@chibitek/chibi 0.1.154 → 0.1.155

package/dist-server/server/mcp-public-registry.js

@@ -0,0 +1,325 @@
+// The Plugins window's MCP Marketplace, backed by the official MCP Registry
+// (https://registry.modelcontextprotocol.io, public, no key). This module
+// fetches and normalizes registry pages and turns one entry, or a featured
+// service from shared/mcp-featured.ts, into a config.json `mcpServers` entry.
+// Adding goes through the same rules as every other MCP server: the entry is
+// saved switched off, secrets are kept in its env or headers like any other
+// server's, and nothing here logs a value.
+import { featuredMcpIcon, featuredMcpServer, MCP_FEATURED } from "../shared/mcp-featured.js";
+import { slugMcpName } from "./mcp-registry.js";
+export const MCP_REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
+/** The OAuth bridge Atomic already runs remote servers through (see
+ * electron/chibitek-defaults.mjs MCP_REMOTE_PACKAGE; a test keeps them equal).
+ * Pinned so its saved sign-ins survive a new mcp-remote release. */
+export const MCP_REMOTE_PACKAGE = "mcp-remote@0.14.3";
+const CACHE_MS = 60 * 60 * 1000;
+const CACHE_MAX = 200;
+const TIMEOUT_MS = 8_000;
+const PAGE_SIZE = 30;
+const OFFICIAL = "io.modelcontextprotocol.registry/official";
+export const REGISTRY_OFFLINE_MESSAGE = "The MCP Registry could not be reached. Check your internet connection and try again.";
+export class RegistryUnavailableError extends Error {
+    constructor() {
+        super(REGISTRY_OFFLINE_MESSAGE);
+        this.name = "RegistryUnavailableError";
+    }
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function httpsUrl(value) {
+    const raw = text(value);
+    if (!raw)
+        return undefined;
+    try {
+        const url = new URL(raw);
+        return url.protocol === "https:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const featuredByRegistryName = new Map(MCP_FEATURED.filter((server) => server.registryName).map((server) => [server.registryName, server]));
+/** "io.github.acme/thing" -> "acme", "com.notion/mcp" -> "notion.com". */
+export function publisherFor(name) {
+    const namespace = name.split("/")[0] ?? name;
+    if (namespace.startsWith("io.github."))
+        return namespace.slice("io.github.".length);
+    return namespace.split(".").reverse().join(".");
+}
+/** "notion-mcp-server" -> "Notion Mcp Server" when the entry has no title. */
+function titleFor(name) {
+    const leaf = name.split("/").pop() ?? name;
+    return leaf.split(/[-_.]+/).filter(Boolean).map((word) => word[0].toUpperCase() + word.slice(1)).join(" ") || name;
+}
+function githubOwner(repositoryUrl) {
+    if (!repositoryUrl)
+        return undefined;
+    const match = /^https:\/\/github\.com\/([A-Za-z0-9-]{1,39})(?:\/|$)/.exec(repositoryUrl);
+    return match?.[1];
+}
+function input(kind, raw) {
+    const item = record(raw);
+    const name = text(item.name);
+    if (!name)
+        return null;
+    const description = text(item.description);
+    return {
+        kind,
+        name,
+        ...(description ? { description: description.slice(0, 300) } : {}),
+        required: item.isRequired === true,
+        secret: item.isSecret === true,
+        ...(kind === "header" && text(item.value) ? { template: text(item.value) } : {}),
+    };
+}
+function remotes(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((entry) => {
+        const item = record(entry);
+        const url = httpsUrl(item.url);
+        // A URL with {placeholders} needs per-person values Atomic cannot guess.
+        if (!url || /[{}]|%7B|%7D/i.test(url))
+            return [];
+        const type = item.type === "sse" ? "sse" : item.type === "streamable-http" ? "http" : null;
+        if (!type)
+            return [];
+        const headers = Array.isArray(item.headers) ? item.headers.map((header) => input("header", header)).filter((header) => header !== null) : [];
+        return [{ type, url, headers }];
+    });
+}
+function packages(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((entry) => {
+        const item = record(entry);
+        const registryType = text(item.registryType);
+        const identifier = text(item.identifier);
+        if (!registryType || !identifier)
+            return [];
+        const env = Array.isArray(item.environmentVariables)
+            ? item.environmentVariables.map((variable) => input("env", variable)).filter((variable) => variable !== null)
+            : [];
+        return [{
+                registryType,
+                identifier,
+                ...(text(item.version) ? { version: text(item.version) } : {}),
+                ...(text(record(item.transport).type) ? { transport: text(record(item.transport).type) } : {}),
+                ...(text(item.runtimeHint) ? { runtimeHint: text(item.runtimeHint) } : {}),
+                env,
+            }];
+    });
+}
+const SAFE_PACKAGE = /^(@[a-z0-9][\w.-]*\/)?[A-Za-z0-9][\w.-]*$/;
+const SAFE_VERSION = /^[\w.+-]{1,64}$/;
+/** Remote first (nothing to install), then npm, then PyPI. A remote whose
+ * headers are all optional is assumed to sign in with OAuth, so it runs
+ * through the mcp-remote bridge; one that requires a header (an API key) is
+ * kept as a plain URL entry with that header. */
+function installPlan(server) {
+    const remote = server.remotes.find((item) => item.type === "http") ?? server.remotes.find((item) => item.type === "sse");
+    if (remote)
+        return { kind: "remote", remote, oauth: !remote.headers.some((header) => header.required) };
+    const stdio = (item) => !item.transport || item.transport === "stdio";
+    const npm = server.packages.find((item) => item.registryType === "npm" && stdio(item) && SAFE_PACKAGE.test(item.identifier));
+    if (npm)
+        return { kind: "npm", pkg: npm };
+    const pypi = server.packages.find((item) => item.registryType === "pypi" && stdio(item) && SAFE_PACKAGE.test(item.identifier));
+    if (pypi)
+        return { kind: "pypi", pkg: pypi };
+    return null;
+}
+function planInputs(plan) {
+    if (!plan)
+        return [];
+    const list = plan.kind === "remote"
+        ? plan.oauth ? [] : plan.remote.headers.map(({ template: _template, ...header }) => header)
+        : plan.pkg.env;
+    return [...list].sort((a, b) => Number(b.required) - Number(a.required));
+}
+/** One registry list entry to the shape the renderer shows, or null when it
+ * is not the latest version or not usable at all. */
+export function normalizeRegistryEntry(raw) {
+    const entry = record(raw);
+    const server = record(entry.server);
+    const meta = record(record(entry._meta)[OFFICIAL]);
+    if (meta.isLatest === false)
+        return null;
+    if (typeof meta.status === "string" && meta.status !== "active")
+        return null;
+    const name = text(server.name);
+    if (!name)
+        return null;
+    const repositoryUrl = httpsUrl(record(server.repository).url);
+    const websiteUrl = httpsUrl(server.websiteUrl);
+    const featured = featuredByRegistryName.get(name);
+    const icons = Array.isArray(server.icons) ? server.icons : [];
+    const registryIcon = icons.map((icon) => httpsUrl(record(icon).src)).find(Boolean);
+    const owner = githubOwner(repositoryUrl);
+    const iconUrl = featured
+        ? featuredMcpIcon(featured.id)
+        : registryIcon ?? (owner ? `https://github.com/${owner}.png?size=64` : undefined);
+    const normalized = {
+        id: name,
+        name,
+        title: text(server.title) ?? featured?.name ?? titleFor(name),
+        description: (text(server.description) ?? "").slice(0, 400),
+        publisher: publisherFor(name),
+        version: text(server.version) ?? "",
+        ...(repositoryUrl ? { repositoryUrl } : {}),
+        ...(websiteUrl ? { websiteUrl } : {}),
+        remotes: remotes(server.remotes),
+        packages: packages(server.packages),
+        ...(iconUrl ? { iconUrl } : {}),
+        ...(featured ? { featured: featured.id } : {}),
+    };
+    const plan = installPlan(normalized);
+    return { ...normalized, install: plan?.kind ?? null, inputs: planInputs(plan) };
+}
+/** Normalize a page: latest versions only, one card per server name. */
+export function normalizeRegistryPage(body) {
+    const page = record(body);
+    const seen = new Set();
+    const servers = [];
+    for (const raw of Array.isArray(page.servers) ? page.servers : []) {
+        const server = normalizeRegistryEntry(raw);
+        if (!server || seen.has(server.id))
+            continue;
+        seen.add(server.id);
+        servers.push(server);
+    }
+    const nextCursor = text(record(page.metadata).nextCursor);
+    return { servers, ...(nextCursor ? { nextCursor } : {}) };
+}
+/** A registry client with a one-hour in-memory cache. Every failure (offline,
+ * timeout, a registry error) becomes RegistryUnavailableError. */
+export function createMcpPublicRegistry(options = {}) {
+    const doFetch = options.fetch ?? fetch;
+    const base = options.base ?? MCP_REGISTRY_BASE;
+    const now = options.now ?? Date.now;
+    const cache = new Map();
+    async function getJson(url) {
+        const hit = cache.get(url);
+        if (hit && now() - hit.at < CACHE_MS)
+            return hit.value;
+        let response;
+        try {
+            response = await doFetch(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(TIMEOUT_MS) });
+        }
+        catch {
+            throw new RegistryUnavailableError();
+        }
+        if (response.status === 404)
+            return null;
+        if (!response.ok)
+            throw new RegistryUnavailableError();
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new RegistryUnavailableError();
+        }
+        if (cache.size >= CACHE_MAX)
+            cache.delete(cache.keys().next().value);
+        cache.set(url, { at: now(), value });
+        return value;
+    }
+    return {
+        async search({ search, cursor }) {
+            const params = new URLSearchParams({ limit: String(PAGE_SIZE), version: "latest" });
+            const query = search?.trim().slice(0, 100);
+            if (query)
+                params.set("search", query);
+            if (cursor)
+                params.set("cursor", cursor.slice(0, 300));
+            return normalizeRegistryPage(await getJson(`${base}/v0/servers?${params}`));
+        },
+        async get(id) {
+            const body = await getJson(`${base}/v0/servers/${encodeURIComponent(id)}/versions/latest`);
+            return body === null ? null : normalizeRegistryEntry(body);
+        },
+    };
+}
+/** A free config name from the server's own name: "notion", then "notion-2". */
+export function freeMcpName(preferred, taken) {
+    const base = slugMcpName(preferred) || "mcp-server";
+    if (!taken(base))
+        return base;
+    for (let n = 2; n < 100; n += 1) {
+        const candidate = `${base.slice(0, 32 - String(n).length - 1)}-${n}`;
+        if (!taken(candidate))
+            return candidate;
+    }
+    return `${base.slice(0, 23)}-${Date.now().toString(36).slice(-8)}`;
+}
+function bridgeEntry(url) {
+    return { command: "npx", args: ["-y", MCP_REMOTE_PACKAGE, url], env: {} };
+}
+function cleanValues(values) {
+    const out = {};
+    for (const [key, value] of Object.entries(record(values))) {
+        if (typeof value === "string" && value.trim())
+            out[key] = value.trim();
+    }
+    return out;
+}
+/** The config entry a featured service becomes: its official URL through the
+ * OAuth bridge. */
+export function planFeaturedAdd(featured, taken) {
+    return { ok: true, name: freeMcpName(featured.id, taken), entry: bridgeEntry(featured.url), kind: "remote", oauth: true };
+}
+/** The config entry a registry server becomes, with the person's values for
+ * its inputs. Required inputs that are missing are refused with the list, so
+ * the renderer can ask for them. */
+export function planRegistryAdd(server, rawValues, taken) {
+    const values = cleanValues(rawValues);
+    const plan = installPlan(server);
+    if (!plan) {
+        const docker = server.packages.some((item) => item.registryType === "oci" || item.registryType === "docker");
+        return {
+            ok: false,
+            status: 400,
+            code: "unsupported",
+            error: docker
+                ? `${server.title} only ships as a Docker image, which Atomic can't add for you yet. Add it by hand under MCP servers.`
+                : `${server.title} doesn't offer a remote address or an npm or PyPI package, so Atomic can't add it for you. Add it by hand under MCP servers.`,
+        };
+    }
+    const inputs = planInputs(plan);
+    const missing = inputs.filter((item) => item.required && !values[item.name]);
+    if (missing.length) {
+        return { ok: false, status: 400, code: "needs_input", inputs, error: `${server.title} needs ${missing.map((item) => item.name).join(", ")} before it can be added.` };
+    }
+    const name = freeMcpName(server.featured ?? server.name.split("/").pop() ?? server.title, taken);
+    if (plan.kind === "remote") {
+        if (plan.oauth)
+            return { ok: true, name, entry: bridgeEntry(plan.remote.url), kind: "remote", oauth: true };
+        const headers = {};
+        for (const header of plan.remote.headers) {
+            const value = values[header.name];
+            if (!value)
+                continue;
+            // "Bearer {api_key}" -> "Bearer <value>" unless the value already is the whole header.
+            headers[header.name] = header.template && /\{[^}]+\}/.test(header.template) && !/\s/.test(value)
+                ? header.template.replace(/\{[^}]+\}/, value)
+                : value;
+        }
+        return { ok: true, name, entry: { type: plan.remote.type, url: plan.remote.url, headers }, kind: "remote", oauth: false };
+    }
+    const env = {};
+    for (const variable of plan.pkg.env) {
+        if (values[variable.name])
+            env[variable.name] = values[variable.name];
+    }
+    const version = plan.pkg.version && SAFE_VERSION.test(plan.pkg.version) ? plan.pkg.version : undefined;
+    if (plan.kind === "npm") {
+        return { ok: true, name, entry: { command: "npx", args: ["-y", version ? `${plan.pkg.identifier}@${version}` : plan.pkg.identifier], env }, kind: "npm", oauth: false };
+    }
+    return { ok: true, name, entry: { command: "uvx", args: [plan.pkg.identifier], env }, kind: "pypi", oauth: false };
+}
+export { featuredMcpServer };

package/dist-server/server/mcp-turn.js

@@ -0,0 +1,26 @@
+import { drainMcpAuthSignals } from "./mcp-auth-signal.js";
+export function mcpTurnPolicy(deps) {
+    return {
+        /** Fold in what gates and the chat runtime reported since the last look. */
+        sync() {
+            const signals = drainMcpAuthSignals(deps.signalDir());
+            if (!signals.length)
+                return;
+            const specs = deps.specs();
+            deps.auth.ingest(signals, specs);
+            for (const signal of deps.health.ingest(signals, specs)) {
+                if (signal.threadId)
+                    deps.reportUnavailable(signal.threadId, `the "${signal.name}" MCP server ${signal.kind === "crashed" ? "stopped during the turn" : "would not start"}; the turn ran on without its tools`);
+            }
+        },
+        /** The servers one turn starts: `servers` minus any whose sign-in is
+         * backing off or stopped, or that lately would not start or crashed. */
+        mountable(servers) {
+            return Object.fromEntries(Object.entries(servers).filter(([name, spec]) => deps.auth.mountable(name, spec) && deps.health.mountable(name, spec)));
+        },
+        /** The ones left out for being broken, so the model is told in one line. */
+        unavailable(servers) {
+            return Object.entries(servers).flatMap(([name, spec]) => { const kind = deps.health.unavailableKind(name, spec); return kind ? [{ name, kind }] : []; });
+        },
+    };
+}

package/dist-server/server/system-prompt.js

@@ -99,12 +99,20 @@ export function accountsPrompt(emails) {
     return ` You can use the user's ${emails.length === 1 ? "account" : "accounts"} ${list} through atomic_accounts (mail, calendar and files). Use list_accounts to check granted permissions. Do not use LLM account connectors for Google or Microsoft services. Pass the email as \`account\` when more than one account of that provider is listed. Save messages as drafts and send only when the user asked you to send.`;
 }
 /** Names the user-added MCP servers a turn actually mounted, so the bot
- * reaches for them instead of saying it has no such tool. Empty when none. */
-export function customMcpPrompt(names) {
-    if (names.length === 0)
-        return "";
-    const list = names.map((name) => `"${name}"`).join(", ");
-    return ` The user also added ${names.length === 1 ? "an MCP server" : "MCP servers"} for you: ${list}. Use their available tools under the engine's normal approval rules.`;
+ * reaches for them instead of saying it has no such tool, and the ones left
+ * out because they are broken, in one plain line each with no error text,
+ * so the bot carries on instead of hunting for a tool that is not there.
+ * Empty when there are neither. */
+export function customMcpPrompt(names, unavailable = []) {
+    const parts = [];
+    if (names.length > 0) {
+        const list = names.map((name) => `"${name}"`).join(", ");
+        parts.push(` The user also added ${names.length === 1 ? "an MCP server" : "MCP servers"} for you: ${list}. Use their available tools under the engine's normal approval rules.`);
+    }
+    for (const server of unavailable) {
+        parts.push(` The "${server.name}" tool server ${server.kind === "crashed" ? "stopped working during a recent turn" : "would not start"}, so its tools are left out of this turn; Atomic tries it again later. Carry on without them.`);
+    }
+    return parts.join("");
 }
 export const CREDENTIAL_PROMPT = " If a supported API key is missing for the service actually needed, use request_credential to create a secure credential request. Before requesting a computer-provider key, inspect the configured targets with select_computer; an existing self-hosted VPS does not need Box credentials. Do not request a different provider's key merely because a task mentions cloud. A freshly QR-paired mobile app or the desktop app can show the secure entry card. Never claim it opened unless the request succeeded, and never ask the user to paste credentials into chat.";
 export const THREADS_PROMPT = " A thread is one conversation with its own history and its own run; a bot can have several running at once, and the person sees them as rows under that bot. Use start_thread to open one on yourself for separate work, or on a teammate to hand them a job that should run on its own. Use list_threads to see how the ones you opened are going. When you mention a thread to the person, write its title as #Title so it links. Do not use a ticket comment, a note, or a room post as a stand-in for a thread.";

package/dist-server/shared/connector-availability.js

@@ -0,0 +1,12 @@
+const MANAGED_CUSTOM_AUTH_TOOLKITS = new Set(["twitter", "x"]);
+/**
+ * Some Composio toolkits no longer include provider-managed credentials.
+ * The official OpenMausBot broker cannot offer those connections until its
+ * project owns the corresponding OAuth app. Self-hosted Composio projects can
+ * still supply their own auth config, so keep this restriction mode-specific.
+ */
+export function managedConnectorUnavailableReason(mode, slug) {
+    if (mode !== "managed" || !MANAGED_CUSTOM_AUTH_TOOLKITS.has(slug.trim().toLowerCase()))
+        return null;
+    return "Twitter/X needs your own X Developer app and Composio auth config. Use self-hosted connected apps for now.";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.154",
+  "version": "0.1.155",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-Bm-MISs3.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-k18eNV07.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/assets/swimlanesDiagram-TC7HE7FX-CPlL77A3.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-KWPJA3E3-CT-fOp9_.js";import{_ as a}from"./mermaid.core-k18eNV07.js";import"./chunk-5VM5RSS4-DuZpQtDE.js";import"./chunk-XXDRQBXY-BsKuu9tP.js";import"./chunk-WEXAMYUT-BeraxyW-.js";import"./chunk-GWA4HPMP-Xrus5lAx.js";import"./channel-Bm-MISs3.js";import"./index-BpHS2C5J.js";var o=a(t=>`${e(t)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),s=o,u=r({styles:s});export{u as diagram};