe(
+      .pipe(redactOperationFailure("read-project", "Unable to read the requested project."));
-        Effect.mapError((error) =>
-          failure(
-            "operation_failed",
-            `Unable to read project ${projectId}: ${errorMessage(error)}`,
-          ),
-        ),
-      );
     if (Option.isNone(project)) {
       return yield* failure("project_not_found", `Project '${projectId}' was not found.`);
     }
     Effect.gen(function* () {
       yield* requireCapability(scope);
       const snapshot = yield* projects.snapshot.pipe(
-        Effect.mapError((error) =>
+        redactOperationFailure("list-projects", "Unable to list projects."),
-          failure("operation_failed", `Unable to list projects: ${errorMessage(error)}`),
-        ),
       );
       const settings = yield* loadSettings;
       const cursor = input.cursor ?? 0;
           const existing = yield* projects
             .getById(projectId, { includeDeleted: true })
             .pipe(
-              Effect.mapError((error) =>
+              redactOperationFailure(
-                failure(
+                "read-project-create-receipt",
-                  "operation_failed",
+                "Unable to check the project creation result.",
-                  `Unable to retry project creation: ${errorMessage(error)}`,
-                ),
               ),
             );
           if (Option.isSome(existing)) {
                 ...(input.source.protocol === undefined ? {} : { protocol: input.source.protocol }),
               })
               .pipe(
-                Effect.mapError((error) =>
+                redactOperationFailure(
-                  failure("operation_failed", `Unable to clone project: ${errorMessage(error)}`),
+                  "clone-project-repository",
+                  "Unable to clone the requested repository.",
                 ),
               );
             workspaceRoot = cloned.cwd;
               ...(input.scripts === undefined ? {} : { scripts: input.scripts }),
             })
             .pipe(
-              Effect.mapError((error) =>
+              redactOperationFailure("create-project", "Unable to create the requested project."),
-                failure("operation_failed", `Unable to create project: ${errorMessage(error)}`),
-              ),
             );
           return yield* projectView(project, settings);
         }),
           ...(input.scripts === undefined ? {} : { scripts: input.scripts }),
         })
         .pipe(
+          Effect.tapError((error) =>
+            Effect.logWarning("Project MCP operation failed.", {
+              operation: "update-project",
+              error,
+            }),
+          ),
           Effect.mapError((error) =>
             error._tag === "ProjectNotFoundError"
-              ? failure("project_not_found", error.message)
+              ? failure("project_not_found", `Project '${input.projectId}' was not found.`)
-              : failure("operation_failed", `Unable to update project: ${errorMessage(error)}`),
+              : failure("operation_failed", "Unable to update the requested project."),
           ),
         );
       return yield* projectView(project, settings);
       yield* requireCapability(scope);
       const projectOption = yield* projects
         .getById(input.projectId, { includeDeleted: true })
-        .pipe(
+        .pipe(redactOperationFailure("read-project-for-delete", "Unable to read the project."));
-          Effect.mapError((error) =>
-            failure(
-              "operation_failed",
-              `Unable to read project ${input.projectId}: ${errorMessage(error)}`,
-            ),
-          ),
-        );
       if (Option.isNone(projectOption)) {
         return yield* failure("project_not_found", `Project '${input.projectId}' was not found.`);
       }
         threads.getShellSnapshot({ location: "active" }),
         threads.getShellSnapshot({ location: "archive" }),
       ]).pipe(
-        Effect.mapError((error) =>
+        redactOperationFailure(
-          failure("operation_failed", `Unable to inspect project threads: ${errorMessage(error)}`),
+          "inspect-project-threads",
+          "Unable to inspect the project's threads.",
         ),
       );
       const projectThreads = [
           }),
         { concurrency: 1, discard: true },
       ).pipe(
-        Effect.mapError((error) =>
+        redactOperationFailure(
-          failure("operation_failed", `Unable to delete project threads: ${errorMessage(error)}`),
+          "delete-project-threads",
+          "Unable to delete the project's thread records.",
         ),
       );
       yield* projects
           }),
           projectId: input.projectId,
         })
-        .pipe(
+        .pipe(redactOperationFailure("delete-project", "Unable to delete the requested project."));
-          Effect.mapError((error) =>
-            failure("operation_failed", `Unable to delete project: ${errorMessage(error)}`),
-          ),
-        );
       return {
         projectId: input.projectId,
         deleted: true,

apps/server/src/mcp/toolkits/project/tools.ts+1−1

@@ -58,7 +58,7 @@ export const ProjectCreateTool = Tool.make("t3_project_create", { · 57 unmodified lines
58	.annotate(Tool.Title, "Create a T3 project")	58	.annotate(Tool.Title, "Create a T3 project")
59	.annotate(Tool.Readonly, false)	59	.annotate(Tool.Readonly, false)
60	.annotate(Tool.Destructive, false)	60	.annotate(Tool.Destructive, false)
61	.annotate(Tool.Idempotent, true)	61	.annotate(Tool.Idempotent, false)
62	.annotate(Tool.OpenWorld, true);	62	.annotate(Tool.OpenWorld, true);
63		63
64	export const ProjectUpdateTool = Tool.make("t3_project_update", {	64	export const ProjectUpdateTool = Tool.make("t3_project_update", {

apps/server/src/mcp/toolkits/worktree/registration.test.ts+6−0

       expect(toolNames).toContain("delegate_task");
       expect(toolNames).toContain("t3_project_list");
       expect(toolNames).toContain("t3_project_delete");
+      const projectCreate = tools.find((tool) => tool.name === "t3_project_create");
+      expect(
+        projectCreate?.annotations && "idempotentHint" in projectCreate.annotations
+          ? projectCreate.annotations.idempotentHint
+          : undefined,
+      ).not.toBe(true);
       // The handoff tool mutates thread state, reaches the network (origin
       // fetch), and runs project setup scripts, so its MCP hints must not

apps/server/src/sourceControl/SourceControlRepositoryService.test.ts+1−1

@@ -209,7 +209,7 @@ it.effect("clones a looked-up repository into the requested destination", () => · 208 unmodified lines
209	assert.deepStrictEqual(cloneCalls, [	209	assert.deepStrictEqual(cloneCalls, [
210	{	210	{
211	cwd: `${parent}/missing/nested`,	211	cwd: `${parent}/missing/nested`,
212	args: ["clone", CLONE_URLS.url, "t3code"],	212	args: ["clone", "--origin", "origin", CLONE_URLS.url, "t3code"],
213	},	213	},
214	]);	214	]);
215	}).pipe(	215	}).pipe(

apps/server/src/sourceControl/SourceControlRepositoryService.ts+1−1

@@ -310,7 +310,7 @@ export const make = Effect.gen(function* () { · 309 unmodified lines
310	yield* git.execute({	310	yield* git.execute({
311	operation: "SourceControlRepositoryService.cloneRepository",	311	operation: "SourceControlRepositoryService.cloneRepository",
312	cwd: preparedDestination.parentPath,	312	cwd: preparedDestination.parentPath,
313	args: ["clone", remoteUrl, preparedDestination.directoryName],	313	args: ["clone", "--origin", "origin", remoteUrl, preparedDestination.directoryName],
314	timeoutMs: 120_000,	314	timeoutMs: 120_000,
315	maxOutputBytes: 256 * 1024,	315	maxOutputBytes: 256 * 1024,
316	});	316	});

packages/contracts/src/orchestration.ts+8−6

   RuntimeMode,
 } from "./providerPolicy.ts";
 import { ProviderInstanceId } from "./providerInstance.ts";
-import { ProjectScript, ProjectIconOverride } from "./project.ts";
+import {
+  Project,
+  ProjectFaviconPath,
+  ProjectIconOverride,
+  ProjectScript,
+  ProjectScriptIcon,
+} from "./project.ts";
 export { ProjectIconColor, ProjectIconOverride } from "./project.ts";
 import { RepositoryIdentity, ThreadEnvMode } from "./environment.ts";
 import { OrchestrationProjectShell } from "./orchestrationProject.ts";
 export const CorrelationId = CommandId;
 export type CorrelationId = typeof CorrelationId.Type;
-export const ProjectFaviconPath = TrimmedNonEmptyString.check(
+export { ProjectFaviconPath } from "./project.ts";
-  Schema.isMaxLength(1024),
-  Schema.isPattern(/\.(?:avif|gif|ico|jpe?g|png|svg|webp)$/i),
-);
-export type ProjectFaviconPath = typeof ProjectFaviconPath.Type;
 export const OrchestrationProject = Schema.Struct({
   id: ProjectId,

packages/contracts/src/project.test.ts+27−0

@@ -3,6 +3,7 @@ import { describe, expect, it } from "vite-plus/test"; · 2 unmodified lines
3		3
4	import {	4	import {
5	ProjectReadFileError,	5	ProjectReadFileError,
		6	ProjectMutation,
6	ProjectSearchContentsError,	7	ProjectSearchContentsError,
7	ProjectSearchContentsInput,	8	ProjectSearchContentsInput,
8	ProjectSearchEntriesError,	9	ProjectSearchEntriesError,
@@ -12,6 +13,7 @@ import { · 3 unmodified lines
12		13
13	const decodeSearchEntriesInput = Schema.decodeUnknownSync(ProjectSearchEntriesInput);	14	const decodeSearchEntriesInput = Schema.decodeUnknownSync(ProjectSearchEntriesInput);
14	const decodeSearchContentsInput = Schema.decodeUnknownSync(ProjectSearchContentsInput);	15	const decodeSearchContentsInput = Schema.decodeUnknownSync(ProjectSearchContentsInput);
		16	const decodeProjectMutation = Schema.decodeUnknownSync(ProjectMutation);
15		17
16	describe("project search inputs", () => {	18	describe("project search inputs", () => {
17	it("allows an empty entries query for bounded frecency browsing", () => {	19	it("allows an empty entries query for bounded frecency browsing", () => {
@@ -37,6 +39,31 @@ describe("project search inputs", () => { · 19 unmodified lines
37	});	39	});
38	});	40	});
39		41
		42	describe("project mutations", () => {
		43	it("rejects favicon paths the asset endpoint cannot serve", () => {
		44	const created = decodeProjectMutation({
		45	type: "project.create",
		46	commandId: "command-project-create",
		47	projectId: "project-1",
		48	title: "Project",
		49	workspaceRoot: "/work/project",
		50	faviconPath: "/work/project/favicon.png",
		51	});
		52	expect(created).toMatchObject({
		53	type: "project.create",
		54	faviconPath: "/work/project/favicon.png",
		55	});
		56	expect(() =>
		57	decodeProjectMutation({
		58	type: "project.update",
		59	commandId: "command-project-update",
		60	projectId: "project-1",
		61	faviconPath: "/work/project/.env",
		62	}),
		63	).toThrow();
		64	});
		65	});
		66
40	describe("project RPC errors", () => {	67	describe("project RPC errors", () => {
41	it("derives stable messages from structured request context while retaining causes", () => {	68	it("derives stable messages from structured request context while retaining causes", () => {
42	const cause = new Error("sensitive platform detail");	69	const cause = new Error("sensitive platform detail");

packages/contracts/src/project.ts+9−3

 const PROJECT_WRITE_FILE_PATH_MAX_LENGTH = 512;
 const PROJECT_READ_FILE_PATH_MAX_LENGTH = 512;
+export const ProjectFaviconPath = TrimmedNonEmptyString.check(
+  Schema.isMaxLength(1024),
+  Schema.isPattern(/\.(?:avif|gif|ico|jpe?g|png|svg|webp)$/i),
+);
+export type ProjectFaviconPath = typeof ProjectFaviconPath.Type;
 export const ProjectScriptIcon = Schema.Literals([
   "play",
   "test",
   title: TrimmedNonEmptyString,
   workspaceRoot: TrimmedNonEmptyString,
   repositoryIdentity: Schema.optional(Schema.NullOr(RepositoryIdentity)),
-  faviconPath: Schema.optional(Schema.NullOr(TrimmedNonEmptyString)),
+  faviconPath: Schema.optional(Schema.NullOr(ProjectFaviconPath)),
   projectIcon: Schema.optional(Schema.NullOr(ProjectIconOverride)),
   defaultModelSelection: Schema.NullOr(ModelSelection),
   defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),
     createWorkspaceRootIfMissing: Schema.optional(Schema.Boolean),
     defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),
     defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),
-    faviconPath: Schema.optional(Schema.NullOr(TrimmedNonEmptyString)),
+    faviconPath: Schema.optional(Schema.NullOr(ProjectFaviconPath)),
     scripts: Schema.optional(Schema.Array(ProjectScript)),
   }),
   Schema.Struct({
     defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),
     autoPull: Schema.optional(Schema.Boolean),
     projectIcon: Schema.optional(Schema.NullOr(ProjectIconOverride)),
-    faviconPath: Schema.optional(Schema.NullOr(TrimmedNonEmptyString)),
+    faviconPath: Schema.optional(Schema.NullOr(ProjectFaviconPath)),
     defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),
     scripts: Schema.optional(Schema.Array(ProjectScript)),
   }),

packages/contracts/src/projectMcp.test.ts+28−1

@@ -1,10 +1,16 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import * as Schema from "effect/Schema";	2	import * as Schema from "effect/Schema";
3		3
4	import { ProjectMcpCreateInput, ProjectMcpFailure, ProjectMcpListInput } from "./projectMcp.ts";	4	import {
		5	ProjectMcpCreateInput,
		6	ProjectMcpFailure,
		7	ProjectMcpListInput,
		8	ProjectMcpUpdateInput,
		9	} from "./projectMcp.ts";
5		10
6	const decodeCreateInput = Schema.decodeUnknownSync(ProjectMcpCreateInput);	11	const decodeCreateInput = Schema.decodeUnknownSync(ProjectMcpCreateInput);
7	const decodeListInput = Schema.decodeUnknownSync(ProjectMcpListInput);	12	const decodeListInput = Schema.decodeUnknownSync(ProjectMcpListInput);
		13	const decodeUpdateInput = Schema.decodeUnknownSync(ProjectMcpUpdateInput);
8	const decodeFailure = Schema.decodeUnknownSync(ProjectMcpFailure);	14	const decodeFailure = Schema.decodeUnknownSync(ProjectMcpFailure);
9		15
10	describe("project MCP contracts", () => {	16	describe("project MCP contracts", () => {
@@ -71,4 +77,25 @@ describe("project MCP contracts", () => { · 60 unmodified lines
71	}),	77	}),
72	).toMatchObject({ code: "project_deleted" });	78	).toMatchObject({ code: "project_deleted" });
73	});	79	});
		80
		81	it("accepts only favicon paths served by the project asset route", () => {
		82	expect(
		83	decodeCreateInput({
		84	title: "Icon project",
		85	source: { type: "existing_directory", workspaceRoot: "/work/icon" },
		86	faviconPath: "/work/icon/favicon.svg",
		87	}).faviconPath,
		88	).toBe("/work/icon/favicon.svg");
		89	expect(() =>
		90	decodeCreateInput({
		91	title: "Secret project",
		92	source: { type: "existing_directory", workspaceRoot: "/work/secret" },
		93	faviconPath: "/work/secret/.env",
		94	}),
		95	).toThrow();
		96	expect(decodeUpdateInput({ projectId: "project-1", faviconPath: null }).faviconPath).toBeNull();
		97	expect(() =>
		98	decodeUpdateInput({ projectId: "project-1", faviconPath: "/work/secret/.env" }),
		99	).toThrow();
		100	});
74	});	101	});

packages/contracts/src/projectMcp.ts+3−3

fix(mcp): harden project creation boundaries

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code

@@ -3,7 +3,7 @@ import * as Schema from "effect/Schema"; · 2 unmodified lines
3	import { NonNegativeInt, PositiveInt, ProjectId, TrimmedNonEmptyString } from "./baseSchemas.ts";	3	import { NonNegativeInt, PositiveInt, ProjectId, TrimmedNonEmptyString } from "./baseSchemas.ts";
4	import { ThreadEnvMode } from "./environment.ts";	4	import { ThreadEnvMode } from "./environment.ts";
5	import { ModelSelection } from "./modelSelection.ts";	5	import { ModelSelection } from "./modelSelection.ts";
6	import { Project, ProjectScript } from "./project.ts";	6	import { Project, ProjectFaviconPath, ProjectScript } from "./project.ts";
7	import { SourceControlCloneProtocol, SourceControlProviderKind } from "./sourceControl.ts";	7	import { SourceControlCloneProtocol, SourceControlProviderKind } from "./sourceControl.ts";
8		8
9	const ProjectMcpClientRequestId = TrimmedNonEmptyString.check(Schema.isMaxLength(256)).annotate({	9	const ProjectMcpClientRequestId = TrimmedNonEmptyString.check(Schema.isMaxLength(256)).annotate({
@@ -91,7 +91,7 @@ export const ProjectMcpCreateInput = Schema.Struct({ · 81 unmodified lines
91	source: ProjectMcpCreateSource,	91	source: ProjectMcpCreateSource,
92	defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),	92	defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),
93	defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),	93	defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),
94	faviconPath: Schema.optional(Schema.NullOr(TrimmedNonEmptyString)),	94	faviconPath: Schema.optional(Schema.NullOr(ProjectFaviconPath)),
95	scripts: Schema.optional(Schema.Array(ProjectScript)),	95	scripts: Schema.optional(Schema.Array(ProjectScript)),
96	clientRequestId: Schema.optional(ProjectMcpClientRequestId),	96	clientRequestId: Schema.optional(ProjectMcpClientRequestId),
97	});	97	});
@@ -103,7 +103,7 @@ export const ProjectMcpUpdateInput = Schema.Struct({ · 5 unmodified lines
103	workspaceRoot: Schema.optional(TrimmedNonEmptyString),	103	workspaceRoot: Schema.optional(TrimmedNonEmptyString),
104	defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),	104	defaultModelSelection: Schema.optional(Schema.NullOr(ModelSelection)),
105	defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),	105	defaultThreadEnvMode: Schema.optional(Schema.NullOr(ThreadEnvMode)),
106	faviconPath: Schema.optional(Schema.NullOr(TrimmedNonEmptyString)),	106	faviconPath: Schema.optional(Schema.NullOr(ProjectFaviconPath)),
107	scripts: Schema.optional(Schema.Array(ProjectScript)),	107	scripts: Schema.optional(Schema.Array(ProjectScript)),
108	clientRequestId: Schema.optional(ProjectMcpClientRequestId),	108	clientRequestId: Schema.optional(ProjectMcpClientRequestId),
109	});	109	});