poetry-agent 0.0.2

data/lib/poetry/agent/config.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Poetry
+  module Agent
+    # The gem's configuration. Every WebMCP surface is OFF until a rendered
+    # instance opts in; the settings here shape delivery and budgets, never
+    # exposure.
+    class Config
+      # Origin-trial tokens the {OriginTrial} middleware serves in the
+      # `Origin-Trial` response header (one per browser trial - Chrome and
+      # Edge run separate trials). Empty by default: local development
+      # enables the API through the browser flag instead.
+      #
+      # @return [Array<String>]
+      attr_accessor :origin_trial_tokens
+
+      def initialize
+        @origin_trial_tokens = []
+      end
+
+      # The per-page registration budget the registrar enforces: past
+      # this many registered tools on one document, further registrations
+      # are dropped with a console warning (each tool costs the agent
+      # context; overlap confuses tool choice). Stored on poetry-core's
+      # configuration, where the component contract reads it to put the
+      # budget on every opted-in root - this accessor writes through.
+      #
+      # @return [Integer]
+      def registration_budget
+        Poetry::Core::Config.current.webmcp_registration_budget
+      end
+
+      # Sets the per-page registration budget.
+      #
+      # @param count [Integer]
+      # @return [Integer]
+      def registration_budget=(count)
+        Poetry::Core::Config.current.webmcp_registration_budget = Integer(count)
+      end
+
+      # The process-wide configuration instance.
+      #
+      # @return [Config]
+      def self.current
+        @current ||= new
+      end
+    end
+  end
+end

data/lib/poetry/agent/engine.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "rails/engine"
+require "action_dispatch"
+
+module Poetry
+  module Agent
+    # The Rails engine: merges the WebMCP controllers manifest into
+    # poetry-core's catalog (so `webmcp:` roots validate at render), serves
+    # the runtime JavaScript through the importmap-first channel, and
+    # mounts the origin-trial middleware. Loading the gem is the only
+    # integration step; the host imports `@poetry/agent` beside
+    # `@poetry/controllers`.
+    class Engine < ::Rails::Engine
+      initializer "poetry_agent.controllers_manifest", before: :eager_load! do
+        Poetry::Core::Stimulus::Manifest.register(Poetry::Agent::WebMCP.manifest_path.to_s)
+      end
+
+      initializer "poetry_agent.origin_trial" do |app|
+        app.config.middleware.use Poetry::Agent::WebMCP::OriginTrial
+      end
+
+      initializer "poetry_agent.assets" do |app|
+        app.config.assets.paths << Poetry::Agent.root.join("app/javascript").to_s if app.config.respond_to?(:assets)
+      end
+
+      # The importmap-first JS channel (the poetry-core shape); bundler
+      # hosts use the @poetry/agent npm package instead.
+      initializer "poetry_agent.importmap", before: "importmap" do |app|
+        if app.config.respond_to?(:importmap)
+          app.config.importmap.paths << Poetry::Agent.root.join("config/importmap.rb")
+          app.config.importmap.cache_sweepers << Poetry::Agent.root.join("app/javascript")
+        end
+      end
+    end
+  end
+end

data/lib/poetry/agent/mcp/bundled.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Poetry
+  module Agent
+    module MCP
+      # The server as the exe assembles it: the registry root defaults to
+      # the bundled poetry-ui gem, poetry-lucide's icon names power check's
+      # icon-membership tier, and poetry-ui's skills, helper names, and
+      # recipes ride along when the gem is bundled - each a soft require,
+      # so the same assembly serves a core-only host. ONE assembly for the
+      # exe and the HTTP mount, so no surface can lag another.
+      module Bundled
+        module_function
+
+        # @param root [String, nil] a registry root; defaults to poetry-ui
+        # @param app_root [String] the host app (build_page's probe/direct
+        #   steps read its config/theme)
+        # @return [Server]
+        # @raise [ArgumentError] when no component registry is found
+        def server(root: nil, app_root: Dir.pwd)
+          ui = soft_require("poetry/ui")
+          root ||= ui ? Poetry::Ui.root.to_s : Gem::Specification.find_all_by_name("poetry-ui").first&.gem_dir
+          registry = root && File.join(root, Poetry::Core::Registry::RELATIVE_PATH)
+          unless registry && File.exist?(registry)
+            raise ArgumentError, "no component registry at #{registry || "(no poetry-ui found)"} - pass root:"
+          end
+
+          skills, helpers, recipes =
+            ui ? [Poetry::Ui.agent_skills, Poetry::Ui.helper_names, Poetry::Ui.recipe_items.summaries] : [{}, nil, []]
+          Server.from_registry(root, icon_names: icon_names, helpers: helpers, skills: skills,
+                                     app_root: app_root, recipes: recipes)
+        end
+
+        # The lucide names, or nil for a host without poetry-lucide (check
+        # then validates icon-name shape only).
+        def icon_names
+          return nil unless soft_require("poetry/lucide")
+
+          Poetry::Core::Icons.set(:lucide).names
+        rescue Poetry::Core::Error
+          nil
+        end
+
+        # @api private
+        def soft_require(feature)
+          require feature
+          true
+        rescue LoadError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/poetry/agent/mcp/http.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Poetry
+  module Agent
+    module MCP
+      # The MCP server over HTTP: a Rack app answering JSON-RPC 2.0 POSTs
+      # (the Streamable HTTP transport's request/response half) with the
+      # same pure {Server#handle} the stdio exe uses - one surface, two
+      # transports. Mount it at the conventional same-origin `/mcp`, which
+      # is where in-page bridges (Cloudflare's WebMCP Site MCP Server pack
+      # among them) look for a site's own MCP server.
+      #
+      # Read-only by construction (every tool describes or verifies), so
+      # exposing it is a discovery surface, not a mutation surface. The
+      # Origin header is validated against the request's own host, so a
+      # cross-site page cannot drive it through a visitor's browser.
+      #
+      # @example config/routes.rb
+      #   mount Poetry::Agent::MCP::HTTP.new => "/mcp"
+      class HTTP
+        # The response media type.
+        JSON_TYPE = "application/json"
+
+        # @param server [Server, Proc, nil] the server, a lambda building it
+        #   on first request, or nil for the bundled assembly
+        def initialize(server = nil)
+          @server = server
+        end
+
+        # The Rack entry point.
+        #
+        # @param env [Hash] the Rack environment
+        # @return [Array(Integer, Hash, Array<String>)] status, headers, body
+        def call(env)
+          request = Rack::Request.new(env)
+          return not_allowed unless request.post?
+          return forbidden unless same_origin?(request)
+
+          payload = JSON.parse(request.body.read)
+          # A batch is an Array; a single request is a Hash (never Array() a
+          # Hash - it splits into pairs).
+          messages = payload.is_a?(Array) ? payload : [payload]
+          responses = messages.filter_map { |message| server.handle(message) }
+          return [202, headers, []] if responses.empty?
+
+          body = payload.is_a?(Array) ? responses : responses.first
+          [200, headers, [JSON.generate(body)]]
+        rescue JSON::ParserError => e
+          [400, headers, [JSON.generate(rpc_error(-32_700, "parse error: #{e.message}"))]]
+        end
+
+        private
+
+        def server
+          @server = @server.call if @server.respond_to?(:call) && !@server.respond_to?(:handle)
+          @server ||= Bundled.server
+        end
+
+        def headers
+          { "content-type" => JSON_TYPE, "cache-control" => "no-store" }
+        end
+
+        def not_allowed
+          [405, headers.merge("allow" => "POST"),
+           [JSON.generate(rpc_error(-32_601, "POST JSON-RPC only (SSE streaming is not offered)"))]]
+        end
+
+        def forbidden
+          [403, headers, [JSON.generate(rpc_error(-32_600, "origin not allowed"))]]
+        end
+
+        # An absent Origin (same-origin fetch, curl, an MCP client) passes;
+        # a present one must match the request's own scheme + host.
+        def same_origin?(request)
+          origin = request.get_header("HTTP_ORIGIN")
+          return true if origin.nil? || origin.empty?
+
+          origin.casecmp?("#{request.scheme}://#{request.host_with_port}")
+        end
+
+        def rpc_error(code, message)
+          { "jsonrpc" => "2.0", "id" => nil, "error" => { "code" => code, "message" => message } }
+        end
+      end
+    end
+  end
+end