@jini-ai/mcp 0.4.4 → 0.6.10

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # @jini-ai/mcp
 
+## 0.6.10
+
+### Patch Changes
+
+- 4f52784: Add a stable `./bin` export subpath resolving to the `jini-mcp` executable.
+
+  The package declared a `bin` entry for `dist/bin/serve.js` but an `exports` map containing only
+  `"."`, so a consumer that needed the executable's path in order to spawn it as a CLI-injected MCP
+  server could not ask for one: `require.resolve('@jini-ai/mcp/dist/bin/serve.js')` fails with
+  `ERR_PACKAGE_PATH_NOT_EXPORTED`. Consumers were resolving the root export and walking to a sibling
+  path by hand, hardcoding this package's private build layout.
+
+  `require.resolve('@jini-ai/mcp/bin')` now returns that path directly. The subpath deliberately
+  declares only a `default` condition — it is meant to be resolved to a path and handed to `spawn`,
+  not imported (`serve.ts` uses top-level await behind its `isMainModule` guard, so it is not
+  `require()`-able). Purely additive: the `"."` export is unchanged.
+
+- 8ff5653: Enforce a tool's declared `inputSchema` server-side before its handler runs.
+
+  `createMcpToolServer` wires tools through the MCP SDK's low-level `Server.setRequestHandler`, not
+  the schema-validating `McpServer.registerTool()` helper — the former never checked a real client's
+  `tools/call` arguments against the tool's own declared `inputSchema`. A wire-level test (a real SDK
+  `Client` and `Server` over `InMemoryTransport`, not the existing `FakeTransport` suite, which calls
+  handlers directly either way and so cannot see this) proved schema-violating arguments — wrong
+  type, an undeclared property under `additionalProperties: false` — reached every handler completely
+  unvalidated.
+
+  `handleToolCall` now validates `rawArgs` against `tool.inputSchema` via the MCP SDK's own
+  `@modelcontextprotocol/sdk/validation/cfworker` provider (no `eval`/codegen, matching this package's
+  Node CLI runtime) before invoking the handler, returning the same `{isError:true}` shape as an
+  unknown-tool-name or thrown-error result rather than ever calling the handler with unvalidated
+  input. Each tool's compiled validator is cached (`WeakMap` keyed by the `McpToolDef` instance, stable
+  for a server's whole lifetime) since compiling one is real work the SDK's validator does not cache
+  internally. Adds `@cfworker/json-schema` (already an optional peer of the installed SDK version) as
+  a direct dependency.
+
+- 3fe4d14: Add default-off delegated-result v1 text markers for generic, read-only and typed gateways. The stdio host can opt in with JINI_DELEGATED_RESULT_MARKERS=1.
+- 9098d22: Describe site-guide discovery as an optional host capability in the generic MCP instructions.
+- 4f52784: Add a `sidecar-strict` security mode and per-run MCP credential propagation.
+
+  For a daemon whose threat model is **another process running as the same OS user** rather than a
+  remote attacker, the existing `jini-local` mode is a no-op: `registerApiBearerAuthMiddleware`
+  short-circuits for any loopback peer before it reads the `Authorization` header, and a `127.0.0.1`
+  bind keeps remote hosts out while doing nothing about a co-resident process. A consumer that spawns a
+  Jini daemon holding real authority — starting agent runs, executing tools against a real database —
+  previously had to write its own middleware.
+
+  - `@jini-ai/http-kit` gains `requireStrictBearerToken`: fail-closed 503 when the named token env var
+    is unset, 401 on mismatch, **no loopback exemption and no disable flag**. Its `tokenEnvVar` is
+    required with no default, so this package never names a host's secret.
+  - `composeJiniKernel` gains `security: { mode: 'sidecar-strict', host, tokenEnvVar, exemptPaths? }`.
+    Purely additive — `host` and `jini-local` are unchanged by construction, since the modes are arms of
+    a discriminated union. The strict gate mounts ahead of the JSON body parser, so a caller it rejects
+    never has its body parsed.
+  - `@jini-ai/daemon`'s `McpJsonInjectionOptions` gains `credential?: (runId) => string | Promise<string>`
+    — a **resolver, not a string**, because injection options are built once before any run exists and a
+    boot-wide shared secret would defeat the point of scoping a credential to a run. It is delivered to
+    the child as `JINI_DAEMON_TOKEN`.
+  - `@jini-ai/mcp`'s `jini-mcp` reads that variable and attaches `Authorization` to every daemon call.
+    Optional throughout: with no credential, request headers and `.mcp.json` output are byte-identical
+    to before.
+
+  Also generalized: both existing bearer gates now compare tokens in constant time (`timingSafeEqual`)
+  and share one header-parsing helper, closing a timing side channel and removing a duplicated regex.
+
+- Updated dependencies [22f0619]
+- Updated dependencies [82ed2d3]
+- Updated dependencies [3fe4d14]
+- Updated dependencies [5a3de86]
+  - @jini-ai/core@0.6.10
+  - @jini-ai/protocol@0.6.10
+
 ## 0.4.4 — 2026-10-22
 
 - 2026-10-22: Typed tools from the launched bridge, concrete describe schemas, list-changed, diagnostic error codes, coverage.

package/dist/bin/serve.js

@@ -148,6 +148,7 @@ function buildDelegatedGatewayOptions({ env }, deps) {
     const rawTimeout = env[DELEGATED_TOOL_TIMEOUT_ENV_VAR];
     return definedOnly({
         generateToolUseId: deps.generateToolUseId,
+        delegatedResultMarkers: env.JINI_DELEGATED_RESULT_MARKERS === '1' ? true : undefined,
         // Parsed, not validated: `createExecuteDelegatedToolTool` already rejects a non-finite or
         // non-positive value back to the default, so `NaN` from a malformed env var lands there too.
         delegatedToolTimeoutMs: rawTimeout === undefined ? undefined : Number(rawTimeout),

package/dist/federation/trust.js

@@ -334,17 +334,17 @@ export function writeShapedSchemaInputNames({ schema }) {
     walk(schema, 0);
     return sortedUnique(found);
 }
-/** R3 action-name rules, applied to the snake_cased remote name. Kept as named module constants
+/** R3 action-name rules, applied to the snake_cased remote name (camelCase split, `-` read as `_`). Kept as named module constants
  * (none carries the `g` flag, so `.test` is stateless) so {@link federatedCallConfirmationForAction}
  * reads as the ordered policy it is. */
-const DELIVERY_ACTION = /(?:send|deliver|invite|reply|forward).*(?:email|mail|newsletter|message|sms|invitation)|(?:email|mail|newsletter|message|sms).*(?:send|deliver|reply|forward)|(?:post|publish).*(?:message|newsletter)/;
+const DELIVERY_ACTION = /(?:send|deliver|invite|reply|forward|broadcast).*(?:email|mail|newsletter|message|sms|invitation|broadcast)|(?:email|mail|newsletter|message|sms).*(?:send|deliver|reply|forward)|(?:post|publish).*(?:message|newsletter)/;
 const SYSTEM_PROMPT_ACTION = /(?:set|update|edit|change).*(?:system_prompt|system_instruction)/;
 const ASSISTANT_PREFIX = /^(?:assistant|agent)_/;
 const READ_ACTION = /^(?:get|list|read|search|describe)_/;
 const ASSISTANT_ACCESS_ACTION = /(?:assistant|agent).*(?:instruction|privacy|permission|access|policy)/;
 const SQL_ACTION = /(?:execute_sql|apply_migration|run_query|query_database)/;
 const REVERSIBLE_REMOVAL_ACTION = /(?:^|_)(?:trash|archive|tombstone|unpublish)(?:_|$)/;
-const PERMANENT_REMOVAL_ACTION = /(?:^|_)(?:delete|purge|drop|destroy|truncate)(?:_|$)/;
+const PERMANENT_REMOVAL_ACTION = /(?:^|_)(?:delete|purge|drop|destroy|truncate|remove|revoke)(?:_|$)/;
 /**
  * Owner confirmation policy (2026-10-01). Ordinary writes run immediately; permanent deletion,
  * delivery to people and changes to the assistant's own access or instructions require a card.
@@ -358,7 +358,8 @@ const PERMANENT_REMOVAL_ACTION = /(?:^|_)(?:delete|purge|drop|destroy|truncate)(
  * @complexity O(n) in the serialized input size.
  */
 export function federatedCallConfirmationForAction({ remoteName, annotations, args }) {
-    const name = remoteName.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+    // `-` separates words like `_` does (`remove-domain`, `send-broadcast`): MCP servers use both.
+    const name = remoteName.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase().replace(/-/g, "_");
     const declaredDestructive = annotations?.destructiveHint === true;
     if (DELIVERY_ACTION.test(name) || SYSTEM_PROMPT_ACTION.test(name))
         return "confirm";

package/dist/server/tools/delegated-tool.d.ts

@@ -1,38 +1,3 @@
-/**
- * @module @jini-ai/mcp/server/tools/delegated-tool
- *
- * `execute_delegated_tool` and its read-only companion `execute_readonly_delegated_tool` — the
- * MCP-callback half of gap 3's continuation transport (see
- * `packages/daemon/archived provenance ledger`'s "run/chat orchestration gap 3, part 1" addition and this
- * package's own dated section in `archived provenance ledger` for the rest of the spike). The swarm-consensus
- * Final Recommendation asked for exactly this: "inject the already-shipped MCP host into one
- * MCP-capable CLI's launch config, prove a tool round-trip through the existing
- * `delegated-tool-bridge.ts`." Where `../tools/run-tools.js`'s tools proxy generic
- * run-lifecycle HTTP endpoints, this tool proxies the new `POST /api/delegated-tool-calls`
- * daemon route (`packages/http/src/delegated-tools.ts`), which is the one and only thing that
- * calls into `createDelegatedToolBridge` (`packages/daemon/src/delegated-tool-bridge.ts`) — the
- * same `ToolExecutor` deny-by-default gate every other tool-execution path in this codebase
- * already uses. No parallel authorization mechanism is introduced anywhere on this path.
- *
- * Unlike every other tool this package ships (`run-tools.ts`'s five tools, plain static
- * objects), this one is a **factory**. The MCP server subprocess a `claude` run spawns via
- * `.mcp.json` (see `../../bin/serve.js`) is scoped to exactly one `runId` for its entire
- * lifetime — the daemon injected that run id into the subprocess's own environment at spawn
- * time, before the model ever said a word. `runId` is therefore closed over at construction
- * time, not accepted as a per-call tool argument: a model has no legitimate way to pick, or
- * need to know, which run it is currently inside, and letting it supply one would open a
- * confused-deputy path (one run's MCP subprocess executing a tool call "as" a different run).
- * `toolUseId` is likewise generated per call (`randomUUID` by default), not model-supplied — a
- * model has no legitimate reason to choose its own correlation id either.
- *
- * TWO defs, ONE code path. `createDelegatedGateway` builds both; the factories differ only in the
- * name/title/description they present and in whether the request carries `requireReadOnly: true`.
- * The read-only companion exists because MCP annotations are static per tool declaration — a
- * surface that promises "this only reads" can only be a second declaration, never a per-call mode —
- * and it ENFORCES that promise daemon-side rather than asserting it, because a `readOnlyHint: true`
- * tool that could still reach writes would launder a write past its caller's own safety gate. See
- * {@link createExecuteReadonlyDelegatedToolTool} for the failure that motivated it.
- */
 import { type ExposedToolDescriptor } from '@jini-ai/core';
 import { type McpToolDef } from '../tool-protocol.js';
 /**
@@ -82,6 +47,8 @@ export interface CreateExecuteDelegatedToolToolOptions {
      * @default DEFAULT_DELEGATED_TOOL_TIMEOUT_MS (6 min)
      */
     readonly delegatedToolTimeoutMs?: number;
+    /** Emit v1 metadata only when the host has enabled daemon/runtime echo correlation. Default off. */
+    readonly delegatedResultMarkers?: boolean;
 }
 /**
  * Builds the `execute_delegated_tool` tool def for one specific `runId`. A fresh MCP server

package/dist/server/tools/delegated-tool.js

@@ -33,6 +33,7 @@
  * tool that could still reach writes would launder a write past its caller's own safety gate. See
  * {@link createExecuteReadonlyDelegatedToolTool} for the failure that motivated it.
  */
+import { delegatedResultMarker } from '@jini-ai/protocol';
 import { batchOutcomeFor, isReadOnlyTool } from '@jini-ai/core';
 import { ToolSchema } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'node:crypto';
@@ -154,9 +155,10 @@ function createDelegatedGateway(variant, { runId }, options) {
         },
         handler: async ({ args, ctx }) => {
             const toolId = requireString({ value: args.toolId, name: 'toolId' });
+            const toolUseId = generateToolUseId({});
             const body = {
                 runId,
-                toolUseId: generateToolUseId({}),
+                toolUseId,
                 toolId: toolId,
                 // The schema tells the model to omit `input` for a tool that takes none, but most tool
                 // handlers refuse an absent input ("input must be an object"). Sending `{}` makes the
@@ -168,7 +170,11 @@ function createDelegatedGateway(variant, { runId }, options) {
                 ...daemonCallOptions({ ctx }),
                 timeoutMs,
             });
-            return unwrapMcpContentEnvelope(data.result);
+            const output = unwrapMcpContentEnvelope(data.result);
+            // Only an unwrapped MCP envelope can correlate against the bridge's saved content digest.
+            if (!options.delegatedResultMarkers || !isRecord(output) || !Array.isArray(output.content))
+                return output;
+            return { ...output, content: [delegatedResultMarker({ toolUseId }), ...output.content] };
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/mcp",
-  "version": "0.4.4",
+  "version": "0.6.10",
   "description": "Model Context Protocol adapters: server config schema and IO, an MCP client, and agent-side MCP server installation.",
   "license": "Apache-2.0",
   "repository": {
@@ -83,11 +83,12 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.9"
+    "@jini-ai/core": "^0.6.10",
+    "@jini-ai/protocol": "^0.6.10"
   },
   "peerDependencies": {
     "@cfworker/json-schema": "^4.1.1",
-    "@jini-ai/platform": "^0.5.3",
+    "@jini-ai/platform": "^0.6.10",
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "peerDependenciesMeta": {
@@ -104,9 +105,9 @@
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@jini-ai/core": "^0.4.9",
-    "@jini-ai/platform": "^0.5.10",
-    "@jini-ai/daemon": "^0.6.9"
+    "@jini-ai/core": "^0.6.10",
+    "@jini-ai/daemon": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json && chmod +x dist/bin/serve.js",