@codeforbreakfast/commy-mcp 0.19.0 → 0.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codeforbreakfast/commy-mcp",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "commy MCP server — the inter-agent communication substrate, runnable on node via npx.",
   "license": "Apache-2.0",
   "type": "module",

package/server.js

@@ -3048,13 +3048,14 @@ var require_data = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/.bun/fast-uri@4.0.0/node_modules/fast-uri/lib/utils.js
+// node_modules/.bun/fast-uri@4.1.0/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
   var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
   var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -3198,7 +3199,7 @@ var require_utils = __commonJS((exports, module) => {
             continue;
           }
         } else if (input[0] === "/") {
-          if (input[1] === "." || input[1] === "/") {
+          if (input[1] === ".") {
             output.push("/");
             break;
           }
@@ -3340,6 +3341,47 @@ var require_utils = __commonJS((exports, module) => {
     }
     return output;
   }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
   function escapePreservingEscapes(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
@@ -3401,6 +3443,7 @@ var require_utils = __commonJS((exports, module) => {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    normalizeQueryFragmentEncoding,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -3410,7 +3453,7 @@ var require_utils = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/.bun/fast-uri@4.0.0/node_modules/fast-uri/lib/schemes.js
+// node_modules/.bun/fast-uri@4.1.0/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils();
   var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -3584,9 +3627,9 @@ var require_schemes = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/.bun/fast-uri@4.0.0/node_modules/fast-uri/index.js
+// node_modules/.bun/fast-uri@4.1.0/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   function normalize3(uri, options5) {
     if (typeof uri === "string") {
@@ -3755,7 +3798,7 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     const matches = uri.match(URI_PARSE);
     if (matches) {
-      parsed.scheme = matches[1];
+      parsed.scheme = matches[1] === undefined ? undefined : matches[1].toLowerCase();
       parsed.userinfo = matches[3];
       parsed.host = matches[4];
       parsed.port = parseInt(matches[5], 10);
@@ -3796,7 +3839,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (!options5.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
         if (parsed.host && (options5.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
           try {
-            parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+            parsed.host = new URL("http://" + parsed.host).hostname;
           } catch (e) {
             parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           }
@@ -3814,12 +3857,11 @@ var require_fast_uri = __commonJS((exports, module) => {
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
@@ -47954,6 +47996,7 @@ var sanitiseShortName = (name) => {
   const collapsed = name.toLowerCase().replace(SHORT_NAME_PATTERN, "-");
   return collapsed.replace(/^-+|-+$/g, "") || "bot";
 };
+var ACQUIRE_MINT_TIMEOUT = exports_Duration.seconds(30);
 var userSchema = exports_Schema.Struct({
   user_id: exports_Schema.Int,
   email: exports_Schema.String,
@@ -48226,7 +48269,7 @@ var zulipAdapter = (config2) => exports_Effect.gen(function* () {
         }
         return exports_Effect.die(new Error(`zulipAdapter: already bound to ${existing.acquiredName} — release() before acquiring ${name}`));
       },
-      onNone: () => provideMintedFor(name).pipe(exports_Effect.flatMap((minted) => exports_Effect.gen(function* () {
+      onNone: () => provideMintedFor(name).pipe(exports_Effect.timeout(ACQUIRE_MINT_TIMEOUT), exports_Effect.flatMap((minted) => exports_Effect.gen(function* () {
         const innerHttp = yield* makeZulipHttp(buildHttpConfig(config2.realmUrl, minted.email, minted.apiKey, config2.hostHeader)).pipe(exports_Effect.provideService(exports_HttpClient.HttpClient, httpClient));
         const http = wrapBotHttp(innerHttp, recipientDirectory, minted.userId);
         const ident = {
@@ -58849,7 +58892,7 @@ class Server extends Protocol {
 }
 
 // packages/mcp/mcp-server.ts
-var PLUGIN_VERSION = "0.19.0";
+var PLUGIN_VERSION = "0.19.1";
 var COMMY_INSTRUCTIONS = `**Substrate.** commy is the inter-agent channel: agents and humans coordinate here. If you run it alongside other agent-messaging tools, keep one substrate canonical and don't fan the same message across all of them.
 
 **Channels.** Each project has one channel: \`#<project-slug>\` where the slug is resolved per session as \`COMMY_PROJECT\` env > git remote \`origin\` basename > git root basename. Sessions launched outside a git repo (e.g. \`/tmp\`, \`$HOME\`) have no project channel and should post to \`#general\` instead. Don't invent a channel name from a metaphor — never post to a literal \`#home\`, \`#project\`, or \`#<project>\`. Use \`list_channels\` to enumerate what actually exists in the realm; posting to a non-existent channel throws \`UnknownChannel\` rather than silently routing to Notification Bot.