@kb-labs/mcp-app 2.96.0

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/index.js

@@ -0,0 +1,592 @@
+import { platform, getProjectRoot, getPlatformRoot, createServiceBootstrap } from '@kb-labs/core-runtime';
+import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
+import { resolvePolicy, can } from '@kb-labs/core-policy';
+import { createCorrelatedLogger, resolveObservabilityInstanceId, createDaemonServer, getListenOptions, OperationMetricsTracker, createServiceObservabilityDescribe, createServiceObservabilityHealth } from '@kb-labs/shared-http';
+import { noopUI, getHandlerPermissions } from '@kb-labs/plugin-contracts';
+import { runDaemon } from '@kb-labs/shared-daemon';
+import { AuthService } from '@kb-labs/gateway-auth';
+import { AsyncLocalStorage } from 'async_hooks';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { createRegistry } from '@kb-labs/core-registry';
+import { generateCommandSchema } from '@kb-labs/cli-commands';
+import { createHash } from 'crypto';
+import path from 'path';
+import { executeCommandV3 } from '@kb-labs/cli-runtime';
+import { performance } from 'perf_hooks';
+
+// src/bootstrap.ts
+var DEV_JWT_SECRET = "dev-insecure-secret-change-me";
+function loadJwtConfig() {
+  const secret = process.env.GATEWAY_JWT_SECRET;
+  if (!secret && process.env.NODE_ENV === "production") {
+    throw new Error(
+      `GATEWAY_JWT_SECRET must be set in production. Generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`
+    );
+  }
+  return { secret: secret ?? DEV_JWT_SECRET };
+}
+function extractBearer(header) {
+  if (header === void 0 || !/^bearer\s/i.test(header)) {
+    return null;
+  }
+  const token = header.slice("bearer".length).trim();
+  return token.length > 0 ? token : null;
+}
+async function resolveAuthContext(header, cache, jwtConfig) {
+  const token = extractBearer(header);
+  if (!token) {
+    return null;
+  }
+  return new AuthService(cache, jwtConfig).verify(token);
+}
+var callOutput = new AsyncLocalStorage();
+function stringifyError(error) {
+  return typeof error === "string" ? error : error.message;
+}
+function createBufferedUI(pushFn) {
+  const lines = [];
+  const push = (text) => {
+    if (pushFn) {
+      pushFn(text);
+    } else {
+      lines.push(text);
+    }
+  };
+  const ui = {
+    colors: noopUI.colors,
+    symbols: noopUI.symbols,
+    write: (text) => push(text),
+    info: (message) => push(`[info] ${message}`),
+    success: (message) => push(`[ok] ${message}`),
+    warn: (message) => push(`[warn] ${message}`),
+    error: (error) => push(`[error] ${stringifyError(error)}`),
+    debug: (message) => push(`[debug] ${message}`),
+    spinner: (message) => {
+      push(`[spinner] ${message}`);
+      return {
+        update: (m) => push(`[spinner] ${m}`),
+        succeed: (m) => push(`[ok] ${m ?? ""}`.trimEnd()),
+        fail: (m) => push(`[fail] ${m ?? ""}`.trimEnd()),
+        stop: () => {
+        }
+      };
+    },
+    table: (data) => push(JSON.stringify(data)),
+    json: (data) => push(JSON.stringify(data)),
+    newline: () => push(""),
+    divider: () => push("---"),
+    box: (content, title) => push(title ? `[${title}]
+${content}` : content),
+    sideBox: (options) => {
+      push(`[${options.title}]`);
+      if (options.summary) {
+        push(JSON.stringify(options.summary));
+      }
+    },
+    chain: (items) => items.forEach((item) => push(`\u2022 ${item.title}`)),
+    log: (entry) => push(`[${entry.level}] ${entry.message}`),
+    // Non-interactive defaults — same semantics as noopUI.
+    confirm: async (message, options) => {
+      push(`[confirm] ${message}`);
+      return options?.defaultValue ?? true;
+    },
+    prompt: async (message, options) => {
+      push(`[prompt] ${message}`);
+      return options?.default ?? "";
+    },
+    select: async (message, choices) => {
+      push(`[select] ${message}`);
+      return choices[0]?.value;
+    },
+    multiSelect: async (message, choices) => {
+      push(`[multiSelect] ${message}`);
+      return choices.filter((c) => c.checked).map((c) => c.value);
+    }
+  };
+  return { ui, getOutput: () => lines.join("\n") };
+}
+function toIdentity(auth) {
+  return { user: auth.userId, roles: [auth.type, auth.tier] };
+}
+function actionForOperation(operationType) {
+  return operationType === "read" ? "mcp.read" : "mcp.write";
+}
+async function createToolRegistry(opts) {
+  return createRegistry({
+    root: opts.root,
+    platformRoot: opts.platformRoot,
+    cache: { ttlMs: 6e4, adapter: opts.cache }
+  });
+}
+function sanitizePluginId(pluginId) {
+  return pluginId.replace(/^@/, "").replace(/\//g, "-").replace(/[^a-zA-Z0-9-]/g, "-");
+}
+function toolName(pluginId, commandPath) {
+  return `${sanitizePluginId(pluginId)}__${commandPath.trim().replace(/\s+/g, "_")}`;
+}
+function toCommandManifest(decl, entry) {
+  const segments = decl.path.trim().split(/\s+/).filter(Boolean);
+  return {
+    manifestVersion: "1.0",
+    segments,
+    id: segments[segments.length - 1] ?? "",
+    group: segments[0] ?? "",
+    subgroup: segments.length >= 3 ? segments[1] : void 0,
+    describe: decl.describe ?? "",
+    longDescription: decl.longDescription,
+    aliases: decl.aliases,
+    category: decl.category,
+    flags: decl.flags,
+    examples: decl.examples,
+    operationType: decl.operationType,
+    package: entry.pluginId,
+    manifestV2: entry.manifest,
+    pkgRoot: entry.pluginRoot
+  };
+}
+function filterTools(snapshot, permits) {
+  const tools = [];
+  for (const entry of snapshot.manifests) {
+    for (const decl of entry.manifest.cli?.commands ?? []) {
+      if (!permits(decl.operationType, entry.pluginId)) {
+        continue;
+      }
+      tools.push({
+        name: toolName(entry.pluginId, decl.path),
+        description: decl.describe,
+        inputSchema: generateCommandSchema(toCommandManifest(decl, entry)),
+        pluginId: entry.pluginId,
+        pluginRoot: entry.pluginRoot,
+        handlerPath: decl.handler,
+        version: entry.manifest.version ?? "0.0.0",
+        operationType: decl.operationType,
+        permissions: getHandlerPermissions(entry.manifest, "cli", decl.path)
+      });
+    }
+  }
+  return tools;
+}
+function resolveHandlerPath(pluginRoot, handler) {
+  const relative = handler.split("#")[0] ?? handler;
+  return relative.startsWith("dist/") ? path.resolve(pluginRoot, relative) : path.resolve(pluginRoot, "dist", relative);
+}
+function createPlatformServices(container) {
+  return {
+    logger: container.logger,
+    llm: container.llm,
+    embeddings: container.embeddings,
+    vectorStore: container.vectorStore,
+    cache: container.cache,
+    config: container.config,
+    storage: container.storage,
+    analytics: container.analytics,
+    eventBus: container.eventBus,
+    invoke: container.invoke,
+    documentDatabase: container.documentDatabase,
+    kvStore: container.kvStore,
+    logs: container.logs
+  };
+}
+async function callTool(tool, args, tenantId, resolvePlatform) {
+  const lines = [];
+  const container = resolvePlatform(tenantId);
+  const exitCode = await callOutput.run(
+    lines,
+    () => executeCommandV3({
+      pluginId: tool.pluginId,
+      pluginVersion: tool.version,
+      pluginRoot: tool.pluginRoot,
+      handlerPath: resolveHandlerPath(tool.pluginRoot, tool.handlerPath),
+      argv: [],
+      flags: args,
+      tenantId,
+      // ui is ignored by executeCommandV3 V3 (backend uses uiProvider).
+      // noopUI is passed explicitly to document this intent.
+      ui: noopUI,
+      platform: createPlatformServices(container),
+      platformContainer: container,
+      socketPath: container.getSocketPath(),
+      permissions: tool.permissions,
+      quotas: tool.permissions?.quotas
+    })
+  );
+  return { success: exitCode === 0, output: lines.join("\n"), exitCode };
+}
+
+// src/mcp/request-handler.ts
+var TOOLS_CACHE_TTL_MS = 6e4;
+function textResult(text, isError) {
+  return { content: [{ type: "text", text }], isError };
+}
+function toolsCacheKey(authHeader) {
+  if (!authHeader) {
+    return "mcp:tools:anonymous";
+  }
+  return `mcp:tools:${createHash("sha256").update(authHeader).digest("hex").slice(0, 16)}`;
+}
+async function resolveVisibleTools(args) {
+  const { permits, authHeader, registry, cache, analytics, collector, tenantId = "anonymous" } = args;
+  const t0 = Date.now();
+  const cacheKey = toolsCacheKey(permits ? authHeader : null);
+  const cached = await cache.get(cacheKey).catch(() => null);
+  if (cached) {
+    const durationMs2 = Date.now() - t0;
+    collector?.recordOp("mcp.tools.list", durationMs2, true);
+    analytics?.track("mcp.tools.list", {
+      tenantId,
+      toolCount: cached.length,
+      cached: true,
+      durationMs: durationMs2
+    }).catch(() => {
+    });
+    return cached;
+  }
+  const tools = permits ? filterTools(registry.snapshot(), permits) : [];
+  await cache.set(cacheKey, tools, TOOLS_CACHE_TTL_MS).catch(() => {
+  });
+  const durationMs = Date.now() - t0;
+  collector?.recordOp("mcp.tools.list", durationMs, true);
+  analytics?.track("mcp.tools.list", {
+    tenantId,
+    toolCount: tools.length,
+    cached: false,
+    durationMs
+  }).catch(() => {
+  });
+  return tools;
+}
+async function executeToolCall(args) {
+  const { name, visibleTools, permits, tenantId, resolvePlatform, analytics, collector } = args;
+  const t0 = Date.now();
+  const tool = visibleTools.find((t) => t.name === name);
+  if (!tool) {
+    return textResult(`Unknown tool: ${name}`, true);
+  }
+  if (!permits || !permits(tool.operationType, tool.pluginId)) {
+    return textResult(`Not authorized: ${name}`, true);
+  }
+  analytics?.track("mcp.tool.call.started", {
+    toolName: name,
+    tenantId,
+    pluginId: tool.pluginId
+  }).catch(() => {
+  });
+  const result = await callTool(tool, args.args, tenantId, resolvePlatform);
+  const durationMs = Date.now() - t0;
+  collector?.recordOp("mcp.tool.call", durationMs, result.success);
+  analytics?.track("mcp.tool.call.completed", {
+    toolName: name,
+    tenantId,
+    pluginId: tool.pluginId,
+    success: result.success,
+    exitCode: result.exitCode,
+    outputLength: result.output.length,
+    durationMs
+  }).catch(() => {
+  });
+  return textResult(result.output, !result.success);
+}
+var McpObservabilityCollector = class {
+  instanceId = resolveObservabilityInstanceId();
+  startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  activeRequests = 0;
+  requestsTotal = 0;
+  errorsTotal = 0;
+  ops = new OperationMetricsTracker();
+  /**
+   * Register Fastify hooks that track HTTP-level request counts and duration.
+   * Must be called before routes are registered so the hooks apply to all routes.
+   */
+  register(server) {
+    server.addHook("onRequest", (req, _reply, done) => {
+      req.kbMetricsStart = performance.now();
+      this.activeRequests++;
+      done();
+    });
+    server.addHook("onResponse", (req, reply, done) => {
+      const start = req.kbMetricsStart;
+      const durationMs = start != null ? performance.now() - start : 0;
+      this.activeRequests = Math.max(0, this.activeRequests - 1);
+      this.requestsTotal++;
+      if (reply.statusCode >= 400) {
+        this.errorsTotal++;
+      }
+      const route = (req.routeOptions?.url ?? req.url).replace(/[?#].*$/, "");
+      this.ops.recordOperation(
+        `http.${req.method} ${route}`,
+        durationMs,
+        reply.statusCode >= 400 ? "error" : "ok"
+      );
+      done();
+    });
+  }
+  /**
+   * Record a completed domain operation. Called from request-handler after
+   * each tools/list and tools/call cycle.
+   */
+  recordOp(name, durationMs, ok) {
+    this.ops.recordOperation(name, durationMs, ok ? "ok" : "error");
+  }
+  // ── Observability payload builders ──────────────────────────────────────
+  buildDescribe(registryReady, toolCount) {
+    return createServiceObservabilityDescribe({
+      schema: "kb.observability/1",
+      contractVersion: "1.0",
+      serviceId: "mcp-daemon",
+      instanceId: this.instanceId,
+      serviceType: "mcp-server",
+      version: process.env.npm_package_version ?? "0.0.0",
+      environment: process.env.NODE_ENV ?? "development",
+      startedAt: this.startedAt,
+      logsSource: "mcp-daemon",
+      dependencies: [],
+      metricsEndpoint: "/metrics",
+      healthEndpoint: "/observability/health",
+      capabilities: ["httpMetrics", "operationMetrics", "logCorrelation"],
+      metricFamilies: [
+        "process_rss_bytes",
+        "process_heap_used_bytes",
+        "service_active_operations",
+        "http_requests_total",
+        "http_errors_total",
+        "service_operation_total",
+        "service_operation_duration_ms"
+      ],
+      meta: { toolCount, registryReady }
+    });
+  }
+  buildHealth(registryReady, toolCount, executionMode) {
+    const mem = process.memoryUsage();
+    return createServiceObservabilityHealth({
+      schema: "kb.observability/1",
+      contractVersion: "1.0",
+      serviceId: "mcp-daemon",
+      instanceId: this.instanceId,
+      observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: registryReady ? "healthy" : "degraded",
+      uptimeSec: Math.floor(process.uptime()),
+      logsSource: "mcp-daemon",
+      metricsEndpoint: "/metrics",
+      capabilities: ["httpMetrics", "operationMetrics", "logCorrelation"],
+      snapshot: {
+        rssBytes: mem.rss,
+        heapUsedBytes: mem.heapUsed,
+        activeOperations: this.activeRequests
+      },
+      checks: [
+        {
+          id: "registry",
+          status: registryReady ? "ok" : "warn",
+          message: registryReady ? `${toolCount} tools loaded` : "Registry not yet ready"
+        },
+        {
+          id: "execution",
+          status: "ok",
+          message: `mode=${executionMode}`
+        }
+      ],
+      topOperations: this.ops.getTopOperations(5)
+    });
+  }
+  renderPrometheusMetrics(toolCount) {
+    const mem = process.memoryUsage();
+    const lines = [
+      "# HELP process_rss_bytes RSS memory in bytes",
+      `process_rss_bytes ${mem.rss}`,
+      "# HELP process_heap_used_bytes Heap used in bytes",
+      `process_heap_used_bytes ${mem.heapUsed}`,
+      "# HELP process_uptime_seconds Process uptime in seconds",
+      `process_uptime_seconds ${Math.floor(process.uptime())}`,
+      "# HELP mcp_tools_total Number of tools registered in the current snapshot",
+      `mcp_tools_total ${toolCount}`,
+      "# HELP http_requests_total Total MCP HTTP requests received",
+      `http_requests_total ${this.requestsTotal}`,
+      "# HELP http_errors_total Total MCP HTTP 4xx/5xx responses",
+      `http_errors_total ${this.errorsTotal}`,
+      "# HELP service_active_operations Currently active MCP requests",
+      `service_active_operations ${this.activeRequests}`,
+      ...this.ops.getMetricLines()
+    ];
+    return lines.join("\n");
+  }
+};
+
+// src/server.ts
+var McpDaemonServer = class {
+  opts;
+  resolvePlatform;
+  collector;
+  app;
+  registry;
+  constructor(opts) {
+    this.opts = opts;
+    this.resolvePlatform = opts.resolvePlatform ?? (() => opts.platform);
+    this.collector = new McpObservabilityCollector();
+  }
+  /** Build a per-request permits predicate bound to the identity (PDP seam). */
+  permitsFor(identity) {
+    return (operationType, resource) => can(this.opts.policy, identity, actionForOperation(operationType), resource);
+  }
+  get toolCount() {
+    return this.registry?.snapshot().manifests.flatMap((m) => m.manifest.cli?.commands ?? []).length ?? 0;
+  }
+  async start() {
+    this.registry = await createToolRegistry({
+      root: this.opts.projectRoot,
+      platformRoot: this.opts.platformRoot,
+      cache: this.opts.cache
+    });
+    const execMode = process.env.KB_MCP_EXECUTION_MODE ?? "subprocess";
+    const observabilityAdapter = {
+      register: (server) => this.collector.register(server),
+      buildDescribe: () => this.collector.buildDescribe(!!this.registry, this.toolCount),
+      buildHealth: () => this.collector.buildHealth(!!this.registry, this.toolCount, execMode),
+      renderPrometheusMetrics: (_status) => this.collector.renderPrometheusMetrics(this.toolCount)
+    };
+    this.app = await createDaemonServer({
+      serviceId: "mcp-daemon",
+      logger: this.opts.logger,
+      observability: observabilityAdapter,
+      readyCheck: () => ({ ready: !!this.registry, service: "mcp-daemon" }),
+      registerRoutes: async (server) => this.registerMcpRoutes(server)
+    });
+    const listenOptions = getListenOptions(this.opts.port, this.opts.host);
+    const address = await this.app.listen(listenOptions);
+    this.opts.logger.info("MCP daemon listening", { address });
+    return address;
+  }
+  async stop() {
+    await this.app?.close();
+  }
+  async registerMcpRoutes(server) {
+    const { cache, logger, jwtConfig } = this.opts;
+    server.all("/api/v1/mcp", async (request, reply) => {
+      reply.header("Access-Control-Allow-Origin", "*").header("Access-Control-Allow-Methods", "GET, POST, OPTIONS").header("Access-Control-Allow-Headers", "Authorization, Content-Type, Mcp-Session-Id");
+      if (request.method === "OPTIONS") {
+        return reply.code(204).send();
+      }
+      const reqLogger = request.kbLogger ?? logger;
+      const authHeader = request.headers.authorization;
+      const authCtx = await resolveAuthContext(authHeader, cache, jwtConfig).catch(
+        () => null
+      );
+      const tenantId = authCtx?.namespaceId ?? "anonymous";
+      const permits = authCtx ? this.permitsFor(toIdentity(authCtx)) : null;
+      const visibleTools = await resolveVisibleTools({
+        permits,
+        authHeader,
+        registry: this.registry,
+        cache,
+        analytics: this.opts.platform.analytics,
+        collector: this.collector,
+        tenantId
+      });
+      const mcp = new Server(
+        { name: "kb-labs", version: "1.0.0" },
+        { capabilities: { tools: {} } }
+      );
+      mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: visibleTools.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema
+        }))
+      }));
+      mcp.setRequestHandler(
+        CallToolRequestSchema,
+        async ({ params }) => executeToolCall({
+          name: params.name,
+          args: params.arguments ?? {},
+          visibleTools,
+          permits,
+          tenantId,
+          resolvePlatform: this.resolvePlatform,
+          analytics: this.opts.platform.analytics,
+          collector: this.collector
+        })
+      );
+      const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+      try {
+        await mcp.connect(transport);
+        await transport.handleRequest(request.raw, reply.raw, request.body);
+      } catch (error) {
+        reqLogger.error("MCP request handling failed", error);
+        if (!reply.raw.headersSent) {
+          reply.code(500).send({ error: "internal_error" });
+        }
+      } finally {
+        await mcp.close().catch(() => {
+        });
+      }
+    });
+  }
+};
+
+// src/bootstrap.ts
+async function bootstrap() {
+  await runDaemon(
+    {
+      appId: "mcp-daemon",
+      defaultPort: 7779,
+      portEnvVar: "KB_MCP_DAEMON_PORT",
+      defaultHost: "localhost",
+      hostEnvVar: "KB_MCP_DAEMON_HOST",
+      async setup({ port, host }) {
+        const logger = createCorrelatedLogger(platform.logger, {
+          serviceId: "mcp-daemon",
+          instanceId: resolveObservabilityInstanceId(),
+          logsSource: "mcp-daemon",
+          layer: "mcp",
+          service: "bootstrap",
+          operation: "mcp-daemon.bootstrap"
+        });
+        logger.info("MCP daemon platform initialised");
+        const projectRoot = getProjectRoot() ?? process.cwd();
+        const platformRoot = getPlatformRoot();
+        const { policy } = await resolvePolicy({});
+        const server = new McpDaemonServer({
+          port,
+          host,
+          logger,
+          cache: platform.cache,
+          platform,
+          resolvePlatform: () => platform,
+          projectRoot,
+          platformRoot,
+          jwtConfig: loadJwtConfig(),
+          policy
+        });
+        await server.start();
+        return async () => {
+          await server.stop();
+        };
+      }
+    },
+    // platformBootstrap: full init with uiProvider for callOutput ALS wiring.
+    // uiProvider flows into initPlatform → createExecutionBackend so the backend
+    // captures plugin output from the very start. Concurrent tool calls are
+    // fully isolated — each gets its own AsyncLocalStorage slot.
+    async (appId, repoRoot) => {
+      await createServiceBootstrap({
+        appId,
+        repoRoot,
+        uiProvider: (_hostType) => {
+          const lines = callOutput.getStore();
+          return lines ? createBufferedUI((s) => lines.push(s)).ui : noopUI;
+        },
+        assemblyHook: makeAssemblyHook()
+      });
+      return platform;
+    }
+  );
+}
+
+// src/index.ts
+bootstrap().catch((error) => {
+  console.error("Failed to start MCP daemon:", error);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map