@jaw.id/cli 0.1.16 → 0.1.17

package/dist/mcp/server.js

@@ -1,7 +1,7 @@
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import * as fs2 from 'fs';
+import * as fs from 'fs';
 import * as crypto from 'crypto';
 import * as path from 'path';
 import * as os from 'os';
@@ -15,10 +15,13 @@ var rpcMethodSchema = {
   params: z.any().optional().describe(
     "Method parameters \u2014 structure varies by method. Read the jaw://api-reference/{method} resource for the expected format."
   ),
-  chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia")
+  chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia"),
+  session: z.boolean().optional().describe(
+    "Sign with the local session key instead of opening the browser (requires `jaw session setup`; check jaw_session_status first). Supported methods only: eth_requestAccounts, eth_accounts, wallet_sendCalls, wallet_getCallsStatus, personal_sign, eth_signTypedData_v4. Defaults to the JAW_SESSION env var."
+  )
 };
 var configSetSchema = {
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl", "sessionExpiry"]).describe("Config key"),
   value: z.string().describe("Config value")
 };
 
@@ -79,8 +82,8 @@ function isValidRelayUrl(url) {
 
 // src/lib/config.ts
 function ensureDir(dir) {
-  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs2.chmodSync(dir, 448);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
 }
 function migrateConfig(config) {
   if (config.paymasterUrl && !config.paymasters) {
@@ -92,10 +95,10 @@ function migrateConfig(config) {
   return config;
 }
 function loadConfig() {
-  if (!fs2.existsSync(PATHS.config)) {
+  if (!fs.existsSync(PATHS.config)) {
     return {};
   }
-  const raw = fs2.readFileSync(PATHS.config, "utf-8");
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
   try {
     const config = JSON.parse(raw);
     return migrateConfig(config);
@@ -107,15 +110,36 @@ function loadConfig() {
 }
 function saveConfig(config) {
   ensureDir(PATHS.root);
-  fs2.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
 }
+function redactUrlSecrets(url) {
+  try {
+    const parsed = new URL(url);
+    for (const key of [...parsed.searchParams.keys()]) {
+      parsed.searchParams.set(key, "***");
+    }
+    return parsed.toString();
+  } catch {
+    return "***";
+  }
+}
 function redactConfig(config) {
   return {
     ...config,
-    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : void 0
+    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : void 0,
+    ...config.paymasters && {
+      paymasters: Object.fromEntries(
+        Object.entries(config.paymasters).map(([chainId, pm]) => [
+          chainId,
+          // context is a free-form object (usually just a sponsorshipPolicyId) but a
+          // provider could stash a token there, so mask it rather than hand it to the agent.
+          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? "***" : void 0 }
+        ])
+      )
+    }
   };
 }
 function setConfigValue(key, value) {
@@ -504,14 +528,10 @@ function safeParse(data) {
     return null;
   }
 }
-
-// src/lib/bridge-singleton.ts
-var DEFAULT_KEYS_URL = "https://keys.jaw.id";
-var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 function loadRelaySession() {
   try {
-    if (!fs2.existsSync(PATHS.relay)) return null;
-    const raw = fs2.readFileSync(PATHS.relay, "utf-8");
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
       return null;
@@ -523,17 +543,21 @@ function loadRelaySession() {
 }
 function saveRelaySession(info) {
   ensureDir(PATHS.root);
-  fs2.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
 }
 function deleteRelaySession() {
   try {
-    if (fs2.existsSync(PATHS.relay)) fs2.unlinkSync(PATHS.relay);
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
   } catch {
   }
 }
+
+// src/lib/bridge-singleton.ts
+var DEFAULT_KEYS_URL = "https://keys.jaw.id";
+var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 async function getBridge(options) {
   const config = loadConfig();
   const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
@@ -632,8 +656,8 @@ async function shutdownDaemon() {
   const legacyLog = PATHS.root + "/daemon.log";
   const legacyLock = PATHS.root + "/daemon.lock";
   try {
-    if (fs2.existsSync(legacyBridge)) {
-      const info = JSON.parse(fs2.readFileSync(legacyBridge, "utf-8"));
+    if (fs.existsSync(legacyBridge)) {
+      const info = JSON.parse(fs.readFileSync(legacyBridge, "utf-8"));
       if (info.pid && Number.isInteger(info.pid) && info.pid > 0) {
         try {
           process.kill(info.pid, "SIGTERM");
@@ -645,44 +669,213 @@ async function shutdownDaemon() {
   }
   for (const f of [legacyBridge, legacyLog, legacyLock]) {
     try {
-      if (fs2.existsSync(f)) fs2.unlinkSync(f);
+      if (fs.existsSync(f)) fs.unlinkSync(f);
     } catch {
     }
   }
 }
+function loadSessionKey() {
+  if (!fs.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function keystoreExists() {
+  return fs.existsSync(PATHS.keystore);
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+
+// src/lib/session-bridge.ts
+var SessionBridge = class {
+  options;
+  session = null;
+  constructor(options) {
+    this.options = { ...options };
+    if (!this.options.paymasterUrl) {
+      const config = loadConfig();
+      const pm = config.paymasters?.[this.options.chainId];
+      if (pm) {
+        this.options.paymasterUrl = pm.url;
+        this.options.paymasterContext = pm.context;
+      }
+    }
+  }
+  async getSession() {
+    if (this.session) {
+      this.checkExpiry(this.session.config);
+      return this.session;
+    }
+    const config = loadSessionConfig();
+    this.checkExpiry(config);
+    if (config.chainId !== this.options.chainId) {
+      throw new Error(
+        `Session was created for chain ${config.chainId}, but --chain ${this.options.chainId} was requested. Run \`jaw session setup --chain ${this.options.chainId}\` to create a session for that chain.`
+      );
+    }
+    let privateKeyHex = loadSessionKey();
+    const { privateKeyToAccount } = await import('viem/accounts');
+    const localAccount = privateKeyToAccount(privateKeyHex);
+    privateKeyHex = null;
+    const { Account } = await import('@jaw.id/core');
+    const account = await Account.fromLocalAccount(
+      {
+        chainId: this.options.chainId,
+        apiKey: this.options.apiKey,
+        paymasterUrl: this.options.paymasterUrl,
+        paymasterContext: this.options.paymasterContext
+      },
+      localAccount
+    );
+    this.session = { account, config };
+    return this.session;
+  }
+  checkExpiry(config) {
+    if (config.expiry <= Date.now() / 1e3) {
+      const expiryDate = new Date(config.expiry * 1e3).toISOString();
+      throw new Error(`Session expired on ${expiryDate}. Run \`jaw session setup\` to create a new session.`);
+    }
+  }
+  async request(method, params) {
+    const { account, config } = await this.getSession();
+    switch (method) {
+      case "eth_requestAccounts":
+      case "eth_accounts":
+        return [config.sessionAddress];
+      case "wallet_sendCalls": {
+        const payload = Array.isArray(params) ? params[0] : params;
+        const { calls } = payload;
+        return account.sendCalls(calls, {
+          permissionId: config.permissionId
+        });
+      }
+      case "wallet_getCallsStatus": {
+        const batchId = Array.isArray(params) ? params[0] : params;
+        return account.getCallStatus(batchId);
+      }
+      case "personal_sign": {
+        const message = Array.isArray(params) ? params[0] : params;
+        return account.signMessage(message);
+      }
+      case "eth_signTypedData_v4": {
+        const asArray = Array.isArray(params) ? params : [params];
+        const raw = asArray.length > 1 ? asArray[1] : asArray[0];
+        const typedData = typeof raw === "string" ? JSON.parse(raw) : raw;
+        return account.signTypedData(typedData);
+      }
+      case "wallet_grantPermissions":
+        throw new Error("Requires browser \u2014 run `jaw session setup`.");
+      case "wallet_revokePermissions":
+        throw new Error("Requires browser \u2014 run `jaw session revoke`.");
+      default:
+        throw new Error(`Method ${method} is not supported in auto mode.`);
+    }
+  }
+  close() {
+  }
+};
+
+// src/lib/rpc-classifier.ts
+var SESSION_SUPPORTED_METHODS = /* @__PURE__ */ new Set([
+  "eth_requestAccounts",
+  "eth_accounts",
+  "wallet_sendCalls",
+  "wallet_getCallsStatus",
+  "personal_sign",
+  "eth_signTypedData_v4"
+]);
+function supportsSessionMode(method) {
+  return SESSION_SUPPORTED_METHODS.has(method);
+}
 
 // src/mcp/handlers/rpc.ts
-function resolveApiKey() {
-  const apiKey = process.env["JAW_API_KEY"] ?? loadConfig().apiKey;
+function resolveApiKey(config) {
+  const apiKey = process.env["JAW_API_KEY"] ?? config.apiKey;
   if (!apiKey) {
     throw new Error("API key required. Set JAW_API_KEY env var or run: jaw config set apiKey <key>");
   }
   return apiKey;
 }
+function resolveChainId(paramChainId, config) {
+  if (paramChainId) return paramChainId;
+  const envChainId = parseInt(process.env["JAW_CHAIN_ID"] ?? "", 10);
+  if (Number.isInteger(envChainId) && envChainId > 0) return envChainId;
+  return config.defaultChain ?? 1;
+}
+function envSessionEnabled() {
+  const value = process.env["JAW_SESSION"]?.toLowerCase();
+  return value === "1" || value === "true";
+}
+var SIGN_RATE_WINDOW_MS = 6e4;
+var MAX_SIGNS_PER_WINDOW = 5;
+var SESSION_SIGNING_METHODS = ["wallet_sendCalls", "personal_sign", "eth_signTypedData_v4"];
 function registerRpcTool(server) {
-  server.tool(
+  const recentSigns = [];
+  function assertUnderSignLimit() {
+    const now = Date.now();
+    while (recentSigns.length && now - recentSigns[0] > SIGN_RATE_WINDOW_MS) recentSigns.shift();
+    if (recentSigns.length >= MAX_SIGNS_PER_WINDOW) {
+      throw new Error("Autonomous signing rate limit reached, retry shortly or call again with session: false.");
+    }
+    recentSigns.push(now);
+  }
+  server.registerTool(
     "jaw_rpc",
-    "Execute any JAW.id wallet RPC method via the browser bridge. Supports transactions, signing, permissions, and queries. Methods that require signing will open the browser for passkey authentication. IMPORTANT: Read the jaw://api-reference resource for the full list of methods, and jaw://api-reference/{method} for detailed parameter formats and examples.",
-    rpcMethodSchema,
+    {
+      description: "Execute any JAW.id wallet RPC method. Supports transactions, signing, permissions, and queries. By default, methods that require signing open the browser for passkey authentication. Pass session: true to sign autonomously with the local session key instead (requires a session created via `jaw session setup` \u2014 check jaw_session_status). IMPORTANT: Read the jaw://api-reference resource for the full list of methods, and jaw://api-reference/{method} for detailed parameter formats and examples.",
+      inputSchema: rpcMethodSchema
+    },
+    // @ts-expect-error — MCP SDK deep type inference with z.any() in schema
     async (params) => {
-      const config = loadConfig();
-      const apiKey = resolveApiKey();
-      const chainId = params.chainId ?? config.defaultChain ?? 1;
-      const pm = config.paymasters?.[chainId];
-      const bridge = await getBridge({
-        keysUrl: config.keysUrl,
-        apiKey,
-        chainId,
-        ens: config.ens,
-        paymasterUrl: pm?.url
-      });
       try {
-        const result = await bridge.request(params.method, params.params);
-        return mcpResult(result);
+        const config = loadConfig();
+        const apiKey = resolveApiKey(config);
+        const chainId = resolveChainId(params.chainId, config);
+        const useSession = params.session ?? envSessionEnabled();
+        let bridge;
+        if (useSession) {
+          if (!supportsSessionMode(params.method)) {
+            throw new Error(
+              `Method ${params.method} is not supported in session mode. Call again with session: false to route through the browser bridge.`
+            );
+          }
+          if (SESSION_SIGNING_METHODS.includes(params.method)) {
+            assertUnderSignLimit();
+          }
+          bridge = new SessionBridge({ apiKey, chainId });
+        } else {
+          bridge = await getBridge({
+            keysUrl: config.keysUrl,
+            apiKey,
+            chainId,
+            ens: config.ens,
+            paymasterUrl: config.paymasters?.[chainId]?.url
+          });
+        }
+        try {
+          const result = await bridge.request(params.method, params.params);
+          return mcpResult(result);
+        } finally {
+          bridge.close();
+        }
       } catch (err) {
         return mcpError(err);
-      } finally {
-        bridge.close();
       }
     }
   );
@@ -690,26 +883,32 @@ function registerRpcTool(server) {
 
 // src/mcp/handlers/config.ts
 function registerConfigTools(server) {
-  server.tool("jaw_config_show", "Show current CLI configuration (API key redacted).", {}, async () => {
-    try {
-      const config = redactConfig(loadConfig());
-      return {
-        content: [{ type: "text", text: JSON.stringify(config) }]
-      };
-    } catch (err) {
-      return mcpError(err);
+  server.registerTool(
+    "jaw_config_show",
+    {
+      description: "Show current CLI configuration (secrets redacted).",
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      try {
+        return mcpResult(redactConfig(loadConfig()));
+      } catch (err) {
+        return mcpError(err);
+      }
     }
-  });
-  server.tool(
+  );
+  server.registerTool(
     "jaw_config_set",
-    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, ens, relayUrl).",
-    configSetSchema,
+    {
+      description: "Set a CLI configuration value (apiKey, defaultChain, keysUrl, ens, relayUrl, sessionExpiry).",
+      inputSchema: configSetSchema
+    },
     async (params) => {
       try {
-        if (params.key === "defaultChain") {
+        if (params.key === "defaultChain" || params.key === "sessionExpiry") {
           const num = parseInt(params.value, 10);
           if (isNaN(num) || num <= 0) {
-            throw new Error(`Invalid chain ID: ${params.value}`);
+            throw new Error(`Invalid number for ${params.key}: ${params.value}`);
           }
           setConfigValue(params.key, num);
         } else {
@@ -729,40 +928,34 @@ function registerConfigTools(server) {
     }
   );
 }
+
+// src/mcp/handlers/daemon.ts
 function registerDaemonTools(server) {
-  server.tool(
+  server.registerTool(
     "jaw_status",
-    "Check the current status of the JAW.id relay bridge \u2014 whether a relay session exists, the bridge connection is active, and what configuration is in use.",
-    {},
+    {
+      description: "Check the current status of the JAW.id relay bridge \u2014 whether a browser-paired relay session exists (established key exchange) and what configuration is in use. Each jaw_rpc call connects on demand, so there is no persistent connection to report.",
+      annotations: { readOnlyHint: true }
+    },
     async () => {
       try {
-        let relaySession = false;
-        try {
-          if (fs2.existsSync(PATHS.relay)) {
-            JSON.parse(fs2.readFileSync(PATHS.relay, "utf-8"));
-            relaySession = true;
-          }
-        } catch {
-          relaySession = false;
-        }
-        const config = redactConfig(loadConfig());
+        const relaySession = loadRelaySession();
+        const established = relaySession !== null && relaySession.peerPublicKey !== null;
         const status = {
-          relay: relaySession ? { session: true } : { session: false },
-          bridgeConnection: "disconnected",
-          config
-        };
-        return {
-          content: [{ type: "text", text: JSON.stringify(status, null, 2) }]
+          relay: established ? { session: true, startedAt: relaySession.startedAt } : { session: false },
+          config: redactConfig(loadConfig())
         };
+        return mcpResult(status);
       } catch (err) {
         return mcpError(err);
       }
     }
   );
-  server.tool(
+  server.registerTool(
     "jaw_disconnect",
-    "Close the relay session and browser tab. Call this when you are done making wallet requests to clean up resources.",
-    {},
+    {
+      description: "Close the relay session and browser tab. Call this when you are done making wallet requests to clean up resources."
+    },
     async () => {
       try {
         await shutdownDaemon();
@@ -780,9 +973,39 @@ function registerDaemonTools(server) {
     }
   );
 }
+
+// src/mcp/handlers/session.ts
+function registerSessionTools(server) {
+  server.registerTool(
+    "jaw_session_status",
+    {
+      description: "Show the local session-key (auto mode) status \u2014 session address, owner, permission ID, chain, and expiry. When a valid session exists, jaw_rpc can sign autonomously with session: true instead of opening the browser. Sessions are created with `jaw session setup` in a terminal (requires a one-time browser passkey approval).",
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      try {
+        if (!keystoreExists()) {
+          return mcpResult({
+            exists: false,
+            hint: "No session key. Ask the user to run `jaw session setup` in a terminal to enable autonomous signing."
+          });
+        }
+        const config = loadSessionConfig();
+        return mcpResult({
+          exists: true,
+          ...config,
+          expired: config.expiry <= Date.now() / 1e3
+        });
+      } catch (err) {
+        return mcpError(err);
+      }
+    }
+  );
+}
 var DOCS_BASE = "https://docs.jaw.id/api-reference";
+var FETCH_TIMEOUT_MS = 15e3;
 async function fetchDocs(url) {
-  const res = await fetch(url);
+  const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
   if (!res.ok) {
     throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);
   }
@@ -790,7 +1013,7 @@ async function fetchDocs(url) {
   return html.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/\s{2,}/g, " ").trim();
 }
 function registerResources(server) {
-  server.resource(
+  server.registerResource(
     "api-reference",
     "jaw://api-reference",
     {
@@ -807,7 +1030,7 @@ function registerResources(server) {
       ]
     })
   );
-  server.resource(
+  server.registerResource(
     "api-reference-method",
     new ResourceTemplate("jaw://api-reference/{method}", { list: void 0 }),
     {
@@ -833,19 +1056,20 @@ function registerResources(server) {
 }
 
 // src/mcp/server.ts
-function createMcpServer() {
+function createMcpServer(version = "0.0.0") {
   const server = new McpServer({
     name: "jaw",
-    version: "0.0.1"
+    version
   });
   registerRpcTool(server);
   registerConfigTools(server);
   registerDaemonTools(server);
+  registerSessionTools(server);
   registerResources(server);
   return server;
 }
-async function startMcpServer() {
-  const server = createMcpServer();
+async function startMcpServer(version) {
+  const server = createMcpServer(version);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }