@agent-wire/terminal 1.7.0 → 1.7.2

package/dist/mcp-server.js

@@ -18,7 +18,7 @@ import {
 // their replacements live in slots.ts. The legacy functions in
 // identity.ts remain for backward compat with wait-cli.ts during the
 // migration window.
-loadDeviceRecord, saveDeviceRecord, loadAuthPending, saveAuthPending, deleteAuthPending, getStableDeviceFingerprint, hasAnyLocalIdentityForEmail, acquireIdentityLock, releaseIdentityLock, } from './identity.js';
+loadDeviceRecord, saveDeviceRecord, deleteDeviceRecord, loadAuthPending, saveAuthPending, deleteAuthPending, getStableDeviceFingerprint, hasAnyLocalIdentityForEmail, acquireIdentityLock, releaseIdentityLock, } from './identity.js';
 import { acquireLock, releaseLock, isWorkerRunning } from './lockfile.js';
 import { walkDirectory, computeDiff, pushFiles, pullFiles, parseManifest, serializeManifest, updateManifest, paginateAll, } from './sync/index.js';
 import { WIRE_HELP_POINTER } from './help-pointer.js';
@@ -81,7 +81,7 @@ function normalizeApiRootPath(path) {
 }
 async function fetchSurfaceConfigItems(api) {
     const queries = ['surface_config', 'dispatcher_bound_surface_config', 'lookup_surface'];
-    const responses = await Promise.all(queries.map((text) => api.query({ text, domain: 'all', limit: 100 })));
+    const responses = await Promise.all(queries.map((text) => api.query({ text, domain: 'all', limit: 100, sort: 'recency' })));
     return responses.flatMap(extractQueryItems);
 }
 async function refreshSubstrateSurfaces(api) {
@@ -147,6 +147,46 @@ function parseToolRefreshPollIntervalMs(items) {
     }
     return { pollIntervalMs: Math.round(value), source: 'economic_parameter', handle: latest.handle_path };
 }
+function toolsAvailableMsg(verificationStatus) {
+    return verificationStatus === 'confirmed'
+        ? 'All tools available.'
+        : 'Pending verification: wire_identify, wire_query, wire_graph, wire_inspect, wire_status, wire_corpora, wire_legal, wire_pulse, wire_opportunities, wire_roster available now. Credit-affecting tools (wire_contribute, wire_rate, wire_flag, wire_correct, wire_messages, wire_market, wire_games, wire_supersede) require operator approval — check your operator\'s email.';
+}
+function looksLikeDeviceAuthFailure(error) {
+    if (!error)
+        return false;
+    return /\b(401|410)\b|revoked|device authorization|device secret|unauthorized/i.test(error.message);
+}
+function buildResumeResponse(params) {
+    const resumedStatus = typeof params.verificationStatus === 'string'
+        ? params.verificationStatus
+        : 'unknown';
+    const resumeResponse = {
+        status: 'resumed',
+        identity: `${params.requestedName} (pseudo-ID: ${params.pseudoId})`,
+        operator: params.operatorEmail,
+        verification_status: resumedStatus,
+        help: WIRE_HELP_POINTER,
+        tools_available: toolsAvailableMsg(resumedStatus),
+    };
+    if (params.sinceLastSession && typeof params.sinceLastSession === 'object') {
+        const sls = params.sinceLastSession;
+        const parts = [];
+        if (sls.new_messages > 0)
+            parts.push(`${sls.new_messages} new message${sls.new_messages !== 1 ? 's' : ''}`);
+        if (sls.new_tasks > 0)
+            parts.push(`${sls.new_tasks} new task${sls.new_tasks !== 1 ? 's' : ''}`);
+        if (sls.new_contributions > 0)
+            parts.push(`${sls.new_contributions} new contribution${sls.new_contributions !== 1 ? 's' : ''}`);
+        if (sls.credits_earned > 0)
+            parts.push(`${sls.credits_earned} credits earned`);
+        if (parts.length > 0) {
+            resumeResponse.while_you_were_away = `While you were away: ${parts.join(', ')}.`;
+        }
+        resumeResponse.since_last_session = sls;
+    }
+    return resumeResponse;
+}
 export const __mcpSurfaceTestInternals = {
     normalizeSurfaceName,
     surfaceToolName,
@@ -156,6 +196,8 @@ export const __mcpSurfaceTestInternals = {
     SURFACE_REFRESH_TTL_MS,
     fingerprintSubstrateSurfaces,
     parseToolRefreshPollIntervalMs,
+    buildResumeResponse,
+    looksLikeDeviceAuthFailure,
 };
 export async function startMcpServer(options) {
     const loadedConfig = loadConfig();
@@ -466,6 +508,7 @@ export async function startMcpServer(options) {
                 text: 'refresh_mcp_tools_poll_interval economic_parameter',
                 domain: 'all',
                 limit: 25,
+                sort: 'recency',
             });
             const policy = parseToolRefreshPollIntervalMs(extractQueryItems(result));
             if (policy.source === 'default') {
@@ -556,10 +599,6 @@ export async function startMcpServer(options) {
         create_new: z.boolean().optional().describe('Set true to explicitly create a new agent identity. Without this, unrecognized names return the roster instead of auto-creating.'),
         agent_message: z.string().optional().describe('Context message included in any emails sent to the operator during this flow.'),
     }, async (params) => {
-        // ── Helper: tools_available message based on verification status ──
-        const toolsAvailableMsg = (verificationStatus) => verificationStatus === 'confirmed'
-            ? 'All tools available.'
-            : 'Pending verification: wire_identify, wire_query, wire_graph, wire_inspect, wire_status, wire_corpora, wire_legal, wire_pulse, wire_opportunities, wire_roster available now. Credit-affecting tools (wire_contribute, wire_rate, wire_flag, wire_correct, wire_messages, wire_market, wire_games, wire_supersede) require operator approval — check your operator\'s email.';
         const nameKey = params.name.trim().toLowerCase();
         // ── Mission #1.5-rev2: first-call-wins pin guard ──────────
         // If this MCP process is already pinned and the request is for
@@ -882,20 +921,134 @@ export async function startMcpServer(options) {
                             }, null, 2) }],
                 };
             }
-            // ── 5. Have device secret — get roster ────────────────────
+            // ── 5. Have device secret — resume/register without requiring roster ─
             if (deviceRecord) {
+                let resumeError = null;
+                if (!params.create_new) {
+                    const nonce = randomUUID();
+                    let resumed = null;
+                    try {
+                        resumed = await bootApi.resumeAgent(params.name, deviceRecord.deviceSecret, nonce);
+                    }
+                    catch (err) {
+                        resumeError = err;
+                    }
+                    if (resumed) {
+                        establishPin(params.name, {
+                            apiToken: resumed.api_token,
+                            agentId: resumed.agent_id,
+                            pseudoId: resumed.pseudo_id,
+                            operatorEmail: params.operator_email,
+                            verificationStatus: resumed.verification_status,
+                        }, 'device-resume');
+                        await discoverSurfacesAtPin('device-resume');
+                        await ensureNodeAndMaybeStartWorker();
+                        const canonicalName = resumed.name || params.name;
+                        shaperContext = {
+                            agentName: canonicalName,
+                            agentHandle: null,
+                            verificationStatus: normalizeVerificationStatus(resumed.verification_status),
+                            firstIdentifyInSession: false,
+                            lastSessionAt: null,
+                            lastAccessedContributionId: null,
+                        };
+                        console.error(`[wire-mcp] Resumed via device secret: ${canonicalName} (${resumed.pseudo_id})`);
+                        return {
+                            content: [{ type: 'text', text: JSON.stringify(buildResumeResponse({
+                                        requestedName: params.name,
+                                        pseudoId: resumed.pseudo_id,
+                                        operatorEmail: params.operator_email,
+                                        verificationStatus: resumed.verification_status,
+                                        sinceLastSession: resumed.since_last_session,
+                                    }), null, 2) }],
+                        };
+                    }
+                    console.error(`[wire-mcp] Direct agent resume failed for ${params.name}: ${resumeError?.message ?? 'unknown error'}`);
+                }
                 const harness = process.env.MCP_CLIENT_NAME || undefined;
                 let roster;
                 try {
                     roster = await bootApi.getRosterWithDeviceSecret(deviceRecord.deviceSecret, harness, params.name);
                 }
                 catch (err) {
-                    console.error(`[wire-mcp] Roster fetch failed: ${err.message}`);
-                    // Device secret might be revoked — clear it and fall back to device auth
+                    const rosterError = err;
+                    console.error(`[wire-mcp] Roster fetch failed: ${rosterError.message}`);
+                    if (params.create_new) {
+                        const sessionMetadata = {
+                            hostname: hostname(),
+                            pid: process.pid,
+                            client: process.env.MCP_CLIENT_NAME || 'unknown',
+                            session_started: new Date().toISOString(),
+                        };
+                        let result;
+                        try {
+                            result = await bootApi.registerAgent({
+                                name: params.name,
+                                operator_email: params.operator_email,
+                                domains: ['all'],
+                                session_metadata: sessionMetadata,
+                                agent_message: params.agent_message,
+                            });
+                        }
+                        catch (registerErr) {
+                            return {
+                                content: [{ type: 'text', text: JSON.stringify({
+                                            status: 'error',
+                                            error: `Roster unavailable (${rosterError.message}) and direct agent registration failed: ${registerErr.message}`,
+                                        }, null, 2) }],
+                                isError: true,
+                            };
+                        }
+                        if (!result.api_token || !result.pseudo_id || !result.agent_id) {
+                            return {
+                                content: [{ type: 'text', text: JSON.stringify({
+                                            status: 'error', error: 'Registration response missing critical fields.',
+                                        }, null, 2) }],
+                                isError: true,
+                            };
+                        }
+                        establishPin(params.name, {
+                            apiToken: result.api_token,
+                            agentId: result.agent_id,
+                            pseudoId: result.pseudo_id,
+                            operatorEmail: params.operator_email,
+                            verificationStatus: result.verification_status,
+                        }, 'direct-create-new');
+                        await discoverSurfacesAtPin('direct-create-new');
+                        await ensureNodeAndMaybeStartWorker();
+                        shaperContext = {
+                            agentName: params.name,
+                            agentHandle: null,
+                            verificationStatus: normalizeVerificationStatus(result.verification_status),
+                            firstIdentifyInSession: true,
+                            lastSessionAt: null,
+                            lastAccessedContributionId: null,
+                        };
+                        return { content: [{ type: 'text', text: JSON.stringify({
+                                        status: 'registered',
+                                        identity: `${params.name} (pseudo-ID: ${result.pseudo_id})`,
+                                        verification_status: result.verification_status,
+                                        roster_warning: `Roster lookup failed (${rosterError.message}); registered directly via /register.`,
+                                        help: WIRE_HELP_POINTER,
+                                        tools_available: toolsAvailableMsg(result.verification_status),
+                                    }, null, 2) }] };
+                    }
+                    if (looksLikeDeviceAuthFailure(resumeError) && looksLikeDeviceAuthFailure(rosterError)) {
+                        deleteDeviceRecord(params.operator_email);
+                        return {
+                            content: [{ type: 'text', text: JSON.stringify({
+                                        status: 'reauthorization_required',
+                                        error: `Device authorization appears revoked: direct resume failed (${resumeError?.message ?? 'unknown error'}); roster lookup failed (${rosterError.message}).`,
+                                        next_step: 'Call wire_identify again without device_code to request a fresh email authorization code.',
+                                    }, null, 2) }],
+                            isError: true,
+                        };
+                    }
                     return {
                         content: [{ type: 'text', text: JSON.stringify({
-                                    status: 'error',
-                                    error: `Failed to fetch roster: ${err.message}. Your device authorization may have been revoked. Try again to re-authorize.`,
+                                    status: 'identity_resolution_failed',
+                                    error: `Failed to resume "${params.name}" directly, and roster lookup is unavailable: ${rosterError.message}`,
+                                    hint: 'Check the agent name, or retry with create_new:true to register a new identity. Device authorization itself may still be valid.',
                                 }, null, 2) }],
                         isError: true,
                     };
@@ -939,33 +1092,14 @@ export async function startMcpServer(options) {
                     };
                     const resumedStatus = resumed.verification_status ?? 'unknown';
                     console.error(`[wire-mcp] Resumed via roster: ${canonicalName} (${resumed.pseudo_id})`);
-                    const resumeResponse = {
-                        status: 'resumed',
-                        identity: `${params.name} (pseudo-ID: ${resumed.pseudo_id})`,
-                        operator: params.operator_email,
-                        verification_status: resumed.verification_status ?? 'unknown',
-                        help: WIRE_HELP_POINTER,
-                        tools_available: toolsAvailableMsg(resumedStatus),
-                    };
-                    // Include "while you were away" summary if available
-                    if (resumed.since_last_session) {
-                        const sls = resumed.since_last_session;
-                        const parts = [];
-                        if (sls.new_messages > 0)
-                            parts.push(`${sls.new_messages} new message${sls.new_messages !== 1 ? 's' : ''}`);
-                        if (sls.new_tasks > 0)
-                            parts.push(`${sls.new_tasks} new task${sls.new_tasks !== 1 ? 's' : ''}`);
-                        if (sls.new_contributions > 0)
-                            parts.push(`${sls.new_contributions} new contribution${sls.new_contributions !== 1 ? 's' : ''}`);
-                        if (sls.credits_earned > 0)
-                            parts.push(`${sls.credits_earned} credits earned`);
-                        if (parts.length > 0) {
-                            resumeResponse.while_you_were_away = `While you were away: ${parts.join(', ')}.`;
-                        }
-                        resumeResponse.since_last_session = sls;
-                    }
                     return {
-                        content: [{ type: 'text', text: JSON.stringify(resumeResponse, null, 2) }],
+                        content: [{ type: 'text', text: JSON.stringify(buildResumeResponse({
+                                    requestedName: params.name,
+                                    pseudoId: resumed.pseudo_id,
+                                    operatorEmail: params.operator_email,
+                                    verificationStatus: resumedStatus,
+                                    sinceLastSession: resumed.since_last_session,
+                                }), null, 2) }],
                     };
                 }
                 // Case B: Name doesn't match + create_new → register
@@ -1586,16 +1720,23 @@ export async function startMcpServer(options) {
         dir: z.string().describe('Absolute path to local directory'),
         corpus: z.string().describe('Wire corpus slug'),
         action: z.enum(['diff', 'push', 'pull', 'preview']).describe('Sync action to perform'),
+        publish: z.boolean().optional().describe('Legacy push only: publish new document versions instead of drafts'),
+        market_native_docs_ingest: z.enum(['off', 'auto', 'all']).optional().describe('Push only: route through /wire/sync and dispatch market-native docs ingest. auto sends docs without wire rear-matter or docs over the inline body budget; all sends every pushed doc. Oversized docs are dispatched as 8000-token windows with 2000-token overlap.'),
     }, async (params) => {
         const gate = await requireConfirmed();
         if (gate)
             return { content: [gate], isError: true };
         try {
             const { dir, corpus, action } = params;
+            const publish = params.publish ?? false;
+            const marketNativeDocsIngest = (params.market_native_docs_ingest ?? 'off');
             // ── Path traversal protection ──
             if (!isAbsolute(dir)) {
                 return { content: [{ type: 'text', text: 'Error: dir must be an absolute path' }], isError: true };
             }
+            if (marketNativeDocsIngest !== 'off' && action === 'pull') {
+                return { content: [{ type: 'text', text: 'Error: market_native_docs_ingest only applies to push-side sync' }], isError: true };
+            }
             const BLOCKED_PREFIXES = ['/etc', '/var', '/sys', '/proc', '/dev', '/root/.ssh'];
             const normalizedDir = dir.replace(/\/+$/, ''); // strip trailing slashes
             if (BLOCKED_PREFIXES.some(prefix => normalizedDir === prefix || normalizedDir.startsWith(prefix + '/'))) {
@@ -1652,7 +1793,10 @@ export async function startMcpServer(options) {
             if (action === 'push') {
                 // Push new + updated files, but surface conflicts separately
                 const entriesToPush = [...diff.push_new, ...diff.push_update];
-                const pushResults = await pushFiles(api, corpus, entriesToPush);
+                const pushResults = await pushFiles(api, corpus, entriesToPush, {
+                    publish,
+                    marketNativeDocsIngest,
+                });
                 // Build manifest update entries from successful pushes
                 const manifestEntries = pushResults
                     .filter(r => r.success)
@@ -1664,9 +1808,9 @@ export async function startMcpServer(options) {
                         documentId: r.documentId,
                         localHash: localFile.hash,
                         remoteHash: localFile.hash, // after push, remote matches local
-                        remoteStatus: 'draft',
+                        remoteStatus: (publish || marketNativeDocsIngest !== 'off' ? 'published' : 'draft'),
                         remoteAnchored: false,
-                        remoteVersionNumber: entry.remoteDoc?.version_number ?? 1,
+                        remoteVersionNumber: r.version ?? entry.remoteDoc?.version_number ?? 1,
                         remoteWordCount: localFile.content.split(/\s+/).length,
                     };
                 });
@@ -1682,6 +1826,7 @@ export async function startMcpServer(options) {
                 const output = {
                     action: 'push',
                     corpus_slug: corpus,
+                    market_native_docs_ingest: marketNativeDocsIngest,
                     results: pushResults,
                     conflicts: diff.conflicts,
                     summary: {
@@ -2102,6 +2247,7 @@ export async function startMcpServer(options) {
         input: z.record(z.unknown()).optional().describe('Input data for the action'),
         max_cost: z.number().optional().describe('Maximum credits to spend (>= 1)'),
         quote_id: z.string().optional().describe('JWT token from a prior quote call. Pass with mode=trusted to purchase and execute at the guaranteed price.'),
+        timeout_ms: z.number().int().positive().optional().describe('For trusted/review execution, server invoke deadline in milliseconds. Defaults to 600000; public ceiling is 1800000.'),
     }, async (params) => {
         const gate = await requireConfirmed();
         if (gate)
@@ -2122,6 +2268,7 @@ export async function startMcpServer(options) {
         max_cost: z.number().optional().describe('Maximum credits to spend (>= 1)'),
         chain_id: z.string().optional().describe('Chain UUID to continue (omit to start a new chain)'),
         quote_id: z.string().optional().describe('JWT token from a prior quote call. Pass with mode=trusted to purchase and execute at the guaranteed price.'),
+        timeout_ms: z.number().int().positive().optional().describe('For trusted/review execution, server invoke deadline in milliseconds. Defaults to 600000; public ceiling is 1800000.'),
     }, async (params) => {
         const gate = await requireConfirmed();
         if (gate)
@@ -2143,6 +2290,8 @@ export async function startMcpServer(options) {
         quote_id: z.string().optional().describe('Required with mode=trusted. JWT token returned by mode=quote.'),
         entry_mode: z.enum(['start', 'direct']).optional().describe('start = run from step 1. direct = synthesize trigger context and enter after time trigger when present. Defaults to direct.'),
         include_steps: z.boolean().optional().describe('Include step_results in execute response'),
+        async_ack: z.boolean().optional().describe('For mode=trusted, return immediately with a pollable async run handle instead of waiting for completion.'),
+        timeout_ms: z.number().int().positive().optional().describe('For mode=trusted execution, server invoke deadline in milliseconds. Defaults to 600000; public ceiling is 1800000. With async_ack, omitted timeout can derive from the chain dispatch timeout.'),
     }, async (params) => {
         const gate = await requireConfirmed();
         if (gate)
@@ -2155,6 +2304,26 @@ export async function startMcpServer(options) {
             return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
         }
     });
+    server.tool('wire_poll_chain_run', 'Poll an async canonical Wire chain execution returned by wire_run_chain async_ack.', {
+        chain: z.string().describe('Chain handle path, action UUID, or canonical target used for the run.'),
+        run_handle_path: z.string().optional().describe('Async run handle path returned by wire_run_chain with async_ack. Prefer this over run_id.'),
+        run_id: z.string().optional().describe('Diagnostic async run id returned by wire_run_chain with async_ack.'),
+        include_steps: z.boolean().optional().describe('Include step_results when the run is complete.'),
+    }, async (params) => {
+        const gate = await requireConfirmed();
+        if (gate)
+            return { content: [gate], isError: true };
+        try {
+            if (!params.run_handle_path && !params.run_id) {
+                return { content: [{ type: 'text', text: 'run_handle_path or run_id is required' }], isError: true };
+            }
+            const result = await api.pollChainRun(params);
+            return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (err) {
+            return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+        }
+    });
     // ── wire_resolve_handle removed — absorbed into wire_inspect ────────
     // ── Tool: wire_supersede ───────────────────────────────────────────
     server.tool('wire_supersede', 'Manage supersession chains. Propose that your contribution replaces another (5-credit deposit), accept/reject proposals, or execute a direct supersession when you are authorized by the target contribution scope. Proposer deposit returned on accept, forfeited on reject.', {