@jbarket/loomai 0.5.0 → 0.6.0

package/dist/transport/http-server.js

@@ -13,13 +13,26 @@
  * session, so sessions are cheap routing handles over a shared contextDir.
  * WHERE it binds on the mesh is deployment (the portable-MCP ADR); THAT it
  * refuses an unsafe bind is this contract.
+ *
+ * Two auth modes, same plumbing (t-677):
+ *   - single `token` — the full loom server (identity/memory/knowledge), one
+ *     shared secret, no identity resolution. The original/default shape.
+ *   - `tokens` (token → identity map) — a scoped server (e.g. the
+ *     knowledge-only service) where the bearer itself names the caller, so
+ *     the acting identity is derivable server-side for attribution and is
+ *     bound to the session at open time (a later request on the same
+ *     session presenting a DIFFERENT identity's token is refused, not
+ *     silently re-attributed).
  */
 import { randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest, EmptyResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { Readable } from 'node:stream';
+import { WebStandardStreamableHTTPServerTransport, isInitializeRequest } from '@modelcontextprotocol/server';
+import { EmptyResultSchema } from '@modelcontextprotocol/core';
 import { createLoomServer } from '../server.js';
-import { assertSafeBind, checkBearer, checkPayloadSize, DEFAULT_MAX_BODY_BYTES, } from './guards.js';
+import { createBackend } from '../backends/index.js';
+import { handleCliBody } from './cli-endpoint.js';
+import { assertSafeBind, checkBearer, checkBearerMulti, checkPayloadSize, DEFAULT_MAX_BODY_BYTES, } from './guards.js';
 /**
  * SSE keep-alive: the SDK opens the standalone GET stream but sends no
  * heartbeat, so an idle stream gets reaped by proxies/NAT (Traefik's default
@@ -38,6 +51,49 @@ function sendError(res, status, message) {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify({ error: message }));
 }
+/**
+ * The split 2.x transport speaks Web Standard Request/Response, not node's
+ * (req, res) pair — bridge node:http to it. Only method/url/headers are
+ * needed on the way in: bodies are pre-read/parsed by collectBody and handed
+ * to handleRequest via options.parsedBody, so the Request itself is bodyless.
+ */
+function nodeRequestToWebRequest(req) {
+    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const v of value)
+                headers.append(key, v);
+        }
+        else {
+            headers.set(key, value);
+        }
+    }
+    return new Request(url, { method: req.method, headers });
+}
+async function sendWebResponse(res, webRes) {
+    const headers = {};
+    webRes.headers.forEach((value, key) => {
+        headers[key] = value;
+    });
+    res.writeHead(webRes.status, headers);
+    if (!webRes.body) {
+        res.end();
+        return;
+    }
+    const nodeStream = Readable.fromWeb(webRes.body);
+    await new Promise((resolve, reject) => {
+        nodeStream.pipe(res);
+        nodeStream.on('end', resolve);
+        nodeStream.on('error', reject);
+        res.on('close', () => {
+            nodeStream.destroy();
+            resolve();
+        });
+    });
+}
 const OVERSIZED = Symbol('oversized');
 function collectBody(req, cap) {
     return new Promise((resolve, reject) => {
@@ -59,12 +115,39 @@ function collectBody(req, cap) {
 export async function startHttpServer(opts) {
     // Bind-safety (ac-lt-bind-safety): refuse an unsafe host BEFORE we open a socket.
     assertSafeBind(opts.host);
+    if (opts.token && opts.tokens) {
+        throw new Error('startHttpServer: pass either token or tokens, not both');
+    }
+    // A scoped server factory (e.g. the knowledge-only service) always needs
+    // to know WHO is calling for attribution — refuse to boot it open or on a
+    // single shared secret with no identity behind it.
+    if (opts.createServer && (!opts.tokens || Object.keys(opts.tokens).length === 0)) {
+        throw new Error('startHttpServer: a scoped createServer requires a non-empty tokens map ' +
+            '(per-identity bearer) — refusing to serve it unauthenticated or identity-less.');
+    }
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BODY_BYTES;
     const heartbeatMs = opts.heartbeatMs ?? HEARTBEAT_MS;
-    // One transport (+ its connected server) per live MCP session.
+    // Eager-migrate (t-1270): the default full server's memory backend runs
+    // pending schema migrations in its constructor (strict — throws loud on a
+    // bad migration), but that constructor previously only ran lazily, on
+    // whichever session's first backend-touching tool call happened to land
+    // first. A restart with new pending migrations looked fully up — the
+    // daemon bound its port and answered health probes — while memories.db
+    // still had the old schema underneath it, until some real caller's first
+    // write tripped over missing columns. Force that construction now, before
+    // the socket opens, so a bad or pending migration fails startup instead of
+    // a session three hops later. Scoped to the default server only — a scoped
+    // createServer (e.g. the knowledge-only service) never touches this
+    // backend, so forcing it there would just pay for an unused embedder load.
+    if (!opts.createServer)
+        createBackend(opts.contextDir);
+    const makeServer = opts.createServer ?? ((ctx) => createLoomServer(ctx));
+    // One transport (+ its connected server) per live MCP session, plus the
+    // identity it was opened for — a multi-token session is pinned to that
+    // identity for its lifetime (see the mismatch check in the request handler).
     const sessions = new Map();
-    async function openSession() {
-        const { server } = createLoomServer({ contextDir: opts.contextDir });
+    async function openSession(identity) {
+        const { server } = makeServer({ contextDir: opts.contextDir, gapsDir: opts.gapsDir, identity });
         // Fires AFTER the initialize handshake completes — getClientVersion() is
         // populated here (it is not yet at onsessioninitialized). Logging the peer
         // makes the resolved harness observable and reveals an unmapped client's
@@ -73,11 +156,11 @@ export async function startHttpServer(opts) {
             const peer = server.server.getClientVersion();
             process.stderr.write(`loom: peer connected client=${JSON.stringify(peer ?? null)}\n`);
         };
-        const transport = new StreamableHTTPServerTransport({
+        const transport = new WebStandardStreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
             enableJsonResponse: true,
             onsessioninitialized: (sid) => {
-                sessions.set(sid, transport);
+                sessions.set(sid, { transport, identity });
             },
         });
         // SSE keep-alive: ping the client over the standalone stream. The first tick
@@ -113,25 +196,79 @@ export async function startHttpServer(opts) {
     }
     const http = createServer((req, res) => {
         void (async () => {
-            // Auth gate (ac-lt-auth-gate): reject unauthenticated when a token is set.
-            const auth = checkBearer(opts.token, req.headers['authorization']);
+            // Auth gate (ac-lt-auth-gate): reject unauthenticated when a token (or
+            // token map) is configured. Multi-token mode additionally resolves
+            // WHICH identity made this call — the bearer itself is the identity
+            // claim (t-677); there is no separate login step.
+            const auth = opts.tokens
+                ? checkBearerMulti(opts.tokens, req.headers['authorization'])
+                : checkBearer(opts.token, req.headers['authorization']);
             if (!auth.ok)
                 return sendError(res, 401, auth.error);
+            const identity = auth.identity ?? 'art';
             // Oversized guard (ac-lt-oversized-guard): fast path on declared length.
             const declared = Number(req.headers['content-length'] ?? 0);
             if (Number.isFinite(declared) && declared > 0 && !checkPayloadSize(declared, maxBytes).ok) {
                 return sendError(res, 413, `oversized: declared ${declared} bytes exceeds cap ${maxBytes}`);
             }
+            // POST /cli: the CLI's remote mode (cli-endpoint.ts). Same gate and cap
+            // as /mcp above. Full server only: a scoped server (knowledge-only)
+            // can't offer the memory verbs, so it has no /cli at all.
+            if (new URL(req.url ?? '/', 'http://localhost').pathname === '/cli') {
+                if (opts.createServer)
+                    return sendError(res, 404, 'not-found: this server has no CLI endpoint');
+                // Unlike /mcp (initialize handshake + mcp-session-id header), a bare
+                // POST could be a browser's "simple" cross-site request. So /cli needs
+                // a configured token, a JSON content type (forces a CORS preflight,
+                // which this server never grants), and no Origin header at all: the
+                // CLI never sends one, and a browser always does.
+                if (!opts.token && !opts.tokens)
+                    return sendError(res, 403, 'forbidden: /cli requires LOOM_BEARER_TOKEN');
+                if (req.headers['origin'] !== undefined)
+                    return sendError(res, 403, 'forbidden: /cli refuses browser requests');
+                if (req.method !== 'POST')
+                    return sendError(res, 405, 'method-not-allowed: POST /cli');
+                if (!/^application\/json\b/i.test(req.headers['content-type'] ?? '')) {
+                    return sendError(res, 415, 'unsupported-media-type: POST /cli takes application/json');
+                }
+                const body = await collectBody(req, maxBytes);
+                if (body === OVERSIZED)
+                    return sendError(res, 413, `oversized: body exceeds cap ${maxBytes}`);
+                let parsed;
+                try {
+                    parsed = JSON.parse(body);
+                }
+                catch (e) {
+                    return sendError(res, 400, `bad-input: malformed JSON (${e.message})`);
+                }
+                const outcome = await handleCliBody(opts.contextDir, parsed);
+                if (!outcome.ok)
+                    return sendError(res, 400, outcome.error);
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify(outcome.response));
+                return;
+            }
             const sessionId = req.headers['mcp-session-id'];
+            // A session is pinned to the identity that opened it. Presenting a
+            // DIFFERENT identity's valid token against an existing session id is
+            // refused outright rather than silently re-attributed or routed —
+            // the per-identity bearer only means anything if a session can't be
+            // hijacked across identities by replaying its id with another token.
+            const existingSession = sessionId ? sessions.get(sessionId) : undefined;
+            if (existingSession && existingSession.identity !== identity) {
+                return sendError(res, 401, 'unauthorized: session belongs to a different identity');
+            }
             // GET = the server->client SSE stream (server push: listChanged, progress,
             // elicitation, ui:// updates). It attaches to an established session, so a
             // GET routes to that session's transport. The stream is kept alive by the
             // per-session heartbeat. A GET for a session we no longer hold is 404 (the
             // client re-initializes); a GET with no session at all is 405.
             if (req.method === 'GET' || req.method === 'DELETE') {
-                const existing = sessionId ? sessions.get(sessionId) : undefined;
-                if (existing) {
-                    return existing.handleRequest(req, res).catch((e) => sendError(res, 500, `internal: ${e.message}`));
+                if (existingSession) {
+                    return existingSession.transport
+                        .handleRequest(nodeRequestToWebRequest(req))
+                        .then((webRes) => sendWebResponse(res, webRes))
+                        .catch((e) => sendError(res, 500, `internal: ${e.message}`));
                 }
                 if (sessionId) {
                     res.writeHead(404, { 'content-type': 'application/json' });
@@ -155,7 +292,7 @@ export async function startHttpServer(opts) {
             catch (e) {
                 return sendError(res, 400, `bad-input: malformed JSON (${e.message})`);
             }
-            let transport = sessionId ? sessions.get(sessionId) : undefined;
+            let transport = existingSession?.transport;
             if (!transport) {
                 if (sessionId) {
                     // A session id we don't have (expired / dropped). Per MCP spec, 404
@@ -168,11 +305,12 @@ export async function startHttpServer(opts) {
                 if (!isInitializeRequest(parsed)) {
                     return sendError(res, 400, 'bad-input: no valid session; expected an initialize request');
                 }
-                transport = await openSession();
+                transport = await openSession(identity);
             }
             // Dispatch totality + typed envelopes (unknown tool / bad args -> JSON-RPC
             // error) are the SDK server's job from here — never a raw throw out.
-            await transport.handleRequest(req, res, parsed);
+            const webRes = await transport.handleRequest(nodeRequestToWebRequest(req), { parsedBody: parsed });
+            await sendWebResponse(res, webRes);
         })().catch((e) => sendError(res, 500, `internal: ${e.message}`));
     });
     await new Promise((resolve, reject) => {
@@ -185,8 +323,8 @@ export async function startHttpServer(opts) {
         port,
         host: opts.host,
         async close() {
-            for (const t of sessions.values())
-                await t.close().catch(() => undefined);
+            for (const s of sessions.values())
+                await s.transport.close().catch(() => undefined);
             sessions.clear();
             await new Promise((resolve) => {
                 // Force-close lingering keep-alive/SSE sockets so close() can't hang.

package/dist/transport/knowledge-server.d.ts

@@ -0,0 +1,11 @@
+import { McpServer } from '@modelcontextprotocol/server';
+export interface KnowledgeServerConfig {
+    contextDir: string;
+    gapsDir?: string;
+    /** The identity this connection is serving — resolved from its bearer token. */
+    identity: string;
+}
+export interface KnowledgeServerInstance {
+    server: McpServer;
+}
+export declare function createKnowledgeOnlyServer(config: KnowledgeServerConfig): KnowledgeServerInstance;

package/dist/transport/knowledge-server.js

@@ -0,0 +1,30 @@
+/**
+ * Knowledge-only MCP server factory (t-677) — the scoped half of the
+ * knowledge/memory split. Registers ONLY the knowledge_* tools (via the
+ * same registerKnowledgeTools() the full loom server uses — see
+ * knowledge-tools.ts for why that sharing matters), with no identity,
+ * dossier, remember/recall, or any other memory-wing tool on the surface.
+ *
+ * This is what lets a second identity (e.g. Mark) read/write Art's
+ * knowledge store over the mesh without ever being handed memory tools:
+ * the MCP tool list itself is smaller, not just access-controlled.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { McpServer } from '@modelcontextprotocol/server';
+import { resolveRepoRoot } from '../config.js';
+import { registerKnowledgeTools } from './knowledge-tools.js';
+export function createKnowledgeOnlyServer(config) {
+    const { contextDir, gapsDir, identity } = config;
+    const pkg = JSON.parse(readFileSync(join(resolveRepoRoot(), 'package.json'), 'utf-8'));
+    const server = new McpServer({
+        name: 'loom-knowledge',
+        version: pkg.version,
+    });
+    // Multi-identity surface: a caller-asserted created_by that names a
+    // DIFFERENT identity than its own bearer resolved to is an attribution
+    // spoof, not a legitimate attribution (t-677 authorization finding) —
+    // the full/local server leaves this open since it's single-operator.
+    registerKnowledgeTools(server, { contextDir, gapsDir, identity, restrictCreatedByToIdentity: true });
+    return { server };
+}

package/dist/transport/knowledge-tools.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Knowledge tool registration (t-677) — factored out of server.ts so there
+ * is exactly ONE implementation of "how a knowledge tool call turns into a
+ * backend call with identity attribution", shared by:
+ *   - the full loom server (createLoomServer), where `identity` is the local
+ *     one (resolveIdentityName: LOOM_IDENTITY, else the context dir's name) —
+ *     same code path as the service below.
+ *   - the standalone knowledge-only HTTP service (createKnowledgeOnlyServer),
+ *     where `identity` is resolved per-connection from the per-identity
+ *     bearer token (checkBearerMulti) and never from a client-supplied field.
+ *
+ * This is the "no separate local-file fast path" requirement from t-677:
+ * Art's own knowledge_write/knowledge_recall calls run through the exact
+ * same registration function — same backend calls, same identity threading
+ * — as a second identity's calls through the scoped service, so the two
+ * cannot silently diverge in how they read/write knowledge.db.
+ */
+import { McpServer } from '@modelcontextprotocol/server';
+export interface RegisterKnowledgeToolsOptions {
+    contextDir: string;
+    /** Knowledge-gaps dir for recall-miss logging (see knowledge-recall.ts). */
+    gapsDir?: string;
+    /**
+     * The identity making calls through this registration. The local identity
+     * (resolveIdentityName) for the main server; for the standalone knowledge-only service this is resolved per
+     * connection from the per-identity bearer token at session-open time —
+     * never from a tool argument, so a caller can't spoof attribution.
+     */
+    identity: string;
+    /**
+     * Reject a knowledge_write whose explicit `created_by` differs from
+     * `identity` (t-677 authorization finding). `created_by` is caller-
+     * asserted, free-text metadata — on the single-operator full server
+     * that's fine (Art legitimately attributes ours/ pages to "jonathan").
+     * On the multi-identity knowledge-only service it would let identity B
+     * claim authorship as identity A, which the per-identity bearer exists
+     * specifically to prevent. Default false (full-server behavior
+     * unchanged); createKnowledgeOnlyServer sets this true.
+     */
+    restrictCreatedByToIdentity?: boolean;
+    /**
+     * Let knowledge_maintain run the person-page misfile check, which reads
+     * person cards from the memory database. The full server sets this; the
+     * knowledge-only service must not — it never opens the memory database,
+     * so cards cannot leak through a shared surface (person-cards spec, c13).
+     */
+    personCards?: boolean;
+}
+/** Registers the full knowledge_* tool surface (11 tools) on `server`. */
+export declare function registerKnowledgeTools(server: McpServer, opts: RegisterKnowledgeToolsOptions): void;