@agentvault/agentvault 0.17.3 → 0.17.5

package/dist/index.js

@@ -46538,6 +46538,7 @@ var http_handlers_exports = {};
 __export(http_handlers_exports, {
   handleActionRequest: () => handleActionRequest,
   handleDecisionRequest: () => handleDecisionRequest,
+  handleMcpConfigRequest: () => handleMcpConfigRequest,
   handleSendRequest: () => handleSendRequest,
   handleStatusRequest: () => handleStatusRequest,
   handleTargetsRequest: () => handleTargetsRequest
@@ -46679,12 +46680,90 @@ function handleTargetsRequest(channel) {
     }
   };
 }
+function handleMcpConfigRequest(agentName, port, mcpSkillCount) {
+  return {
+    status: 200,
+    body: {
+      mcpServers: {
+        [`agentvault-${agentName}`]: {
+          url: `http://127.0.0.1:${port}/mcp`
+        }
+      },
+      _meta: {
+        agent: agentName,
+        skills_count: mcpSkillCount,
+        transport: "streamable-http",
+        auth: "none (localhost)",
+        instructions: "Add the mcpServers block to your MCP configuration file (e.g., .mcp.json or mcp_config.json)"
+      }
+    }
+  };
+}
 var init_http_handlers = __esm({
   "src/http-handlers.ts"() {
     "use strict";
   }
 });
 
+// src/mcp-proxy-helpers.ts
+var mcp_proxy_helpers_exports = {};
+__export(mcp_proxy_helpers_exports, {
+  createMcpProxyRequest: () => createMcpProxyRequest
+});
+import { Readable } from "node:stream";
+async function createMcpProxyRequest(mcpServer, payload) {
+  const bodyStr = JSON.stringify(payload);
+  const req = Object.assign(new Readable({ read() {
+  } }), {
+    method: "POST",
+    url: "/mcp",
+    headers: {
+      "content-type": "application/json",
+      "content-length": String(Buffer.byteLength(bodyStr)),
+      // Use localhost to bypass SPT validation (WS already authenticated)
+      host: "localhost"
+    },
+    socket: { remoteAddress: "127.0.0.1" }
+  });
+  req.push(bodyStr);
+  req.push(null);
+  let responseStatus = 200;
+  let responseBody = "";
+  const chunks = [];
+  const res = {
+    writeHead: (status) => {
+      responseStatus = status;
+    },
+    write: (chunk) => {
+      chunks.push(typeof chunk === "string" ? chunk : chunk.toString());
+      return true;
+    },
+    end: (data) => {
+      if (data) chunks.push(typeof data === "string" ? data : data.toString());
+      responseBody = chunks.join("");
+    },
+    setHeader: () => {
+    },
+    getHeader: () => void 0,
+    statusCode: 200,
+    headersSent: false
+  };
+  await mcpServer.handleRequest(req, res);
+  if (responseBody) {
+    try {
+      return JSON.parse(responseBody);
+    } catch {
+      return { jsonrpc: "2.0", error: { code: -32603, message: responseBody } };
+    }
+  }
+  return null;
+}
+var init_mcp_proxy_helpers = __esm({
+  "src/mcp-proxy-helpers.ts"() {
+    "use strict";
+  }
+});
+
 // src/workspace-handlers.ts
 var workspace_handlers_exports = {};
 __export(workspace_handlers_exports, {
@@ -46900,6 +46979,7 @@ var init_channel = __esm({
       _stopped = false;
       _persisted = null;
       _httpServer = null;
+      _mcpServer = null;
       _pollFallbackTimer = null;
       _heartbeatTimer = null;
       _heartbeatCallback = null;
@@ -47951,9 +48031,28 @@ var init_channel = __esm({
             const result = handlers.handleTargetsRequest(this);
             res.writeHead(result.status, { "Content-Type": "application/json" });
             res.end(JSON.stringify(result.body));
+          } else if (req.url === "/mcp" && (req.method === "POST" || req.method === "GET" || req.method === "DELETE")) {
+            if (!this._mcpServer) {
+              res.writeHead(503, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ ok: false, error: "MCP server not initialized" }));
+              return;
+            }
+            this._mcpServer.handleRequest(req, res).catch((err) => {
+              console.error("[MCP] Request handling error:", err);
+              if (!res.headersSent) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Internal MCP error" }));
+              }
+            });
+          } else if (req.method === "GET" && req.url === "/mcp-config") {
+            const agentName = this.config.agentName ?? "agent";
+            const mcpSkillCount = this._mcpServer?.skillCount ?? 0;
+            const result = handlers.handleMcpConfigRequest(agentName, port, mcpSkillCount);
+            res.writeHead(result.status, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(result.body));
           } else {
             res.writeHead(404, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: "Not found. Use POST /send, POST /decision, POST /action, GET /status, or GET /targets" }));
+            res.end(JSON.stringify({ ok: false, error: "Not found. Use POST /send, POST /decision, POST /action, GET /status, GET /targets, or /mcp" }));
           }
         });
         this._httpServer.listen(port, "127.0.0.1", () => {
@@ -47966,6 +48065,17 @@ var init_channel = __esm({
           this._httpServer = null;
         }
       }
+      /**
+       * Attach an MCP server instance to this channel.
+       * The MCP server will be served at /mcp on the local HTTP server.
+       */
+      setMcpServer(mcpServer) {
+        this._mcpServer = mcpServer;
+      }
+      /** The attached MCP server, if any. */
+      get mcpServer() {
+        return this._mcpServer;
+      }
       // --- Topic management ---
       /**
        * Create a new topic within the conversation group.
@@ -48560,6 +48670,33 @@ var init_channel = __esm({
               await this._fetchScanRules();
               return;
             }
+            if (data.event === "mcp_request") {
+              const requestId = data.data?.request_id;
+              const mcpPayload = data.data?.mcp_payload;
+              if (requestId && mcpPayload && this._mcpServer) {
+                try {
+                  const { createMcpProxyRequest: createMcpProxyRequest2 } = await Promise.resolve().then(() => (init_mcp_proxy_helpers(), mcp_proxy_helpers_exports));
+                  const mcpResponse = await createMcpProxyRequest2(this._mcpServer, mcpPayload);
+                  ws.send(JSON.stringify({
+                    event: "mcp_response",
+                    data: { request_id: requestId, mcp_payload: mcpResponse }
+                  }));
+                } catch (err) {
+                  ws.send(JSON.stringify({
+                    event: "mcp_response",
+                    data: {
+                      request_id: requestId,
+                      mcp_payload: {
+                        jsonrpc: "2.0",
+                        id: mcpPayload?.id ?? null,
+                        error: { code: -32603, message: String(err) }
+                      }
+                    }
+                  }));
+                }
+              }
+              return;
+            }
             if (data.event === "hub_identity_sync") {
               if (this._persisted && data.data?.hub_id) {
                 const changed = this._persisted.hubId !== data.data.hub_id || this._persisted.agentRole !== (data.data.agent_role ?? "peer");
@@ -74952,7 +75089,7 @@ var init_mcp = __esm({
 // ../../node_modules/@hono/node-server/dist/index.mjs
 import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
 import { Http2ServerRequest } from "http2";
-import { Readable } from "stream";
+import { Readable as Readable2 } from "stream";
 import crypto2 from "crypto";
 async function readWithoutBlocking(readPromise) {
   return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(void 0))]);
@@ -75069,7 +75206,7 @@ var init_dist2 = __esm({
           init.body = new ReadableStream({
             async pull(controller) {
               try {
-                reader ||= Readable.toWeb(incoming).getReader();
+                reader ||= Readable2.toWeb(incoming).getReader();
                 const { done, value } = await reader.read();
                 if (done) {
                   controller.close();
@@ -75082,7 +75219,7 @@ var init_dist2 = __esm({
             }
           });
         } else {
-          init.body = Readable.toWeb(incoming);
+          init.body = Readable2.toWeb(incoming);
         }
       }
       return new Request2(url2, init);
@@ -76278,23 +76415,29 @@ var init_mcp_server2 = __esm({
        * Each request gets a fresh stateless transport; after the response is
        * flushed the transport + underlying protocol connection are torn down
        * so the single McpServer instance is ready for the next caller.
+       *
+       * Local requests from 127.0.0.1/::1 bypass SPT validation (owner access).
        */
       async handleRequest(req, res) {
         if (!this.initialized) {
           this.initialize();
         }
-        const authHeader = req.headers.authorization;
-        if (!authHeader?.startsWith("Bearer ")) {
-          res.writeHead(401, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Missing or invalid Authorization header" }));
-          return;
-        }
-        const token = authHeader.slice(7);
-        const valid = await this.validateSpt(token);
-        if (!valid) {
-          res.writeHead(403, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Invalid or expired SPT token" }));
-          return;
+        const remote = req.socket?.remoteAddress;
+        const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+        if (!isLocal) {
+          const authHeader = req.headers.authorization;
+          if (!authHeader?.startsWith("Bearer ")) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing or invalid Authorization header" }));
+            return;
+          }
+          const token = authHeader.slice(7);
+          const valid = await this.validateSpt(token);
+          if (!valid) {
+            res.writeHead(403, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid or expired SPT token" }));
+            return;
+          }
         }
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: void 0