@ainyc/canonry 4.98.0 → 4.99.0

package/dist/{chunk-7COFPNMH.js → chunk-CEHD33NQ.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-3TH54726.js";
+} from "./chunk-VQN74WWA.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -8331,13 +8331,63 @@ function buildSkillDocTools() {
 // src/agent/mcp-to-agent-tool.ts
 import { Type as Type2 } from "@sinclair/typebox";
 var MAX_TOOL_RESULT_CHARS = 2e4;
-function truncate(json) {
-  if (json.length <= MAX_TOOL_RESULT_CHARS) return json;
-  return json.slice(0, MAX_TOOL_RESULT_CHARS) + "\n... (truncated \u2014 result too large)";
+var TRUNCATION_NOTE = "... (truncated \u2014 result too large)";
+function serializeResult(value) {
+  return JSON.stringify(value, null, 2);
+}
+function largestArrayKey(obj) {
+  let best;
+  let bestLen = -1;
+  for (const [k, v] of Object.entries(obj)) {
+    if (!Array.isArray(v)) continue;
+    const len = serializeResult(v).length;
+    if (len > bestLen) {
+      bestLen = len;
+      best = k;
+    }
+  }
+  return best;
+}
+function trimRowsToFit(rows, render) {
+  let kept = rows.slice();
+  while (kept.length > 0 && render(kept).length > MAX_TOOL_RESULT_CHARS) {
+    kept = kept.slice(0, -1);
+  }
+  return kept;
+}
+function truncateToolResult(details) {
+  const full = serializeResult(details);
+  if (full.length <= MAX_TOOL_RESULT_CHARS) return full;
+  if (Array.isArray(details)) {
+    const kept = trimRowsToFit(
+      details,
+      (rows) => serializeResult({ items: rows, __truncated: true, __omittedRows: details.length - rows.length })
+    );
+    return serializeResult({ items: kept, __truncated: true, __omittedRows: details.length - kept.length });
+  }
+  if (details && typeof details === "object") {
+    const obj = details;
+    const arrayKey = largestArrayKey(obj);
+    if (arrayKey) {
+      const rows = obj[arrayKey];
+      const kept = trimRowsToFit(
+        rows,
+        (r) => serializeResult({ ...obj, [arrayKey]: r, __truncated: true, __omittedRows: rows.length - r.length })
+      );
+      const out = serializeResult({
+        ...obj,
+        [arrayKey]: kept,
+        __truncated: true,
+        __omittedRows: rows.length - kept.length
+      });
+      if (out.length <= MAX_TOOL_RESULT_CHARS) return out;
+    }
+  }
+  return full.slice(0, MAX_TOOL_RESULT_CHARS) + "\n" + TRUNCATION_NOTE;
 }
 function textResult2(details) {
   return {
-    content: [{ type: "text", text: truncate(JSON.stringify(details, null, 2)) }],
+    content: [{ type: "text", text: truncateToolResult(details) }],
     details
   };
 }
@@ -8404,13 +8454,31 @@ function loadAeroSystemPrompt(pkgDir) {
   const skillDir = resolveAeroSkillDir(pkgDir);
   const skillBody = fs7.readFileSync(path8.join(skillDir, "SKILL.md"), "utf-8");
   const soulPath = path8.join(skillDir, "soul.md");
-  if (!fs7.existsSync(soulPath)) return skillBody;
-  const soulBody = fs7.readFileSync(soulPath, "utf-8");
-  return `${soulBody.trimEnd()}
+  const base = fs7.existsSync(soulPath) ? `${fs7.readFileSync(soulPath, "utf-8").trimEnd()}
 
 ---
 
-${skillBody}`;
+${skillBody}` : skillBody;
+  return appendSystemPromptExtras(base);
+}
+function appendSystemPromptExtras(base, env = process.env) {
+  const inline = env.AERO_SYSTEM_PROMPT_APPEND?.trim();
+  let fileBody = "";
+  const filePath = env.AERO_SYSTEM_PROMPT_FILE?.trim();
+  if (filePath) {
+    try {
+      fileBody = fs7.readFileSync(filePath, "utf-8").trim();
+    } catch {
+      fileBody = "";
+    }
+  }
+  const extras = [inline, fileBody].filter((s) => !!s && s.length > 0);
+  if (extras.length === 0) return base;
+  return `${base.trimEnd()}
+
+---
+
+${extras.join("\n\n")}`;
 }
 function missingProviderMessage() {
   const configHints = agentProvidersByPriority().join(", ");
@@ -8461,6 +8529,93 @@ function resolveSessionProviderAndModel(config, opts) {
   return { provider, modelId };
 }
 
+// src/agent/remote-mcp.ts
+import { Type as Type3 } from "@sinclair/typebox";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var log18 = createLogger("RemoteMcp");
+var AERO_EXCLUDED_MCP_TOOLS2 = /* @__PURE__ */ new Set([]);
+var MAX_TOOL_RESULT_CHARS2 = 2e4;
+function truncate(text) {
+  if (text.length <= MAX_TOOL_RESULT_CHARS2) return text;
+  return text.slice(0, MAX_TOOL_RESULT_CHARS2) + "\n... (truncated, result too large)";
+}
+async function connectStreamableHttp(server) {
+  const transport = new StreamableHTTPClientTransport(new URL(server.url), {
+    requestInit: {
+      headers: { Authorization: `Bearer ${server.token}` }
+    }
+  });
+  const client = new Client(
+    { name: "canonry-aero", version: "1.0.0" },
+    { capabilities: {} }
+  );
+  await client.connect(transport);
+  return client;
+}
+function isReadOnly(tool) {
+  return tool.annotations?.readOnlyHint === true;
+}
+function adaptRemoteTool(client, tool) {
+  const parameters = Type3.Unsafe(
+    tool.inputSchema ?? { type: "object", properties: {} }
+  );
+  const execute = async (_toolCallId, params) => {
+    const result = await client.callTool({ name: tool.name, arguments: params });
+    return {
+      content: [{ type: "text", text: truncate(JSON.stringify(result, null, 2)) }],
+      details: result
+    };
+  };
+  return {
+    name: tool.name,
+    label: tool.annotations?.title ?? tool.name,
+    description: tool.description ?? "",
+    parameters,
+    execute
+  };
+}
+async function loadExternalMcpTools(servers, opts = {}) {
+  if (!servers || servers.length === 0) return [];
+  const connect = opts.connect ?? connectStreamableHttp;
+  const excluded = opts.excluded ?? AERO_EXCLUDED_MCP_TOOLS2;
+  const tools = [];
+  for (const server of servers) {
+    const label = server.label ?? server.url;
+    let client;
+    try {
+      client = await connect(server);
+    } catch (err) {
+      log18.error("external-mcp.connect-failed", {
+        label,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    let listed;
+    try {
+      listed = await client.listTools();
+    } catch (err) {
+      log18.error("external-mcp.list-failed", {
+        label,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    for (const tool of listed.tools) {
+      if (excluded.has(tool.name)) continue;
+      if (!isReadOnly(tool)) continue;
+      tools.push(adaptRemoteTool(client, tool));
+    }
+    log18.info("external-mcp.loaded", {
+      label,
+      discovered: listed.tools.length,
+      adopted: tools.length
+    });
+  }
+  return tools;
+}
+
 // src/agent/memory-store.ts
 import crypto18 from "crypto";
 import { and as and13, desc as desc6, eq as eq17, like, sql as sql5 } from "drizzle-orm";
@@ -8684,7 +8839,7 @@ async function compactMessages(args) {
 }
 
 // src/agent/session-registry.ts
-var log18 = createLogger("SessionRegistry");
+var log19 = createLogger("SessionRegistry");
 var MAX_HYDRATE_NOTES = 20;
 var MAX_HYDRATE_BYTES = 32 * 1024;
 function escapeMemoryFragment(value) {
@@ -8703,10 +8858,53 @@ var SessionRegistry = class {
    * awaits the same promise instead of kicking off a duplicate LLM call.
    */
   compactions = /* @__PURE__ */ new Map();
+  /**
+   * Read-only tools loaded once from the injected remote MCP servers (OSS-A).
+   * The server set is static config, so we connect + adapt a single time and
+   * cache the promise; every session merges the same AgentTool list. Resolves
+   * to `[]` when no servers are configured or all fail to connect (the load is
+   * fail-soft and never throws).
+   */
+  externalToolsPromise;
   opts;
   constructor(opts) {
     this.opts = opts;
   }
+  /**
+   * Lazily load + cache the injected remote MCP tools. The seam OSS-A exposes:
+   * `loadExternalMcpTools` connects to each configured server over the frozen
+   * bearer-gated Streamable HTTP transport, lists tools, and adapts the
+   * read-only, non-excluded ones into AgentTools. Cached so we connect once per
+   * registry lifetime regardless of how many projects or turns run.
+   */
+  loadExternalTools() {
+    if (!this.externalToolsPromise) {
+      this.externalToolsPromise = loadExternalMcpTools(this.opts.config.externalMcpServers).catch(
+        (err) => {
+          log19.error("external-mcp.load-failed", {
+            error: err instanceof Error ? err.message : String(err)
+          });
+          return [];
+        }
+      );
+    }
+    return this.externalToolsPromise;
+  }
+  /**
+   * Append the cached external MCP tools to the live agent's tool list, idempotently.
+   * Called after scope/model alignment in `acquireForTurn` (which rebuilds
+   * `state.tools` from the local registry), so the remote read-only tools ride
+   * alongside the local ones for the upcoming turn. No-op when none are configured.
+   */
+  async mergeExternalTools(agent) {
+    const external = await this.loadExternalTools();
+    if (external.length === 0) return;
+    const current = agent.state.tools;
+    const present = new Set(current.map((t) => t.name));
+    const additions = external.filter((t) => !present.has(t.name));
+    if (additions.length === 0) return;
+    agent.state.tools = [...current, ...additions];
+  }
   /** Read-only access to the config snapshot the registry was built with. */
   getConfig() {
     return this.opts.config;
@@ -8865,6 +9063,7 @@ ${lines.join("\n")}
     if (preferences?.provider || preferences?.modelId) {
       this.alignModel(projectName, agent, preferences);
     }
+    await this.mergeExternalTools(agent);
     await this.maybeCompact(projectName, agent);
     return agent;
   }
@@ -8911,13 +9110,13 @@ ${lines.join("\n")}
       agent.state.messages = result.messages;
       agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
       this.save(projectName);
-      log18.info("compaction.completed", {
+      log19.info("compaction.completed", {
         projectName,
         removedCount: result.removedCount,
         summaryBytes: Buffer.byteLength(result.summary, "utf8")
       });
     } catch (err) {
-      log18.error("compaction.failed", {
+      log19.error("compaction.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9014,7 +9213,7 @@ ${lines.join("\n")}
       await agent.prompt(msgs);
       this.save(projectName);
     } catch (err) {
-      log18.error("drain.failed", {
+      log19.error("drain.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9612,7 +9811,7 @@ function formatAuditFactorScore(factor) {
 }
 
 // src/snapshot-service.ts
-var log19 = createLogger("Snapshot");
+var log20 = createLogger("Snapshot");
 var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
 var SNAPSHOT_QUERY_COUNT = 6;
 var ProviderExecutionGate2 = class {
@@ -9758,7 +9957,7 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log19.warn("audit.failed", { homepageUrl, error: message });
+      log20.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
@@ -9787,7 +9986,7 @@ var SnapshotService = class {
           queries: parsedQueries
         };
       } catch (err) {
-        log19.warn("profile.generation-failed", {
+        log20.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -9929,7 +10128,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log19.warn("response.analysis-failed", {
+      log20.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -10211,7 +10410,7 @@ function clipText(value, length) {
 // src/server.ts
 var _require3 = createRequire3(import.meta.url);
 var { version: PKG_VERSION2 } = _require3("../package.json");
-var log20 = createLogger("Server");
+var log21 = createLogger("Server");
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
   maxRequestsPerMinute: 10,
@@ -10344,7 +10543,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGoogle > 0) {
     saveConfigPatch({ google: config.google });
-    log20.info("credentials.migrated", { type: "google", count: migratedGoogle });
+    log21.info("credentials.migrated", { type: "google", count: migratedGoogle });
   }
   let migratedGa4 = 0;
   for (const row of rows.ga4) {
@@ -10362,7 +10561,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGa4 > 0) {
     saveConfigPatch({ ga4: config.ga4 });
-    log20.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
+    log21.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
   }
 }
 function isLoopbackBindHost(host) {
@@ -10401,11 +10600,11 @@ async function createServer(opts) {
     applyLegacyCredentials(legacyRows, opts.config);
     dropLegacyCredentialColumns(opts.db);
   } catch (err) {
-    log20.warn("credentials.migration.failed", {
+    log21.warn("credentials.migration.failed", {
       error: err instanceof Error ? err.message : String(err)
     });
   }
-  log20.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
+  log21.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
     const p = providers[k];
     return p?.apiKey || p?.baseUrl || p?.vertexProject;
   }) });

package/dist/{chunk-3TH54726.js → chunk-VQN74WWA.js}

@@ -118,8 +118,34 @@ Do not write config.yaml by hand; use "canonry init", "canonry settings", or "ca
     } catch {
     }
   }
+  const parsedExternalMcp = parseExternalMcpEnv(process.env.CANONRY_EXTERNAL_MCP);
+  if (parsedExternalMcp) {
+    parsed.externalMcpServers = parsedExternalMcp;
+  }
   return parsed;
 }
+function parseExternalMcpEnv(raw) {
+  const trimmed = raw?.trim();
+  if (!trimmed) return void 0;
+  let value;
+  try {
+    value = JSON.parse(trimmed);
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(value)) return void 0;
+  const servers = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object") continue;
+    const candidate = entry;
+    const url = typeof candidate.url === "string" ? candidate.url.trim() : "";
+    const token = typeof candidate.token === "string" ? candidate.token : "";
+    if (!url || !token) continue;
+    const label = typeof candidate.label === "string" ? candidate.label : void 0;
+    servers.push({ url, token, ...label ? { label } : {} });
+  }
+  return servers.length > 0 ? servers : void 0;
+}
 function loadConfigRaw() {
   const configPath = getConfigPath();
   if (!fs.existsSync(configPath)) return null;

package/dist/cli.js

@@ -27,7 +27,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-7COFPNMH.js";
+} from "./chunk-CEHD33NQ.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -44,7 +44,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-3TH54726.js";
+} from "./chunk-VQN74WWA.js";
 import {
   apiKeys,
   createClient,

package/dist/index.d.ts

@@ -156,6 +156,21 @@ interface VercelTrafficConnectionConfigEntry {
 interface VercelTrafficConfigEntry {
     connections?: VercelTrafficConnectionConfigEntry[];
 }
+/**
+ * One injected remote MCP server Aero loads read-only tools from (OSS-A).
+ * Generic shape: `{ url, token, label? }`. The transport is bearer-gated MCP
+ * Streamable HTTP (the contract is frozen in `agent/remote-mcp.ts`). The
+ * server is remote, never co-located in the OSS container; per-tenant
+ * isolation is the token's responsibility, not the container boundary.
+ */
+interface ExternalMcpServerConfig {
+    /** Streamable HTTP endpoint of the remote MCP server. */
+    url: string;
+    /** Bearer token sent as `Authorization: Bearer <token>`. */
+    token: string;
+    /** Optional human label used in logs. Defaults to `url`. */
+    label?: string;
+}
 interface AgentConfigEntry {
     /**
      * Agent mode. `'disabled'` turns the built-in Aero agent OFF entirely — the
@@ -212,6 +227,7 @@ interface CanonryConfig {
     lastUpdateCheckAt?: string;
     lastKnownLatestVersion?: string;
     agent?: AgentConfigEntry;
+    externalMcpServers?: ExternalMcpServerConfig[];
     places?: PlacesConfigEntry;
     embed?: EmbedConfigEntry;
 }

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   createServer
-} from "./chunk-7COFPNMH.js";
+} from "./chunk-CEHD33NQ.js";
 import {
   loadConfig
-} from "./chunk-3TH54726.js";
+} from "./chunk-VQN74WWA.js";
 import "./chunk-DJVUNURL.js";
 import "./chunk-CWFTMFEU.js";
 export {

package/dist/mcp.js

@@ -3,7 +3,7 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-3TH54726.js";
+} from "./chunk-VQN74WWA.js";
 import {
   isReadOnlyKey
 } from "./chunk-CWFTMFEU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainyc/canonry",
-  "version": "4.98.0",
+  "version": "4.99.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -62,27 +62,27 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-api-client": "0.0.0",
-    "@ainyc/canonry-config": "0.0.0",
+    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
-    "@ainyc/canonry-integration-bing": "0.0.0",
+    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
     "@ainyc/canonry-integration-openai-ads": "0.0.0",
+    "@ainyc/canonry-integration-bing": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-google-business-profile": "0.0.0",
-    "@ainyc/canonry-integration-wordpress": "0.0.0",
+    "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
-    "@ainyc/canonry-provider-claude": "0.0.0",
-    "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
+    "@ainyc/canonry-provider-claude": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
+    "@ainyc/canonry-integration-wordpress": "0.0.0",
     "@ainyc/canonry-provider-local": "0.0.0",
-    "@ainyc/canonry-provider-perplexity": "0.0.0",
-    "@ainyc/canonry-provider-openai": "0.0.0"
+    "@ainyc/canonry-provider-openai": "0.0.0",
+    "@ainyc/canonry-provider-perplexity": "0.0.0"
   },
   "scripts": {
     "build": "tsx scripts/copy-agent-assets.ts && tsup && tsx build-web.ts",