50c 2.11.0 → 2.15.0

package/bin/50c.js

@@ -464,6 +464,13 @@ async function main() {
   // MCP mode: --mcp flag or no args AND piped input
   const isMCPMode = args[0] === '--mcp' || (args.length === 0 && !process.stdin.isTTY);
   
+  // Version check (non-blocking, only warns)
+  if (!isMCPMode && args[0] !== 'help' && args[0] !== '--help') {
+    lib.checkVersion().then(v => {
+      if (v.message) console.error(`\n  Warning: ${v.message}\n`);
+    }).catch(() => {});
+  }
+  
   if (isMCPMode) {
     await runMCP();
   } else if (args.length === 0) {

package/lib/index.js

@@ -25,9 +25,83 @@ const ux = require('./packs/ux');
 const promptEngine = require('./packs/prompt_engine');
 const grabr = require('./packs/grabr');
 
+// ═══════════════════════════════════════════════════════════════
+//                    MANIFEST - SINGLE SOURCE OF TRUTH
+// ═══════════════════════════════════════════════════════════════
+// genxis.one/v1/manifest is the canonical tool registry
+// CLI bootstraps from it, caches locally, validates versions
+
+const MANIFEST_URL = 'https://api.50c.ai/v1/manifest';
+const MANIFEST_CACHE_TTL = 3600000; // 1 hour
+let manifestCache = null;
+let manifestCacheTime = 0;
+
+async function fetchManifest(staging = false) {
+  const now = Date.now();
+  if (manifestCache && (now - manifestCacheTime) < MANIFEST_CACHE_TTL) {
+    return manifestCache;
+  }
+  
+  try {
+    const https = require('https');
+    const headers = staging ? { 'X-GenXis-Env': 'staging' } : {};
+    
+    const data = await new Promise((resolve, reject) => {
+      const req = https.get(MANIFEST_URL, { headers, timeout: 10000 }, (res) => {
+        let body = '';
+        res.on('data', chunk => body += chunk);
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(body));
+          } catch (e) {
+            reject(new Error('Invalid manifest JSON'));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.on('timeout', () => { req.destroy(); reject(new Error('Manifest timeout')); });
+    });
+    
+    manifestCache = data;
+    manifestCacheTime = now;
+    return data;
+  } catch (e) {
+    // Fallback to local tools if manifest unavailable
+    console.error('Manifest fetch failed, using local tools:', e.message);
+    return null;
+  }
+}
+
+async function checkVersion() {
+  try {
+    const manifest = await fetchManifest();
+    if (!manifest) return { upToDate: true };
+    
+    const pkg = require('../package.json');
+    const minVersion = manifest.meta?.min_client_version || '0.0.0';
+    const currentVersion = pkg.version;
+    
+    const [minMajor, minMinor] = minVersion.split('.').map(Number);
+    const [curMajor, curMinor] = currentVersion.split('.').map(Number);
+    
+    const upToDate = curMajor > minMajor || (curMajor === minMajor && curMinor >= minMinor);
+    
+    return {
+      upToDate,
+      current: currentVersion,
+      minimum: minVersion,
+      latest: manifest.meta?.api_version,
+      message: upToDate ? null : `Update available: npx 50c@latest`
+    };
+  } catch (e) {
+    return { upToDate: true, error: e.message };
+  }
+}
+
 // Tool name mappings by pack
 const TOOL_PACKS = {
-  beacon: ['hints', 'hints_plus', 'roast', 'quick_vibe', 'one_liner', 'name_it', 'price_it', 'compute', 'ide_conversation', 'learning_stats'],
+  beacon: ['hints', 'hints_plus', 'roast', 'quick_vibe', 'one_liner', 'name_it', 'price_it', 'compute', 'ide_conversation', 'learning_stats',
+           'beacon_scan', 'beacon_compress', 'beacon_extract', 'beacon_focus', 'beacon_rank'],
   labs: ['genius', 'mind_opener', 'idea_fold', 'agent_autopsy', 'prompt_fortress', 'context_health', 'context_compress', 'context_extract', 'context_reposition'],
   labs_plus: ['bcalc', 'genius_plus', 'bcalc_why', 'discovery_collision', 'cvi_loop', 'cvi_verify', 'chaos_fingerprint', 'resonance', 'prime_residue', 'echo_sequence', 'conversation_diagnostic', 'handoff'],
   prompt_engine: ['prompt_extract', 'prompt_phases', 'prompt_refine', 'prompt_expand', 'prompt_categorize'],
@@ -195,5 +269,9 @@ module.exports = {
   labs,
   labsPlus,
   promptEngine,
-  grabr
+  grabr,
+  // Manifest - Single Source of Truth
+  fetchManifest,
+  checkVersion,
+  MANIFEST_URL
 };

package/lib/packs/grabr.js

@@ -110,7 +110,7 @@ async function grabrScrape(url, depth = 1) {
   
   try {
     // Use 50c page_fetch via API
-    const result = await apiRequest('page_fetch', { url });
+    const result = await apiRequest('POST', '/tools/page_fetch', { url });
     if (result.error) return { error: result.error };
     
     const html = result.content || result.text || '';
@@ -130,7 +130,7 @@ async function grabrScrape(url, depth = 1) {
         if (href) {
           try {
             const fullUrl = href.startsWith('http') ? href : new URL(href, url).href;
-            const subResult = await apiRequest('page_fetch', { url: fullUrl });
+            const subResult = await apiRequest('POST', '/tools/page_fetch', { url: fullUrl });
             if (subResult.content) {
               contacts.emails.push(...extractEmails(subResult.content));
               contacts.phones.push(...extractPhones(subResult.content));
@@ -237,15 +237,15 @@ async function grabrSitemap(url) {
   }
   
   try {
-    const result = await apiRequest('page_fetch', { url: sitemapUrl });
+    const result = await apiRequest('POST', '/tools/page_fetch', { url: sitemapUrl });
     if (result.error) {
       // Try robots.txt fallback
       const robotsUrl = url.replace(/\/$/, '') + '/robots.txt';
-      const robotsResult = await apiRequest('page_fetch', { url: robotsUrl });
+      const robotsResult = await apiRequest('POST', '/tools/page_fetch', { url: robotsUrl });
       if (robotsResult.content) {
         const sitemapMatch = robotsResult.content.match(/Sitemap:\s*(\S+)/i);
         if (sitemapMatch) {
-          const altResult = await apiRequest('page_fetch', { url: sitemapMatch[1] });
+          const altResult = await apiRequest('POST', '/tools/page_fetch', { url: sitemapMatch[1] });
           if (altResult.content) {
             result.content = altResult.content;
           }

package/lib/vault.js

@@ -15,6 +15,9 @@ const SALT_LENGTH = 32;
 const IV_LENGTH = 16;
 const AUTH_TAG_LENGTH = 16;
 
+// Security: Auto-lock after 5 minutes of inactivity (300 seconds)
+const AUTO_LOCK_INACTIVITY_MS = 5 * 60 * 1000;
+
 // Local file paths
 const MASTER_KEY_FILE = path.join(VAULT_DIR, 'master.key.enc');
 const VAULT_DB_FILE = path.join(VAULT_DIR, 'vault.db');
@@ -54,10 +57,25 @@ function loadLocalSession() {
   try {
     if (fs.existsSync(SESSION_FILE)) {
       const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf8'));
-      if (session.expires_at > Date.now()) {
-        return session;
+      const now = Date.now();
+      
+      // Check TTL expiry
+      if (session.expires_at <= now) {
+        fs.unlinkSync(SESSION_FILE);
+        return null;
+      }
+      
+      // Check inactivity auto-lock (5 minutes)
+      if (session.last_access && (now - session.last_access) > AUTO_LOCK_INACTIVITY_MS) {
+        fs.unlinkSync(SESSION_FILE);
+        return null;
       }
-      fs.unlinkSync(SESSION_FILE);
+      
+      // Update last_access timestamp
+      session.last_access = now;
+      fs.writeFileSync(SESSION_FILE, JSON.stringify(session), { mode: 0o600 });
+      
+      return session;
     }
   } catch {}
   return null;
@@ -291,11 +309,26 @@ async function remove(name) {
 }
 
 async function status() {
+  const session = MODE === 'local' ? loadLocalSession() : null;
+  const now = Date.now();
+  
+  let autoLockIn = null;
+  if (session && session.last_access) {
+    const remaining = AUTO_LOCK_INACTIVITY_MS - (now - session.last_access);
+    autoLockIn = remaining > 0 ? Math.ceil(remaining / 1000) : 0;
+  }
+  
   return {
     mode: MODE,
     initialized: await isInitialized(),
     locked: !(await isUnlocked()),
-    path: MODE === 'local' ? VAULT_DIR : 'cloud'
+    path: MODE === 'local' ? VAULT_DIR : 'cloud',
+    auto_lock_seconds: autoLockIn,
+    security: {
+      auto_lock_inactivity: '5 minutes',
+      encryption: 'AES-256-GCM',
+      pbkdf2_iterations: PBKDF2_ITERATIONS
+    }
   };
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "50c",
-  "version": "2.11.0",
-  "description": "AI toolkit with Dewey quality gates. 137 tools, noise-free indexing.",
+  "version": "2.15.0",
+  "description": "AI toolkit. Added beacon_* tools to TOOL_PACKS routing.",
   "main": "lib/index.js",
   "bin": {
     "50c": "./bin/50c.js"