@elisym/mcp 0.1.6 → 0.2.0

package/README.md

@@ -20,6 +20,9 @@ npx @elisym/mcp install --agent <agent-name>
 # List detected MCP clients
 npx @elisym/mcp install --list
 
+# Refresh the version pin in installed clients (preserves agent + env)
+npx @elisym/mcp update
+
 # Remove from MCP clients
 npx @elisym/mcp uninstall
 

package/dist/index.js

@@ -192,7 +192,7 @@ var AgentContext = class _AgentContext {
   registry = /* @__PURE__ */ new Map();
   /** Currently active agent name. */
   activeAgentName = "";
-  /** Rate limiter for payment/messaging tools (10 calls per 10s). */
+  /** Rate limiter for payment tools (10 calls per 10s). */
   toolRateLimiter = new RateLimiter(10, 10);
   /** Stricter rate limiter for withdrawals (3 calls per 60s). */
   withdrawRateLimiter = new RateLimiter(3, 60);
@@ -304,13 +304,11 @@ function checkLen(field, value, max) {
   }
 }
 var MAX_INPUT_LEN = LIMITS.MAX_INPUT_LENGTH;
-var MAX_MESSAGE_LEN = LIMITS.MAX_MESSAGE_LENGTH;
 var MAX_CAPABILITIES = LIMITS.MAX_CAPABILITIES;
 var MAX_TIMEOUT_SECS = LIMITS.MAX_TIMEOUT_SECS;
 var MAX_NPUB_LEN = 128;
 var MAX_EVENT_ID_LEN = 128;
 var MAX_PAYMENT_REQ_LEN = 1e4;
-var MAX_MESSAGES = 1e3;
 var MAX_SOLANA_ADDR_LEN = 64;
 var _paymentStrategy = null;
 function payment() {
@@ -319,6 +317,35 @@ function payment() {
 }
 
 // src/install.ts
+function elisymPackageArgs() {
+  return ["-y", `@elisym/mcp@~${PACKAGE_VERSION}`];
+}
+function validateClientName(name) {
+  if (name === void 0) {
+    return;
+  }
+  if (!CLIENTS.some((c) => c.name === name)) {
+    throw new Error(
+      `Unknown client "${name}". Known clients: ${CLIENTS.map((c) => c.name).join(", ")}`
+    );
+  }
+}
+async function safeRewriteJson(path, expectedRaw, newConfig) {
+  let recheck;
+  try {
+    recheck = await readFile(path, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `${path} disappeared between read and write: ${err.message}. Re-run after the file is restored.`
+    );
+  }
+  if (recheck !== expectedRaw) {
+    throw new Error(
+      `${path} was modified by another process during update. Close the MCP client and re-run.`
+    );
+  }
+  await writeJsonAtomic(path, newConfig);
+}
 var CLIENTS = [
   {
     name: "claude-desktop",
@@ -361,7 +388,7 @@ var CLIENTS = [
 function buildServerEntry(agentName, env) {
   const entry = {
     command: "npx",
-    args: ["-y", `@elisym/mcp@~${PACKAGE_VERSION}`]
+    args: elisymPackageArgs()
   };
   const mergedEnv = { ...env };
   if (agentName) {
@@ -373,6 +400,7 @@ function buildServerEntry(agentName, env) {
   return entry;
 }
 async function runInstall(options) {
+  validateClientName(options.client);
   if (options.agent) {
     validateAgentName(options.agent);
   }
@@ -402,7 +430,12 @@ async function runInstall(options) {
     console.log("No MCP clients found to install into.");
   }
 }
-async function runUninstall(options) {
+async function runUpdate(options) {
+  validateClientName(options.client);
+  if (options.agent) {
+    validateAgentName(options.agent);
+  }
+  let updated = 0;
   for (const client of CLIENTS) {
     if (options.client && client.name !== options.client) {
       continue;
@@ -411,15 +444,105 @@ async function runUninstall(options) {
     if (!path) {
       continue;
     }
+    let raw;
     try {
-      const raw = await readFile(path, "utf-8");
-      const config = JSON.parse(raw);
-      if (config.mcpServers?.elisym) {
-        delete config.mcpServers.elisym;
-        await writeJsonAtomic(path, config);
-        console.log(`Removed from ${client.name}: ${path}`);
+      raw = await readFile(path, "utf-8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        console.log(`Skipped ${client.name}: ${err.message}`);
       }
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(raw);
     } catch {
+      console.log(`Warning: ${path} is not valid JSON. Skipping update for ${client.name}.`);
+      continue;
+    }
+    const existing = config.mcpServers?.elisym;
+    if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+      continue;
+    }
+    const rawEnv = existing.env;
+    const newEnv = rawEnv && typeof rawEnv === "object" && !Array.isArray(rawEnv) ? { ...rawEnv } : {};
+    const existingAgentRaw = typeof newEnv.ELISYM_AGENT === "string" ? newEnv.ELISYM_AGENT : void 0;
+    if (existingAgentRaw !== void 0 && options.agent === void 0) {
+      try {
+        validateAgentName(existingAgentRaw);
+      } catch (err) {
+        console.log(
+          `Skipped ${client.name}: existing ELISYM_AGENT in ${path} is invalid (${err.message}). Re-run with --agent <name> to overwrite.`
+        );
+        continue;
+      }
+    }
+    if (options.agent !== void 0) {
+      newEnv.ELISYM_AGENT = options.agent;
+    }
+    const entry = existing;
+    const newArgs = elisymPackageArgs();
+    if (Array.isArray(entry.args)) {
+      const idx = entry.args.findIndex(
+        (a) => typeof a === "string" && a.startsWith("@elisym/mcp@")
+      );
+      if (idx >= 0) {
+        entry.args[idx] = newArgs[1];
+      } else {
+        entry.args = newArgs;
+      }
+    } else {
+      entry.args = newArgs;
+    }
+    if (Object.keys(newEnv).length > 0) {
+      entry.env = newEnv;
+    } else {
+      delete entry.env;
+    }
+    try {
+      await safeRewriteJson(path, raw, config);
+    } catch (err) {
+      console.log(`Skipped ${client.name}: ${err.message}`);
+      continue;
+    }
+    console.log(`Updated ${client.name}: ${path} -> @elisym/mcp@~${PACKAGE_VERSION}`);
+    updated++;
+  }
+  if (updated === 0) {
+    console.log("No existing elisym MCP installs found to update.");
+  }
+}
+async function runUninstall(options) {
+  validateClientName(options.client);
+  for (const client of CLIENTS) {
+    if (options.client && client.name !== options.client) {
+      continue;
+    }
+    const path = client.configPath();
+    if (!path) {
+      continue;
+    }
+    let raw;
+    try {
+      raw = await readFile(path, "utf-8");
+    } catch {
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (!config.mcpServers?.elisym) {
+      continue;
+    }
+    delete config.mcpServers.elisym;
+    try {
+      await safeRewriteJson(path, raw, config);
+      console.log(`Removed from ${client.name}: ${path}`);
+    } catch (err) {
+      console.log(`Skipped ${client.name}: ${err.message}`);
     }
   }
 }
@@ -444,18 +567,21 @@ async function writeJsonAtomic(path, data) {
   await writeFileAtomic(path, JSON.stringify(data, null, 2), 384);
 }
 async function installToConfig(path, entry) {
-  let config;
   let raw;
   try {
     raw = await readFile(path, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw err;
+    }
+    await writeJsonAtomic(path, { mcpServers: { elisym: entry } });
+    return true;
+  }
+  let config;
+  try {
     config = JSON.parse(raw);
   } catch {
-    if (raw !== void 0) {
-      console.error(
-        `Warning: ${path} is not valid JSON. A backup was saved to ${path}.elisym-backup. Other MCP server entries may have been lost - restore from backup if needed.`
-      );
-    }
-    config = {};
+    throw new Error(`${path} is not valid JSON. Fix the file manually and re-run install.`);
   }
   if (!config.mcpServers) {
     config.mcpServers = {};
@@ -463,14 +589,8 @@ async function installToConfig(path, entry) {
   if (config.mcpServers.elisym) {
     return false;
   }
-  if (raw) {
-    try {
-      await writeFile(`${path}.elisym-backup`, raw, { mode: 384 });
-    } catch {
-    }
-  }
   config.mcpServers.elisym = entry;
-  await writeJsonAtomic(path, config);
+  await safeRewriteJson(path, raw, config);
   return true;
 }
 
@@ -810,8 +930,13 @@ function normalizeConfusables(text) {
   return text.normalize("NFKC").replace(CONFUSABLE_RE, (ch) => CONFUSABLE_MAP[ch] ?? ch);
 }
 var INJECTION_PATTERNS = [
-  // Role hijacking
-  { category: "role_hijack", pattern: /\b(?:you are|act as|pretend to be|roleplay as)\b/i },
+  // Role hijacking — agents legitimately describe themselves with "act as" /
+  // "you are" in their public cards, so this is noisy in structured contexts.
+  {
+    category: "role_hijack",
+    pattern: /\b(?:you are|act as|pretend to be|roleplay as)\b/i,
+    noisy: true
+  },
   // Instruction override
   {
     category: "instruction_override",
@@ -825,20 +950,39 @@ var INJECTION_PATTERNS = [
   // Tool call injection
   {
     category: "tool_injection",
-    pattern: /\b(?:call the tool|send_payment\(|send_message\(|submit_job_result\()\b/i
+    pattern: /\b(?:call the tool|send_payment\(|submit_job_result\()/i
   },
   // Delimiter injection
   { category: "delimiter_injection", pattern: /<\/system>|\[\/INST\]|```system|<\|im_end\|>/i },
-  // Data exfiltration
-  { category: "data_exfil", pattern: /\b(?:send|post|leak).*?\b(?:secret|key|password)\b/i },
+  // Data exfiltration. Require a composite term ("secret key", "api key") or a strong
+  // single noun ("password", "credential", "seed phrase"). The previous version matched
+  // the bare word "key", which produces false positives on benign phrases like
+  // "send a link, get the key points" — common in legitimate agent descriptions.
+  // Cap the gap at 40 chars within the same clause (no sentence terminators) so the
+  // verb and noun must actually relate to each other. Composite-term separators are
+  // [\s_-]? so variants like `private-key`, `secret_key`, `seed-phrase` are caught.
+  // Marked `noisy` because even after tightening, NL verb+noun phrases remain a
+  // common source of FP on free-text agent descriptions.
+  {
+    category: "data_exfil",
+    pattern: /\b(?:send|post|exfiltrate|leak)\b[^.!?\n]{0,40}\b(?:secret[\s_-]?key|api[\s_-]?key|private[\s_-]?key|password|credential|auth[\s_-]?token|seed[\s_-]?phrase|mnemonic)\b/i,
+    noisy: true
+  },
   // Payment manipulation
   { category: "payment_manipulation", pattern: /\b(?:change|modify).*?\b(?:recipient|address)\b/i },
   { category: "payment_manipulation", pattern: /\bsend all funds\b/i },
-  // Jailbreak
-  { category: "jailbreak", pattern: /\b(?:DAN mode|developer mode enabled|from now on)\b/i },
-  // Urgency
-  { category: "urgency", pattern: /^(?:IMPORTANT|CRITICAL|URGENT|SYSTEM):/m }
+  // Jailbreak — "from now on" is a common phrase in changelogs/release notes that
+  // an agent could legitimately put in its description, hence noisy.
+  {
+    category: "jailbreak",
+    pattern: /\b(?:DAN mode|developer mode enabled|from now on)\b/i,
+    noisy: true
+  },
+  // Urgency — agents may put "IMPORTANT: rate limited to N req/s" in their card,
+  // so the line-anchored prefix is noisy in structured contexts.
+  { category: "urgency", pattern: /^(?:IMPORTANT|CRITICAL|URGENT|SYSTEM):/m, noisy: true }
 ];
+var STRICT_INJECTION_PATTERNS = INJECTION_PATTERNS.filter((p) => !p.noisy);
 function stripDangerousUnicode(text) {
   return text.replace(
     // eslint-disable-next-line no-control-regex
@@ -852,14 +996,18 @@ function truncateLongLines(text) {
   ).join("\n");
 }
 var INJECTION_SCAN_BUDGET = 8e3;
-function detectInjections(text) {
+function detectInjections(text, includeNoisy) {
   const normalized = normalizeConfusables(text);
+  const patterns = includeNoisy ? INJECTION_PATTERNS : STRICT_INJECTION_PATTERNS;
   if (normalized.length <= INJECTION_SCAN_BUDGET) {
-    return INJECTION_PATTERNS.some((p) => p.pattern.test(normalized));
+    return patterns.some((p) => p.pattern.test(normalized));
   }
   const head = normalized.slice(0, INJECTION_SCAN_BUDGET);
   const tail = normalized.slice(-INJECTION_SCAN_BUDGET);
-  return INJECTION_PATTERNS.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+  return patterns.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+}
+function scanForInjections(text, mode = "full") {
+  return detectInjections(text, mode === "full");
 }
 function isLikelyBase64(s) {
   if (s.length < 64) {
@@ -868,12 +1016,13 @@ function isLikelyBase64(s) {
   const base64Chars = s.replace(/[A-Za-z0-9+/=\s]/g, "");
   return base64Chars.length / s.length < 0.05;
 }
-function sanitizeUntrusted(input, kind = "text") {
+function sanitizeUntrusted(input, kind = "text", options) {
   let text = stripDangerousUnicode(input);
   text = truncateLongLines(text);
   text = text.replaceAll(BOUNDARY_BEGIN, "--- [UNTRUSTED MARKER STRIPPED] ---");
   text = text.replaceAll(BOUNDARY_END, "--- [UNTRUSTED MARKER STRIPPED] ---");
-  const injectionsDetected = kind !== "binary" && detectInjections(text);
+  const scanned = kind !== "binary" && detectInjections(text, kind === "text");
+  const injectionsDetected = scanned || options?.extraInjectionSignal === true;
   let wrapped = `${BOUNDARY_BEGIN}
 ${text}
 ${BOUNDARY_END}`;
@@ -884,14 +1033,14 @@ ${wrapped}`;
   }
   return { text: wrapped, injectionsDetected };
 }
+function sanitizeInner(input) {
+  return truncateLongLines(stripDangerousUnicode(input));
+}
 function sanitizeField(input, maxLen) {
   let text = stripDangerousUnicode(input);
   if (text.length > maxLen) {
     text = text.slice(0, maxLen) + "...";
   }
-  if (detectInjections(text)) {
-    text = `[SUSPICIOUS] ${text}`;
-  }
   return text;
 }
 
@@ -1212,13 +1361,26 @@ var customerTools = [
           console.error("[mcp:list_my_jobs] queryJobResults failed:", e);
         }
       }
+      let freetextSuspicious = false;
       const results = mine.map((job) => {
         const dec = decryptedByRequest.get(job.eventId);
         let resultText;
         if (dec) {
-          resultText = dec.decryptionFailed ? "[decryption failed - targeted result not for this agent]" : sanitizeUntrusted(dec.content).text;
+          if (dec.decryptionFailed) {
+            resultText = "[decryption failed - targeted result not for this agent]";
+          } else {
+            const cleaned = sanitizeInner(dec.content);
+            if (scanForInjections(cleaned, "full")) {
+              freetextSuspicious = true;
+            }
+            resultText = cleaned;
+          }
         } else if (job.result) {
-          resultText = sanitizeUntrusted(job.result).text;
+          const cleaned = sanitizeInner(job.result);
+          if (scanForInjections(cleaned, "full")) {
+            freetextSuspicious = true;
+          }
+          resultText = cleaned;
         }
         return {
           event_id: job.eventId,
@@ -1229,10 +1391,11 @@ var customerTools = [
           result: resultText
         };
       });
-      return textResult(
-        `Found ${results.length} of your jobs:
-${JSON.stringify(results, null, 2)}`
-      );
+      const { text: wrapped } = sanitizeUntrusted(JSON.stringify(results, null, 2), "structured", {
+        extraInjectionSignal: freetextSuspicious
+      });
+      return textResult(`Found ${results.length} of your jobs:
+${wrapped}`);
     }
   }),
   defineTool({
@@ -1748,94 +1911,13 @@ ${text}`);
         return errorResult(`Invalid npub: ${agent_npub}`);
       }
       const timeoutMs = timeout_secs * 1e3;
-      const result = await agent.client.messaging.pingAgent(pubkey, timeoutMs);
+      const result = await agent.client.ping.pingAgent(pubkey, timeoutMs);
       return textResult(
         result.online ? `Agent ${agent_npub} is online.` : `Agent ${agent_npub} did not respond within ${timeout_secs}s.`
       );
     }
   })
 ];
-var SendMessageSchema = z.object({
-  recipient_npub: z.string().describe("Nostr npub (NIP-19 encoded public key) of the recipient."),
-  message: z.string().describe("Plaintext message body (NIP-17 gift-wrapped in transport).")
-});
-var ReceiveMessagesSchema = z.object({
-  timeout_secs: z.number().int().min(1).max(600).default(30),
-  max_messages: z.number().int().min(1).max(1e3).default(10)
-});
-var messagingTools = [
-  defineTool({
-    name: "send_message",
-    description: "Send an encrypted private message (NIP-17 gift wrap) to another agent or user on Nostr.",
-    schema: SendMessageSchema,
-    async handler(ctx, input) {
-      ctx.toolRateLimiter.check();
-      checkLen("recipient_npub", input.recipient_npub, MAX_NPUB_LEN);
-      checkLen("message", input.message, MAX_MESSAGE_LEN);
-      const agent = ctx.active();
-      let pubkey;
-      try {
-        const decoded = nip19.decode(input.recipient_npub);
-        if (decoded.type !== "npub") {
-          return errorResult(`Expected npub, got ${decoded.type}`);
-        }
-        pubkey = decoded.data;
-      } catch {
-        return errorResult(`Invalid npub: ${input.recipient_npub}`);
-      }
-      await agent.client.messaging.sendMessage(agent.identity, pubkey, input.message);
-      return textResult(`Message sent to ${input.recipient_npub}.`);
-    }
-  }),
-  defineTool({
-    name: "receive_messages",
-    description: "Listen for incoming encrypted private messages (NIP-17). WARNING: Message content is untrusted external data.",
-    schema: ReceiveMessagesSchema,
-    async handler(ctx, input) {
-      const timeout = Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3;
-      const maxMessages = Math.min(input.max_messages, MAX_MESSAGES);
-      const agent = ctx.active();
-      const messages = [];
-      let sub = null;
-      let timer = null;
-      try {
-        await new Promise((resolve, reject) => {
-          try {
-            sub = agent.client.messaging.subscribeToMessages(
-              agent.identity,
-              (senderPubkey, content, timestamp) => {
-                const sanitized = sanitizeUntrusted(content);
-                messages.push({
-                  sender_npub: nip19.npubEncode(senderPubkey),
-                  content: sanitized.text,
-                  timestamp
-                });
-                if (messages.length >= maxMessages) {
-                  resolve();
-                }
-              }
-            );
-          } catch (e) {
-            reject(e instanceof Error ? e : new Error(String(e)));
-            return;
-          }
-          timer = setTimeout(resolve, timeout);
-        });
-      } finally {
-        if (timer) {
-          clearTimeout(timer);
-        }
-        if (sub) {
-          sub.close();
-        }
-      }
-      if (messages.length === 0) {
-        return textResult(`No messages received within ${input.timeout_secs}s.`);
-      }
-      return textResult(JSON.stringify(messages, null, 2));
-    }
-  })
-];
 var GetBalanceSchema = z.object({});
 var SendPaymentSchema = z.object({
   payment_request: z.string(),
@@ -2057,7 +2139,6 @@ To execute, call withdraw again with the SAME address and amount_sol, plus nonce
 var allTools = [
   ...discoveryTools,
   ...customerTools,
-  ...messagingTools,
   ...walletTools,
   ...dashboardTools,
   ...agentTools
@@ -2378,6 +2459,9 @@ program.command("install").description("Install elisym MCP server into client co
     await runInstall({ client: options.client, agent: options.agent });
   }
 });
+program.command("update").description("Refresh the elisym MCP entry in installed client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Override the agent binding").action(async (options) => {
+  await runUpdate({ client: options.client, agent: options.agent });
+});
 program.command("uninstall").description("Remove elisym from MCP client configs").option("--client <name>", "Specific client").action(async (options) => {
   await runUninstall({ client: options.client });
 });