@dypai-ai/mcp 1.5.24 → 1.5.26

package/src/tools/project-context.js

@@ -1,26 +1,29 @@
 /**
  * Auto-inject project_id into tool calls that accept it.
  *
- * The agent shouldn't have to pass project_id manually on every call —
- * the local MCP already knows it from dypai/dypai.config.yaml. This keeps
- * the remote MCP's metrics and permission layer happy without polluting
- * the agent-facing API.
+ * Resolution order:
+ *   1. DYPAI_PROJECT_ID env (Studio / cursor-worker bound project)
+ *   2. dypai/dypai.config.yaml in the workspace
  *
- * Strategy:
- *   1. Detect the dypai/ folder near the workspace (env vars + walk up).
- *   2. Parse dypai.config.yaml once, cache the resolved project_id in memory.
- *   3. For remote tool calls: if the tool's inputSchema declares project_id
- *      and the caller didn't pass one, inject the cached value.
+ * Studio profiles hide project_id from tool schemas — the bound id is injected
+ * server-side so the agent never passes it.
  */
 
 import { readFileSync, existsSync } from "fs"
 import { join, isAbsolute, dirname, delimiter } from "path"
 import { homedir } from "os"
 import YAML from "yaml"
+import { isStudioProfile } from "../toolProfiles.js"
 
 let _cached = null  // { projectId, configPath } | null
 let _resolved = false
 
+export function getEnvBoundProjectId(env = process.env) {
+  const raw = env.DYPAI_PROJECT_ID
+  if (typeof raw === "string" && raw.trim()) return raw.trim()
+  return null
+}
+
 function findDypaiFolder() {
   const envCandidates = [
     process.env.CLAUDE_PROJECT_DIR,
@@ -48,7 +51,7 @@ function findDypaiFolder() {
   return null
 }
 
-function resolveProjectId() {
+function resolveProjectIdFromConfig() {
   if (_resolved) return _cached
   _resolved = true
   try {
@@ -71,6 +74,56 @@ export function invalidateProjectContext() {
   _cached = null
 }
 
+/**
+ * Resolved project id for tool calls.
+ * @returns {{ projectId: string, source: "env" | "config", configPath?: string } | null}
+ */
+export function resolveBoundProjectId() {
+  const envId = getEnvBoundProjectId()
+  if (envId) return { projectId: envId, source: "env" }
+
+  const configCtx = resolveProjectIdFromConfig()
+  if (configCtx) {
+    return { projectId: configCtx.projectId, source: "config", configPath: configCtx.configPath }
+  }
+  return null
+}
+
+export function omitProjectIdFromInputSchema(inputSchema) {
+  if (!inputSchema?.properties?.project_id) return inputSchema
+
+  const { project_id: _removed, ...properties } = inputSchema.properties
+  const required = Array.isArray(inputSchema.required)
+    ? inputSchema.required.filter((key) => key !== "project_id")
+    : inputSchema.required
+
+  const next = { ...inputSchema, properties }
+  if (required !== undefined) next.required = required
+  return next
+}
+
+export function presentToolInputSchema(tool, profile) {
+  if (!isStudioProfile(profile)) return tool.inputSchema
+  return omitProjectIdFromInputSchema(tool.inputSchema)
+}
+
+/**
+ * Studio runs bind one project — reject explicit overrides from the agent.
+ * @returns {string | null} error message
+ */
+export function assertBoundProjectIdMatches(profile, args) {
+  if (!isStudioProfile(profile)) return null
+  const bound = resolveBoundProjectId()
+  if (!bound?.projectId || !args?.project_id) return null
+  if (args.project_id !== bound.projectId) {
+    return (
+      `project_id is bound to ${bound.projectId} in Studio (DYPAI_PROJECT_ID). ` +
+      "Do not pass project_id — the MCP server injects it automatically."
+    )
+  }
+  return null
+}
+
 /**
  * Inject project_id into args if the tool's schema declares it and the caller
  * didn't provide one. No-op otherwise. Never overwrites an explicit value.
@@ -78,7 +131,7 @@ export function invalidateProjectContext() {
 export function withProjectContext(toolDef, args) {
   if (!toolDef?.inputSchema?.properties?.project_id) return args
   if (args?.project_id) return args
-  const ctx = resolveProjectId()
-  if (!ctx) return args
-  return { ...args, project_id: ctx.projectId }
+  const bound = resolveBoundProjectId()
+  if (!bound) return args
+  return { ...args, project_id: bound.projectId }
 }

package/src/tools/proxy.js

@@ -13,8 +13,40 @@ import http from "http"
 
 const MCP_BASE = process.env.DYPAI_MCP_URL || "https://mcp.dypai.dev"
 const MCP_ENDPOINT = `${MCP_BASE}/mcp`
+// Slightly above MCP cloud POST timeout so the server 504s before we abort.
+const MCP_PROXY_TIMEOUT_MS = Math.max(
+  30_000,
+  Number(process.env.DYPAI_MCP_PROXY_TIMEOUT_MS || 620_000),
+)
 
 let sessionId = null
+let initPromise = null
+
+function requestLabel(body) {
+  const method = body?.method || "mcp"
+  const tool = body?.params?.name
+  return tool ? `${method}:${tool}` : method
+}
+
+function wrapTransportError(error, label) {
+  const message = error?.message || String(error)
+  const wrapped = new Error(`MCP ${label} transport error: ${message}`)
+  if (error?.code) wrapped.code = error.code
+  return wrapped
+}
+
+function isRecoverableTransportError(error) {
+  const message = error?.message || ""
+  return /ECONNRESET|ECONNREFUSED|EPIPE|socket hang up|fetch failed|invalid session|session not found|MCP remote error 404/i.test(message)
+}
+
+function resetMcpSession(reason) {
+  if (sessionId || initPromise) {
+    process.stderr.write(`[dypai-mcp-proxy] resetting MCP session: ${reason}\n`)
+  }
+  sessionId = null
+  initPromise = null
+}
 
 function extractLastSseData(text) {
   const events = text.split(/\r?\n\r?\n/).filter(Boolean)
@@ -82,6 +114,7 @@ function normalizeJsonRpcResponse(response) {
 
 function mcpRequest(body) {
   const token = process.env.DYPAI_TOKEN || ""
+  const label = requestLabel(body)
 
   return new Promise((resolve, reject) => {
     const parsed = new URL(MCP_ENDPOINT)
@@ -94,6 +127,10 @@ function mcpRequest(body) {
       Authorization: `Bearer ${token}`,
       Accept: "application/json, text/event-stream",
     }
+    const docsChannel = process.env.DOCS_CHANNEL?.trim()
+    const docSet = process.env.DOC_SET?.trim()
+    if (docsChannel) headers["X-DYPAI-Docs-Channel"] = docsChannel
+    if (docSet) headers["X-DYPAI-Doc-Set"] = docSet
     if (sessionId) {
       headers["Mcp-Session-Id"] = sessionId
     }
@@ -111,6 +148,12 @@ function mcpRequest(body) {
 
       let buf = ""
       res.on("data", (c) => (buf += c))
+      res.on("aborted", () => {
+        reject(new Error(`MCP ${label} response aborted after ${buf.length} bytes`))
+      })
+      res.on("error", (error) => {
+        reject(wrapTransportError(error, label))
+      })
       res.on("end", () => {
         if (res.statusCode >= 200 && res.statusCode < 300) {
           // Handle SSE responses (text/event-stream)
@@ -121,21 +164,19 @@ function mcpRequest(body) {
             try { resolve(JSON.parse(buf)) } catch { resolve({ result: buf }) }
           }
         } else {
-          reject(new Error(`MCP remote error ${res.statusCode}: ${buf.slice(0, 300)}`))
+          reject(new Error(`MCP remote error ${res.statusCode} during ${label}: ${buf.slice(0, 300)}`))
         }
       })
     })
-    req.on("error", reject)
+    req.on("error", (error) => reject(wrapTransportError(error, label)))
+    req.setTimeout(MCP_PROXY_TIMEOUT_MS, () => {
+      req.destroy(new Error(`MCP proxy timeout after ${MCP_PROXY_TIMEOUT_MS}ms during ${label} (${MCP_ENDPOINT})`))
+    })
     req.write(data)
     req.end()
   })
 }
 
-// Single in-flight init promise so concurrent first-calls (e.g. push with
-// concurrency=5) don't all race to initialize and clobber each other's
-// session id mid-handshake.
-let initPromise = null
-
 async function ensureInitialized() {
   if (sessionId) return
   if (initPromise) return initPromise
@@ -169,51 +210,63 @@ async function ensureInitialized() {
 }
 
 export async function proxyToolCall(toolName, args) {
-  await ensureInitialized()
-
-  const response = normalizeJsonRpcResponse(await mcpRequest({
-    jsonrpc: "2.0",
-    id: `proxy-${Date.now()}`,
-    method: "tools/call",
-    params: {
-      name: toolName,
-      arguments: args || {},
-    },
-  }))
-
-  // Extract result from JSON-RPC response
-  if (response.result) {
-    const { content, isError } = response.result
-    const text = Array.isArray(content) && content[0]?.text ? content[0].text : null
-
-    if (isError) {
-      throw new Error(text || "Remote tool call failed with isError=true")
-    }
+  async function callOnce() {
+    await ensureInitialized()
+
+    const response = normalizeJsonRpcResponse(await mcpRequest({
+      jsonrpc: "2.0",
+      id: `proxy-${Date.now()}`,
+      method: "tools/call",
+      params: {
+        name: toolName,
+        arguments: args || {},
+      },
+    }))
 
-    if (text != null) {
-      let parsed
-      parsed = decodeTransportValue(text)
-      // Some remote errors come as a plain string without isError flag
-      if (typeof parsed === "string" && /^(Error:|Input validation error:|You don't have)/i.test(parsed)) {
-        throw new Error(parsed)
+    // Extract result from JSON-RPC response
+    if (response.result) {
+      const { content, isError } = response.result
+      const text = Array.isArray(content) && content[0]?.text ? content[0].text : null
+
+      if (isError) {
+        throw new Error(text || "Remote tool call failed with isError=true")
       }
-      // Other remote errors come as a JSON object with success:false but no isError
-      // flag. The push pipeline was treating these as successes — promote them to
-      // throws here so the caller's try/catch sees them.
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        if (parsed.success === false || parsed.ok === false) {
-          const msg = parsed.error || parsed.message || parsed.detail || JSON.stringify(parsed).slice(0, 300)
-          throw new Error(typeof msg === "string" ? msg : JSON.stringify(msg))
+
+      if (text != null) {
+        let parsed
+        parsed = decodeTransportValue(text)
+        // Some remote errors come as a plain string without isError flag
+        if (typeof parsed === "string" && /^(Error:|Input validation error:|You don't have)/i.test(parsed)) {
+          throw new Error(parsed)
         }
+        // Other remote errors come as a JSON object with success:false but no isError
+        // flag. The push pipeline was treating these as successes — promote them to
+        // throws here so the caller's try/catch sees them.
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+          if (parsed.success === false || parsed.ok === false) {
+            const msg = parsed.error || parsed.message || parsed.detail || JSON.stringify(parsed).slice(0, 300)
+            throw new Error(typeof msg === "string" ? msg : JSON.stringify(msg))
+          }
+        }
+        return parsed
       }
-      return parsed
+      return response.result
+    }
+
+    if (response.error) {
+      throw new Error(response.error.message || "Remote tool call failed")
     }
-    return response.result
-  }
 
-  if (response.error) {
-    throw new Error(response.error.message || "Remote tool call failed")
+    return response
   }
 
-  return response
+  try {
+    return await callOnce()
+  } catch (error) {
+    if (isRecoverableTransportError(error)) {
+      resetMcpSession(error.message)
+      return await callOnce()
+    }
+    throw error
+  }
 }

package/src/tools/sql-guard.js

@@ -162,3 +162,20 @@ export function formatValidationError(v) {
   if (v.ok) return null
   return v.hint ? `${v.error}\nHint: ${v.hint}` : v.error
 }
+
+const MULTI_STATEMENT_RE =
+  /;\s*(?:SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER|SET|GRANT|REVOKE|TRUNCATE|COPY|WITH|DO|COMMENT|LOAD|EXPLAIN)\b/i
+
+export function shouldRouteSqlAsScript(sql) {
+  const cleaned = stripSqlNoise(sql)
+  return MULTI_STATEMENT_RE.test(cleaned)
+}
+
+export function estimateStatementCount(sql) {
+  if (!shouldRouteSqlAsScript(sql)) return 1
+  const cleaned = stripSqlNoise(sql.trim())
+  let count = 1
+  const re = new RegExp(MULTI_STATEMENT_RE.source, "gi")
+  while (re.exec(cleaned)) count += 1
+  return count
+}

package/src/tools/sync/diff.js

@@ -6,21 +6,13 @@
  *   - DRAFT  : what's already been staged via prior pushes (system.config_drafts)
  *   - LIVE   : what the engine actually serves at <project_id>.dypai.dev
  *
- * The diff body reports the LOCAL → LIVE plan (existing behavior) — that's
- * what `dypai_push` will queue. We additionally surface the DRAFT layer so
- * the agent can spot:
- *   1. Endpoints with a pending draft AND a local change → pushing again
- *      will REPLACE the existing draft with the new local version.
- *   2. Endpoints with only a pending draft → run manage_drafts to publish/discard.
- *   3. Endpoints with only a local change → push will create a new draft.
- *
- * A full 3-way semantic diff (local vs draft vs live, field-by-field) would
- * require reserializing each draft payload and comparing — deferred. The
- * overlap signal here covers the common workflow without the extra cost.
+ * The diff body reports LOCAL → EFFECTIVE_REMOTE (live + pending drafts) —
+ * what `dypai_push` will actually queue. We additionally surface the DRAFT
+ * layer metadata so the agent can spot overlap and publish/discard decisions.
  */
 
 import { resolve as resolvePath } from "path"
-import { fetchRemoteState, readLocalState, readLocalStateSnapshot, readLocalConfig, computePlan } from "./planner.js"
+import { fetchRemoteState, readLocalEffectiveState, readLocalStateSnapshot, readLocalConfig, computePlan, buildEffectiveRemoteState } from "./planner.js"
 import { proxyToolCall } from "../proxy.js"
 
 export const dypaiDiffTool = {
@@ -56,7 +48,7 @@ export const dypaiDiffTool = {
     const targetProjectId = project_id || config?.project_id || null
 
     const [local, remote, stateSnapshot, draftsResult] = await Promise.all([
-      readLocalState(rootDir),
+      readLocalEffectiveState(rootDir),
       fetchRemoteState(targetProjectId),
       readLocalStateSnapshot(rootDir),
       // Pending drafts. Cheap on dev (always 0); on prod surfaces what's
@@ -85,9 +77,11 @@ export const dypaiDiffTool = {
       }
     }
 
-    const plan = computePlan(local, remote, remote.mapsCtx, {
+    const effectiveRemote = buildEffectiveRemoteState(remote, draftsResult)
+    const plan = computePlan(local, effectiveRemote, remote.mapsCtx, {
       deleteOrphans: delete_orphans,
       stateSnapshot,
+      liveRemote: remote,
     })
 
     const groupChanges = (plan.groups?.create?.length || 0) + (plan.groups?.delete?.length || 0)
@@ -144,6 +138,8 @@ export const dypaiDiffTool = {
         ? "Some YAMLs reference credentials missing remotely. Create them in the dashboard before pushing."
         : overlap.length > 0
           ? `${overlap.length} endpoint(s) have BOTH a pending draft AND a local change — dypai_push will REPLACE the existing draft with the new version. Review pending_drafts.overlap_with_local before pushing.`
+        : totalChanges === 0 && draftCount > 0
+          ? `${draftCount} pending draft(s) — local matches what's already staged. Test with dypai_test_endpoint(mode:'draft'), then manage_drafts(operation:'publish', confirm:true) when ready.`
           : draftCount > 0 && totalChanges > 0
             ? `${draftCount} draft(s) already pending; this diff would queue ${totalChanges} more. Consider manage_drafts(operation:'publish'|'discard', confirm:true) first to keep the staged set focused.`
             : draftCount > 0

package/src/tools/sync/generate-types.js

@@ -0,0 +1,101 @@
+/**
+ * Regenerate dypai/types/endpoints.gen.ts from effective Flow/YAML contracts.
+ */
+
+import { resolve as resolvePath } from "path"
+import {
+  resolveProjectRootFromDypaiDir,
+  runEffectiveWorkflowsCli,
+} from "../../lib/effective-workflows-runner.js"
+
+export async function runGenerateEndpointTypes(rootDir) {
+  const projectRoot = resolveProjectRootFromDypaiDir(resolvePath(rootDir))
+  const result = runEffectiveWorkflowsCli(projectRoot, ["generate-types"])
+
+  if (result.unavailable) {
+    return {
+      ok: false,
+      skipped: true,
+      reason: "runner_unavailable",
+      warning: result.warning?.message || "Effective workflow runner unavailable.",
+    }
+  }
+
+  if (!result.ok) {
+    return {
+      ok: false,
+      error: result.error || "generate-types failed",
+      stderr: result.stderr,
+    }
+  }
+
+  const payload = result.data
+  if (!payload?.ok) {
+    return {
+      ok: false,
+      error: payload?.error || "generate-types returned failure",
+    }
+  }
+
+  return {
+    ok: true,
+    endpointCount: payload.endpointCount ?? 0,
+    typesPath: payload.typesPath,
+    contractPath: payload.contractPath,
+    endpoints: payload.endpoints || [],
+  }
+}
+
+export const dypaiGenerateTypesTool = {
+  name: "dypai_generate_types",
+  description:
+    "Regenerate frontend endpoint types from the local dypai/ backend (Flow IR + legacy YAML). " +
+    "Writes dypai/types/endpoints.gen.ts and dypai/types/endpoints.contract.json. " +
+    "Call after editing dypai/flows/*.flow.ts or endpoint YAML, before frontend work. " +
+    "Also runs automatically during dypai_push after validation.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      root_dir: {
+        type: "string",
+        description: "Root of the dypai/ folder (default: ./dypai).",
+        default: "./dypai",
+      },
+    },
+  },
+
+  async execute({ root_dir = "./dypai" } = {}) {
+    const outcome = await runGenerateEndpointTypes(root_dir)
+    if (outcome.skipped) {
+      return {
+        success: false,
+        generated: false,
+        reason: outcome.reason,
+        hint: outcome.warning,
+      }
+    }
+    if (!outcome.ok) {
+      return {
+        success: false,
+        generated: false,
+        error: outcome.error,
+        stderr: outcome.stderr,
+      }
+    }
+    return {
+      success: true,
+      generated: true,
+      endpoint_count: outcome.endpointCount,
+      types_path: "dypai/types/endpoints.gen.ts",
+      contract_path: "dypai/types/endpoints.contract.json",
+      endpoints: outcome.endpoints.slice(0, 50),
+      hint: outcome.endpointCount
+        ? `Types refreshed for ${outcome.endpointCount} endpoint(s). Frontend can import from dypai/types/endpoints.gen.ts.`
+        : "No effective endpoints found — types file is empty.",
+    }
+  },
+}
+
+export const __testing = {
+  runGenerateEndpointTypes,
+}

package/src/tools/sync/index.js

@@ -5,13 +5,15 @@
  *   transforms.js — bidirectional field transforms (symmetric by construction)
  *   codec.js      — endpoint-level serialize / deserialize (structural shape)
  *   pull.js       — DB → filesystem (uses codec.serializeEndpoint)
- *   push.js       — filesystem → DB (uses codec.deserializeEndpoint)  [pending]
- *   diff.js       — compares both sides without writing                [pending]
+ *   push.js       — filesystem → DB (uses codec.deserializeEndpoint + effective Flow IR)
+ *   diff.js       — compares both sides without writing
+ *   generate-types.js — regenerates dypai/types/endpoints.gen.ts from effective contracts
  */
 
 export { dypaiPullTool } from "./pull.js"
 export { dypaiDiffTool } from "./diff.js"
 export { dypaiPushTool } from "./push.js"
+export { dypaiGenerateTypesTool } from "./generate-types.js"
 export { dypaiDescribeTool } from "./describe.js"
 export { dypaiValidateTool } from "./validate.js"
 export { dypaiTestTool } from "./test.js"