@akasha-book/mcp 1.1.3 → 1.1.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ersith
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/cordis.patch.yml

@@ -1,10 +1,13 @@
+# ⚠ 安装前必改：把 <AKASHA_DIR> / <LOCAL_PATH> 换成你的实际路径（Windows 路径建议用单引号包住）。
+#   五个插件都会检测未替换的占位符并**直接报错**（fail closed）——不再静默降级。
+#   也可以删掉这些路径字段，改用 AKASHA_DIR 环境变量（插件默认从它推导）。
 - insert:
     - id: mcp-akasha
-      name: '@local/mcp-akasha'
+      name: '@akasha-book/mcp'
       config:
         serverName: akasha
         transport: stdio
-        command: 'F:\h\all\Nodejs\node.exe'
-        args: ['H:\Harness\akasha\mcp.mjs']
+        command: 'node'
+        args: ['<AKASHA_DIR>/mcp.mjs']
         toolCallTimeoutMs: 600000
         failOnStartupError: false

package/index.js

@@ -35,6 +35,40 @@ const DEFAULTS = {
   failOnStartupError: false,
 };
 
+// ── 占位符守卫（2026-10-19 发布面 P0）──────────────────────────────
+// OSS 的 `cordis.patch.yml` 里 `args: ['<AKASHA_DIR>/mcp.mjs']` 是示例字面量。照抄不改时：
+// spawn 找不到文件 → 配合 `failOnStartupError:false` **静默降级为 0 工具**（22 个 mcp__akasha__* 全消失）。
+// 这里明确抛错（fail closed）：让配置错误在启动时说话，不静默降级。
+const PLACEHOLDER_TOKEN = /<[A-Za-z][A-Za-z0-9_]{2,}>/;   // 大小写都认（2026-10-19 审计 B：小写/混合形态此前漏检）
+/** 递归找配置里的未替换占位符（只认全大写尖括号 token，不误伤普通文本）。 */
+export function findPlaceholders(value, path = 'config', depth = 0) {
+  if (depth > 8) return [];
+  if (typeof value === 'string') {
+    const m = value.match(PLACEHOLDER_TOKEN);
+    return m ? [{ field: path, token: m[0] }] : [];
+  }
+  if (Array.isArray(value)) return value.flatMap((v, i) => findPlaceholders(v, `${path}[${i}]`, depth + 1));
+  if (!value || typeof value !== 'object') return [];
+  return Object.entries(value).flatMap(([k, v]) => findPlaceholders(v, `${path}.${k}`, depth + 1));
+}
+export function assertNoPlaceholders(config) {
+  const hits = findPlaceholders(config);
+  // 2026-10-19（审计 B）：环境变量路线此前完全没设防——AKASHA_DIR='<AKASHA_DIR>' 时插件事先不知道。
+  const envVal = process.env.AKASHA_DIR;
+  if (typeof envVal === 'string' && envVal.trim() !== '') {
+    const m = envVal.match(PLACEHOLDER_TOKEN);
+    if (m) hits.push({ field: 'AKASHA_DIR(环境变量)', token: m[0] });
+  }
+  if (!hits.length) return;
+  const fields = [...new Set(hits.map((h) => h.field))].join('、');
+  throw new Error(
+    `mcp-akasha: 配置里还有未替换的占位符 ${hits[0].token}（${fields}）。` +
+    '请先把 cordis.patch.yml 里的 <AKASHA_DIR> / <LOCAL_PATH> 改成你的实际路径；' +
+    '或删掉这些字段，改用 AKASHA_DIR 环境变量。' +
+    '（宁可启动失败，也不静默降级——照抄占位符会让 MCP 拉不到 mcp.mjs，22 个工具静默消失。）'
+  );
+}
+
 /** 与官方同名函数的规则一致：必要时加哈希后缀，保证公开名稳定且合法。 */
 export function publicToolName(serverName, rawName) {
   const joined = `mcp__${serverName}__${rawName}`;
@@ -88,6 +122,8 @@ export class StdioMcpClient {
         this.closed = true;
         this.#fail(new Error(`MCP server exited (code=${code} signal=${signal ?? 'none'})`));
       });
+      this.child.stdout.setEncoding('utf8');   // F12（2026-10-14 外部审查）：保持跨块 UTF-8 解码状态——否则多字节字符恰好分块时静默乱码（'���忆原文'）
+      this.child.stderr.setEncoding('utf8');
       this.child.stdout.on('data', (chunk) => this.#onData(chunk));
       this.child.stderr.on('data', (chunk) => this.log('stderr: ' + String(chunk).trim().slice(0, 500)));
       // 关键：子进程死后写 stdin 会以**异步 'error' 事件**抛 EPIPE（try/catch 抓不到同步的），
@@ -194,16 +230,20 @@ export function createToolDefinition(client, { serverName, tool, toolCallTimeout
       const argsObject = args && typeof args === 'object' ? args : {};
       if (exec?.signal?.aborted) throw new Error(`tool ${rawName} 已取消`);
       const call = client.callTool(rawName, argsObject, toolCallTimeoutMs);
-      // 尊重调用方取消信号（与官方桥同语义：取消即拒绝，不等超时）
+      // 尊重调用方取消信号（与官方桥同语义：取消即拒绝，不等超时）。
+      // F07（2026-10-14 外部审查 · GPT）：原实现用 `call.finally(...)` 清理监听器——它会**派生出第二个 promise**；
+      //   `call` 拒绝时该派生 promise 无人消费 ⇒ 未处理拒绝，隔离 Node 在外层已 catch 的情况下仍 exit 1。
+      //   修法：成功/失败两个分支**都接在 `call` 本身**（单消费者），不再产生派生 promise。
       const result = exec?.signal
-        ? await Promise.race([
-            call,
-            new Promise((_resolve, reject) => {
-              const onAbort = () => reject(new Error(`tool ${rawName} 已取消`));
-              exec.signal.addEventListener('abort', onAbort, { once: true });
-              call.finally(() => exec.signal.removeEventListener('abort', onAbort));
-            }),
-          ])
+        ? await new Promise((resolve, reject) => {
+            const onAbort = () => reject(new Error(`tool ${rawName} 已取消`));
+            if (exec.signal.aborted) { reject(new Error(`tool ${rawName} 已取消`)); return; }
+            exec.signal.addEventListener('abort', onAbort, { once: true });
+            call.then(
+              (v) => { exec.signal.removeEventListener('abort', onAbort); resolve(v); },
+              (e) => { exec.signal.removeEventListener('abort', onAbort); reject(e); },
+            );
+          })
         : await call;
       const text = renderText(result?.content);
       if (result?.isError === true) throw new Error(text || `tool ${rawName} failed`);
@@ -221,6 +261,7 @@ export async function apply(ctx, config = {}) {
     try { (ctx.logger?.info ?? (() => {}))('mcp: abOff=true（A/B 关闭臂）——本插件不注册任何面'); } catch { /* 静默 */ }
     return;
   }
+  assertNoPlaceholders(config);
   const cfg = { ...DEFAULTS, ...(config ?? {}) };
   const log = (message) => { try { ctx.logger?.info?.(`mcp-akasha(${cfg.serverName}): ${message}`); } catch { /* 日志失败不影响主流程 */ } };
   const logError = (message) => { try { ctx.logger?.error?.(`mcp-akasha(${cfg.serverName}): ${message}`); } catch { /* 同上 */ } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasha-book/mcp",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "engines": {
     "node": ">=22.15.0"
   },
@@ -28,10 +28,13 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Ersith/akasha-book.git",
-    "directory": "dsh-mcp-akasha"
+    "directory": "plugins/mcp-akasha"
   },
   "scripts": {
     "test": "node selftest.test.mjs",
-    "check": "node --check lib/index.js"
+    "check": "node --check index.js"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }