entropic_mcp.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include "engine_handle.h"
 
#include <entropic/entropic.h>
#include <entropic/config/loader.h>
#include <entropic/mcp/mcp_json_discovery.h>
#include <entropic/prompts/manager.h>
#include <entropic/types/logging.h>
 
#include "json_serializers.h"
 
#include <cstring>
#include <filesystem>
#include <fstream>
#include <iterator>
#include <optional>
#include <memory>
#include <string>
#include <vector>
 
static auto logger = entropic::log::get("facade.mcp");
 
static entropic_error_t check_server_mgr(entropic_handle_t h) {
    if (!h) { return ENTROPIC_ERROR_INVALID_HANDLE; }
    if (!h->server_manager) { return ENTROPIC_ERROR_INVALID_STATE; }
    return ENTROPIC_OK;
}
 
// ── Named workspaces (gh#166, v2.13.0) ──────────────────────
 
static entropic::MCPConfig confined_mcp_config(entropic_handle_t h) {
    entropic::MCPConfig mcp = h->config.mcp;
    auto& fs_cfg = mcp.filesystem;
    if (fs_cfg.allow_outside_root != entropic::OutsideRootAccess::refuse
        || !fs_cfg.outside_root_allow.empty()) {
        logger->info("workspace servers confine to their root (host "
                     "mcp.filesystem.allow_outside_root, outside_root_allow "
                     "({} entries) and the path approver apply to the "
                     "default set only)", fs_cfg.outside_root_allow.size());
    }
    fs_cfg.allow_outside_root = entropic::OutsideRootAccess::refuse;
    fs_cfg.outside_root_allow.clear();
    return mcp;
}
 
static entropic::OutsideRootVerdict outside_root_thunk(
    const entropic::OutsideRootRequest& req, void* ud) {
    auto* h = static_cast<entropic_handle_t>(ud);
    ent_path_approval_cb cb = nullptr;
    void* cb_data = nullptr;
    {
        std::lock_guard<std::mutex> lock(h->path_approval_mutex);
        cb = h->path_approval_cb;
        cb_data = h->path_approval_data;
    }
    auto verdict = entropic::OutsideRootVerdict::no_approver;
    if (cb != nullptr) {
        const std::string session = entropic::current_run_session();
        ent_path_approval_request_t c_req{
            req.path.c_str(), req.root.c_str(), req.tool.c_str(),
            req.access == entropic::PathAccess::write
                ? ENT_PATH_ACCESS_WRITE : ENT_PATH_ACCESS_READ,
            session.c_str()};
        verdict = cb(&c_req, cb_data) == ENT_DECISION_ACCEPT
            ? entropic::OutsideRootVerdict::approved
            : entropic::OutsideRootVerdict::rejected;
    }
    return verdict;
}
 
void entropic::wire_outside_root_approver(entropic_handle_t h) {
    if (h != nullptr && h->server_manager) {
        h->server_manager->set_outside_root_approver(outside_root_thunk, h);
    }
}
 
static bool discovered_server_thunk(const std::string& context_json, void* ud) {
    auto* h = static_cast<entropic_handle_t>(ud);
    constexpr auto kPoint = ENTROPIC_HOOK_PRE_MCP_SERVER_CONNECT;
    bool approved = false;
    if (h->hook_registry.hook_count(kPoint) > 0) {
        char* ignored = nullptr;
        const int rc = h->hook_registry.fire_pre(kPoint, context_json.c_str(),
                                                 &ignored);
        free(ignored);
        approved = rc == 0;
    }
    return approved;
}
 
std::filesystem::path entropic::bridge_project_dir(entropic_handle_t h) {
    return h->config.config_dir.empty() ? std::filesystem::current_path()
                                        : h->config.config_dir;
}
 
std::filesystem::path entropic::expected_bridge_socket(entropic_handle_t h) {
    const auto& ext = h->config.mcp.external;
    std::filesystem::path sock;
    if (ext.enabled) {
        sock = ext.socket_path.has_value()
            ? *ext.socket_path : compute_socket_path(bridge_project_dir(h));
    }
    return sock;
}
 
void entropic::apply_workspace_app_context(
    entropic_handle_t h, const std::string& workspace,
    const std::optional<std::string>& app_context) {
    if (!app_context) {
        h->engine->clear_workspace_prompts(workspace);
        return;
    }
    const auto data_dir = entropic::config::resolve_data_dir(h->config);
    std::string constitution, handle_ctx;
    entropic::prompts::load_shared_prompt_sources(h->config, data_dir,
                                                  constitution, handle_ctx);
    std::string prefix;
    if (!constitution.empty()) { prefix += constitution + "\n\n"; }
    if (!app_context->empty()) { prefix += *app_context + "\n\n"; }
    entropic::WorkspacePrompts prompts;
    prompts.default_prompt = prefix;
    for (const auto& [name, tier] : h->config.models.tiers) {
        prompts.tier_prompts[name] = prefix
            + entropic::prompts::resolve_tier_identity_full(tier, name, data_dir).body;
    }
    auto def = prompts.tier_prompts.find(h->config.models.default_tier);
    if (def != prompts.tier_prompts.end()) { prompts.default_prompt = def->second; }
    h->engine->set_workspace_prompts(workspace, std::move(prompts));
}
 
void entropic::wire_external_server_policy(entropic_handle_t h,
                                           ServerManager& servers,
                                           bool with_declared) {
    MCPConfig policy = h->config.mcp;
    if (!with_declared) { policy.external_servers.clear(); }
    servers.set_mcp_config(policy);
    servers.set_own_bridge_socket(expected_bridge_socket(h));
    servers.set_discovered_server_approver(discovered_server_thunk, h);
}
 
void entropic::swap_session_tool_dir(
    const std::string& session_key,
    const std::filesystem::path& path,
    bool entering, void* ud) {
    auto* h = static_cast<entropic_handle_t>(ud);
    auto* servers = entropic::workspace_servers(h, session_key);
    if (servers == nullptr) { return; }
    logger->info("delegation dir swap: session='{}' -> {} ({})",
                 session_key, path.string(),
                 entering ? "enter" : "restore");
    if (entering) {
        servers->enter_working_dir(path);
    } else {
        servers->leave_working_dir(path);
    }
}
 
std::size_t entropic::release_session_tool_state(entropic_handle_t h,
                                                 const std::string& key) {
    std::size_t released = 0;
    if (h == nullptr) { return released; }
    if (h->server_manager) {
        released += h->server_manager->release_session(key);
    }
    std::lock_guard<std::mutex> lock(h->workspace_mutex);
    for (const auto& [name, ws] : h->workspaces) {
        if (ws && ws->servers) {
            released += ws->servers->release_session(key);
        }
    }
    return released;
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_set_path_approval_callback(entropic_handle_t handle,
                                    ent_path_approval_cb cb,
                                    void* user_data) {
    if (handle == nullptr) { return ENTROPIC_ERROR_INVALID_HANDLE; }
    entropic::log::HandleLogScope scope(handle->log_id);
    {
        std::lock_guard<std::mutex> lock(handle->path_approval_mutex);
        handle->path_approval_cb = cb;
        handle->path_approval_data = user_data;
    }
    logger->info("path approval callback {}",
                 cb != nullptr ? "registered" : "cleared");
    return ENTROPIC_OK;
}
 
static std::unique_ptr<EntropicWorkspace> build_workspace(
    entropic_handle_t h, const std::string& name,
    const std::filesystem::path& dir) {
    auto ws = std::make_unique<EntropicWorkspace>();
    ws->name = name;
    ws->root = dir;
    ws->servers = std::make_unique<entropic::ServerManager>(
        h->config.permissions, dir);
    std::vector<std::string> tier_names;
    std::vector<std::string> require_context;
    for (const auto& [tier, cfg] : h->config.models.tiers) {
        if (tier != h->config.models.default_tier) {
            tier_names.push_back(tier);
        }
        if (cfg.requires_context) { require_context.push_back(tier); }
    }
    auto data_dir = entropic::config::resolve_data_dir(h->config);
    const auto mcp = confined_mcp_config(h);
    ws->servers->init_builtins(mcp, tier_names,
                               data_dir.string(), require_context);
    ws->servers->load_plugins(mcp);
    // gh#199: the workspace inherits the handle's enablement policy, so its
    // root's .mcp.json launches nothing the operator did not enable.
    // v2.14.1: and it launches the operator's DECLARED servers itself,
    // rooted here — a bound session dispatches only to this set, so a
    // declared server left on the base set was invisible to it (decision
    // #87, revising #83).
    entropic::wire_external_server_policy(h, *ws->servers, true);
    return ws;
}
 
static entropic_error_t validate_workspace_args(
    entropic_handle_t handle, const char* name, const char* dir,
    std::filesystem::path& root) {
    if (name == nullptr || *name == '\0' || dir == nullptr
        || *dir == '\0') {
        return ENTROPIC_ERROR_INVALID_ARGUMENT;
    }
    std::error_code ec;
    root = std::filesystem::absolute(dir, ec);
    std::string err;
    if (ec || !std::filesystem::is_directory(root, ec)) {
        err = std::string("workspace dir is not a directory: ") + dir;
    } else {
        std::lock_guard<std::mutex> guard(handle->workspace_mutex);
        if (handle->workspaces.count(name) > 0) {
            err = std::string("workspace already exists: ") + name;
        }
    }
    if (!err.empty()) {
        handle->last_error = err;
        return ENTROPIC_ERROR_INVALID_ARGUMENT;
    }
    return ENTROPIC_OK;
}
 
static entropic_error_t load_workspace_context_file(
    entropic_handle_t handle, const std::filesystem::path& root,
    std::optional<std::string>& text) {
    namespace fs = std::filesystem;
    const auto& rel = handle->config.workspace_app_context;
    std::error_code ec;
    if (rel.empty() || !fs::exists(root / rel, ec)) { return ENTROPIC_OK; }
    const auto file = fs::weakly_canonical(root / rel, ec);
    const auto base = fs::weakly_canonical(root, ec);
    std::ifstream in(file, std::ios::binary);
    entropic_error_t rc = ENTROPIC_OK;
    if (file.lexically_relative(base).string().rfind("..", 0) == 0) {
        handle->last_error = "workspace_app_context " + (root / rel).string()
            + " resolves outside the workspace root (" + file.string() + ")";
        rc = ENTROPIC_ERROR_INVALID_ARGUMENT;
    } else if (!in) {
        handle->last_error = "cannot read workspace_app_context " + file.string();
        rc = ENTROPIC_ERROR_IO;
    } else {
        text = std::string(std::istreambuf_iterator<char>(in), {});
        logger->info("workspace app_context loaded from {} ({} bytes)",
                     file.string(), text->size());
    }
    if (rc != ENTROPIC_OK) { logger->error("{}", handle->last_error); }
    return rc;
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_workspace_create(entropic_handle_t handle,
                          const char* name,
                          const char* dir) {
    auto rc = check_server_mgr(handle);
    if (rc != ENTROPIC_OK) { return rc; }
    entropic::HandleApiLock lock(handle);
    std::filesystem::path root;
    std::optional<std::string> ctx;
    rc = validate_workspace_args(handle, name, dir, root);
    if (rc == ENTROPIC_OK) { rc = load_workspace_context_file(handle, root, ctx); }
    if (rc == ENTROPIC_OK) {
        try {
            auto ws = build_workspace(handle, name, root);
            ws->app_context = ctx;
            ws->servers->initialize();
            std::lock_guard<std::mutex> guard(handle->workspace_mutex);
            handle->workspaces[name] = std::move(ws);
            entropic::apply_workspace_app_context(handle, name, ctx);  // gh#179
            logger->info("workspace '{}' created at {} (app_context: {})",
                         name, root.string(), ctx ? "its own" : "the handle's");
        } catch (const std::exception& e) {
            // Design rule #5: exceptions never cross the .so boundary.
            handle->last_error = e.what();
            rc = ENTROPIC_ERROR_INTERNAL;
        }
    }
    return rc;
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_session_bind_workspace(entropic_handle_t handle,
                                const char* session_key,
                                const char* name) {
    auto rc = check_server_mgr(handle);
    if (rc != ENTROPIC_OK) { return rc; }
    if (name == nullptr || *name == '\0' || !handle->engine) {
        return ENTROPIC_ERROR_INVALID_ARGUMENT;
    }
    entropic::HandleApiLock lock(handle);
    std::string key = session_key != nullptr ? session_key : "";
    // Single-exit accumulator (knots returns gate ≤ 3). A conversation
    // cites paths relative to the root it was built in, so re-rooting one
    // mid-life invalidates every citation in it with no error anywhere:
    // refuse rather than silently re-point.
    rc = ENTROPIC_OK;
    if (handle->engine->message_count_for(key) > 0) {
        handle->last_error =
            "session '" + key + "' already holds messages; bind a "
            "workspace before its first turn";
        rc = ENTROPIC_ERROR_INVALID_STATE;
    } else {
        std::lock_guard<std::mutex> guard(handle->workspace_mutex);
        if (handle->workspaces.count(name) == 0) {
            handle->last_error = std::string("unknown workspace: ") + name;
            rc = ENTROPIC_ERROR_INVALID_ARGUMENT;
        } else {
            handle->session_workspace[key] = name;
            handle->engine->bind_session_workspace(key, name);  // gh#179
            logger->info("session '{}' bound to workspace '{}'", key, name);
        }
    }
    return rc;
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_workspace_set_app_context(entropic_handle_t handle,
                                   const char* name,
                                   const char* app_context) {
    auto rc = check_server_mgr(handle);
    if (rc != ENTROPIC_OK) { return rc; }
    if (name == nullptr || *name == '\0') { return ENTROPIC_ERROR_INVALID_ARGUMENT; }
    entropic::HandleApiLock lock(handle);
    std::optional<std::string> ctx;
    if (app_context != nullptr) { ctx = app_context; }
    {
        std::lock_guard<std::mutex> guard(handle->workspace_mutex);
        auto it = handle->workspaces.find(name);
        if (it == handle->workspaces.end()) {
            handle->last_error = std::string("unknown workspace: ") + name;
            rc = ENTROPIC_ERROR_INVALID_ARGUMENT;
        } else {
            it->second->app_context = ctx;
        }
    }
    try {
        if (rc == ENTROPIC_OK) {
            entropic::apply_workspace_app_context(handle, name, ctx);
            logger->info("workspace '{}' app_context {}", name,
                         ctx ? "set (" + std::to_string(ctx->size()) + " bytes)"
                             : std::string("reset to the handle's"));
        }
    } catch (const std::exception& e) {
        // Design rule #5: exceptions never cross the .so boundary.
        handle->last_error = e.what();
        rc = ENTROPIC_ERROR_INTERNAL;
    }
    return rc;
}
 
static entropic::ExternalServerConfig parse_external_server_spec(
    const char* name, const nlohmann::json& j) {
    entropic::ExternalServerConfig spec;
    spec.name = name;
    spec.command = j.value("command", "");
    spec.url = j.value("url", "");
    spec.transport = j.value("transport",
        spec.url.empty() ? "stdio" : "sse");
    if (j.contains("args") && j["args"].is_array()) {
        spec.args = j["args"].get<std::vector<std::string>>();
    }
    if (j.contains("env") && j["env"].is_object()) {
        for (auto& [key, val] : j["env"].items()) {
            if (entropic::is_blocked_env_var(key)) {
                logger->warn("register_mcp_server '{}': blocked env var "
                             "'{}' — skipping", name, key);
                continue;
            }
            if (val.is_string()) {
                spec.env[key] = val.get<std::string>();
            }
        }
    }
    return spec;
}
 
static entropic::ServerManager* resolve_registration_target(
    entropic_handle_t handle, const std::string& ws_name,
    entropic::ExternalServerConfig& spec) {
    if (ws_name.empty()) { return handle->server_manager.get(); }
    std::lock_guard<std::mutex> guard(handle->workspace_mutex);
    auto it = handle->workspaces.find(ws_name);
    if (it == handle->workspaces.end()) { return nullptr; }
    spec.working_dir = it->second->root.string();
    return it->second->servers.get();
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_register_mcp_server(
    entropic_handle_t handle,
    const char* name,
    const char* config_json) {
 
    auto rc = check_server_mgr(handle);
    if (rc != ENTROPIC_OK || !name || !config_json) {
        return rc != ENTROPIC_OK ? rc : ENTROPIC_ERROR_INVALID_ARGUMENT;
    }
 
    try {
        auto j = nlohmann::json::parse(config_json);
        auto spec = parse_external_server_spec(name, j);
        // gh#166 (v2.13.0): an optional "workspace" field registers the
        // server on that workspace's set instead of the handle's, and
        // spawns it with cwd = the workspace root — which is what a
        // repo-scoped server like `clew-mcp --repo` actually needs.
        auto ws_name = j.value("workspace", std::string{});
        auto* servers = resolve_registration_target(handle, ws_name, spec);
        if (servers == nullptr) {
            handle->last_error = "unknown workspace: " + ws_name;
            rc = ENTROPIC_ERROR_INVALID_ARGUMENT;
        } else {
            servers->connect_external_server(spec);
            logger->info("register_mcp_server: name='{}' env_keys={} "
                         "workspace='{}'", name, spec.env.size(), ws_name);
        }
    } catch (const std::exception& e) {
        handle->last_error = e.what();
        rc = ENTROPIC_ERROR_CONNECTION_FAILED;
    }
    return rc;
}
 
extern "C" ENTROPIC_EXPORT entropic_error_t
entropic_deregister_mcp_server(
    entropic_handle_t handle,
    const char* name) {
 
    auto rc = check_server_mgr(handle);
    if (rc != ENTROPIC_OK || !name) {
        return rc != ENTROPIC_OK ? rc : ENTROPIC_ERROR_INVALID_ARGUMENT;
    }
 
    try {
        handle->server_manager->disconnect_external_server(name);
        logger->info("deregister_mcp_server: name='{}'", name);
        return ENTROPIC_OK;
    } catch (const std::exception& e) {
        handle->last_error = e.what();
        return ENTROPIC_ERROR_SERVER_NOT_FOUND;
    }
}
 
extern "C" ENTROPIC_EXPORT char*
entropic_list_mcp_servers(entropic_handle_t handle) {
    if (!handle || !handle->configured.load()) {
        return nullptr;
    }
    try {
        nlohmann::json arr = nlohmann::json::array();
        if (handle->server_manager) {
            auto servers = handle->server_manager->list_server_info();
            for (const auto& [name, s] : servers) {
                arr.push_back({{"name", s.name},
                               {"transport", s.transport},
                               {"status", s.status},
                               {"source", s.source}});
            }
        }
        return strdup(arr.dump().c_str());
    } catch (const std::exception& e) {
        handle->last_error = e.what();
        return nullptr;
    }
}