@kya-os/mcp-i 1.6.1 → 1.6.2-canary.1

package/dist/runtime/utils/tools.js

@@ -9,12 +9,12 @@ const auth_handshake_1 = require("../auth-handshake");
 const session_1 = require("../session");
 const request_context_1 = require("../request-context");
 const proof_batch_queue_1 = require("../proof-batch-queue");
-// Parse runtime config path from injected variable
-// @ts-expect-error: injected by compiler
 const rawRuntimeConfigPath = typeof RUNTIME_CONFIG_PATH !== "undefined" ? RUNTIME_CONFIG_PATH : undefined;
 // Single-parse to match single-stringify from webpack DefinePlugin
 const runtimeConfigPath = rawRuntimeConfigPath
-    ? (typeof rawRuntimeConfigPath === 'string' ? JSON.parse(rawRuntimeConfigPath) : rawRuntimeConfigPath)
+    ? typeof rawRuntimeConfigPath === "string"
+        ? JSON.parse(rawRuntimeConfigPath)
+        : rawRuntimeConfigPath
     : null;
 /** Validates if a value is a valid Zod schema object */
 function isZodRawShape(value) {
@@ -68,7 +68,8 @@ async function initializeProofBatchQueue(debug) {
             return null;
         }
         const proofingConfig = runtimeConfig.proofing;
-        if (!proofingConfig.batchQueue?.destinations || proofingConfig.batchQueue.destinations.length === 0) {
+        if (!proofingConfig.batchQueue?.destinations ||
+            proofingConfig.batchQueue.destinations.length === 0) {
             if (debug) {
                 console.error("[MCPI] No proof destinations configured");
             }
@@ -113,14 +114,15 @@ async function initializeProofBatchQueue(debug) {
         return null;
     }
 }
-if (typeof global !== 'undefined') {
-    global.__MCPI_HANDLERS_REGISTERED__ = global.__MCPI_HANDLERS_REGISTERED__ || false;
+if (typeof global !== "undefined") {
+    global.__MCPI_HANDLERS_REGISTERED__ =
+        global.__MCPI_HANDLERS_REGISTERED__ || false;
 }
 /** Loads tools and injects them into the server */
 async function addToolsToServer(server, toolModules, identityConfig) {
     // Guard against double registration using global scope
     // Set this IMMEDIATELY to prevent race conditions
-    if (typeof global !== 'undefined') {
+    if (typeof global !== "undefined") {
         if (global.__MCPI_HANDLERS_REGISTERED__) {
             if (identityConfig?.debug) {
                 console.error("[MCPI] Handlers already registered, skipping duplicate registration");
@@ -149,7 +151,7 @@ async function addToolsToServer(server, toolModules, identityConfig) {
             const identity = await identityManager.ensureIdentity();
             if (identityConfig.debug) {
                 console.error(`[MCPI] Identity enabled - DID: ${identity.did}`);
-                console.error(`[MCPI] Identity path: ${identityConfig.devIdentityPath || '.mcpi/identity.json'}`);
+                console.error(`[MCPI] Identity path: ${identityConfig.devIdentityPath || ".mcpi/identity.json"}`);
             }
         }
         catch (error) {
@@ -157,6 +159,8 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                 console.error("[MCPI] Failed to initialize identity:", error);
             }
             // Continue without identity if initialization fails
+            // Set identityManager to null to prevent later unhandled calls to ensureIdentity()
+            identityManager = null;
         }
     }
     // Initialize ProofBatchQueue for proof submission (if runtime config exists)
@@ -206,12 +210,180 @@ async function addToolsToServer(server, toolModules, identityConfig) {
     });
     // Debug: log server state before registering handler
     if (identityConfig?.debug) {
-        console.error("[MCPI] About to register handlers (tools/list, tools/call)");
+        console.error("[MCPI] About to register handlers (tools/list, tools/call, handshake)");
     }
-    // NOTE: Custom handshake handler removed - it was causing registration errors
-    // Handshake/session management should be handled via HTTP headers or custom tools
-    // The setRequestHandler expects a Zod schema, not a request object
-    // TODO: Implement handshake as a custom tool if needed
+    // Set server DID on session manager after identity is loaded
+    if (identityManager) {
+        try {
+            const identity = await identityManager.ensureIdentity();
+            sessionManager.setServerDid(identity.did);
+        }
+        catch (error) {
+            // If identity initialization failed earlier, ensureIdentity() may throw again
+            // Log but don't crash - server can operate without identity
+            if (identityConfig?.debug) {
+                console.error("[MCPI] Failed to set server DID on session manager:", error);
+            }
+            // Set to null to prevent future attempts
+            identityManager = null;
+        }
+    }
+    // Add internal handshake tool for MCP-I session establishment
+    // This allows MCP clients to perform a handshake and receive a sessionId
+    const handshakeTool = {
+        name: "_mcpi_handshake",
+        description: "Internal MCP-I handshake tool for session establishment. Clients should call this before protected tools.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                nonce: {
+                    type: "string",
+                    description: "Unique nonce for replay prevention",
+                },
+                audience: {
+                    type: "string",
+                    description: "Target audience (server DID or URL)",
+                },
+                timestamp: { type: "number", description: "Unix timestamp in seconds" },
+                agentDid: {
+                    type: "string",
+                    description: "Agent DID for delegation verification (optional)",
+                },
+                clientInfo: {
+                    type: "object",
+                    description: "MCP client metadata (optional)",
+                    properties: {
+                        name: { type: "string" },
+                        version: { type: "string" },
+                        platform: { type: "string" },
+                        vendor: { type: "string" },
+                    },
+                },
+                clientProtocolVersion: {
+                    type: "string",
+                    description: "MCP protocol version (optional)",
+                },
+                clientCapabilities: {
+                    type: "object",
+                    description: "MCP client capabilities (optional)",
+                    additionalProperties: true,
+                },
+            },
+            required: ["nonce", "audience", "timestamp"],
+        },
+    };
+    tools.push(handshakeTool);
+    // Handshake tool handler
+    toolHandlers.set("_mcpi_handshake", async (args) => {
+        // Validate required fields explicitly before conversion
+        const missingFields = [];
+        if (!args.nonce ||
+            (typeof args.nonce === "string" && args.nonce.trim().length === 0)) {
+            missingFields.push("nonce");
+        }
+        if (!args.audience ||
+            (typeof args.audience === "string" && args.audience.trim().length === 0)) {
+            missingFields.push("audience");
+        }
+        // Validate timestamp is present and valid
+        if (args.timestamp === undefined ||
+            args.timestamp === null ||
+            typeof args.timestamp !== "number" ||
+            args.timestamp <= 0 ||
+            !Number.isInteger(args.timestamp)) {
+            if (args.timestamp === undefined || args.timestamp === null) {
+                missingFields.push("timestamp");
+            }
+            else {
+                // Invalid format (not a positive integer)
+                return {
+                    success: false,
+                    error: {
+                        code: "XMCP_I_EHANDSHAKE",
+                        message: "Invalid timestamp: must be a positive integer (Unix timestamp in seconds)",
+                        details: {
+                            received: typeof args.timestamp,
+                            value: args.timestamp,
+                        },
+                    },
+                };
+            }
+        }
+        if (missingFields.length > 0) {
+            return {
+                success: false,
+                error: {
+                    code: "XMCP_I_EHANDSHAKE",
+                    message: `Missing required field(s): ${missingFields.join(", ")}`,
+                    details: {
+                        missingFields,
+                        requiredFields: ["nonce", "audience", "timestamp"],
+                    },
+                },
+            };
+        }
+        // At this point, timestamp is guaranteed to be a valid positive integer
+        const timestamp = args.timestamp;
+        // Build handshake request from validated tool arguments
+        const handshakeRequest = {
+            nonce: String(args.nonce).trim(),
+            audience: String(args.audience).trim(),
+            timestamp,
+            agentDid: typeof args.agentDid === "string" && args.agentDid.trim().length > 0
+                ? args.agentDid.trim()
+                : undefined,
+            clientInfo: typeof args.clientInfo === "object" && args.clientInfo !== null
+                ? args.clientInfo
+                : undefined,
+            clientProtocolVersion: typeof args.clientProtocolVersion === "string" &&
+                args.clientProtocolVersion.trim().length > 0
+                ? args.clientProtocolVersion.trim()
+                : undefined,
+            clientCapabilities: typeof args.clientCapabilities === "object" &&
+                args.clientCapabilities !== null
+                ? args.clientCapabilities
+                : undefined,
+        };
+        // Double-check format (should always pass at this point, but defensive)
+        if (!(0, session_1.validateHandshakeFormat)(handshakeRequest)) {
+            return {
+                success: false,
+                error: {
+                    code: "XMCP_I_EHANDSHAKE",
+                    message: "Invalid handshake request format. Required: nonce, audience, timestamp",
+                },
+            };
+        }
+        // Validate handshake and create session
+        const result = await sessionManager.validateHandshake(handshakeRequest);
+        // Log clientInfo in development mode
+        if (identityConfig?.debug &&
+            result.success &&
+            result.session?.clientInfo) {
+            console.error("[MCPI] Client connected:", {
+                name: result.session.clientInfo.name,
+                version: result.session.clientInfo.version,
+                platform: result.session.clientInfo.platform,
+                vendor: result.session.clientInfo.vendor,
+                clientId: result.session.clientInfo.clientId,
+            });
+        }
+        if (result.success && result.session) {
+            return {
+                success: true,
+                sessionId: result.session.sessionId,
+                serverDid: result.session.serverDid,
+                ttlMinutes: result.session.ttlMinutes,
+                ...(result.session.clientInfo && {
+                    clientInfo: result.session.clientInfo,
+                }),
+            };
+        }
+        return {
+            success: false,
+            error: result.error,
+        };
+    });
     // Register tools/list handler
     server.setRequestHandler(types_js_1.ListToolsRequestSchema, async (request) => {
         return {
@@ -297,7 +469,7 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                                     `     "agentDid": "did:key:z6Mk...",\n` +
                                     `     "nonce": "unique-value",\n` +
                                     `     "audience": "server-did",\n` +
-                                    `     "timestamp": ${Date.now()}\n` +
+                                    `     "timestamp": ${Math.floor(Date.now() / 1000)}\n` +
                                     `   }\n\n` +
                                     `2. **Handshake missing agentDid**: Ensure the handshake request includes the 'agentDid' field.\n\n` +
                                     `3. **Session expired**: The session may have expired. Try performing a new handshake.\n\n` +
@@ -309,7 +481,7 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                     };
                 }
                 if (identityConfig?.debug) {
-                    console.error(`[MCPI] Tool "${name}" requires delegation - verifying scopes: ${toolProtection.requiredScopes?.join(', ')}`);
+                    console.error(`[MCPI] Tool "${name}" requires delegation - verifying scopes: ${toolProtection.requiredScopes?.join(", ")}`);
                 }
                 // Verify delegation
                 const verifyResult = await (0, auth_handshake_1.verifyOrHints)(agentDid, toolProtection.requiredScopes || [], authConfig);
@@ -348,7 +520,9 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                     content: [
                         {
                             type: "text",
-                            text: typeof result === "string" ? result : JSON.stringify(result),
+                            text: typeof result === "string"
+                                ? result
+                                : JSON.stringify(result),
                         },
                     ],
                 };
@@ -365,11 +539,9 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                         const toolResponse = {
                             data: result,
                         };
-                        // Create a session context for standalone tool calls
-                        // In a full implementation, this would use proper handshake
-                        // TODO: Use proper handshake
+                        // Reuse the active session if available, otherwise synthesize one
                         const timestamp = Math.floor(Date.now() / 1000);
-                        const session = {
+                        const proofSession = session ?? {
                             sessionId: `tool-${Date.now()}`,
                             nonce: `${Date.now()}`,
                             audience: "client",
@@ -382,7 +554,8 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                         // This enables AgentShield tool auto-discovery
                         let scopeId;
                         const toolProtection = tool_protection_registry_1.toolProtectionRegistry.get(name);
-                        if (toolProtection?.requiredScopes && toolProtection.requiredScopes.length > 0) {
+                        if (toolProtection?.requiredScopes &&
+                            toolProtection.requiredScopes.length > 0) {
                             // Use the first required scope as the scopeId (e.g., "files:read")
                             scopeId = toolProtection.requiredScopes[0];
                         }
@@ -395,9 +568,9 @@ async function addToolsToServer(server, toolModules, identityConfig) {
                         }
                         // Generate proof using the proof generator with scopeId
                         const proofGen = new proof_1.ProofGenerator(identity);
-                        const proof = await proofGen.generateProof(toolRequest, toolResponse, session, {
+                        const proof = await proofGen.generateProof(toolRequest, toolResponse, proofSession, {
                             scopeId, // Pass scopeId for tool auto-discovery
-                            clientDid: session?.clientDid, // Pass clientDid if available
+                            clientDid: session?.clientDid,
                         });
                         if (identityConfig?.debug) {
                             console.error(`[MCPI] Generated proof for tool "${name}" - DID: ${proof.meta.did}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.6.1",
+  "version": "1.6.2-canary.1",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -63,8 +63,8 @@
     "model-context-protocol"
   ],
   "dependencies": {
-    "@kya-os/contracts": "^1.6.1",
-    "@kya-os/mcp-i-core": "^1.3.1",
+    "@kya-os/contracts": "1.6.3-canary.0",
+    "@kya-os/mcp-i-core": "1.3.8-canary.0",
     "@modelcontextprotocol/sdk": "^1.11.4",
     "@swc/core": "^1.11.24",
     "@types/express": "^5.0.1",