@addai/node 0.22.0 → 0.23.0

package/dist/codex-spawn.js

@@ -52,6 +52,7 @@ const codex_binary_1 = require("./codex-binary");
 const diskguard_1 = require("./diskguard");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const mcp_headers_1 = require("./mcp-headers");
 /** Quote a string as a TOML basic string (double-quoted, escape backslash + quote). */
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
@@ -60,6 +61,11 @@ function tomlString(s) {
  *  Only the NAME goes in config.toml — the value rides on the child env, so
  *  the token never lands on disk. */
 const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
+/** Env var name carrying one HTTP header's value into the codex process.
+ *  config.toml references it by name via env_http_headers, so the value
+ *  itself never lands on disk. */
+const headerEnvVar = (slug, header) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}` +
+    `_H_${header.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}`;
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
  *  (bearer tokens for remote servers). Caller is responsible for cleanup
@@ -74,12 +80,16 @@ function writeCodexHome(servers, workingDirectory) {
         // Remote MCP servers. Registry rows store command='http'|'sse' with
         // args=[url]; codex spells that `url = "..."`, NOT command/args. Writing
         // the row verbatim made codex try to exec a binary called `http`, so the
-        // server never started and its tools silently vanished — which is how a
-        // provider-ladder hop to codex dropped an entity's GitHub access without
-        // any error anywhere. The claude path (install.ts) always handled this;
-        // codex and grok did not.
-        if (s.command === 'http' || s.command === 'sse') {
-            const url = Array.isArray(s.args) && typeof s.args[0] === 'string' ? s.args[0] : null;
+        // server never started and its tools silently vanished.
+        //
+        // Credentials go through env_http_headers, which maps a header name to the
+        // NAME of an env var holding its value — so the whole credential set is
+        // forwarded and config.toml still never contains a secret. This adapter
+        // used to send only ONE credential as a bearer token, on the belief that
+        // codex could not send custom headers; it can, and a server needing more
+        // than one header (addai-drive carries three) was arriving half-authorised.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
             if (!url) {
                 console.error(`[codex] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
                 continue;
@@ -87,22 +97,24 @@ function writeCodexHome(servers, workingDirectory) {
             const name = tomlString(s.slug).slice(1, -1);
             toml += `[mcp_servers.${name}]\n`;
             toml += `url = ${tomlString(url)}\n`;
-            // codex reads the bearer from its OWN environment (--env is stdio-only),
-            // so the value goes on the child env and only the var name in the file.
-            const creds = Object.entries(s.env || {})
-                .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
-            const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            // An OAuth access token is spelled as codex's native bearer rather than
+            // a hand-rolled Authorization header, so its OAuth handling still applies.
+            const bearer = headers.Authorization;
             if (bearer) {
+                delete headers.Authorization;
                 const varName = bearerEnvVar(s.slug);
-                extraEnv[varName] = String(bearer[1]);
+                extraEnv[varName] = bearer.replace(/^Bearer\s+/i, '');
                 toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
-                if (creds.length > 1) {
-                    // codex carries one bearer and no arbitrary headers. Anything that
-                    // authenticates with several custom headers is only partly wired,
-                    // and saying so beats a server that 401s for no visible reason.
-                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
-                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
-                        `field(s) were dropped`);
+            }
+            const entries = Object.entries(headers);
+            if (entries.length > 0) {
+                // Sub-table must follow the parent table's scalar keys.
+                toml += `[mcp_servers.${name}.env_http_headers]\n`;
+                for (const [header, value] of entries) {
+                    const varName = headerEnvVar(s.slug, header);
+                    extraEnv[varName] = value;
+                    toml += `${tomlString(header)} = ${tomlString(varName)}\n`;
                 }
             }
             toml += '\n';

package/dist/desktop/relay-client.js

@@ -93,10 +93,28 @@ function dropBridges() {
     }
     bridges.clear();
 }
+/**
+ * Start a connection attempt that CANNOT take the daemon down with it.
+ *
+ * `connect` is fire-and-forget. While the socket was gated on having a
+ * running desktop, most nodes returned early and never reached the pairing
+ * read or the WebSocket construction — so a throw there was unreachable in
+ * practice. Making the socket unconditional put every node on that path, and
+ * an unhandled rejection in Node terminates the process. At boot. In a loop.
+ * A relay that cannot connect must cost this node its push channel, nothing
+ * more.
+ */
+function connectSafely() {
+    connect().catch(err => {
+        ws = null;
+        console.error('[relay] connect failed:', err?.message ?? String(err));
+        scheduleReconnect();
+    });
+}
 function scheduleReconnect() {
     if (stopped)
         return;
-    setTimeout(() => { void connect(); }, backoff);
+    setTimeout(connectSafely, backoff);
     backoff = Math.min(backoff * 2, RECONNECT_MAX_MS);
 }
 async function connect() {
@@ -215,7 +233,7 @@ function startRelayClient() {
         return;
     stopped = false;
     backoff = RECONNECT_MIN_MS;
-    void connect();
+    connectSafely();
 }
 function stopRelayClient() {
     stopped = true;

package/dist/gemini-spawn.d.ts

@@ -26,6 +26,21 @@ export interface GeminiHandle {
     onEvent(cb: (e: RuntimeEvent) => void): void;
     done: Promise<number>;
 }
+/**
+ * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
+ *
+ * gemini-cli's settings hierarchy is workspace > user — a workspace
+ * settings file wins over `~/.gemini/settings.json` field-by-field, so
+ * we can override `mcpServers` (the field we care about) without
+ * touching the user's home dir.
+ *
+ * The OLD approach pointed HOME at a temp dir to suppress the host's
+ * `~/.gemini/settings.json`. That was destructive: gemini-cli shells out
+ * to git, npm, node, and those tools read `~/.gitconfig`, `~/.npmrc`,
+ * `~/.netrc` from HOME. Pointing HOME at an empty dir blew them all
+ * away → silent tool failures (git push without creds, etc.).
+ */
+export declare function writeGeminiWorkspaceSettings(cwd: string, servers: GeminiMcpServer[]): string;
 /** gemini-cli session ids are v4 UUIDs (createSessionId → node randomUUID).
  *  Only pass a plausibly-gemini id to `--resume`; a foreign id would just be
  *  reported "Invalid session identifier" and the run degrades to fresh via the

package/dist/gemini-spawn.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeGeminiWorkspaceSettings = writeGeminiWorkspaceSettings;
 exports.isGeminiSessionId = isGeminiSessionId;
 exports.lineToEvents = lineToEvents;
 exports.spawnGemini = spawnGemini;
@@ -55,6 +56,7 @@ const gemini_binary_1 = require("./gemini-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /**
  * Write a workspace-scope `<cwd>/.gemini/settings.json` for THIS spawn.
  *
@@ -76,6 +78,24 @@ function writeGeminiWorkspaceSettings(cwd, servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. gemini's settings schema spells streamable HTTP as
+        // `httpUrl` and SSE as `url` + `type: "sse"`, both with a `headers` map.
+        // Writing the registry row verbatim made gemini try to exec a binary
+        // called `http`, so the server never started and its tools were simply
+        // absent from the run — no error, nothing in the DB.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[gemini] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            const hasHeaders = Object.keys(headers).length > 0;
+            mcpServers[s.slug] = s.command === 'sse'
+                ? { url, type: 'sse', ...(hasHeaders ? { headers } : {}) }
+                : { httpUrl: url, ...(hasHeaders ? { headers } : {}) };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpServers[s.slug] = {

package/dist/grok-spawn.js

@@ -74,6 +74,7 @@ const grok_binary_1 = require("./grok-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Real config dir for the logged-in account. GROK_HOME points here so the
  *  entity uses the same account and token refresh works. */
 function realGrokHome() {
@@ -160,16 +161,30 @@ function writeProjectMcpConfig(workingDirectory, servers) {
     }
     const lines = [];
     for (const s of usable) {
-        // Remote MCP servers (registry command='http'|'sse', args=[url]) have no
-        // verified grok config spelling, and writing the row verbatim is worse
-        // than skipping: grok would try to exec a binary called `http`, the
-        // server would never start, and its tools would vanish with no error —
-        // the exact silent failure that cost an entity its GitHub access after a
-        // provider-ladder hop. Skip it, and say so loudly enough to be findable.
-        if (s.command === 'http' || s.command === 'sse') {
-            console.error(`[grok] MCP ${s.slug}: remote ${s.command} servers are not supported by the grok ` +
-                `adapter — skipping. Its tools will be ABSENT from this run. Use claude (or codex, ` +
-                `which supports url + bearer_token_env_var) for entities that depend on it.`);
+        // Remote MCP servers. xAI documents [mcp_servers.<name>] with `url` and a
+        // `headers` inline table, so grok now gets them properly instead of the
+        // skip this used to do — a skip that was safe (better than emitting
+        // `command = "http"`, which grok would try to exec) but meant an entity
+        // running on grok silently had none of its remote servers.
+        //
+        // Folder trust still gates repo-local config.toml servers, so the --trust
+        // launch flag remains load-bearing for these entries to start at all.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[grok] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            lines.push(`[mcp_servers.${tomlStr(s.slug)}]`);
+            lines.push(`url = ${tomlStr(url)}`);
+            const headers = Object.entries((0, mcp_headers_1.remoteMcpHeaders)(s.env));
+            if (headers.length > 0) {
+                const kv = headers.map(([k, v]) => `${tomlStr(k)} = ${tomlStr(v)}`).join(', ');
+                lines.push(`headers = { ${kv} }`);
+            }
+            lines.push('enabled = true');
+            lines.push('startup_timeout_sec = 30');
+            lines.push('');
             continue;
         }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).

package/dist/install.d.ts

@@ -42,6 +42,7 @@ export interface InstallResult {
     /** Cleanup callback — removes everything this install wrote. */
     dispose: () => Promise<void>;
 }
+export declare function writeMcpConfig(cwd: string, mcps: ResolvedMcp[]): string | null;
 /**
  * Run install side-effects against `cwd` and return paths to clean up
  * later. Safe to call with an empty set — returns a no-op result.

package/dist/install.js

@@ -47,12 +47,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_MCP_CONFIG_FILENAME = exports.MCP_CONFIG_FILENAME = void 0;
+exports.writeMcpConfig = writeMcpConfig;
 exports.install = install;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const supabase_client_1 = require("./supabase-client");
 const store_1 = require("./store");
 const win_1 = require("./win");
+const mcp_headers_1 = require("./mcp-headers");
 /** Hidden per-session MCP config written next to the agent's working dir. */
 exports.MCP_CONFIG_FILENAME = '.ainode.mcp.json';
 /** Pre-rename filename; removed when found so agents don't read a stale copy. */
@@ -111,27 +113,19 @@ function writeMcpConfig(cwd, mcps) {
         if (!m.slug || !m.command)
             continue;
         // Remote MCP servers: registry rows use command='http' (or 'sse') with
-        // args=[url]. An OAuth bearer token rides in the credential as
-        // OAUTH_ACCESS_TOKEN and becomes the Authorization header — this is how
-        // headless sessions use account-authenticated remote MCPs (e.g. the
-        // official Higgsfield server) without an interactive OAuth dance.
-        if (m.command === 'http' || m.command === 'sse') {
-            const url = Array.isArray(m.args) && typeof m.args[0] === 'string' ? m.args[0] : null;
-            if (!url)
+        // args=[url]. Credentials ride as request headers — see mcp-headers.ts for
+        // the naming rule and why OAUTH_* keys other than the access token are
+        // withheld. This is how headless sessions use account-authenticated remote
+        // MCPs (e.g. the official Higgsfield server) without an interactive OAuth
+        // dance.
+        if ((0, mcp_headers_1.isRemoteMcp)(m.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(m.args);
+            if (!url) {
+                console.error(`[install] MCP ${m.slug}: ${m.command} server has no URL — skipped`);
                 continue;
-            const entry = { type: m.command, url };
-            const headers = {};
-            const token = m.env?.OAUTH_ACCESS_TOKEN;
-            if (token)
-                headers.Authorization = `Bearer ${token}`;
-            // Other env keys become literal headers (so remote MCPs with custom
-            // header auth work), but OAUTH_* keys are token bookkeeping (refresh
-            // token, expiry) — never send them as request headers.
-            for (const [k, v] of Object.entries(m.env || {})) {
-                if (!v || k.startsWith('OAUTH_'))
-                    continue;
-                headers[k.replace(/_/g, '-')] = v;
             }
+            const entry = { type: m.command, url };
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(m.env);
             if (Object.keys(headers).length > 0)
                 entry.headers = headers;
             servers[m.slug] = entry;

package/dist/kimi-spawn.d.ts

@@ -39,6 +39,13 @@ export interface KimiHandle {
     onActivity(cb: () => void): void;
     done: Promise<number>;
 }
+/** Write a sandbox $HOME with an empty .kimi dir so kimi's default
+ *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
+ *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
+export declare function writeKimiSandboxHome(servers: KimiMcpServer[]): {
+    homeDir: string;
+    mcpConfigPath: string;
+};
 /** Parse one stream-json line into 0+ RuntimeEvents. Kimi's shapes are
  *  similar in spirit to claude's: assistant text deltas, tool calls,
  *  turn completion, and session metadata. Anything we don't recognise

package/dist/kimi-spawn.js

@@ -42,6 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeKimiSandboxHome = writeKimiSandboxHome;
 exports.lineToEvents = lineToEvents;
 exports.spawnKimi = spawnKimi;
 const child_process_1 = require("child_process");
@@ -52,6 +53,7 @@ const kimi_binary_1 = require("./kimi-binary");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
+const mcp_headers_1 = require("./mcp-headers");
 /** Write a sandbox $HOME with an empty .kimi dir so kimi's default
  *  `~/.kimi/mcp.json` resolves to nothing. Caller is responsible for
  *  cleanup (we drop it under os.tmpdir() so the OS reaps it). */
@@ -62,6 +64,24 @@ function writeKimiSandboxHome(servers) {
     for (const s of servers) {
         if (!s.slug || !s.command)
             continue;
+        // Remote MCP servers. kimi's mcp.json takes `url` and infers the transport
+        // from url-vs-command, so no `transport` key is needed for streamable HTTP;
+        // SSE is stated explicitly. Headers carry the credential set. Writing the
+        // registry row verbatim made kimi try to exec a binary called `http`.
+        if ((0, mcp_headers_1.isRemoteMcp)(s.command)) {
+            const url = (0, mcp_headers_1.remoteMcpUrl)(s.args);
+            if (!url) {
+                console.error(`[kimi] MCP ${s.slug}: ${s.command} server has no URL — skipped`);
+                continue;
+            }
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            mcpConfig.mcpServers[s.slug] = {
+                url,
+                ...(s.command === 'sse' ? { transport: 'sse' } : {}),
+                ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            };
+            continue;
+        }
         // `cmd /c` wrapper for npm-shim commands on native Windows (no-op on POSIX).
         const wrapped = (0, win_1.wrapMcpCommandForPlatform)(s.command, Array.isArray(s.args) ? s.args : []);
         mcpConfig.mcpServers[s.slug] = {

package/dist/mcp-headers.d.ts

@@ -0,0 +1,15 @@
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+export declare function isRemoteMcp(command: string): boolean;
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+export declare function remoteMcpUrl(args?: string[] | null): string | null;
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+export declare function remoteMcpHeaders(env?: Record<string, string> | null): Record<string, string>;

package/dist/mcp-headers.js

@@ -0,0 +1,49 @@
+"use strict";
+// Shared handling for remote (http/sse) MCP registry rows.
+//
+// Registry rows store remote servers as command='http'|'sse' with args=[url]
+// and the credential set in env. Each agent CLI spells the config differently,
+// but all five make the same three decisions first — is this row remote, what
+// URL does it point at, and what headers does its env map become. That lived
+// inline in install.ts (the claude path) and the other four adapters each got
+// it wrong in their own way, so it lives here now and they all call it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRemoteMcp = isRemoteMcp;
+exports.remoteMcpUrl = remoteMcpUrl;
+exports.remoteMcpHeaders = remoteMcpHeaders;
+/** True when a registry row describes a remote MCP server rather than a
+ *  local process to spawn. */
+function isRemoteMcp(command) {
+    return command === 'http' || command === 'sse';
+}
+/** The endpoint a remote row points at. Returns null for a malformed row so
+ *  callers can skip it loudly rather than emit a broken config entry. */
+function remoteMcpUrl(args) {
+    if (!Array.isArray(args))
+        return null;
+    const first = args[0];
+    return typeof first === 'string' && first.length > 0 ? first : null;
+}
+/**
+ * Convert a registry env map into the HTTP headers the remote server expects.
+ *
+ * Underscores become hyphens (ENTITY_API_KEY -> ENTITY-API-KEY), matching the
+ * deployed github-mcp server. OAUTH_ACCESS_TOKEN becomes an Authorization
+ * bearer; every OTHER OAUTH_* key is token bookkeeping (refresh token, expiry)
+ * and must never be sent as a header.
+ */
+function remoteMcpHeaders(env) {
+    const headers = {};
+    for (const [key, value] of Object.entries(env || {})) {
+        if (typeof value !== 'string' || value.length === 0)
+            continue;
+        if (key === 'OAUTH_ACCESS_TOKEN') {
+            headers.Authorization = `Bearer ${value}`;
+            continue;
+        }
+        if (key.startsWith('OAUTH_'))
+            continue;
+        headers[key.replace(/_/g, '-')] = value;
+    }
+    return headers;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [