@knotpad/app 0.1.4 → 0.1.6

package/app/mcp/route.tsx

@@ -0,0 +1,430 @@
+import { NextRequest, NextResponse } from "next/server";
+import { verifyMcpToken, extractBearerToken } from "@/lib/mcp-auth";
+import { rateLimit, getClientIp } from "@/lib/rate-limit";
+import { prisma } from "@/lib/prisma";
+import type { Priority } from "@/app/generated/prisma/client";
+import { parseTasksFromMarkdown, isAgentHandle } from "@/lib/task-parser";
+import { encryptContent, decryptContent } from "@/lib/note-crypto";
+import { SERVER_INSTRUCTIONS, TOOLS } from "@/lib/mcp-contract";
+
+// Sync ((task title)) cross-note references — runs outside the main transaction
+async function syncRefs(noteId: string, workspaceId: string, content: string) {
+  const refMap = new Map<string, string>();
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    for (const m of lines[i].matchAll(/\(\(([^)]+)\)\)/g)) {
+      const title = m[1].trim();
+      if (title && !refMap.has(title)) {
+        const start = Math.max(0, i - 1);
+        refMap.set(title, lines.slice(start, Math.min(lines.length, i + 2)).join("\n"));
+      }
+    }
+  }
+  await prisma.taskReference.deleteMany({ where: { noteId } });
+  if (refMap.size === 0) return;
+  const matched = await prisma.task.findMany({
+    where: { workspaceId, title: { in: Array.from(refMap.keys()) } },
+    select: { id: true, title: true },
+  });
+  if (matched.length > 0) {
+    await prisma.taskReference.createMany({
+      data: matched.map((t) => ({ taskId: t.id, noteId, snippet: "" })),
+    });
+  }
+}
+
+type McpCtx = { userId: string; workspaceId: string; tokenId: string; alias: string | null };
+
+const JSON_HEADERS = { "Content-Type": "application/json" };
+
+function toolResult(id: unknown, data: unknown): NextResponse {
+  return NextResponse.json(
+    { jsonrpc: "2.0", id, result: { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] } },
+    { headers: JSON_HEADERS }
+  );
+}
+
+function rpcError(id: unknown, code: number, message: string): NextResponse {
+  return NextResponse.json(
+    { jsonrpc: "2.0", id, error: { code, message } },
+    { headers: JSON_HEADERS }
+  );
+}
+
+async function callTool(
+  name: string,
+  args: Record<string, unknown>,
+  ctx: McpCtx,
+  id: unknown
+): Promise<NextResponse> {
+  const { workspaceId, userId, alias } = ctx;
+
+  switch (name) {
+    case "get_notes": {
+      const notes = await prisma.note.findMany({
+        where: { workspaceId },
+        orderBy: { updatedAt: "desc" },
+        select: {
+          id: true, title: true, isLocked: true, createdAt: true, updatedAt: true,
+          _count: { select: { tasks: true } },
+        },
+      });
+      return toolResult(id, notes.map((n) => ({ ...n, taskCount: n._count.tasks })));
+    }
+
+    case "get_tasks": {
+      const tasks = await prisma.task.findMany({
+        where: { workspaceId, assigneeType: "AGENT", status: "OPEN", claimedBy: null },
+        orderBy: { createdAt: "asc" },
+        include: { note: { select: { id: true, title: true } } },
+      });
+      return toolResult(id, tasks.map((t) => ({
+        id: t.id,
+        title: t.title,
+        fileRefs: t.fileRefs,
+        sourceNote: { id: t.note.id, title: t.note.title },
+        age: Math.floor((Date.now() - t.createdAt.getTime()) / 1000 / 60) + "m",
+      })));
+    }
+
+    case "get_task_detail": {
+      const task = await prisma.task.findFirst({
+        where: { id: args.taskId as string, workspaceId },
+        include: {
+          note: { select: { id: true, title: true } },
+          auditLogs: { orderBy: { createdAt: "desc" }, take: 10 },
+        },
+      });
+      if (!task) return rpcError(id, -32002, "Task not found");
+      return toolResult(id, task);
+    }
+
+    case "get_linked_files": {
+      const task = await prisma.task.findFirst({
+        where: { id: args.taskId as string, workspaceId },
+        select: { fileRefs: true },
+      });
+      if (!task) return rpcError(id, -32002, "Task not found");
+      return toolResult(id, { fileRefs: task.fileRefs });
+    }
+
+    case "claim_tasks": {
+      const ids = args.ids as string[];
+      if (!Array.isArray(ids) || ids.length === 0) return rpcError(id, -32602, "ids array required");
+      const now = new Date();
+      const claimedByAlias = alias ?? userId;
+      const claimed: string[] = [];
+      const failed: string[] = [];
+      for (const taskId of ids) {
+        const result = await prisma.task.updateMany({
+          where: { id: taskId, workspaceId, status: "OPEN", claimedBy: null },
+          data: { status: "CLAIMED", claimedBy: userId, claimedByAlias, claimedAt: now, lastHeartbeat: now },
+        });
+        if (result.count > 0) {
+          await prisma.auditLog.create({
+            data: { taskId, userId, action: "claimed", detail: `claimed by @agent:${claimedByAlias}` },
+          });
+          claimed.push(taskId);
+        } else {
+          failed.push(taskId);
+        }
+      }
+      return toolResult(id, { claimed, failed });
+    }
+
+    case "release_task": {
+      const taskId = args.id as string;
+      const reason = args.reason as string | undefined;
+      const task = await prisma.task.findFirst({ where: { id: taskId, workspaceId, claimedBy: userId } });
+      if (!task) return rpcError(id, -32002, "Task not found or not claimed by you");
+      await prisma.$transaction([
+        prisma.task.update({
+          where: { id: taskId },
+          data: { status: "OPEN", claimedBy: null, claimedByAlias: null, claimedAt: null, lastHeartbeat: null },
+        }),
+        prisma.auditLog.create({
+          data: {
+            taskId,
+            userId,
+            action: "released",
+            detail: reason
+              ? `released by @agent:${alias ?? userId}: ${reason}`
+              : `released by @agent:${alias ?? userId}`,
+          },
+        }),
+      ]);
+      const owner = await prisma.workspaceMember.findFirst({ where: { workspaceId, role: "OWNER" } });
+      if (owner) {
+        await prisma.notification.create({
+          data: {
+            userId: owner.userId,
+            type: "task_released",
+            title: `Task released: "${task.title}"`,
+            body: reason ?? undefined,
+            taskId,
+          },
+        });
+      }
+      return toolResult(id, { ok: true });
+    }
+
+    case "update_task": {
+      const STATUS_MAP: Record<string, "IN_PROGRESS" | "REVIEW" | "DONE"> = {
+        in_progress: "IN_PROGRESS", review: "REVIEW", done: "DONE",
+      };
+      const status = args.status as string;
+      if (!STATUS_MAP[status]) return rpcError(id, -32602, "status must be one of: in_progress, review, done");
+      const taskId = args.id as string;
+      const task = await prisma.task.findFirst({ where: { id: taskId, workspaceId, claimedBy: userId } });
+      if (!task) return rpcError(id, -32002, "Task not found or not claimed by you");
+      const newStatus = STATUS_MAP[status];
+      await prisma.$transaction(async (tx) => {
+        await tx.task.update({
+          where: { id: taskId },
+          data: { status: newStatus, lastHeartbeat: new Date(), version: { increment: 1 } },
+        });
+        await tx.auditLog.create({
+          data: { taskId, userId, action: "status_change", detail: `${task.status} → ${newStatus} by @agent:${alias ?? userId}` },
+        });
+        if (newStatus === "DONE") {
+          const note = await tx.note.findUnique({ where: { id: task.noteId } });
+          if (note) {
+            const plain = await decryptContent(note.content, workspaceId);
+            const lines = plain.split("\n");
+            let changed = false;
+            for (let i = 0; i < lines.length; i++) {
+              if (lines[i].includes("[ ]") && lines[i].includes(task.title)) {
+                lines[i] = lines[i].replace("[ ]", "[x]").replace(/\s*<!--task::[A-Z_]+-->/, "") + " <!--task::DONE-->";
+                changed = true;
+                break;
+              }
+            }
+            if (changed) {
+              const stored = await encryptContent(lines.join("\n"), workspaceId);
+              await tx.note.update({ where: { id: task.noteId }, data: { content: stored, version: { increment: 1 } } });
+            }
+          }
+        }
+      });
+      return toolResult(id, { ok: true, status: newStatus });
+    }
+
+    case "heartbeat": {
+      const result = await prisma.task.updateMany({
+        where: { id: args.id as string, workspaceId, claimedBy: userId },
+        data: { lastHeartbeat: new Date() },
+      });
+      if (result.count === 0) return rpcError(id, -32002, "Task not found or not claimed by you");
+      return toolResult(id, { ok: true });
+    }
+
+    case "create_note": {
+      const title = args.title as string;
+      const plainContent = (args.content as string | undefined) ?? "";
+      const storedContent = await encryptContent(plainContent, workspaceId);
+      const note = await prisma.$transaction(async (tx) => {
+        const newNote = await tx.note.create({ data: { title, content: storedContent, workspaceId } });
+        const taskIds: string[] = [];
+        if (plainContent) {
+          for (const p of parseTasksFromMarkdown(plainContent)) {
+            const assigneeType = p.assigneeHandle && isAgentHandle(p.assigneeHandle) ? "AGENT" : "HUMAN";
+            const t = await tx.task.create({
+              data: {
+                title: p.title, noteId: newNote.id, workspaceId, assigneeType, fileRefs: p.fileRefs,
+                ...(p.isChecked && { status: "DONE" as const }),
+                ...(p.startDate && { startDate: new Date(p.startDate) }),
+                ...(p.dueDate && { dueDate: new Date(p.dueDate) }),
+                ...(p.priority && { priority: p.priority as Priority }),
+              },
+            });
+            taskIds.push(t.id);
+          }
+        }
+        return { id: newNote.id, taskIds };
+      });
+      // syncRefs runs async — don't await so it never blocks or 500s the response
+      if (plainContent) syncRefs(note.id, workspaceId, plainContent).catch(() => {});
+      return toolResult(id, note);
+    }
+
+    case "get_note": {
+      const note = await prisma.note.findFirst({
+        where: { id: args.noteId as string, workspaceId },
+        include: {
+          tasks: { select: { id: true, title: true, status: true, assigneeType: true, claimedByAlias: true } },
+        },
+      });
+      if (!note) return rpcError(id, -32002, "Note not found");
+      const content = await decryptContent(note.content, workspaceId);
+      return toolResult(id, { ...note, content });
+    }
+
+    case "append_to_note": {
+      const noteId = args.noteId as string;
+      const appendContent = args.content as string;
+      const note = await prisma.note.findFirst({ where: { id: noteId, workspaceId } });
+      if (!note) return rpcError(id, -32002, "Note not found");
+      if (note.isLocked) return rpcError(id, -32003, "Note is locked");
+      const existingPlain = await decryptContent(note.content, workspaceId);
+      const newPlainContent = existingPlain + "\n" + appendContent;
+      const storedContent = await encryptContent(newPlainContent, workspaceId);
+      const result = await prisma.$transaction(async (tx) => {
+        await tx.note.update({ where: { id: noteId }, data: { content: storedContent, version: { increment: 1 } } });
+        const existingTasks = await tx.task.findMany({ where: { noteId }, select: { title: true } });
+        const existingTitles = new Set(existingTasks.map((t) => t.title));
+        const newTasks: string[] = [];
+        for (const p of parseTasksFromMarkdown(newPlainContent)) {
+          if (!existingTitles.has(p.title)) {
+            const assigneeType = p.assigneeHandle && isAgentHandle(p.assigneeHandle) ? "AGENT" : "HUMAN";
+            const t = await tx.task.create({
+              data: {
+                title: p.title, noteId, workspaceId, assigneeType, fileRefs: p.fileRefs,
+                ...(p.isChecked && { status: "DONE" as const }),
+                ...(p.startDate && { startDate: new Date(p.startDate) }),
+                ...(p.dueDate && { dueDate: new Date(p.dueDate) }),
+                ...(p.priority && { priority: p.priority as Priority }),
+              },
+            });
+            newTasks.push(t.id);
+          }
+        }
+        return { newTaskIds: newTasks };
+      });
+      syncRefs(noteId, workspaceId, newPlainContent).catch(() => {});
+      return toolResult(id, result);
+    }
+
+    default:
+      return rpcError(id, -32601, `Unknown tool: ${name}`);
+  }
+}
+
+// SSE stream for server→client notifications (required by MCP Streamable HTTP spec)
+export async function GET(req: NextRequest): Promise<Response> {
+  const token = extractBearerToken(req.headers.get("authorization"));
+  if (!token) {
+    return new Response(JSON.stringify({ error: "Missing authorization token" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const ctx = await verifyMcpToken(token);
+  if (!ctx) {
+    return new Response(JSON.stringify({ error: "Invalid or revoked token" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // Open an SSE stream that stays alive for server-push notifications
+  const controller = new AbortController();
+  const stream = new ReadableStream({
+    start(ctrl) {
+      const encoder = new TextEncoder();
+      // Send an initial keep-alive comment so the client knows the stream is open
+      ctrl.enqueue(encoder.encode(": stream opened\n\n"));
+
+      // Send periodic keep-alive comments to prevent timeout
+      const interval = setInterval(() => {
+        try {
+          ctrl.enqueue(encoder.encode(": keepalive\n\n"));
+        } catch {
+          clearInterval(interval);
+        }
+      }, 30_000);
+
+      // Clean up on client disconnect or server abort
+      const cleanup = () => {
+        clearInterval(interval);
+        try { ctrl.close(); } catch {}
+      };
+      controller.signal.addEventListener("abort", cleanup);
+      // Also listen for the request abort (client disconnect)
+      if (req.signal) {
+        req.signal.addEventListener("abort", () => {
+          controller.abort();
+        });
+      }
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  const ip = getClientIp(req);
+  const rl = rateLimit(`mcp:${ip}`, 120, 60_000);
+  if (rl.limited) {
+    return NextResponse.json(
+      { jsonrpc: "2.0", id: null, error: { code: -32029, message: "Too many requests" } },
+      { status: 429, headers: { ...JSON_HEADERS, "Retry-After": String(rl.retryAfter) } }
+    );
+  }
+
+  const token = extractBearerToken(req.headers.get("authorization"));
+  if (!token) return rpcError(null, -32001, "Missing authorization token");
+
+  const ctx = await verifyMcpToken(token);
+  if (!ctx) return rpcError(null, -32001, "Invalid or revoked token");
+
+  let body: { id?: unknown; method?: string; params?: unknown };
+  try {
+    body = await req.json();
+  } catch {
+    return rpcError(null, -32700, "Parse error");
+  }
+
+  const { id = null, method, params } = body;
+
+  if (method === "initialize") {
+    return NextResponse.json(
+      {
+        jsonrpc: "2.0",
+        id,
+        result: {
+          protocolVersion: "2024-11-05",
+          capabilities: { tools: {} },
+          serverInfo: { name: "knotpad", version: "1.0.0" },
+          instructions: SERVER_INSTRUCTIONS,
+        },
+      },
+      { headers: JSON_HEADERS }
+    );
+  }
+
+  // ping — MCP clients use this to verify the server is alive
+  if (method === "ping") {
+    return NextResponse.json(
+      { jsonrpc: "2.0", id, result: {} },
+      { headers: JSON_HEADERS }
+    );
+  }
+
+  if (method === "notifications/initialized") {
+    return new NextResponse(null, { status: 204 });
+  }
+
+  if (method === "tools/list") {
+    return NextResponse.json(
+      { jsonrpc: "2.0", id, result: { tools: TOOLS } },
+      { headers: JSON_HEADERS }
+    );
+  }
+
+  if (method === "tools/call") {
+    const p = (params ?? {}) as { name?: string; arguments?: Record<string, unknown> };
+    const name = p.name ?? "";
+    const args = p.arguments ?? {};
+    if (!name) return rpcError(id, -32602, "Missing tool name in params");
+    return callTool(name, args, ctx, id);
+  }
+
+  return rpcError(id, -32601, "Method not found");
+}

package/app/opengraph-image.tsx

@@ -0,0 +1,120 @@
+import { ImageResponse } from "next/og";
+
+// Image metadata — Next.js serves this at /opengraph-image.png
+export const runtime = "edge";
+export const alt = "Knotpad — Write the note. The tasks come with it.";
+export const size = { width: 1200, height: 630 };
+export const contentType = "image/png";
+
+export default function OgImage() {
+  return new ImageResponse(
+    (
+      <div
+        style={{
+          width: "100%",
+          height: "100%",
+          display: "flex",
+          flexDirection: "column",
+          justifyContent: "center",
+          backgroundColor: "#09090b",
+          padding: "80px 100px",
+          fontFamily: "sans-serif",
+        }}
+      >
+        {/* Logo mark */}
+        <div
+          style={{
+            display: "flex",
+            alignItems: "center",
+            gap: "16px",
+            marginBottom: "40px",
+          }}
+        >
+          <div
+            style={{
+              width: "56px",
+              height: "56px",
+              borderRadius: "12px",
+              backgroundColor: "#18181b",
+              border: "1px solid #27272a",
+              display: "flex",
+              alignItems: "center",
+              justifyContent: "center",
+              fontSize: "28px",
+              fontWeight: 700,
+              color: "#fafafa",
+            }}
+          >
+            K
+          </div>
+          <span
+            style={{
+              fontSize: "24px",
+              fontWeight: 600,
+              color: "#a1a1aa",
+              letterSpacing: "-0.02em",
+            }}
+          >
+            knotpad.app
+          </span>
+        </div>
+
+        {/* Headline */}
+        <h1
+          style={{
+            fontSize: "72px",
+            fontWeight: 700,
+            color: "#fafafa",
+            lineHeight: 1.1,
+            letterSpacing: "-0.03em",
+            margin: 0,
+          }}
+        >
+          Write the note.
+          <br />
+          <span style={{ color: "#52525b" }}>The tasks come with it.</span>
+        </h1>
+
+        {/* Tagline */}
+        <p
+          style={{
+            fontSize: "28px",
+            color: "#71717a",
+            marginTop: "32px",
+            lineHeight: 1.4,
+          }}
+        >
+          Note-first project management with AI agent task routing
+        </p>
+
+        {/* Bottom badges */}
+        <div
+          style={{
+            display: "flex",
+            gap: "12px",
+            marginTop: "auto",
+          }}
+        >
+          {["Notes → Tasks", "Kanban", "Calendar", "AI Agents", "Local-first"].map(
+            (tag) => (
+              <span
+                key={tag}
+                style={{
+                  fontSize: "16px",
+                  color: "#a1a1aa",
+                  backgroundColor: "#18181b",
+                  border: "1px solid #27272a",
+                  borderRadius: "9999px",
+                  padding: "6px 16px",
+                }}
+              >
+                {tag}
+              </span>
+            )
+          )}
+        </div>
+      </div>
+    ),
+    { ...size }
+  );
+}