@iicp/client 0.7.51 → 0.7.56

package/README.md

@@ -317,6 +317,8 @@ const node = new IicpNode({
 });
 ```
 
+> **Security note**: relay bind authentication is pending ([#510](https://github.com/RobLe3/iicp.network/issues/510)) — only run a relay accept port on networks you trust until the signed-bind mechanism ships.
+
 ### Opt-out / override
 
 ```bash

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAwCA,OAAO,EAcL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AAypBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AAicD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAyCA,OAAO,EAeL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAuaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AA+pBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AA8dD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}

package/dist/cli.js

@@ -26,6 +26,7 @@ const node_crypto_1 = require("node:crypto");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const SDK_VERSION = require("../package.json").version;
 const net = require("node:net");
+const http = require("node:http");
 const node_child_process_1 = require("node:child_process");
 const readline = require("node:readline/promises");
 const node_process_1 = require("node:process");
@@ -64,6 +65,7 @@ function printHelp() {
         `  query <prompt>             Discover mesh nodes and submit a chat task\n` +
         `  credits                    Show this node's earned / spent / balance credits\n` +
         `  proxy                      Run the local OpenAI/Ollama/Anthropic-compat gateway (loopback; no registration)\n` +
+        `  mcp-gateway                Bridge a local MCP server as an IICP provider node (registers + serves)\n` +
         `  operator rename <name>     Change your public display_name (signed by your operator key)\n` +
         `  operator encrypt           Password-encrypt the operator secret at rest ($IICP_OPERATOR_PASSPHRASE)\n` +
         `  operator decrypt           Remove at-rest encryption of the operator secret\n\n` +
@@ -90,7 +92,9 @@ function printHelp() {
         `  --external-ip-probe-url U  IICP_EXTERNAL_IP_PROBE_URL — fallback IPv4 probe\n` +
         `  --relay-worker-endpoint H  IICP_RELAY_WORKER_ENDPOINT — <host>:<port> of a relay node (R2 last-resort)\n` +
         `  --relay-capable            IICP_RELAY_CAPABLE — advertise as relay server for CGNAT/tier-4 operators\n` +
-        `  --relay-accept-port N      IICP_RELAY_ACCEPT_PORT — TCP port for relay accept server (default 9485)\n` +
+        `  --relay-accept-port N      IICP_RELAY_ACCEPT_PORT — TCP port for relay accept server (default 9485).\n` +
+        `                             Note: relay bind authentication is pending (#510) — only run a relay\n` +
+        `                             accept port on networks you trust until the signed-bind mechanism ships.\n` +
         `  --log-dir DIR              IICP_LOG_DIR — directory for persistent log files (<node_id>.log + events.jsonl)\n` +
         `  --with-proxy               IICP_WITH_PROXY — also run the loopback compat proxy (127.0.0.1:9483) in-process\n\n` +
         `query optional:\n` +
@@ -619,6 +623,12 @@ async function runServe(opts) {
     let _opDisplayName;
     let _opCreatedAt;
     let _opIntegrityHash;
+    const _identityNotice = (0, identity_js_1.noIdentityNotice)(_op);
+    if (_identityNotice !== null) {
+        // #503 — anonymous registration accrues no founder/recognition standing;
+        // say so loudly instead of silently excluding the operator. Non-fatal.
+        process.stderr.write(_identityNotice + "\n");
+    }
     if (_op && (0, identity_js_1.operatorIsKeyBacked)(_op)) {
         _opDelegation = (0, delegation_js_1.issueDelegation)((0, identity_js_1.operatorSigningKey)(_op), nodeId);
         _opDisplayName = _op.display_name || undefined;
@@ -1206,13 +1216,22 @@ async function runCredits(argv) {
                         // Multiple nodes have tokens — show all of them.
                         const dir = directoryUrl ?? process.env["IICP_DIRECTORY_URL"] ?? "https://iicp.network/api";
                         process.stderr.write(`[iicp-node] no --node given — showing credits for all ${withToken.length} nodes:\n`);
+                        // One node failing must not hide the others — show every node,
+                        // then exit non-zero if any failed (2026-06-11).
+                        let failed = 0;
                         for (let i = 0; i < withToken.length; i++) {
                             if (i > 0)
                                 process.stdout.write("\n");
                             const n = withToken[i];
                             const rc = await fetchAndDisplayCredits(n.directory_url ?? dir, n.node_id, n.node_token, n.name, Boolean(values["json"]), Boolean(values["verify"]));
-                            if (rc !== 0)
-                                return rc;
+                            if (rc !== 0) {
+                                process.stderr.write(`ERROR: credits fetch failed for node '${n.name}' — continuing with remaining nodes\n`);
+                                failed++;
+                            }
+                        }
+                        if (failed > 0) {
+                            process.stderr.write(`ERROR: ${failed}/${withToken.length} node(s) failed\n`);
+                            return 1;
                         }
                         return 0;
                     }
@@ -1252,23 +1271,43 @@ async function runCredits(argv) {
 /** Shared fetch+display logic for one node's credits summary. */
 async function fetchAndDisplayCredits(directoryUrl, nodeId, token, label, asJson, verify) {
     const url = `${directoryUrl.replace(/\/+$/, "")}/v1/credits/summary?node_id=${encodeURIComponent(nodeId)}`;
+    // Transient failures (network error, 5xx, undecodable body) get ONE retry
+    // after a short pause — shared-hosting blips and deploy windows otherwise
+    // surface as one-shot CLI errors (observed 2026-06-11).
     let resp;
-    try {
-        resp = await fetch(url, {
-            headers: { Authorization: `Bearer ${token}` },
-            signal: AbortSignal.timeout(15000),
-        });
-    }
-    catch (e) {
-        process.stderr.write(`ERROR: request failed: ${e instanceof Error ? e.message : String(e)}\n`);
-        return 1;
-    }
     let body;
-    try {
-        body = (await resp.json());
+    let lastErr = "";
+    for (let attempt = 1; attempt <= 2; attempt++) {
+        resp = undefined;
+        body = undefined;
+        try {
+            resp = await fetch(url, {
+                headers: { Authorization: `Bearer ${token}` },
+                signal: AbortSignal.timeout(15000),
+            });
+        }
+        catch (e) {
+            lastErr = `request failed: ${e instanceof Error ? e.message : String(e)}`;
+        }
+        if (resp) {
+            try {
+                body = (await resp.json());
+            }
+            catch {
+                lastErr = `bad response (HTTP ${resp.status})`;
+            }
+            if (body !== undefined && resp.status < 500)
+                break; // success or definitive 4xx
+            if (body !== undefined) {
+                const err = body["error"];
+                lastErr = `HTTP ${resp.status}: ${err?.message ?? "request rejected"}`;
+            }
+        }
+        if (attempt === 1)
+            await new Promise((r) => setTimeout(r, 2000));
     }
-    catch {
-        process.stderr.write(`ERROR: bad response (HTTP ${resp.status})\n`);
+    if (!resp || body === undefined || resp.status >= 500) {
+        process.stderr.write(`ERROR: ${lastErr}\n`);
         return 1;
     }
     if (!resp.ok) {
@@ -1556,6 +1595,187 @@ async function main(argv = process.argv.slice(2)) {
         throw exc;
     }
 }
+// ── mcp-gateway (#512) ───────────────────────────────────────────────────────
+const _MCP_DANGEROUS = new Set(["bash", "shell", "exec", "run_command", "eval"]);
+function _toolToIntent(name) {
+    const safe = name.toLowerCase().replace(/[^a-z0-9_]/g, "_");
+    return `urn:iicp:intent:mcp:${safe}:v1`;
+}
+async function runMcpGateway(argv) {
+    const helpFlag = argv.includes("--help") || argv.includes("-h");
+    if (helpFlag) {
+        process.stdout.write(`usage: iicp-node mcp-gateway [options]\n\n` +
+            `Bridge a local MCP server into the IICP mesh as a registered provider node.\n\n` +
+            `Options:\n` +
+            `  --mcp-url URL        IICP_MCP_URL — MCP server base URL (default http://localhost:8001)\n` +
+            `  --tools NAMES        IICP_MCP_TOOLS — comma-separated tool names to advertise (required)\n` +
+            `  --node-id ID         IICP_NODE_ID — auto-generated if absent\n` +
+            `  --public-endpoint U  IICP_PUBLIC_ENDPOINT — externally reachable URL of this gateway\n` +
+            `  --directory-url URL  IICP_DIRECTORY_URL (default https://iicp.network/api/v1)\n` +
+            `  --region REGION      IICP_REGION (default local)\n` +
+            `  --port N             IICP_PORT (default 9484)\n` +
+            `  --host HOST          IICP_HOST (default ::)\n`);
+        return 0;
+    }
+    const { values } = safeParseArgs({
+        args: argv,
+        options: {
+            "mcp-url": { type: "string" },
+            tools: { type: "string" },
+            "node-id": { type: "string" },
+            "public-endpoint": { type: "string" },
+            "directory-url": { type: "string" },
+            region: { type: "string" },
+            port: { type: "string" },
+            host: { type: "string" },
+        },
+        allowPositionals: false,
+    });
+    const mcpUrl = (values["mcp-url"] ?? envOr("IICP_MCP_URL") ?? "http://localhost:8001").replace(/\/$/, "");
+    const rawTools = (values["tools"] ?? envOr("IICP_MCP_TOOLS") ?? "")
+        .split(",").map((t) => t.trim()).filter(Boolean);
+    const activeTools = rawTools.filter((t) => !_MCP_DANGEROUS.has(t.toLowerCase()));
+    if (activeTools.length === 0) {
+        process.stderr.write(`ERROR: --tools is required. Provide a comma-separated list of MCP tool names.\n` +
+            `  Example: iicp-node mcp-gateway --tools read_file,list_dir --mcp-url http://localhost:8001\n`);
+        return 2;
+    }
+    const nodeId = values["node-id"] ?? envOr("IICP_NODE_ID") ?? `gateway-mcp-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`;
+    const directoryUrl = (values["directory-url"] ?? envOr("IICP_DIRECTORY_URL") ?? "https://iicp.network/api/v1").replace(/\/$/, "");
+    const region = values["region"] ?? envOr("IICP_REGION") ?? "local";
+    const port = parsePort(values["port"], 9484);
+    const host = values["host"] ?? envOr("IICP_HOST") ?? "::";
+    const publicEndpoint = values["public-endpoint"] ?? envOr("IICP_PUBLIC_ENDPOINT") ?? `http://localhost:${port}`;
+    const intents = activeTools.map(_toolToIntent);
+    let nodeToken = envOr("IICP_NODE_TOKEN") ?? "";
+    async function doRegister() {
+        const payload = { node_id: nodeId, region, endpoint: publicEndpoint, intents, mcp_tools: activeTools, protocol_version: "1.0" };
+        const headers = { "Content-Type": "application/json" };
+        if (nodeToken)
+            headers["Authorization"] = `Bearer ${nodeToken}`;
+        const resp = await fetch(`${directoryUrl}/register`, { method: "POST", headers, body: JSON.stringify(payload), signal: AbortSignal.timeout(10_000) });
+        if (!resp.ok)
+            throw new Error(`register ${resp.status}`);
+        const data = await resp.json();
+        return data["node_token"] ?? nodeToken;
+    }
+    async function doHeartbeat() {
+        const payload = { node_id: nodeId, intents, load: 0.0, status: "active" };
+        try {
+            await fetch(`${directoryUrl}/heartbeat`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "Authorization": `Bearer ${nodeToken}` },
+                body: JSON.stringify(payload),
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            // heartbeat failures are non-fatal
+        }
+    }
+    let mcpRpcId = 0;
+    async function callMcp(toolName, args) {
+        mcpRpcId += 1;
+        const rpc = { jsonrpc: "2.0", id: mcpRpcId, method: "tools/call", params: { name: toolName, arguments: args } };
+        const resp = await fetch(`${mcpUrl}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(rpc),
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!resp.ok)
+            throw new Error(`MCP server unreachable: ${resp.status}`);
+        const data = await resp.json();
+        if (data["error"])
+            throw new Error(data["error"]["message"] ?? "MCP error");
+        return data["result"];
+    }
+    try {
+        nodeToken = await doRegister();
+        process.stdout.write(`iicp-node mcp-gateway registered as '${nodeId}' with ${activeTools.length} tool(s): ${activeTools.join(", ")}\n` +
+            `  IICP endpoint: ${publicEndpoint}\n  MCP server:    ${mcpUrl}\n`);
+    }
+    catch (err) {
+        process.stderr.write(`WARNING: directory registration failed (${err.message}) — running without listing\n`);
+    }
+    const hbInterval = setInterval(() => { void doHeartbeat(); }, 30_000);
+    const server = http.createServer(async (req, res) => {
+        if (req.method === "GET" && req.url === "/iicp/health") {
+            const body = JSON.stringify({ status: "ok", node_id: nodeId, active_tools: activeTools, mcp_server: mcpUrl, timestamp: Math.floor(Date.now() / 1000) });
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(body);
+            return;
+        }
+        if (req.method === "POST" && req.url === "/v1/task") {
+            const auth = req.headers["authorization"] ?? "";
+            if (!nodeToken || auth !== `Bearer ${nodeToken}`) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            let body;
+            try {
+                body = JSON.parse(Buffer.concat(chunks).toString());
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid JSON" }));
+                return;
+            }
+            const payload = (body["payload"] ?? {});
+            let toolName = payload["tool_name"] ?? "";
+            if (!toolName) {
+                const m = /urn:iicp:intent:mcp:([^:]+):v1/.exec(body["intent"] ?? "");
+                if (m)
+                    toolName = m[1];
+            }
+            if (!toolName) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Cannot determine tool name" }));
+                return;
+            }
+            if (_MCP_DANGEROUS.has(toolName.toLowerCase())) {
+                res.writeHead(403, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Tool not permitted" }));
+                return;
+            }
+            if (activeTools.length && !activeTools.includes(toolName)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Tool not available" }));
+                return;
+            }
+            const taskId = body["task_id"] ?? (0, node_crypto_1.randomUUID)();
+            try {
+                const result = await callMcp(toolName, (payload["arguments"] ?? {}));
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ task_id: taskId, status: "completed", result }));
+            }
+            catch (err) {
+                const msg = err.message ?? "error";
+                const code = msg.includes("unreachable") ? 502 : 422;
+                res.writeHead(code, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: msg }));
+            }
+            return;
+        }
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not found" }));
+    });
+    await new Promise((resolve) => {
+        server.listen(port, host === "::" ? "::" : host, () => {
+            process.stdout.write(`  Listening on ${host}:${port}\n`);
+            resolve();
+        });
+    });
+    await new Promise((resolve) => {
+        process.on("SIGINT", () => { clearInterval(hbInterval); server.close(); resolve(); });
+        process.on("SIGTERM", () => { clearInterval(hbInterval); server.close(); resolve(); });
+    });
+    return 0;
+}
 /** Command dispatch — separated so main() can wrap parse failures as clean CliError output. */
 async function dispatch(argv) {
     const cmd = argv[0];
@@ -1571,6 +1791,8 @@ async function dispatch(argv) {
         return runOperator(argv.slice(1));
     if (cmd === "proxy")
         return runProxyCmd(argv.slice(1));
+    if (cmd === "mcp-gateway")
+        return runMcpGateway(argv.slice(1));
     if (cmd !== "serve") {
         process.stderr.write(`unknown command: ${cmd}\n`);
         printHelp();