@khirby/plugin-pokelo 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khirby/plugin-pokelo",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Khirby — Pokelo RAG knowledge base context for AI Compose",
   "main": "src/index.ts",
   "keywords": [
@@ -21,4 +21,4 @@
     "access": "public",
     "registry": "https://registry.npmjs.org"
   }
-}
+}

package/src/pokelo-context.service.ts

@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import type { PokeloContextServiceLike, PokeloFetchOpts } from '../../../packages/plugin-host/src';
+import type { KnowledgeContextLike, PokeloFetchOpts } from '../../../packages/plugin-host/src';
 import { PokeloSettingsService } from './pokelo-settings.service';
 
 const SNIPPET_LIMIT_TOTAL = 8;
@@ -9,12 +9,13 @@ const SNIPPET_MAX_CHARS = 800;
 type McpToolResult = {
   result?: {
     content?: Array<{ type?: string; text?: string }>;
+    isError?: boolean;
   };
   error?: { message?: string };
 };
 
 @Injectable()
-export class PokeloContextService implements PokeloContextServiceLike {
+export class PokeloContextService implements KnowledgeContextLike {
   private readonly logger = new Logger(PokeloContextService.name);
 
   constructor(private readonly settings: PokeloSettingsService) {}
@@ -177,6 +178,11 @@ export class PokeloContextService implements PokeloContextServiceLike {
     if (envelope.error) {
       throw new Error(envelope.error.message ?? 'Pokelo MCP tool error');
     }
+    // Pokelo maps tool failures to CallToolResult.isError (HTTP 200), not JSON-RPC error.
+    if (envelope.result?.isError) {
+      const msg = envelope.result.content?.[0]?.text?.trim() || 'Pokelo MCP tool error';
+      throw new Error(msg);
+    }
 
     return envelope.result?.content?.[0]?.text ?? '';
   }
@@ -223,12 +229,19 @@ export function parseProjectList(text: string): Array<{ id: string; name: string
   if (!text.trim()) return [];
   try {
     const parsed = JSON.parse(text) as {
-      items?: Array<{ id?: string; name?: string }>;
+      items?: Array<{ id?: string; projectId?: string; name?: string }>;
     };
     if (Array.isArray(parsed.items)) {
       return parsed.items
-        .filter((p): p is { id: string; name: string } => !!p.id && !!p.name)
-        .map((p) => ({ id: p.id, name: p.name }));
+        .map((p) => {
+          const id =
+            (typeof p.projectId === 'string' && p.projectId.trim()) ||
+            (typeof p.id === 'string' && p.id.trim()) ||
+            '';
+          const name = typeof p.name === 'string' ? p.name.trim() : '';
+          return { id, name };
+        })
+        .filter((p) => p.id && p.name);
     }
   } catch {
     // ignore

package/src/pokelo-crypto.ts

@@ -1,60 +1,5 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
-
-const ALGORITHM = 'aes-256-gcm';
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-
-function getKey(): Buffer {
-  const raw = process.env.POKELO_SECRETS_KEY?.trim();
-  if (!raw) {
-    throw new Error('POKELO_SECRETS_KEY is not set');
-  }
-  let buf: Buffer;
-  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
-    buf = Buffer.from(raw, 'hex');
-  } else {
-    buf = Buffer.from(raw, 'base64');
-  }
-  if (buf.length !== 32) {
-    throw new Error(
-      "POKELO_SECRETS_KEY must be 32 bytes as hex (64 chars) or base64 — generate with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"",
-    );
-  }
-  return buf;
-}
-
-export function isPokeloSecretsKeyConfigured(): boolean {
-  try {
-    getKey();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Encrypts plaintext using AES-256-GCM.
- * Returns a base64 string: iv(12) + ciphertext + tag(16)
- */
-export function encrypt(plaintext: string): string {
-  const key = getKey();
-  const iv = randomBytes(IV_BYTES);
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return Buffer.concat([iv, encrypted, tag]).toString('base64');
-}
-
-/**
- * Decrypts a base64 blob produced by `encrypt`.
- */
-export function decrypt(ciphertext: string): string {
-  const key = getKey();
-  const buf = Buffer.from(ciphertext, 'base64');
-  const iv = buf.subarray(0, IV_BYTES);
-  const tag = buf.subarray(buf.length - TAG_BYTES);
-  const encrypted = buf.subarray(IV_BYTES, buf.length - TAG_BYTES);
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted) + decipher.final('utf8');
-}
+export {
+  decrypt,
+  encrypt,
+  isInstanceSecretsKeyConfigured as isPokeloSecretsKeyConfigured,
+} from '../../../packages/plugin-host/src/instance-secrets';

package/src/pokelo-settings.service.ts

@@ -99,7 +99,7 @@ export class PokeloSettingsService {
     let encryptedToken: string | undefined = undefined;
     if (dto.token !== undefined && dto.token.trim()) {
       if (!isPokeloSecretsKeyConfigured()) {
-        throw AppException.badRequest('POKELO_SECRETS_KEY is not configured');
+        throw AppException.badRequest('KHIRBY_SECRETS_KEY is not configured');
       }
       encryptedToken = encrypt(dto.token.trim());
     }

package/src/pokelo.module.ts

@@ -1,12 +1,12 @@
 import { Global, Module } from '@nestjs/common';
-import { POKELO_CONTEXT_SERVICE } from '../../../packages/plugin-host/src';
+import { KNOWLEDGE_CONTEXT, POKELO_CONTEXT_SERVICE } from '../../../packages/plugin-host/src';
 import { PokeloSettingsService } from './pokelo-settings.service';
 import { PokeloContextService } from './pokelo-context.service';
 import { PokeloSettingsController } from './pokelo-settings.controller';
 
 /**
- * @Global so AI Compose (sibling plugin module) can @Optional()-inject
- * POKELO_CONTEXT_SERVICE (ADR-0022).
+ * @Global so sibling plugins can @Optional()-inject KNOWLEDGE_CONTEXT (ADR-0047).
+ * POKELO_CONTEXT_SERVICE stays as a second provide until published consumers bump.
  */
 @Global()
 @Module({
@@ -14,8 +14,9 @@ import { PokeloSettingsController } from './pokelo-settings.controller';
   providers: [
     PokeloSettingsService,
     PokeloContextService,
+    { provide: KNOWLEDGE_CONTEXT, useExisting: PokeloContextService },
     { provide: POKELO_CONTEXT_SERVICE, useExisting: PokeloContextService },
   ],
-  exports: [POKELO_CONTEXT_SERVICE],
+  exports: [KNOWLEDGE_CONTEXT, POKELO_CONTEXT_SERVICE],
 })
 export class PokeloModule {}

package/src/pokelo.spec.ts

@@ -7,10 +7,16 @@ describe('pokelo-crypto', () => {
   const HEX_KEY = 'c'.repeat(64);
 
   beforeEach(() => {
+    delete process.env.KHIRBY_SECRETS_KEY;
+    delete process.env.MAIL_SECRETS_KEY;
+    delete process.env.AI_COMPOSE_SECRETS_KEY;
     process.env.POKELO_SECRETS_KEY = HEX_KEY;
   });
 
   afterEach(() => {
+    delete process.env.KHIRBY_SECRETS_KEY;
+    delete process.env.MAIL_SECRETS_KEY;
+    delete process.env.AI_COMPOSE_SECRETS_KEY;
     delete process.env.POKELO_SECRETS_KEY;
   });
 
@@ -26,9 +32,15 @@ describe('pokelo-crypto', () => {
     expect(isPokeloSecretsKeyConfigured()).toBe(false);
   });
 
+  it('isPokeloSecretsKeyConfigured returns true when KHIRBY_SECRETS_KEY is set', () => {
+    delete process.env.POKELO_SECRETS_KEY;
+    process.env.KHIRBY_SECRETS_KEY = HEX_KEY;
+    expect(isPokeloSecretsKeyConfigured()).toBe(true);
+  });
+
   it('throws on missing key at encrypt time', () => {
     delete process.env.POKELO_SECRETS_KEY;
-    expect(() => encrypt('anything')).toThrow('POKELO_SECRETS_KEY is not set');
+    expect(() => encrypt('anything')).toThrow('KHIRBY_SECRETS_KEY is not set');
   });
 });
 
@@ -50,12 +62,28 @@ describe('parseSseJsonRpc / parseSearchMatches / parseProjectList', () => {
     expect(matches).toEqual(['Snippet A', 'Snippet B']);
   });
 
-  it('parses project list JSON', () => {
+  it('parses project list JSON with current MCP projectId', () => {
+    const projects = parseProjectList(
+      JSON.stringify({
+        items: [{ projectId: 'p1', name: 'Bearly CRM', slug: 'bearly-crm-p1' }, { name: 'x' }],
+      }),
+    );
+    expect(projects).toEqual([{ id: 'p1', name: 'Bearly CRM' }]);
+  });
+
+  it('parses legacy project list JSON with id', () => {
     const projects = parseProjectList(
       JSON.stringify({ items: [{ id: 'p1', name: 'Bearly CRM' }, { id: 'x' }] }),
     );
     expect(projects).toEqual([{ id: 'p1', name: 'Bearly CRM' }]);
   });
+
+  it('prefers projectId over id when both are present', () => {
+    const projects = parseProjectList(
+      JSON.stringify({ items: [{ id: 'legacy', projectId: 'current', name: 'CRM' }] }),
+    );
+    expect(projects).toEqual([{ id: 'current', name: 'CRM' }]);
+  });
 });
 
 function makeSelectChain(returnValue: unknown[]) {
@@ -197,7 +225,7 @@ describe('PokeloContextService.fetchContext', () => {
         content: [
           {
             type: 'text',
-            text: JSON.stringify({ items: [{ id: 'proj-uuid', name: 'Bearly CRM' }] }),
+            text: JSON.stringify({ items: [{ projectId: 'proj-uuid', name: 'Bearly CRM' }] }),
           },
         ],
       },
@@ -264,8 +292,8 @@ describe('PokeloContextService.fetchContext', () => {
             type: 'text',
             text: JSON.stringify({
               items: [
-                { id: 'a', name: 'CRM' },
-                { id: 'b', name: 'Finsly' },
+                { projectId: 'a', name: 'CRM' },
+                { projectId: 'b', name: 'Finsly' },
               ],
             }),
           },
@@ -319,4 +347,33 @@ describe('PokeloContextService.fetchContext', () => {
     const ctx = new PokeloContextService(settings);
     expect(await ctx.fetchContext('pricing')).toBe('');
   });
+
+  it('returns empty string on MCP tool isError instead of using the error as a snippet', async () => {
+    const settings = new PokeloSettingsService(
+      makeMockDb({
+        encryptedToken: encrypt('mcp_tok'),
+        projectIds: ['proj-uuid'],
+        projectId: 'proj-uuid',
+        baseUrl: 'https://rag.bearly.pro/v1',
+      }) as any,
+      makeMockRegistry(true) as any,
+    );
+
+    (global.fetch as jest.Mock).mockResolvedValue({
+      ok: true,
+      headers: { get: () => 'application/json' },
+      text: async () =>
+        JSON.stringify({
+          jsonrpc: '2.0',
+          id: 1,
+          result: {
+            isError: true,
+            content: [{ type: 'text', text: 'Project not found' }],
+          },
+        }),
+    });
+
+    const ctx = new PokeloContextService(settings);
+    expect(await ctx.fetchContext('pricing')).toBe('');
+  });
 });

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Khirby Labs
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.