@fangorn-network/westmarch 0.0.20-dev → 0.1.1

package/src/agent/mcp.js

@@ -1,425 +1,136 @@
 #!/usr/bin/env node
-// Every Fangorn app's WebMCP tools, behind one stdio MCP server.
+// Fangorn for agents: every publisher's records, found through the explorer.
 //
-//   fangorn-mcp [--cdp <url>] [--headed] [--from-block <n>]
+//   fangorn-mcp
 //   claude mcp add fangorn -- fangorn-mcp
-//   claude mcp add fangorn -e FANGORN_MCP_CDP=ws://browser:9222 -- fangorn-mcp
 //
-// WebMCP tools live on `document.modelContext` inside a loaded tab. There is no
-// endpoint, so an agent outside the browser cannot reach them, and one MCP
-// server per app would mean one registration per app. Instead this server is
-// the directory and the browser both:
+// The explorer (FANGORN_EXPLORER, default https://explorer.fangorn.network) is the Fangorn
+// app that indexes every publisher. This server downloads the explorer's view and searches
+// it here, so no query ever leaves the machine; it never reads the chain to find anything:
 //
-//   list-apps      apps read off the chain (AppAgentChanged → verified cards)
-//   open-app       verify one app's card, open its page in a tab, and add its
-//                  tools to this server as `<app>__<tool>` (tools/list_changed)
-//   call-app-tool  the same call by name, for clients that ignore list_changed
+//   search      records across every publisher, or one (`publisher`)
+//   publishers  who publishes what: each publisher's repos, with row counts
+//   get         one record in full
+//   buy         a record a publisher sells, quoted at the explorer, paid over x402
+//   wallet      the person's address and balances
+//   publish     records into the person's own repo, on their yes
 //
-// One browser, one tab per opened app: a WebMCP browser at --cdp, or else a
-// local Chrome with WebMCP on, headless unless --headed. Calls
-// are relayed to the tab's own `modelContext.executeTool`, so the tools, their
-// schemas and their answers are the page's, and queries still run in the tab.
-// A local Chrome's profile persists (~/.cache/westmarch-mcp), so a page's
-// downloads, such as an embedding model, are fetched once. A tab or browser that
-// dies is reopened on the next call.
+// Buying needs FANGORN_MCP_WALLET_KEY and pays at most FANGORN_MCP_MAX_PRICE a record
+// (default 0.10). Publishing signs with that key, else the fangorn CLI's.
 
-import { spawn } from "node:child_process";
-import { mkdirSync, readFileSync, existsSync, rmSync, writeFileSync, renameSync } from "node:fs";
-import { createHash } from "node:crypto";
 import net from "node:net";
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline";
-import { APP_EXTENSION, listApps, toApp } from "../discover/apps.js";
 
-// The current AppRegistry's first event on Arbitrum Sepolia. A reader's
-// default, not deployment config: pass --from-block for another deployment.
-const DEFAULT_FROM_BLOCK = 311637349n;
 const log = (...a) => console.error("[fangorn-mcp]", ...a);   // stdout is the protocol
-// FANGORN_MCP_TRACE=1: step timings on stderr, for finding where an answer waits.
-const T0 = performance.now();
-const trace = process.env.FANGORN_MCP_TRACE ? (what) => log(`${Math.round(performance.now() - T0)}ms ${what}`) : () => {};
 
-let client;
-async function fangorn() {
-    if (!client) {
-        const [{ Fangorn, FangornConfig }, { generatePrivateKey }] = await Promise.all([
-            import("@fangorn-network/sdk"), import("viem/accounts")]);
-        client = Fangorn.create({ privateKey: generatePrivateKey(), config: FangornConfig });   // reads only
-        // list-apps verifies every card and open-app verifies one again: once a minute is enough.
-        const verify = client.discoverApp.bind(client), seen = new Map();
-        client.discoverApp = (url) => {
-            const hit = seen.get(url);
-            if (hit && Date.now() - hit.at < 60_000) return hit.p;
-            const p = verify(url).catch((e) => { seen.delete(url); throw e; });
-            seen.set(url, { at: Date.now(), p });
-            return p;
-        };
-    }
-    return client;
-}
-
-/** A card URL → the verified card and the page to open. A plain A2A card (no
- *  Fangorn extension) opens unverified: the caller asked for it by URL. */
-async function resolveCard(cardUrl) {
-    const card = await (await fetch(cardUrl)).json();
-    const fangornApp = card.capabilities?.extensions?.some((e) => e.uri === APP_EXTENSION);
-    // Views only from a verified card, and only http(s) ones (toApp filters).
-    const app = fangornApp ? toApp(await (await fangorn()).discoverApp(cardUrl), cardUrl) : null;
-    const page = new URL(card.url);
-    if (page.protocol !== "https:" && page.protocol !== "http:") throw new Error(`card.url is not http(s): ${card.url}`);
-    return { card, page: page.toString(), verified: fangornApp, views: app?.views ?? [], paid: app?.paid ?? null };
-}
-
-// ── the network ─────────────────────────────────────────────────────────────
-// Every byte an answer waits on, cached where it is safe to:
-//   - a content-addressed file (`…-<12 hex>.<ext>`, every shard) never changes,
-//     so it is kept on disk forever. shard.js still checks it against the
-//     manifest's sha256, so a bad cache entry fails loudly, not silently.
-//   - catalogs, manifests and cards change on a rebake: held for a minute, so
-//     one search (or resolving then verifying a card) does not fetch each twice.
-const CACHE = `${homedir()}/.cache/fangorn-mcp`;
-/** Stale-while-revalidate from disk: the last copy at once, a fresh one fetched
- *  behind it for next time. Only for reads where stale is harmless. */
-function staleFetch(fetcher) {
-    mkdirSync(`${CACHE}/stale`, { recursive: true });
-    return async (url) => {
-        const f = `${CACHE}/stale/${createHash("sha256").update(url).digest("hex")}`;
-        const refresh = fetcher(url).then(async (r) => {
-            if (!r.ok) return r;
-            const b = new Uint8Array(await r.arrayBuffer());
-            writeFileSync(`${f}.tmp`, b); renameSync(`${f}.tmp`, f);
-            return new Response(b);
-        });
-        if (existsSync(f)) { refresh.catch(() => {}); return new Response(readFileSync(f)); }
-        return refresh;
-    };
-}
-
-function cachingFetch(real = globalThis.fetch) {
-    mkdirSync(`${CACHE}/blobs`, { recursive: true });
-    const memo = new Map();
-    return async (input, init) => {
-        const url = String(input?.url ?? input);
-        if ((init?.method ?? input?.method ?? "GET") !== "GET" || !/^https?:/.test(url)) return real(input, init);
-        const path = new URL(url).pathname;
-        if (/-[0-9a-f]{12}\.[a-z.]+$/.test(path)) {
-            const f = `${CACHE}/blobs/${createHash("sha256").update(url).digest("hex")}`;
-            if (existsSync(f)) return new Response(readFileSync(f));
-            const r = await real(input, init);
-            if (!r.ok) return r;
-            const b = new Uint8Array(await r.arrayBuffer());
-            writeFileSync(`${f}.tmp`, b); renameSync(`${f}.tmp`, f);   // never a torn file
-            return new Response(b, { headers: r.headers });
-        }
-        // A card, catalog or manifest is small: 8s without one means the host is
-        // down, and a dead card in the directory must not stall a listing for a
-        // TCP timeout. Shards get no deadline; a big file on a slow link is legitimate.
-        init = { ...init, signal: init?.signal ?? AbortSignal.timeout(8000) };
-        if (/\/cdn\/catalog$|\/manifest$|\/agent-card\.json$/.test(path)) {
-            const hit = memo.get(url);
-            if (hit && Date.now() - hit.at < 60_000) return new Response(hit.body, { headers: hit.headers });
-            const r = await real(input, init);
-            if (!r.ok) return r;
-            const body = new Uint8Array(await r.arrayBuffer());
-            memo.set(url, { at: Date.now(), body, headers: r.headers });
-            return new Response(body, { headers: r.headers });
-        }
-        return real(input, init);
-    };
-}
-
-// ── the browser ─────────────────────────────────────────────────────────────
-// Anything that speaks the Chrome DevTools Protocol and has WebMCP: a headless
-// Chromium service, a hosted browser, or the local Chrome. `--cdp` (or
-// FANGORN_MCP_CDP) names it as http(s)://host:port or a ws(s):// browser
-// endpoint. Without it, a local Chrome is reused if one is already serving
-// this profile (another session's), else launched.
-//
-// Everything goes over the one browser-level WebSocket (Target.* plus flat
-// sessions). That is the endpoint every CDP host exposes, where the per-tab
-// /json HTTP routes are not.
-
-const PROFILE = `${homedir()}/.cache/westmarch-mcp`;
-
-/** An http(s) DevTools address → its browser WebSocket, reached via the host we were given. */
-async function browserWs(http) {
-    const v = await (await fetch(new URL("/json/version", http), { signal: AbortSignal.timeout(3000) })).json();
-    const ws = new URL(v.webSocketDebuggerUrl), base = new URL(http);
-    ws.host = base.host;                                  // the service reports its own view of itself
-    if (base.protocol === "https:") ws.protocol = "wss:";
-    return ws.toString();
-}
-
-async function localChrome({ headed }) {
-    mkdirSync(PROFILE, { recursive: true });
-    const portFile = `${PROFILE}/DevToolsActivePort`;
-    if (existsSync(portFile)) {
-        const ws = await browserWs(`http://127.0.0.1:${readFileSync(portFile, "utf-8").split("\n")[0]}`).catch(() => null);
-        if (ws) { log("reusing the Chrome already serving this profile"); return { ws }; }
-        rmSync(portFile, { force: true });                // stale: that Chrome is gone
-    }
-    const bin = process.env.CHROME ?? "google-chrome";
-    const proc = spawn(bin, [
-        ...(headed ? [] : ["--headless=new"]),
-        "--enable-features=WebMCP", "--remote-debugging-port=0", "--no-first-run",
-        "--no-default-browser-check", `--user-data-dir=${PROFILE}`, "about:blank",
-    ], { stdio: "ignore" });
-    const failed = new Promise((_, j) => proc.on("error", (e) => j(new Error(
-        `no browser: cannot launch ${bin} (${e.code}). Point --cdp / FANGORN_MCP_CDP at a WebMCP browser, or set CHROME.`))));
-    // 30s: a cold start on a loaded machine or CI box has taken 16s.
-    for (let i = 0; i < 300; i++) {
-        await Promise.race([new Promise((r) => setTimeout(r, 100)), failed]);
-        if (existsSync(portFile)) return { ws: await browserWs(`http://127.0.0.1:${readFileSync(portFile, "utf-8").split("\n")[0]}`), proc };
-    }
-    proc.kill();
-    throw new Error(`${bin} did not start`);
-}
-
-let conn;
-/** The browser connection, opened once and reopened after it drops. */
-function browser(opts) {
-    return conn ??= (async () => {
-        const { cdp } = opts;
-        const { ws: url, proc } = !cdp ? await localChrome(opts)
-            : /^wss?:/.test(cdp) ? { ws: cdp } : { ws: await browserWs(cdp) };
-        const ws = new WebSocket(url);
-        await new Promise((r, j) => { ws.onopen = r; ws.onerror = () => j(new Error(`cannot connect to the browser at ${url}`)); });
-        let id = 0; const pending = new Map(), dead = new Set();
-        ws.onmessage = (m) => {
-            const d = JSON.parse(m.data);
-            if (d.method === "Target.detachedFromTarget") dead.add(d.params.sessionId);
-            if (d.id !== undefined) { pending.get(d.id)?.(d); pending.delete(d.id); }
-        };
-        ws.onclose = () => { conn = null; for (const r of pending.values()) r({ error: { message: "browser connection closed" } }); };
-        const send = (method, params = {}, sessionId) => new Promise((res, rej) => {
-            if (ws.readyState !== WebSocket.OPEN) return rej(new Error("browser connection closed"));
-            pending.set(++id, (d) => (d.error ? rej(new Error(d.error.message)) : res(d.result)));
-            ws.send(JSON.stringify({ id, method, params, ...(sessionId && { sessionId }) }));
-        });
-        const tabs = new Set();
-        // Close what we opened. A shared or remote browser outlives this process.
-        const bye = async () => {
-            await Promise.race([Promise.all([...tabs].map((t) => send("Target.closeTarget", { targetId: t }).catch(() => {}))),
-                                new Promise((r) => setTimeout(r, 500))]);
-            // A local Chrome may be serving another session: leave it running
-            // while anyone else has a tab open; the last one out closes it.
-            const others = await Promise.race([send("Target.getTargets").then((r) => r.targetInfos.filter((t) => t.type === "page" && t.url !== "about:blank").length).catch(() => 0),
-                                               new Promise((r) => setTimeout(() => r(0), 500))]);
-            // Never a --cdp browser: that one is somebody's service.
-            if (!cdp && !others) await Promise.race([send("Browser.close").catch(() => {}), new Promise((r) => setTimeout(r, 500))]);
-            proc?.kill();
-            process.exit(0);
-        };
-        process.once("SIGINT", bye); process.once("SIGTERM", bye); process.stdin.once("end", bye);
-        log(`browser: ${cdp ?? (proc ? "launched local Chrome" : "local Chrome")}`);
-        return { send, dead, tabs };
-    })().catch((e) => { conn = null; throw e; });
-}
-
-/** A new tab on `page`; returns `ev(expr)`, which evaluates in it. */
-async function openTab(page, opts) {
-    const { send, dead, tabs } = await browser(opts);
-    const { targetId } = await send("Target.createTarget", { url: page });
-    tabs.add(targetId);
-    const { sessionId } = await send("Target.attachToTarget", { targetId, flatten: true });
-    return async (expression) => {
-        if (dead.has(sessionId)) throw new Error(`tab closed: ${page}`);
-        const r = await send("Runtime.evaluate", { expression, awaitPromise: true, returnByValue: true }, sessionId)
-            .catch((e) => { throw new Error(`tab closed: ${page} (${e.message})`); });
-        if (r.exceptionDetails) throw new Error(r.exceptionDetails.exception?.description ?? r.exceptionDetails.text);
-        return r.result.value;
-    };
-}
-
-/** The tab's tools in MCP's shape. Waits for the page to register them. */
-async function tabTools(ev) {
-    let hasWebMCP = false;
-    for (let i = 0; i < 150; i++) {
-        const got = await ev(`(async () => {
-            const mc = document.modelContext;
-            if (!mc?.getTools) return { webmcp: false, loaded: location.protocol.startsWith("http") && document.readyState === "complete" };
-            return { webmcp: true, tools: (await mc.getTools()).map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema })) };
-        })()`).catch(() => null);
-        hasWebMCP ||= !!got?.webmcp;
-        // modelContext is there from the first script or never; no need to wait out the page.
-        if (got && !got.webmcp && got.loaded) break;
-        if (got?.tools?.length) return got.tools.map((t) => ({ ...t, inputSchema: t.inputSchema ? JSON.parse(t.inputSchema) : { type: "object" } }));
-        await new Promise((r) => setTimeout(r, 200));
-    }
-    throw new Error(hasWebMCP
-        ? "the page registered no WebMCP tools in 30s (is card.url the page that registers them?)"
-        : "this browser has no WebMCP (document.modelContext.getTools): it needs Chrome 150+ with --enable-features=WebMCP, or a Chromium built with it");
-}
-
-/** One call, relayed. WebMCP takes the arguments as a JSON string and returns one. */
-async function tabCall(ev, name, args) {
-    const out = await ev(`document.modelContext.getTools().then((ts) => {
-        const t = ts.find((t) => t.name === ${JSON.stringify(name)});
-        if (!t) throw new Error("no tool " + ${JSON.stringify(name)});
-        return document.modelContext.executeTool(t, ${JSON.stringify(JSON.stringify(args ?? {}))});
-    })`);
-    try { const r = JSON.parse(out); if (Array.isArray(r?.content)) return r; } catch {}
-    return { content: [{ type: "text", text: String(out) }] };
-}
-
-/** JSON-RPC over newline-delimited stdio. Returns `notify` for server → client messages. */
-export function serve(handlers, { input = process.stdin, output = process.stdout } = {}) {
-    const send = (m) => output.write(JSON.stringify({ jsonrpc: "2.0", ...m }) + "\n");
-    createInterface({ input }).on("line", async (line) => {
-        let msg; try { msg = JSON.parse(line); } catch { return; }
-        if (msg.id === undefined) return;   // notifications
-        const h = handlers[msg.method];
-        if (!h) return send({ id: msg.id, error: { code: -32601, message: `unknown method ${msg.method}` } });
-        try { send({ id: msg.id, result: await h(msg.params ?? {}) }); }
-        catch (e) { send({ id: msg.id, error: { code: -32000, message: e?.message ?? String(e) } }); }
-    });
-    return (method, params = {}) => send({ method, params });
-}
+// FANGORN_NETWORK: the SDK's network name ("baseSepolia"); unset, its default.
+const network = async () => (await import("../publish/view.js")).network();
 
+// ── the server ──────────────────────────────────────────────────────────────
 const text = (o) => ({ content: [{ type: "text", text: typeof o === "string" ? o : JSON.stringify(o, null, 1) }] });
-// MCP tool names: [a-zA-Z0-9_-]{1,64}. `__` separates app from tool.
-const slug = (name) => String(name).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "").slice(0, 24) || "app";
+const ADDRESS = { type: "string", description: "A publisher's address (0x…)" };
 
-const META = [
-    { name: "list-apps",
-      description: "List the Fangorn apps registered on chain whose agent cards verify: name, description, card URL, and the WebMCP tools each page offers. Filter with `query`. Call open-app on one to use its tools.",
-      inputSchema: { type: "object", properties: { query: { type: "string", description: "Case-insensitive match on name or description" } } } },
-    { name: "find-apps",
-      description: "Find Fangorn apps for a question, ranked by what their data is about (e.g. \"where can I learn about weather?\", \"music\"). Each app carries its site, agent card, ERC-8004 agent with an 8004scan link, ERC-8004 reputation (feedback count and average), record count and bound block. Only apps whose cards verify on chain. `relevant: true` marks the ones worth opening; the rest are sorted, not relevant. With no query, lists every app. Then open-app.",
-      inputSchema: { type: "object", properties: {
+const TOOLS = [
+    { name: "search",
+      description: "Search every publisher's records on Fangorn by meaning. Each hit names its `publisher`, and carries `sale` ({publisher, repo, id, price} in USDC base units) when it is sold. Pass `publisher` to search one publisher's records.",
+      inputSchema: { type: "object", required: ["query"], properties: {
           query: { type: "string", description: "What the person is looking for, in their words" },
-          limit: { type: "integer", minimum: 1, maximum: 50, default: 10 } } } },
-    { name: "open-app",
-      description: "Verify an app's card against the chain and add its tools to this server as `<app>__<tool>`. An app that publishes views gets fast data tools (describe, search, get, similar, count, browse) with no browser. `page: true` also opens the app's page in a browser for its own WebMCP tools (slower). `app` is a name from list-apps, an appId, or a card URL.",
-      inputSchema: { type: "object", properties: { app: { type: "string" }, page: { type: "boolean", description: "Also load the page's own WebMCP tools in a browser" } }, required: ["app"] } },
-    { name: "call-app-tool",
-      description: "Call one tool of an opened app. Same as calling `<app>__<tool>` directly.",
-      inputSchema: { type: "object", properties: { app: { type: "string" }, tool: { type: "string" }, arguments: { type: "object" } }, required: ["app", "tool"] } },
+          publisher: ADDRESS, limit: { type: "integer", minimum: 1, maximum: 50, default: 10 } } } },
+    { name: "publishers",
+      description: "Who publishes on Fangorn: each publisher's repos, with what they hold and how many records. Filter with `query` (matches a repo's name or description, or the address). The busiest first.",
+      inputSchema: { type: "object", properties: { query: { type: "string" } } } },
+    { name: "get",
+      description: "One record in full, by the id a search hit gave.",
+      inputSchema: { type: "object", required: ["id"], properties: { id: { type: "string" } } } },
+    { name: "buy",
+      description: "Buy one record a publisher sells (a search hit with `sale`) and return its sealed fields opened. Pays the price in USDC from the person's wallet (FANGORN_MCP_WALLET_KEY), never above FANGORN_MCP_MAX_PRICE. It checks the sealed data can be read before paying. Tell the person the price first.",
+      inputSchema: { type: "object", required: ["publisher", "repo", "id"], properties: {
+          publisher: ADDRESS, repo: { type: "string" }, id: { type: "string", description: "From the hit's `sale`" } } } },
+    { name: "wallet",
+      description: "The person's Fangorn wallet: its address and its USDC and ETH balances.",
+      inputSchema: { type: "object", properties: {} } },
+    { name: "publish",
+      description: "Publish records to the person's own repo on Fangorn, from their wallet, where any agent can find them. Public and permanent: first show the person exactly what will be published and call this only on their yes to these records. Propose it when something you made for them (research, a list, a dataset) would be worth to others.",
+      inputSchema: { type: "object", required: ["repo", "records"], properties: {
+          repo: { type: "string", description: "Repo name, lowercase, e.g. \"notes\" or \"rust-crates\"; created if new" },
+          records: { type: "array", items: { type: "object", required: ["id", "payload"], properties: {
+              id: { type: "string", description: "Stable: the same thing keeps the same id" },
+              type: { type: "string", description: "Record type, e.g. \"note.v1\"" },
+              payload: { type: "object", description: "The record. Include a title and text that say what it is, in words" } } } } } } },
 ];
 
 /**
  * The server. `deps` is the outside world, so the self-check can fake it:
- *   findApps()          → { apps: [{ name, desc, card, appId }], rejected }
- *   exploreApps(query)  → { apps: ranked explore.js entries, ranked_by }
- *   findByName(name)    → { card, appId } | null     (optional: a direct registry read)
- *   resolveCard(url)    → { card, page, verified, views }
- *   viewTools(app)      → { tools, call(name, args) } | null   (no browser)
- *   openTab(page)       → ev
- *   tabTools(ev), tabCall(ev, name, args)
- *   notify(method)      set after serve()
+ *   explorer()        → { call(name, args) }   (view-tools over the explorer's view, run here)
+ *   quote(p, r, id)   → the explorer's x402 URL for one record
+ *   buy(quoteUrl)     → { fields, price, tx }  (src/agent/x402.js, from the person's wallet)
+ *   wallet(), publish({ repo, records })
  */
 export function handlers(deps) {
-    const open = new Map();   // slug → { name, card, verified, page, views?, pages?, tools }
-
-    const findOpen = (app) => open.get(slug(app)) ?? [...open.values()].find((o) => o.card === app || o.appId === app);
-    const retool = (o) => {
-        const taken = new Set(o.views?.tools.map((t) => t.name));
-        // A page tool that shares a data tool's name is kept, under `page-<name>`.
-        o.pageNames = new Map((o.pageTools ?? []).map((t) => [taken.has(t.name) ? `page-${t.name}` : t.name, t.name]));
-        o.tools = [...(o.views?.tools ?? []), ...(o.pageTools ?? []).map((t) => ({ ...t, name: taken.has(t.name) ? `page-${t.name}` : t.name }))];
+    const ask = async (name, args) => {
+        const r = await (await deps.explorer()).call(name, args);
+        if (r.isError) throw new Error(`explorer: ${r.content?.[0]?.text ?? "error"}`);
+        return r;
     };
-    async function openPage(o) {
-        o.ev = await deps.openTab(o.page);
-        o.pageTools = await deps.tabTools(o.ev);
-    }
-
-    async function openApp(app, { page = false } = {}) {
-        const hit = findOpen(app);
-        if (hit && (hit.ev || !page)) return hit;
-        let o = hit;
-        if (!o) {
-            let cardUrl = app, appId;
-            if (!/^https?:\/\//.test(app)) {
-                // One registry read when the name is the app's own; the scan only when it is not.
-                trace(`open ${app}: lookup`);
-                const a = await deps.findByName?.(app)
-                    ?? (await deps.findApps()).apps.find((x) => x.appId === app || slug(x.name) === slug(app));
-                if (!a) throw new Error(`no verified app named ${JSON.stringify(app)}; see list-apps`);
-                ({ card: cardUrl, appId } = a);
-            }
-            trace(`open ${app}: resolve ${cardUrl}`);
-            const { card, page: url, verified, views, paid } = await deps.resolveCard(cardUrl);
-            trace(`open ${app}: verified`);
-            let s = slug(card.name ?? app);
-            while (open.has(s)) s += "-";
-            o = { slug: s, name: card.name, card: cardUrl, appId, verified, page: url,
-                  views: deps.viewTools?.({ name: card.name, desc: card.description, views, paid }) ?? null };
-        }
-        // The browser only when asked, or when there is no other way in.
-        if (page || !o.views) await openPage(o);
-        retool(o);
-        trace(`open ${app}: ready`);
-        open.set(o.slug, o);
-        deps.notify?.("notifications/tools/list_changed");
-        return o;
-    }
-
-    async function call(app, tool, args) {
-        const o = findOpen(app);
-        if (!o) throw new Error(`${app} is not open; call open-app first`);
-        if (!o.pageNames?.has(tool)) {
-            if (o.views?.tools.some((t) => t.name === tool)) return o.views.call(tool, args);
-            throw new Error(`${o.slug} has no tool ${tool}${o.ev ? "" : " (its page tools load with open-app page: true)"}`);
-        }
-        const name = o.pageNames.get(tool);
-        try { return await deps.tabCall(o.ev, name, args); }
-        catch (e) {
-            if (!/tab closed/.test(e.message)) throw e;
-            // The tab or the whole browser went away. Reopen once; the tools keep their names.
-            await openPage(o);
-            return deps.tabCall(o.ev, name, args);
-        }
-    }
-
     const run = {
-        "list-apps": async ({ query }) => {
-            const { apps, rejected } = await deps.findApps();
+        search: ({ query, publisher, limit = 10 }) =>
+            ask("search", { query, limit: Math.min(50, Math.max(1, limit)), ...(publisher ? { where: { owner: publisher } } : {}) }),
+        publishers: async ({ query }) => {
+            const { views = [] } = JSON.parse((await ask("describe", {})).content[0].text);
+            const by = new Map();
+            for (const r of views.flatMap((v) => v.repos ?? [])) {
+                const p = by.get(r.publisher.toLowerCase()) ?? { publisher: r.publisher, rows: 0, repos: [] };
+                p.rows += r.rows;
+                p.repos.push({ repo: r.repo, rows: r.rows, description: r.description });
+                by.set(r.publisher.toLowerCase(), p);
+            }
             const q = String(query ?? "").toLowerCase();
-            return text({
-                apps: apps.filter((a) => !q || `${a.name} ${a.desc}`.toLowerCase().includes(q)).map((a) => ({
-                    app: slug(a.name), name: a.name, description: a.desc, card: a.card, appId: a.appId,
-                    tools: a.tools, open: open.has(slug(a.name)),
-                })),
-                unverified: rejected.length,
-            });
+            const hit = (p) => !q || p.publisher.toLowerCase().includes(q) || p.repos.some((r) => `${r.repo} ${r.description}`.toLowerCase().includes(q));
+            return text({ publishers: [...by.values()].filter(hit).sort((a, b) => b.rows - a.rows) });
         },
-        "find-apps": async ({ query, limit = 10 }) => {
-            const { apps, ranked_by } = await deps.exploreApps(query);
-            return text({ query: query ?? null, ranked_by, apps: apps.slice(0, Math.min(50, Math.max(1, limit)))
-                .map((a) => ({ ...a, open: open.has(a.app) })) });
+        get: ({ id }) => ask("get", { id }),
+        buy: async ({ publisher, repo, id }) => text({ publisher, repo, id, ...await deps.buy(deps.quote(publisher, repo, id)) }),
+        wallet: async () => text(await deps.wallet()),
+        publish: async ({ repo, records }) => {
+            if (!records?.length) throw new Error("no records to publish");
+            return text(await deps.publish({ repo, records: records.map(({ id, type = "record.v1", payload }) => ({ id: String(id), type, payload })) }));
         },
-        "open-app": async ({ app, page }) => {
-            const o = await openApp(app, { page });
-            return text({ app: o.slug, name: o.name, verified: o.verified,
-                          data_tools: !!o.views, page_tools: o.ev ? o.page : false,
-                          call_as: `${o.slug}__<tool>, or call-app-tool`, tools: o.tools });
-        },
-        "call-app-tool": async ({ app, tool, arguments: args }) => call(app, tool, args),
     };
 
     return {
         initialize: async (p) => ({
             protocolVersion: p.protocolVersion ?? "2025-06-18",
-            capabilities: { tools: { listChanged: true } },
-            serverInfo: { name: "fangorn-mcp", version: "0.1.0" },
-            instructions: "Fangorn apps are static sites anchored on chain. list-apps to find one, open-app to load it, then call its tools as <app>__<tool>. Start with <app>__describe when it exists.",
+            capabilities: { tools: { listChanged: false } },
+            serverInfo: { name: "fangorn-mcp", version: "0.2.0" },
+            instructions: "Fangorn is publishers' records, anchored on chain and indexed by the Fangorn explorer. search finds records across every publisher; publishers says who publishes what; get reads one; buy pays for a sold one (say the price first).",
         }),
         ping: async () => ({}),
-        "tools/list": async () => ({ tools: [
-            ...META,
-            ...[...open.values()].flatMap((o) => o.tools.map((t) => ({ ...t, name: `${o.slug}__${t.name}`, description: `[${o.name}] ${t.description ?? ""}` }))),
-        ] }),
+        "tools/list": async () => ({ tools: TOOLS }),
         "tools/call": async ({ name, arguments: args = {} }) => {
             try {
-                if (run[name]) return await run[name](args);
-                const i = name.indexOf("__");
-                if (i > 0) return await call(name.slice(0, i), name.slice(i + 2), args);
-                throw new Error(`no tool ${name}`);
+                if (!run[name]) throw new Error(`no tool ${name}`);
+                return await run[name](args);
             } catch (e) { return { isError: true, content: [{ type: "text", text: e?.message ?? String(e) }] }; }
         },
     };
 }
 
+/** JSON-RPC over newline-delimited stdio. Returns `notify` for server → client messages. */
+export function serve(handlers, { input = process.stdin, output = process.stdout } = {}) {
+    const send = (m) => output.write(JSON.stringify({ jsonrpc: "2.0", ...m }) + "\n");
+    createInterface({ input }).on("line", async (line) => {
+        let msg; try { msg = JSON.parse(line); } catch { return; }
+        if (msg.id === undefined) return;   // notifications
+        const h = handlers[msg.method];
+        if (!h) return send({ id: msg.id, error: { code: -32601, message: `unknown method ${msg.method}` } });
+        try { send({ id: msg.id, result: await h(msg.params ?? {}) }); }
+        catch (e) { send({ id: msg.id, error: { code: -32000, message: e?.message ?? String(e) } }); }
+    });
+    return (method, params = {}) => send({ method, params });
+}
+
 // ── main / self-check ───────────────────────────────────────────────────────
 // A command, not a module: installed as a bin, argv[1] is the symlink, so there is no is-main check.
 if (process.argv[2] === "--selfcheck") {
@@ -427,142 +138,104 @@ if (process.argv[2] === "--selfcheck") {
     const input = new PassThrough(), output = new PassThrough();
     const replies = [];
     createInterface({ input: output }).on("line", (l) => replies.push(JSON.parse(l)));
-    let opened = 0;
-    const deps = {
-        findApps: async () => ({ apps: [{ name: "Kings Foil", desc: "trials", card: "https://k.test/card", appId: "0xk", tools: ["greet"] }], rejected: [{}] }),
-        exploreApps: async (q) => ({ ranked_by: q ? "meaning" : null, apps: [{ app: "kings-foil", name: "Kings Foil", relevant: true }, { app: "b", name: "B", relevant: false }] }),
-        resolveCard: async () => ({ card: { name: "Kings Foil" }, page: "https://k.test/p", verified: true }),
-        openTab: async () => (opened++ ? "ev" : "dead"),   // the first tab dies
-        tabTools: async () => [{ name: "greet", description: "Hi.", inputSchema: { type: "object" } }],
-        tabCall: async (ev, name, args) => (name === "boom" ? Promise.reject(new Error("no tool boom"))
-            : ev === "dead" ? Promise.reject(new Error("tab closed: x")) : text({ ev, name, args })),
-    };
-    deps.notify = serve(handlers(deps), { input, output });
+    const P = "0xAbC0000000000000000000000000000000000001", Q = "0x0000000000000000000000000000000000000002";
+    // The explorer's view tools, as view-tools.js answers them.
+    const views = [{ view: "view", rows: 6, repos: [
+        { publisher: P, repo: "weather", rows: 4, description: "hourly readings" },
+        { publisher: Q, repo: "notes", rows: 1, description: "" },
+        { publisher: P, repo: "tides", rows: 1, description: "" }] }];
+    const explorer = { call: async (name, args) => (name === "describe" ? text({ views }) : text({ via: name, ...args })) };
+    const published = [];
+    serve(handlers({
+        explorer: async () => explorer,
+        quote: (p, r, id) => `https://explorer.test/paid/${p}/${r}/${encodeURIComponent(id)}`,
+        buy: async (quoted) => ({ fields: { quoted }, price: "10000" }),
+        wallet: async () => ({ address: "0xme" }),
+        publish: async (a) => (published.push(a), { repo: a.repo, records: a.records.length }),
+    }), { input, output });
     const rpc = (id, method, params) => input.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
-    const wait = () => new Promise((r) => setTimeout(r, 20));
     const call = (id, name, args) => rpc(id, "tools/call", { name, arguments: args });
+    const wait = () => new Promise((r) => setTimeout(r, 20));
     const res = (id) => replies.find((r) => r.id === id);
     const body = (id) => JSON.parse(res(id).result.content[0].text);
     const assert = (c, m) => { if (!c) throw new Error(m); };
 
-    rpc(1, "initialize", {}); rpc(2, "tools/list"); call(3, "list-apps", { query: "TRIAL" }); call(4, "kings-foil__greet"); await wait();
-    assert(res(1).result.capabilities.tools.listChanged, "advertises list_changed");
-    assert(res(2).result.tools.length === 4, "only the meta tools before anything is open");
-    assert(body(3).apps[0].app === "kings-foil" && body(3).unverified === 1, "list-apps filters and slugs");
-    assert(res(4).result.isError && /not open/.test(res(4).result.content[0].text), "an unopened app's tool is an error");
-
-    call(30, "find-apps", { query: "trials", limit: 1 }); await wait();
-    assert(body(30).ranked_by === "meaning" && body(30).apps.length === 1 && body(30).apps[0].open === false, "find-apps ranks, caps, and says what is open");
-
-    call(5, "open-app", { app: "Kings Foil" }); await wait();
-    call(6, "open-app", { app: "https://k.test/card" }); await wait();
-    assert(body(5).tools[0].name === "greet" && opened === 1, "open once, by name or by card URL");
-    call(50, "kings-foil__greet", { who: "b" }); await wait();
-    assert(body(50).ev === "ev" && opened === 2, "a dead tab is reopened and the call retried");
-    assert(replies.some((r) => r.method === "notifications/tools/list_changed"), "opening notifies");
-    rpc(7, "tools/list"); call(8, "kings-foil__greet", { who: "a" }); call(9, "call-app-tool", { app: "kings-foil", tool: "greet" });
-    call(10, "call-app-tool", { app: "kings-foil", tool: "boom" }); call(11, "open-app", { app: "nope" }); rpc(12, "nope"); await wait();
-    assert(res(7).result.tools.some((t) => t.name === "kings-foil__greet"), "opened tools are listed under the app");
-    assert(body(8).args.who === "a" && body(9).name === "greet", "both call paths reach the tab");
-    assert(res(10).result.isError && res(11).result.isError, "failures are tool errors");
-    assert(res(12).error.code === -32601, "unknown method");
-
-    // An app with views: data tools, no browser, until page: true.
-    {
-        const out2 = new PassThrough(), in2 = new PassThrough(), r2 = [];
-        createInterface({ input: out2 }).on("line", (l) => r2.push(JSON.parse(l)));
-        let tabs = 0;
-        const d2 = { ...deps,
-            resolveCard: async () => ({ card: { name: "Kings Foil" }, page: "https://k.test/p", verified: true, views: ["https://k.test/v"] }),
-            viewTools: (app) => ({ tools: [{ name: "search" }, { name: "greet" }], call: async (n, a) => text({ via: "views", n, a, views: app.views }) }),
-            openTab: async () => (tabs++, "ev"),
-        };
-        d2.notify = serve(handlers(d2), { input: in2, output: out2 });
-        const q = (id, name, args) => in2.write(JSON.stringify({ jsonrpc: "2.0", id, method: "tools/call", params: { name, arguments: args } }) + "\n");
-        const got = (id) => r2.find((r) => r.id === id)?.result;
-        q(1, "open-app", { app: "Kings Foil" }); await wait(); q(2, "kings-foil__search", { query: "x" }); await wait();
-        assert(tabs === 0 && JSON.parse(got(1).content[0].text).data_tools, "views mean no browser");
-        assert(JSON.parse(got(2).content[0].text).via === "views", "data tools answer from the views");
-        q(3, "open-app", { app: "kings-foil", page: true }); await wait();
-        const names = JSON.parse(got(3).content[0].text).tools.map((t) => t.name);
-        assert(tabs === 1 && names.includes("search") && names.includes("greet") && names.includes("page-greet"), `page: true adds page tools, a clash renamed: ${names}`);
-        q(4, "kings-foil__page-greet", { who: "p" }); q(5, "kings-foil__greet", {}); await wait();
-        assert(JSON.parse(got(4).content[0].text).ev === "ev" && JSON.parse(got(5).content[0].text).via === "views", "each name reaches its own side");
-    }
-    console.log("mcp.js self-check ok — one server, apps opened on demand, data tools without a browser, page tools on request");
+    rpc(1, "initialize", {}); rpc(2, "tools/list"); call(3, "search", { query: "rain", publisher: P }); call(4, "search", { query: "rain", limit: 500 });
+    call(5, "publishers", {}); call(6, "publishers", { query: "HOURLY" }); call(7, "get", { id: "a" }); call(8, "nope"); rpc(9, "nope"); await wait();
+    assert(res(2).result.tools.map((t) => t.name).join() === "search,publishers,get,buy,wallet,publish", "the six tools, no apps");
+    assert(body(3).via === "search" && body(3).where.owner === P && body(4).where === undefined && body(4).limit === 50, "search goes to the explorer, narrowed to a publisher on request, capped");
+    assert(body(5).publishers.map((p) => [p.publisher, p.rows, p.repos.length]).join("|") === `${P},5,2|${Q},1,1`, "publishers groups repos by publisher, busiest first");
+    assert(body(6).publishers.length === 1 && body(6).publishers[0].publisher === P, "publishers filters on what a repo holds");
+    assert(body(7).via === "get" && body(7).id === "a", "get goes to the explorer");
+    assert(res(8).result.isError && res(9).error.code === -32601, "unknown tool and method");
+    call(10, "buy", { publisher: P, repo: "weather", id: "a/b" }); call(11, "publish", { repo: "notes", records: [{ id: 1, payload: { title: "t" } }] });
+    call(12, "publish", { repo: "notes", records: [] }); call(13, "wallet"); await wait();
+    assert(body(10).fields.quoted === `https://explorer.test/paid/${P}/weather/a%2Fb` && body(10).price === "10000", "buy quotes the record at the explorer, the id escaped");
+    assert(body(11).records === 1 && published[0].records[0].id === "1" && published[0].records[0].type === "record.v1", "publish commits, ids as strings, a default type");
+    assert(res(12).result.isError && body(13).address === "0xme", "publishing nothing is an error; wallet reports");
+    const failing = handlers({ explorer: async () => ({ call: async () => ({ isError: true, content: [{ type: "text", text: "down" }] }) }) });
+    assert(/explorer: down/.test((await failing["tools/call"]({ name: "search", arguments: { query: "x" } })).content[0].text), "an explorer error says so");
+    console.log("mcp.js self-check ok — search, get and publishers ask the explorer and never the chain; publishers groups repos by publisher; buy quotes at the explorer; publish and wallet");
     process.exit(0);
 }
 
-const argv = process.argv.slice(2);
-globalThis.fetch = cachingFetch();
 // Node gives each address 250ms before trying the next; on a slow link, or a
 // host with no working IPv6, every attempt times out and fetch fails outright.
 net.setDefaultAutoSelectFamilyAttemptTimeout?.(2000);
-const vt = await import("./view-tools.js");
-const stale = staleFetch(globalThis.fetch);
-const fb = argv.indexOf("--from-block");
-const fromBlock = fb >= 0 ? BigInt(argv[fb + 1]) : DEFAULT_FROM_BLOCK;
-const headed = argv.includes("--headed");
-const ci = argv.indexOf("--cdp");
-const cdp = ci >= 0 ? argv[ci + 1] : process.env.FANGORN_MCP_CDP || undefined;
-let found, foundAt = 0, explored, exploredAt = 0;
+const EXPLORER = (process.env.FANGORN_EXPLORER || "https://explorer.fangorn.network").replace(/\/+$/, "");
+let explorer;
+// The person's key: this server's own, else the one the fangorn CLI signs with.
+const FANGORN_DIR = `${homedir()}/.fangorn`;
+let KEY = process.env.FANGORN_MCP_WALLET_KEY || undefined;   // the plugin passes "" when unset
+try { KEY ??= JSON.parse(readFileSync(`${FANGORN_DIR}/config.json`, "utf8")).privateKey; } catch { /* no CLI config */ }
+KEY &&= `0x${KEY.trim().replace(/^0x/i, "")}`;   // a key file may lack 0x
+const needKey = () => { if (!KEY) throw new Error("no wallet: run `fangorn init`, or set FANGORN_MCP_WALLET_KEY"); return KEY; };
+let signer, pub;
+const signing = async () => (signer ??= (await import("@fangorn-network/sdk")).Fangorn.create({
+    privateKey: needKey(), config: await network(), storage: { signedUrl: {} } }));
+const chainClient = async () => {
+    if (!pub) {
+        const [{ createPublicClient, http }, n] = await Promise.all([import("viem"), network()]);
+        pub = createPublicClient({ chain: n.chain, transport: http(n.rpcUrl) });
+    }
+    return pub;
+};
+// Circle's USDC on Base Sepolia. ponytail: one network's; FANGORN_USDC for another.
+const USDC = process.env.FANGORN_USDC || "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
 const deps = {
-    // ponytail: cached for a minute. The scan is a few RPC calls plus a fetch per card.
-    findApps: async () => {
-        if (!found || Date.now() - foundAt > 60_000) {
-            const { apps, rejected } = await listApps(await fangorn(), { fromBlock });
-            found = { rejected, apps: await Promise.all(apps.map(async (a) => {
-                const card = await (await fetch(a.card)).json().catch(() => ({}));
-                return { ...a, tools: card.skills?.filter((s) => s.tags?.includes("webmcp")).map((s) => s.id) ?? [] };
-            })) };
-            foundAt = Date.now();
+    // The explorer's view, searched here. Re-read every 5 minutes, so a long session sees new publishers.
+    // ponytail: the first search downloads the whole view; route to the best domains (shard.js setDomains)
+    // once the network is big enough for that to hurt.
+    explorer: async () => {
+        if (!explorer || Date.now() - explorer.at > 300_000) {
+            const [vt, { resetShard }] = await Promise.all([import("./view-tools.js"), import("../core/shard.js")]);
+            resetShard();
+            explorer = { at: Date.now(), ...vt.viewTools({ name: "the Fangorn explorer", desc: "every publisher", views: [`${EXPLORER}/view`] }) };
         }
-        return found;
+        return explorer;
     },
-    // ponytail: cached for a minute, like findApps. Two getLogs, a card and catalog per app.
-    exploreApps: async (query) => {
-        if (!explored || Date.now() - exploredAt > 60_000) {
-            const [ex, { createPublicClient, http }, { arbitrumSepolia }] = await Promise.all([import("../discover/explore.js"), import("viem"), import("viem/chains")]);
-            explored = { ex, dir: await ex.readDirectory(createPublicClient({ chain: arbitrumSepolia, transport: http() })) };
-            exploredAt = Date.now();
-        }
-        const { ex, dir } = explored;
-        const { EMBED_MODEL } = await import("../core/embed.js");
-        const qv = query?.trim() ? await vt.queryVector(query) : null;
-        const apps = ex.rankApps(dir.apps, query, { qv, model: EMBED_MODEL }).map(ex.brief);
-        return { apps, ranked_by: apps[0]?.ranked_by ?? null };
+    quote: (p, r, id) => `${EXPLORER}/paid/${encodeURIComponent(p)}/${encodeURIComponent(r)}/${encodeURIComponent(id)}`,
+    // Paying is opted into with this server's own key; the CLI's key alone only publishes.
+    buy: async (quote) => {
+        if (!process.env.FANGORN_MCP_WALLET_KEY) throw new Error("buying is off: set FANGORN_MCP_WALLET_KEY");
+        const { buyRecord } = await import("./x402.js");
+        return buyRecord(quote, { privateKey: needKey(), fangorn: await signing(),
+            maxPrice: BigInt(Math.round(Number(process.env.FANGORN_MCP_MAX_PRICE || "0.10") * 1e6)) });
     },
-    findByName: async (name) => {
-        const [f, { appId }] = await Promise.all([fangorn(), import("@fangorn-network/sdk")]);
-        const reg = f.getAppRegistry();
-        for (const id of /^0x[0-9a-fA-F]{64}$/.test(name) ? [name] : [...new Set([name, name.toLowerCase()])].map(appId)) {
-            const card = await reg.appAgentUri(id).catch(() => "");
-            if (card) return { card, appId: id };
-        }
-        return null;
+    wallet: async () => {
+        const [{ privateKeyToAccount }, { parseAbi, formatUnits, formatEther }, c] = await Promise.all([import("viem/accounts"), import("viem"), chainClient()]);
+        const address = privateKeyToAccount(needKey()).address;
+        const [usdc, eth] = await Promise.all([
+            c.readContract({ address: USDC, abi: parseAbi(["function balanceOf(address) view returns (uint256)"]), functionName: "balanceOf", args: [address] }),
+            c.getBalance({ address })]);
+        return { address, usdc: formatUnits(usdc, 6), eth: formatEther(eth) };
     },
-    resolveCard,
-    viewTools: (app) => {
-        const v = vt.viewTools(app, { fetchCatalog: stale });
-        if (v) vt.warm({ cacheDir: `${CACHE}/models` });   // already started at initialize; this is the fallback
-        return v;
+    publish: async ({ repo, records }) => {
+        const f = await signing();
+        await f.initRepo(repo);
+        const { txHash, commitCid } = await f.uploadBatch(repo, records);
+        return { publisher: f.getAddress(), repo, records: records.length, commit: commitCid, tx: txHash };
     },
-    openTab: (page) => openTab(page, { headed, cdp }),
-    tabTools, tabCall,
-};
-const h = handlers(deps);
-// The client starts this server with the session, long before an agent opens an
-// app: load the SDK and the embedding model then, behind the agent's first
-// thought. After the initialize reply, not before: both block the thread while
-// they load, and the client is waiting on that reply.
-const reply = h.initialize;
-h.initialize = async (p) => {
-    setImmediate(() => {
-        fangorn().then(() => trace("sdk ready"), () => {});
-        vt.warm({ cacheDir: `${CACHE}/models` }).then((ok) => ok ? trace("embedder ready")
-            : log(`embedder unavailable, searching by words: ${vt.warmError}`));
-    });
-    return reply(p);
 };
-deps.notify = serve(h);
-log(`ready: apps from block ${fromBlock}; browser ${cdp ?? "local Chrome"}, connected on the first open-app`);
+serve(handlers(deps));
+log(`ready: explorer ${EXPLORER}`);