@kigo-dev/sindri 0.1.6 → 0.1.8

package/README.md

@@ -40,14 +40,22 @@ name, typed confirmation before `delete_app`).
 
 ## Install
 
-**Claude Desktop (recommended for PMs):** double-click the `sindri.mcpb` extension (built from
+**Claude Desktop (recommended for builders):** double-click the `sindri.mcpb` extension (built from
 `manifest.json` with `npx @anthropic-ai/mcpb pack`), accept, done. The first conversation runs
 `setup` and `login`.
 
+The extension starts `dist/launcher.js`, not the connector itself: Claude Desktop never refreshes
+an installed `.mcpb`, so at every start the launcher reads npm's `latest` for `@kigo-dev/sindri`
+and, when it is a different version of the same major and not older than the bundled copy,
+downloads it (sha512 checked) into `~/.sindri/connector/<version>` and runs it. The cache keeps
+two versions. Offline or on any error it runs the newest cached version, else the bundled one.
+Releasing is therefore the `connector-vX.Y.Z` tag alone; to roll everyone back, move the tag:
+`npm dist-tag add @kigo-dev/sindri@<good> latest`. `SINDRI_AUTO_UPDATE=0` turns it off.
+
 **Claude Code:**
 
 ```
-claude mcp add sindri -- npx -y @kigo-dev/sindri@0.1.6
+claude mcp add sindri -- npx -y @kigo-dev/sindri@latest
 ```
 
 **Manual check without an MCP client:**

package/dist/index.js

@@ -36913,6 +36913,7 @@ function readSchedules(manifestText) {
 import { randomBytes as randomBytes3 } from "node:crypto";
 import http2 from "node:http";
 var SECRET_MAX_BYTES = 8 * 1024;
+var REFERRER_POLICY = "same-origin";
 var SecretPageBrowserUnavailable = class extends Error {
   constructor() {
     super("browser unavailable");
@@ -36944,7 +36945,7 @@ async function collectSecret(opts) {
     timer = setTimeout(() => reject(new Error("expired")), opts.timeoutMs ?? 5 * 6e4);
     server.on("request", (req, res) => {
       const html = (status, body) => {
-        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "X-Frame-Options": "DENY" });
+        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": REFERRER_POLICY, "X-Frame-Options": "DENY" });
         res.end(body);
       };
       const u = new URL(req.url ?? "/", origin);
@@ -37041,7 +37042,7 @@ button.primary{background:var(--primary);border-color:var(--primary);color:#fff;
 .note{font-size:13px;margin-top:1rem}
 `;
 function shell(title, body) {
-  return `<!doctype html><html lang="es"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body><main><div class="brand"><i></i>Kigo Sindri</div>${body}</main></body></html>`;
+  return `<!doctype html><html lang="es"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="${REFERRER_POLICY}"><title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body><main><div class="brand"><i></i>Kigo Sindri</div>${body}</main></body></html>`;
 }
 function FORM_PAGE(app, name, hint, error61) {
   const title = `Guardar secreto para \xAB${app}\xBB`;
@@ -37909,7 +37910,7 @@ function when(iso, now = /* @__PURE__ */ new Date()) {
 }
 
 // src/index.ts
-var VERSION = "0.1.6";
+var VERSION = "0.1.8";
 function registerTools(server, tools) {
   for (const name of Object.keys(SCHEMAS)) {
     const meta3 = DESCRIPTIONS[name];

package/dist/launcher.js

@@ -0,0 +1,165 @@
+// src/launcher.ts
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { gunzipSync } from "node:zlib";
+var PACKAGE = "@kigo-dev/sindri";
+var ENTRY = path.join("package", "dist", "index.js");
+var KEEP = 2;
+function parseVersion(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function newer(a, b) {
+  if (a[0] !== b[0]) return a[0] > b[0];
+  if (a[1] !== b[1]) return a[1] > b[1];
+  return a[2] > b[2];
+}
+function optionsFromEnv(env = process.env) {
+  const stateDir = path.resolve(env.SINDRI_STATE_DIR || path.join(env.HOME || os.homedir(), ".sindri"));
+  return {
+    bundledDir: path.dirname(fileURLToPath(import.meta.url)),
+    cacheDir: path.join(stateDir, "connector"),
+    registry: (env.SINDRI_NPM_REGISTRY || "https://registry.npmjs.org").replace(/\/+$/, ""),
+    enabled: env.SINDRI_AUTO_UPDATE !== "0",
+    timeoutMs: 8e3
+  };
+}
+function bundledVersion(bundledDir) {
+  const pkg = JSON.parse(fs.readFileSync(path.join(bundledDir, "..", "package.json"), "utf8"));
+  return pkg.version;
+}
+function cachedVersions(cacheDir) {
+  let names;
+  try {
+    names = fs.readdirSync(cacheDir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    const parsed = parseVersion(name);
+    const entry = path.join(cacheDir, name, ENTRY);
+    if (parsed && fs.existsSync(entry)) out.push({ version: name, parsed, entry });
+  }
+  return out.sort((x, y) => newer(x.parsed, y.parsed) ? -1 : 1);
+}
+function bestLocal(opts, bundled, bundledV) {
+  const top = cachedVersions(opts.cacheDir).find((c) => c.parsed[0] === bundled[0] && newer(c.parsed, bundled));
+  return top ? { entry: top.entry, version: top.version, source: "cache" } : { entry: path.join(opts.bundledDir, "index.js"), version: bundledV, source: "bundled" };
+}
+function extractTgz(tgz, dest) {
+  const tar = gunzipSync(tgz);
+  const root = path.resolve(dest);
+  let off = 0;
+  while (off + 512 <= tar.length) {
+    const header = tar.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) break;
+    const field = (start2, len) => header.subarray(start2, start2 + len).toString("utf8").replace(/\0.*$/s, "");
+    const size = Number.parseInt(field(124, 12).trim() || "0", 8);
+    const type = field(156, 1);
+    const prefix = field(345, 155);
+    const name = prefix ? `${prefix}/${field(0, 100)}` : field(0, 100);
+    const body = tar.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+    if (type !== "0" && type !== "") continue;
+    const target = path.resolve(root, name);
+    if (!target.startsWith(root + path.sep)) throw new Error(`tarball entry outside the package: ${name}`);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, body);
+  }
+}
+function integrityOk(data, integrity) {
+  const sri = integrity.split(/\s+/).find((s) => s.startsWith("sha512-"));
+  return Boolean(sri) && createHash("sha512").update(data).digest("base64") === sri.slice("sha512-".length);
+}
+async function fetchWithin(fetchImpl, url, deadline, headers = {}) {
+  const res = await fetchImpl(url, { headers, signal: AbortSignal.timeout(Math.max(1, deadline - Date.now())) });
+  if (!res.ok) throw new Error(`${url}: HTTP ${res.status}`);
+  return res;
+}
+async function download(opts, version, tarball, integrity, deadline) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const data = Buffer.from(await (await fetchWithin(fetchImpl, tarball, deadline)).arrayBuffer());
+  if (!integrityOk(data, integrity)) throw new Error(`integrity mismatch for ${PACKAGE}@${version}`);
+  fs.mkdirSync(opts.cacheDir, { recursive: true });
+  const tmp = fs.mkdtempSync(path.join(opts.cacheDir, `.${version}-`));
+  try {
+    extractTgz(data, tmp);
+    if (!fs.existsSync(path.join(tmp, ENTRY))) throw new Error(`${PACKAGE}@${version} has no ${ENTRY}`);
+    const final = path.join(opts.cacheDir, version);
+    fs.rmSync(final, { recursive: true, force: true });
+    fs.renameSync(tmp, final);
+    return path.join(final, ENTRY);
+  } catch (err) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    throw err;
+  }
+}
+function prune(cacheDir, current) {
+  const others = cachedVersions(cacheDir).filter((c) => c.version !== current);
+  for (const c of others.slice(KEEP - 1)) fs.rmSync(path.join(cacheDir, c.version), { recursive: true, force: true });
+}
+async function resolveEntry(opts) {
+  const log = opts.log ?? (() => void 0);
+  const bundledV = bundledVersion(opts.bundledDir);
+  const bundled = parseVersion(bundledV);
+  if (!bundled) throw new Error(`bundled version is not x.y.z: ${bundledV}`);
+  const local = bestLocal(opts, bundled, bundledV);
+  if (!opts.enabled) return local;
+  const deadline = Date.now() + opts.timeoutMs;
+  try {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const res = await fetchWithin(fetchImpl, `${opts.registry}/${PACKAGE.replace("/", "%2f")}`, deadline, { accept: "application/vnd.npm.install-v1+json" });
+    const doc = await res.json();
+    const latestV = doc["dist-tags"]?.latest ?? "";
+    const latest = parseVersion(latestV);
+    if (!latest || latest[0] !== bundled[0] || newer(bundled, latest) || latestV === local.version) return local;
+    if (latestV === bundledV) return { entry: path.join(opts.bundledDir, "index.js"), version: bundledV, source: "bundled" };
+    const cached = cachedVersions(opts.cacheDir).find((c) => c.version === latestV);
+    if (cached) return { entry: cached.entry, version: latestV, source: "cache" };
+    const dist = doc.versions?.[latestV]?.dist;
+    if (!dist?.tarball || !dist.integrity) throw new Error(`${PACKAGE}@${latestV} has no tarball or integrity`);
+    const entry = await download(opts, latestV, dist.tarball, dist.integrity, deadline);
+    prune(opts.cacheDir, latestV);
+    log(`sindri: actualizado a ${latestV} desde npm`);
+    return { entry, version: latestV, source: "npm" };
+  } catch (err) {
+    log(`sindri: sin actualizar (${err instanceof Error ? err.message : String(err)}); uso ${local.version}`);
+    return local;
+  }
+}
+async function start(entry) {
+  process.argv[1] = entry;
+  await import(pathToFileURL(entry).href);
+}
+async function main() {
+  const opts = optionsFromEnv();
+  const log = (m) => process.stderr.write(`${m}
+`);
+  const chosen = await resolveEntry({ ...opts, log });
+  try {
+    await start(chosen.entry);
+  } catch (err) {
+    if (chosen.source === "bundled") throw err;
+    log(`sindri: ${chosen.version} no carg\xF3 (${err instanceof Error ? err.message : String(err)}); uso la versi\xF3n de la extensi\xF3n`);
+    await start(path.join(opts.bundledDir, "index.js"));
+  }
+}
+if (process.argv[1] && /(^|[\\/])launcher\.(js|ts)$/.test(process.argv[1])) {
+  main().catch((err) => {
+    process.stderr.write(`sindri: ${err instanceof Error ? err.stack ?? err.message : String(err)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  PACKAGE,
+  extractTgz,
+  newer,
+  optionsFromEnv,
+  parseVersion,
+  resolveEntry
+};

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "sindri",
   "display_name": "Kigo Sindri",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Create, preview and publish Kigo internal apps from your Claude.",
   "long_description": "Sindri lets anyone at Kigo build small internal apps by talking to Claude. Claude edits the app on your computer; this connector installs what is needed, runs the app locally with test data, publishes it at <name>.sindri.kigo.dev and keeps versions. Sign in with your @cargomovil.com account.",
   "author": {
@@ -10,11 +10,11 @@
   },
   "server": {
     "type": "node",
-    "entry_point": "dist/index.js",
+    "entry_point": "dist/launcher.js",
     "mcp_config": {
       "command": "node",
       "args": [
-        "${__dirname}/dist/index.js"
+        "${__dirname}/dist/launcher.js"
       ],
       "env": {
         "SINDRI_HOME": "${user_config.sindri_home}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kigo-dev/sindri",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Sindri connector: an MCP server that lets a Kigo PM's Claude create, preview and publish internal apps on Kigo Sindri",
   "license": "UNLICENSED",
   "type": "module",
@@ -16,7 +16,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --outfile=dist/index.js --banner:js=\"#!/usr/bin/env node\" && chmod +x dist/index.js",
+    "build": "esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --outfile=dist/index.js --banner:js=\"#!/usr/bin/env node\" && esbuild src/launcher.ts --bundle --platform=node --target=node20 --format=esm --outfile=dist/launcher.js && chmod +x dist/index.js",
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test test/*.test.ts",
     "start": "node --import tsx src/index.ts",