mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zeekay
9539f5a380
execute_code no longer POSTs /v1/exec behind a shared service key. It leases a Hanzo sandbox (cloud /v1/sandboxes) with the CALLER's own hanzo.id bearer, runs the program there, and reports what it printed and what it wrote. The session IS the sandbox. `session_id` is the sandbox id, the artifact directory is its workdir, an expired session is a lease the reaper ended. There is no session table here because there is no second object to keep in sync. Why the key had to be deleted rather than fixed ----------------------------------------------- A shared service key IS custom auth, and it is also why that surface could not bill: it carries no tenant, so cloud could not tell whose org a run belonged to — apps/exec's own header says so. With the user's bearer the run lands on the account that ran it, because the account is the only thing the call carries. It was never even wired: `EnvVar.CODE_API_KEY` does not exist in the shipped @hanzochat/agents, so `authFields: [undefined]` at every call site and setting the env var was a silent no-op. Deleted at all ~20 sites, plus the guard in loadAuthValues that existed only to survive the `undefined`, plus the client's key-entry path in the tool-auth contract (`fieldsMap[execute_code]` is now `[]` and verifyToolAuth never consults the credential store for it). What the tool does now ---------------------- One round trip. The program rides the exec channel's stdin, so the source is never quoted into a command line. Its stdout/stderr are redirected to files, so the command's own stdout carries only four framed lines — exit code, then base64 of out, err and the new-file list. That is unforgeable by construction: a delimiter would let a program that printed the delimiter name files it never wrote. Scratch lives in /tmp, never in /mnt/data, so the artifact scan cannot mistake this tool's own source for a user's output. The language menu is measured against the sandbox image rather than inherited: `d`, `f90` and `r` are dropped (no compiler), `rb` added, `ts` runs on bun. Files in and out ride the same three verbs: upload is POST /:id/fs, download is GET /:id/fs, and "is this session still alive?" is GET /:id — one question where there used to be a `lastModified` fetch and a 23-hour freshness rule that only together approximated it. PTC is declared and not executable: it is a different protocol (it suspends the run and resumes from a continuation token) and cloud answers it 501, so offering a tool that fails mid-run is worse than not offering one. De-branding: user-facing prose first, wire second. The `LIBRECHAT_TEST_RUN_HOOK` env var and the `@librechat/*` requires are renamed because BOTH ends live in this repo. The `application/vnd.librechat.*` artifact MIMEs are NOT renamed — they are identifiers on the wire, no user reads them, and a rename needs a migration story it would not buy anything. NOTICE and LICENSE are untouched.
110 lines
2.4 KiB
JavaScript
110 lines
2.4 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
|
|
const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
|
|
const z = require('zod/v4');
|
|
|
|
const APPROVAL_AUDIT_DIR = path.join('/tmp', 'chat-e2e-approval-audit');
|
|
|
|
function recordApprovalInvocation(value) {
|
|
fs.mkdirSync(APPROVAL_AUDIT_DIR, { recursive: true });
|
|
const filename = Buffer.from(value).toString('base64url');
|
|
fs.appendFileSync(path.join(APPROVAL_AUDIT_DIR, filename), `${value}\n`);
|
|
}
|
|
|
|
const server = new McpServer({
|
|
name: 'e2e-memory',
|
|
version: '1.0.0',
|
|
});
|
|
|
|
server.registerTool(
|
|
'remember_fact',
|
|
{
|
|
description: 'Stores a deterministic fact for mock end-to-end tests.',
|
|
inputSchema: {
|
|
fact: z.string().optional(),
|
|
},
|
|
},
|
|
async ({ fact = 'Hanzo Chat MCP e2e fact' }) => ({
|
|
content: [
|
|
{
|
|
type: 'text',
|
|
text: `E2E MCP memory noted: ${fact}`,
|
|
},
|
|
],
|
|
}),
|
|
);
|
|
|
|
server.registerTool(
|
|
'recall_fact',
|
|
{
|
|
description: 'Returns a deterministic fact for mock end-to-end tests.',
|
|
inputSchema: {},
|
|
},
|
|
async () => ({
|
|
content: [
|
|
{
|
|
type: 'text',
|
|
text: 'E2E MCP memory recalled: Hanzo Chat can persist MCP tools on agents.',
|
|
},
|
|
],
|
|
}),
|
|
);
|
|
|
|
server.registerTool(
|
|
'slow_echo',
|
|
{
|
|
description:
|
|
'Echoes text after a delay; used to verify background tool dispatch in mock e2e tests.',
|
|
inputSchema: {
|
|
text: z.string(),
|
|
delay_ms: z.number().optional(),
|
|
},
|
|
},
|
|
async ({ text, delay_ms = 1500 }) => {
|
|
await new Promise((resolve) => setTimeout(resolve, delay_ms));
|
|
return {
|
|
content: [
|
|
{
|
|
type: 'text',
|
|
text: `E2E slow echo: ${text}`,
|
|
},
|
|
],
|
|
};
|
|
},
|
|
);
|
|
|
|
server.registerTool(
|
|
'approval_probe',
|
|
{
|
|
description:
|
|
'Echoes reviewed input so mock end-to-end tests can verify tool approval decisions.',
|
|
inputSchema: {
|
|
value: z.string(),
|
|
review: z.string().optional(),
|
|
},
|
|
},
|
|
async ({ value }) => {
|
|
recordApprovalInvocation(value);
|
|
return {
|
|
content: [
|
|
{
|
|
type: 'text',
|
|
text: `E2E approval probe executed: ${value}`,
|
|
},
|
|
],
|
|
};
|
|
},
|
|
);
|
|
|
|
async function main() {
|
|
await server.connect(new StdioServerTransport());
|
|
}
|
|
|
|
main().catch((error) => {
|
|
console.error('[fake-mcp-server] failed to start', error);
|
|
process.exit(1);
|
|
});
|