@harbinger-ai/harbinger 0.1.0

package/lib/db/users.js

@@ -0,0 +1,89 @@
+import { randomUUID } from 'crypto';
+import { hashSync, genSaltSync, compare } from 'bcrypt-ts';
+import { eq, sql } from 'drizzle-orm';
+import { getDb } from './index.js';
+import { users } from './schema.js';
+
+/**
+ * Get the total number of users.
+ * Used to detect first-time setup (no users = needs setup).
+ * @returns {number}
+ */
+export function getUserCount() {
+  const db = getDb();
+  const result = db.select({ count: sql`count(*)` }).from(users).get();
+  return result?.count ?? 0;
+}
+
+/**
+ * Find a user by email address.
+ * @param {string} email
+ * @returns {object|undefined}
+ */
+export function getUserByEmail(email) {
+  const db = getDb();
+  return db.select().from(users).where(eq(users.email, email.toLowerCase())).get();
+}
+
+/**
+ * Create a new user with a hashed password.
+ * @param {string} email
+ * @param {string} password - Plain text password (will be hashed)
+ * @returns {object} The created user (without password_hash)
+ */
+export async function createUser(email, password) {
+  const db = getDb();
+  const now = Date.now();
+  const passwordHash = hashSync(password, genSaltSync(10));
+
+  const user = {
+    id: randomUUID(),
+    email: email.toLowerCase(),
+    passwordHash: passwordHash,
+    role: 'admin',
+    createdAt: now,
+    updatedAt: now,
+  };
+
+  db.insert(users).values(user).run();
+
+  return { id: user.id, email: user.email, role: user.role };
+}
+
+/**
+ * Atomically create the first user (admin) if no users exist.
+ * Uses a transaction to prevent race conditions — only one caller wins.
+ * @param {string} email
+ * @param {string} password - Plain text password (will be hashed)
+ * @returns {object|null} The created user, or null if users already exist
+ */
+export function createFirstUser(email, password) {
+  const db = getDb();
+  return db.transaction((tx) => {
+    const count = tx.select({ count: sql`count(*)` }).from(users).get();
+    if (count?.count > 0) return null;
+
+    const now = Date.now();
+    const passwordHash = hashSync(password, genSaltSync(10));
+    const user = {
+      id: randomUUID(),
+      email: email.toLowerCase(),
+      passwordHash: passwordHash,
+      role: 'admin',
+      createdAt: now,
+      updatedAt: now,
+    };
+    tx.insert(users).values(user).run();
+    return { id: user.id, email: user.email, role: user.role };
+  });
+}
+
+/**
+ * Verify a password against a user's stored hash.
+ * @param {object} user - User object with password_hash field
+ * @param {string} password - Plain text password to verify
+ * @returns {Promise<boolean>}
+ */
+export async function verifyPassword(user, password) {
+  return compare(password, user.passwordHash);
+}

package/lib/mcp/actions.js

@@ -0,0 +1,104 @@
+'use server';
+
+import fs from 'fs';
+import { auth } from '../auth/index.js';
+import { mcpServersFile } from '../paths.js';
+
+async function requireAuth() {
+  const session = await auth();
+  if (!session?.user?.id) {
+    throw new Error('Unauthorized');
+  }
+  return session.user;
+}
+
+/**
+ * Read MCP_SERVERS.json config.
+ */
+export async function getMcpServers() {
+  await requireAuth();
+  if (!fs.existsSync(mcpServersFile)) return [];
+  try {
+    return JSON.parse(fs.readFileSync(mcpServersFile, 'utf8'));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Get status of loaded MCP tools from the client singleton.
+ */
+export async function getMcpStatus() {
+  await requireAuth();
+  try {
+    const { loadMcpTools } = await import('./client.js');
+    const tools = await loadMcpTools();
+    return {
+      loaded: true,
+      toolCount: tools.length,
+      tools: tools.map(t => ({ name: t.name, description: t.description })),
+    };
+  } catch (err) {
+    return { loaded: false, toolCount: 0, tools: [], error: err.message };
+  }
+}
+
+/**
+ * Get metadata about thepopebot's own MCP server capabilities.
+ */
+export async function getOwnMcpServerInfo() {
+  await requireAuth();
+  return {
+    tools: [
+      { name: 'create_job', description: 'Create a new autonomous agent job' },
+      { name: 'get_job_status', description: 'Get the status of running or recent agent jobs' },
+      { name: 'chat', description: 'Send a message to the AI chat agent' },
+      { name: 'list_agents', description: 'List all discovered agent profiles' },
+      { name: 'get_agent_profile', description: 'Get the full profile for a specific agent' },
+    ],
+    resources: [
+      { uri: 'agent://agents', description: 'List of all agent profiles' },
+      { uri: 'agent://{agentId}/soul', description: 'SOUL.md for a specific agent' },
+      { uri: 'config://soul', description: 'Main SOUL.md configuration' },
+      { uri: 'config://crons', description: 'Cron jobs configuration' },
+      { uri: 'config://triggers', description: 'Webhook triggers configuration' },
+    ],
+    prompts: [
+      { name: 'agent-prompt', description: 'System prompt for an agent' },
+    ],
+  };
+}
+
+/**
+ * Test an external MCP tool by invoking it.
+ */
+export async function testMcpTool(toolName, args = {}) {
+  await requireAuth();
+  try {
+    const { loadMcpTools } = await import('./client.js');
+    const tools = await loadMcpTools();
+    const tool = tools.find(t => t.name === toolName);
+    if (!tool) return { error: `Tool "${toolName}" not found` };
+    const result = await tool.invoke(args);
+    return { success: true, result };
+  } catch (err) {
+    return { error: err.message };
+  }
+}
+
+/**
+ * Reset the MCP client and agent singletons, then reload tools.
+ */
+export async function reloadMcpClient() {
+  await requireAuth();
+  try {
+    const { resetMcpClient, loadMcpTools } = await import('./client.js');
+    const { resetAgent } = await import('../ai/agent.js');
+    await resetMcpClient();
+    resetAgent();
+    const tools = await loadMcpTools();
+    return { success: true, toolCount: tools.length };
+  } catch (err) {
+    return { error: err.message };
+  }
+}

package/lib/mcp/client.js

@@ -0,0 +1,79 @@
+import fs from 'fs';
+import { mcpServersFile } from '../paths.js';
+
+let _client = null;
+let _promise = null;
+
+/**
+ * Load MCP tools from configured external servers in MCP_SERVERS.json.
+ * Uses @langchain/mcp-adapters MultiServerMCPClient to connect and
+ * convert external MCP tools into LangChain-compatible tools.
+ *
+ * Returns an empty array if no servers are configured or the config file doesn't exist.
+ * Uses promise-based singleton to prevent concurrent initialization races.
+ */
+export function loadMcpTools() {
+  if (!_promise) {
+    _promise = _loadMcpToolsImpl().catch(err => {
+      _promise = null; // allow retry on failure
+      throw err;
+    });
+  }
+  return _promise;
+}
+
+async function _loadMcpToolsImpl() {
+  // Read config
+  if (!fs.existsSync(mcpServersFile)) return [];
+
+  let servers;
+  try {
+    servers = JSON.parse(fs.readFileSync(mcpServersFile, 'utf8'));
+  } catch {
+    return [];
+  }
+
+  if (!Array.isArray(servers) || servers.length === 0) return [];
+
+  // Filter to enabled servers only
+  const enabled = servers.filter(s => s.enabled !== false);
+  if (enabled.length === 0) return [];
+
+  // Build config for MultiServerMCPClient
+  const mcpConfig = {};
+  for (const server of enabled) {
+    if (!server.name || !server.url) continue;
+    mcpConfig[server.name] = {
+      transport: server.transport || 'http',
+      url: server.url,
+      headers: server.headers || {},
+    };
+  }
+
+  if (Object.keys(mcpConfig).length === 0) return [];
+
+  try {
+    const { MultiServerMCPClient } = await import('@langchain/mcp-adapters');
+    _client = new MultiServerMCPClient(mcpConfig);
+    // Race against a timeout to prevent hanging on unresponsive MCP servers
+    const tools = await Promise.race([
+      _client.getTools(),
+      new Promise((_, reject) => setTimeout(() => reject(new Error('MCP tool loading timed out after 15s')), 15000)),
+    ]);
+    return tools;
+  } catch (err) {
+    console.error('Failed to load MCP tools:', err.message);
+    return [];
+  }
+}
+
+/**
+ * Reset the MCP client singleton so tools are reloaded on next call.
+ */
+export async function resetMcpClient() {
+  if (_client) {
+    try { await _client.close(); } catch {}
+  }
+  _client = null;
+  _promise = null;
+}

package/lib/mcp/handler.js

@@ -0,0 +1,57 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpServer } from './server.js';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { version } = require('../../package.json');
+
+// Cache the MCP server instance — it's stateless, only the transport is per-request
+let _mcpServer = null;
+function getMcpServer() {
+  if (!_mcpServer) _mcpServer = createMcpServer();
+  return _mcpServer;
+}
+
+/**
+ * Handle MCP HTTP requests at /api/mcp.
+ * Auth is handled by the main API router (api/index.js checkAuth).
+ *
+ * - POST: JSON-RPC messages (tool calls, resource reads, etc.)
+ * - GET: Server capability info
+ * - DELETE: Not supported (stateless, no sessions)
+ */
+export async function handleMcpRequest(request) {
+  const method = request.method;
+
+  if (method === 'DELETE') {
+    return Response.json({ error: 'Method not allowed' }, { status: 405 });
+  }
+
+  try {
+    if (method === 'POST') {
+      const server = getMcpServer();
+      const transport = new StreamableHTTPServerTransport({ enableJsonResponse: true });
+      await server.connect(transport);
+      const body = await request.json();
+      const result = await transport.handleRequest(request, body);
+      if (result instanceof Response) return result;
+      return Response.json(result);
+    }
+
+    if (method === 'GET') {
+      return Response.json({
+        name: 'thepopebot',
+        version,
+        description: 'thepopebot MCP server — autonomous AI agent platform',
+        tools: ['create_job', 'get_job_status', 'chat', 'list_agents', 'get_agent_profile'],
+        resources: ['agent://agents', 'agent://{agentId}/soul', 'config://soul', 'config://crons', 'config://triggers'],
+        prompts: ['agent-prompt'],
+      });
+    }
+
+    return Response.json({ error: 'Method not allowed' }, { status: 405 });
+  } catch (err) {
+    console.error('MCP handler error:', err);
+    return Response.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

package/lib/mcp/server.js

@@ -0,0 +1,165 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import fs from 'fs';
+import { createRequire } from 'module';
+import { soulMd, cronsFile, triggersFile } from '../paths.js';
+
+const require = createRequire(import.meta.url);
+const { version } = require('../../package.json');
+
+/**
+ * Create a fresh McpServer instance with all tools, resources, and prompts registered.
+ */
+export function createMcpServer() {
+  const server = new McpServer({
+    name: 'thepopebot',
+    version,
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Tools
+  // ─────────────────────────────────────────────────────────────────────────
+
+  server.tool(
+    'create_job',
+    'Create a new autonomous agent job. The agent runs in a Docker container and creates a PR with results.',
+    { job_description: z.string().describe('Description of the task for the agent to perform') },
+    async ({ job_description }) => {
+      const { createJob } = await import('../tools/create-job.js');
+      const result = await createJob(job_description);
+      return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+    }
+  );
+
+  server.tool(
+    'get_job_status',
+    'Get the status of running or recent agent jobs.',
+    { job_id: z.string().optional().describe('Optional specific job ID to check') },
+    async ({ job_id }) => {
+      const { getJobStatus } = await import('../tools/github.js');
+      const result = await getJobStatus(job_id);
+      return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+    }
+  );
+
+  server.tool(
+    'chat',
+    'Send a message to the AI chat agent and get a response. Use agent_id to route to a specific Harbinger agent profile.',
+    {
+      thread_id: z.string().describe('Conversation thread ID'),
+      message: z.string().describe('Message to send'),
+      agent_id: z.string().optional().describe('Optional agent profile ID to route to (e.g. recon-scout, web-hacker)'),
+    },
+    async ({ thread_id, message, agent_id }) => {
+      const { chat } = await import('../ai/index.js');
+      const response = await chat(thread_id, message, [], agent_id ? { agentId: agent_id } : {});
+      return { content: [{ type: 'text', text: response }] };
+    }
+  );
+
+  server.tool(
+    'list_agents',
+    'List all discovered agent profiles with their identities and roles.',
+    {},
+    async () => {
+      const { discoverAgents } = await import('../agents.js');
+      const agents = discoverAgents();
+      return { content: [{ type: 'text', text: JSON.stringify(agents.map(a => ({ id: a.id, codename: a.codename, name: a.name, role: a.role }))) }] };
+    }
+  );
+
+  server.tool(
+    'get_agent_profile',
+    'Get the full profile for a specific agent including SOUL, skills, and tools.',
+    { agent_id: z.string().describe('Directory name of the agent profile') },
+    async ({ agent_id }) => {
+      const { loadAgentProfile } = await import('../agents.js');
+      const profile = loadAgentProfile(agent_id);
+      if (!profile) return { content: [{ type: 'text', text: JSON.stringify({ error: 'Agent not found' }) }] };
+      return { content: [{ type: 'text', text: JSON.stringify(profile) }] };
+    }
+  );
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Resources
+  // ─────────────────────────────────────────────────────────────────────────
+
+  server.resource(
+    'agents-list',
+    'agent://agents',
+    'List of all discovered agent profiles',
+    async () => {
+      const { discoverAgents } = await import('../agents.js');
+      const agents = discoverAgents();
+      return { contents: [{ uri: 'agent://agents', text: JSON.stringify(agents.map(a => ({ id: a.id, codename: a.codename, name: a.name, role: a.role }))) }] };
+    }
+  );
+
+  server.resource(
+    'agent-soul',
+    'agent://{agentId}/soul',
+    'SOUL.md system prompt for a specific agent',
+    async (uri) => {
+      const agentId = uri.pathname.split('/')[0] || uri.host;
+      const { loadAgentProfile } = await import('../agents.js');
+      const profile = loadAgentProfile(agentId);
+      const text = profile?.soul || 'Agent not found or has no SOUL.md';
+      return { contents: [{ uri: uri.href, text }] };
+    }
+  );
+
+  server.resource(
+    'config-soul',
+    'config://soul',
+    'The main SOUL.md configuration file',
+    async () => {
+      const text = fs.existsSync(soulMd) ? fs.readFileSync(soulMd, 'utf8') : 'SOUL.md not found';
+      return { contents: [{ uri: 'config://soul', text }] };
+    }
+  );
+
+  server.resource(
+    'config-crons',
+    'config://crons',
+    'Configured cron jobs from CRONS.json',
+    async () => {
+      const text = fs.existsSync(cronsFile) ? fs.readFileSync(cronsFile, 'utf8') : '[]';
+      return { contents: [{ uri: 'config://crons', text }] };
+    }
+  );
+
+  server.resource(
+    'config-triggers',
+    'config://triggers',
+    'Configured webhook triggers from TRIGGERS.json',
+    async () => {
+      const text = fs.existsSync(triggersFile) ? fs.readFileSync(triggersFile, 'utf8') : '[]';
+      return { contents: [{ uri: 'config://triggers', text }] };
+    }
+  );
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Prompts
+  // ─────────────────────────────────────────────────────────────────────────
+
+  server.prompt(
+    'agent-prompt',
+    'Get the system prompt for an agent (default: main event handler)',
+    { agent_id: z.string().optional().describe('Optional agent profile ID') },
+    async ({ agent_id }) => {
+      if (agent_id) {
+        const { loadAgentProfile } = await import('../agents.js');
+        const profile = loadAgentProfile(agent_id);
+        if (profile?.soul) {
+          return { messages: [{ role: 'user', content: { type: 'text', text: profile.soul } }] };
+        }
+      }
+      const { eventHandlerMd } = await import('../paths.js');
+      const { render_md } = await import('../utils/render-md.js');
+      const text = render_md(eventHandlerMd);
+      return { messages: [{ role: 'user', content: { type: 'text', text } }] };
+    }
+  );
+
+  return server;
+}

package/lib/paths.js

@@ -0,0 +1,46 @@
+import path from 'path';
+
+/**
+ * Central path resolver for thepopebot.
+ * All paths resolve from process.cwd() (the user's project root).
+ */
+
+const PROJECT_ROOT = process.cwd();
+
+export {
+  PROJECT_ROOT,
+};
+
+// config/ files
+export const configDir = path.join(PROJECT_ROOT, 'config');
+export const cronsFile = path.join(PROJECT_ROOT, 'config', 'CRONS.json');
+export const triggersFile = path.join(PROJECT_ROOT, 'config', 'TRIGGERS.json');
+export const mcpServersFile = path.join(PROJECT_ROOT, 'config', 'MCP_SERVERS.json');
+export const eventHandlerMd = path.join(PROJECT_ROOT, 'config', 'EVENT_HANDLER.md');
+export const jobSummaryMd = path.join(PROJECT_ROOT, 'config', 'JOB_SUMMARY.md');
+export const soulMd = path.join(PROJECT_ROOT, 'config', 'SOUL.md');
+export const claudeMd = path.join(PROJECT_ROOT, 'CLAUDE.md');
+export const skillGuidePath = path.join(PROJECT_ROOT, 'config', 'SKILL_BUILDING_GUIDE.md');
+
+// Active skills (resolves through .pi/skills → skills/active symlink)
+export const piSkillsDir = path.join(PROJECT_ROOT, '.pi', 'skills');
+
+// Working directories for command-type actions
+export const cronDir = path.join(PROJECT_ROOT, 'cron');
+export const triggersDir = path.join(PROJECT_ROOT, 'triggers');
+
+// Logs
+export const logsDir = path.join(PROJECT_ROOT, 'logs');
+
+// Data (SQLite memory, etc.)
+export const dataDir = path.join(PROJECT_ROOT, 'data');
+
+// Database
+export const thepopebotDb = process.env.DATABASE_PATH || path.join(PROJECT_ROOT, 'data', 'thepopebot.sqlite');
+
+// Agents
+export const agentsDir = path.join(PROJECT_ROOT, 'agents');
+export const agentSharedDir = path.join(PROJECT_ROOT, 'agents', 'shared');
+
+// .env
+export const envFile = path.join(PROJECT_ROOT, '.env');