@kynver-app/mcp-agent-os 0.3.68 → 0.3.71

package/dist/lib/mcp-json-result.js

@@ -1,30 +0,0 @@
-function orderedStringifyForMcp(value, priorityKeys) {
-    const ordered = {};
-    const seen = new Set();
-    for (const key of priorityKeys) {
-        if (key in value) {
-            ordered[key] = value[key];
-            seen.add(key);
-        }
-    }
-    for (const [key, val] of Object.entries(value)) {
-        if (!seen.has(key))
-            ordered[key] = val;
-    }
-    return JSON.stringify(ordered, null, 2);
-}
-/** Default MCP text result — pretty JSON for small payloads. */
-export function jsonResult(data) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
-        structuredContent: data,
-    };
-}
-/** Truncation-safe MCP result — priority keys serialize first. */
-export function jsonResultOrdered(data, priorityKeys) {
-    const text = orderedStringifyForMcp(data, priorityKeys);
-    return {
-        content: [{ type: "text", text }],
-        structuredContent: data,
-    };
-}

package/dist/lib/mcp-sse-server.d.ts

@@ -1,44 +0,0 @@
-import { createServer, type IncomingMessage } from "node:http";
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare const MAX_SSE_BODY_BYTES: number;
-export type SessionAuth = {
-    kind: "apiKey";
-    apiKey: string;
-} | {
-    kind: "internal";
-    userId: string;
-};
-type RequestContextStore = {
-    run: <T>(store: {
-        userId?: string;
-    }, fn: () => Promise<T>) => Promise<T>;
-};
-export type StartKynverMcpSseServerOptions = {
-    label: string;
-    defaultPort: number;
-    createMcpServer: () => McpServer | Promise<McpServer>;
-    requestContext: RequestContextStore;
-};
-export declare function headerValue(req: IncomingMessage, name: string): string | null;
-export declare function timingSafeEqualString(a: string, b: string): boolean;
-export declare function hasForbiddenQueryAuth(url: URL): boolean;
-export declare function resolveListenHost(): string;
-/** Positive integer from env, else fallback. */
-export declare function intFromEnv(name: string, fallback: number): number;
-/**
- * Resolve + validate the Kynver API origin the server sends bearer keys to.
- * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
- * anything that isn't https (http is allowed only for localhost dev).
- */
-export declare function resolveApiBaseUrl(): string;
-/** First client IP from x-forwarded-for, else the socket address. */
-export declare function clientIp(req: IncomingMessage): string;
-type RateLimiter = {
-    check: (key: string) => boolean;
-};
-/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
-export declare function createFixedWindowRateLimiter(limit: number, windowMs: number): RateLimiter;
-export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<unknown>;
-export declare function validateMcporterServerName(name: string): string;
-export declare function startKynverMcpSseServer(options: StartKynverMcpSseServerOptions): ReturnType<typeof createServer>;
-export {};

package/dist/lib/mcp-sse-server.js

@@ -1,441 +0,0 @@
-// @generated — synced from packages/kynver-mcp-sse-lib/src/index.ts via scripts/sync-mcp-sse-server.mjs
-// Do not edit by hand; change the canonical file and re-run the sync script.
-import { createServer } from "node:http";
-import { randomUUID, timingSafeEqual } from "node:crypto";
-import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
-const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
-const TRUTHY_ENV = new Set(["1", "true", "yes", "on"]);
-function isServiceSecretImpersonationRejectedInProduction() {
-    const override = process.env.KYNVER_ALLOW_SERVICE_SECRET_IMPERSONATION?.trim().toLowerCase();
-    if (override !== undefined && TRUTHY_ENV.has(override))
-        return false;
-    return process.env.NODE_ENV === "production" || process.env.VERCEL_ENV === "production";
-}
-export function headerValue(req, name) {
-    const v = req.headers[name];
-    return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
-}
-export function timingSafeEqualString(a, b) {
-    const left = Buffer.from(a);
-    const right = Buffer.from(b);
-    if (left.length !== right.length)
-        return false;
-    return timingSafeEqual(left, right);
-}
-export function hasForbiddenQueryAuth(url) {
-    return FORBIDDEN_QUERY_KEYS.some((key) => url.searchParams.has(key));
-}
-export function resolveListenHost() {
-    const configured = process.env.MCP_SSE_HOST?.trim();
-    return configured || "127.0.0.1";
-}
-/** Positive integer from env, else fallback. */
-export function intFromEnv(name, fallback) {
-    const raw = process.env[name];
-    if (!raw)
-        return fallback;
-    const n = parseInt(raw, 10);
-    return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-/**
- * Resolve + validate the Kynver API origin the server sends bearer keys to.
- * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
- * anything that isn't https (http is allowed only for localhost dev).
- */
-export function resolveApiBaseUrl() {
-    const raw = process.env.KYNVER_API_URL?.trim();
-    if (!raw)
-        return "https://kynver.com";
-    let parsed;
-    try {
-        parsed = new URL(raw);
-    }
-    catch {
-        throw new Error(`Invalid KYNVER_API_URL: ${raw}`);
-    }
-    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
-    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
-        throw new Error(`KYNVER_API_URL must be https (got "${parsed.protocol}//${parsed.hostname}"); API keys are sent to this origin.`);
-    }
-    return raw.replace(/\/$/, "");
-}
-/** First client IP from x-forwarded-for, else the socket address. */
-export function clientIp(req) {
-    const fwd = headerValue(req, "x-forwarded-for");
-    if (fwd)
-        return fwd.split(",")[0].trim();
-    return req.socket?.remoteAddress ?? "unknown";
-}
-/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
-export function createFixedWindowRateLimiter(limit, windowMs) {
-    const hits = new Map();
-    return {
-        check(key) {
-            const now = Date.now();
-            const entry = hits.get(key);
-            if (!entry || now >= entry.resetAt) {
-                hits.set(key, { count: 1, resetAt: now + windowMs });
-                return true;
-            }
-            if (entry.count >= limit)
-                return false;
-            entry.count += 1;
-            return true;
-        },
-    };
-}
-export function parseJsonBody(req, maxBytes = MAX_SSE_BODY_BYTES) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let totalSize = 0;
-        req.on("data", (chunk) => {
-            totalSize += chunk.length;
-            if (totalSize > maxBytes) {
-                req.destroy();
-                reject(new Error("Request body too large"));
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.on("end", () => {
-            try {
-                resolve(JSON.parse(Buffer.concat(chunks).toString()));
-            }
-            catch (error) {
-                reject(error);
-            }
-        });
-        req.on("error", reject);
-    });
-}
-export function validateMcporterServerName(name) {
-    const trimmed = name.trim();
-    if (!/^[a-zA-Z0-9_-]+$/.test(trimmed)) {
-        throw new Error("Invalid mcporter server name.");
-    }
-    return trimmed;
-}
-function bearerToken(req) {
-    const auth = headerValue(req, "authorization");
-    if (!auth)
-        return "";
-    const match = /^Bearer\s+(.+)$/i.exec(auth);
-    return match?.[1]?.trim() ?? "";
-}
-function resolveInternalAuth(req, serviceSecret) {
-    const internalUserId = headerValue(req, "x-kynver-user-id");
-    const internalSecret = headerValue(req, "x-kynver-service-secret");
-    if (!internalUserId || !serviceSecret || !internalSecret)
-        return null;
-    if (isServiceSecretImpersonationRejectedInProduction())
-        return null;
-    if (!timingSafeEqualString(internalSecret, serviceSecret))
-        return null;
-    return { userId: internalUserId, auth: { kind: "internal", userId: internalUserId } };
-}
-function verifyPostAuth(req, url, sessionAuth, serviceSecret) {
-    if (sessionAuth.kind === "apiKey") {
-        const token = bearerToken(req);
-        return token.length > 0 && timingSafeEqualString(token, sessionAuth.apiKey);
-    }
-    const internal = resolveInternalAuth(req, serviceSecret);
-    return (internal !== null &&
-        internal.userId === sessionAuth.userId &&
-        internal.auth.kind === "internal");
-}
-async function resolveUserFromApiKey(baseUrl, apiKey) {
-    try {
-        const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/users/me`, {
-            headers: { Authorization: `Bearer ${apiKey}` },
-        });
-        if (!res.ok)
-            return null;
-        const data = (await res.json());
-        return data.id ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-function parseUrl(req, port) {
-    return new URL(req.url ?? "/", `http://localhost:${port}`);
-}
-function json(res, status, body) {
-    res.writeHead(status, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(body));
-}
-export function startKynverMcpSseServer(options) {
-    const port = parseInt(process.env.PORT ?? String(options.defaultPort), 10);
-    const baseUrl = resolveApiBaseUrl();
-    const serviceSecret = process.env.KYNVER_SERVICE_SECRET ?? "";
-    const host = resolveListenHost();
-    const sessions = {};
-    const streamableSessions = {};
-    // Resource / abuse limits (env-overridable; in-process per server).
-    const maxSessions = intFromEnv("MCP_SSE_MAX_SESSIONS", 200);
-    const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
-    const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
-    const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
-    const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
-    // Close idle sessions (both transports) so a flood of half-open connections
-    // can't pin memory.
-    const idleSweep = setInterval(() => {
-        const now = Date.now();
-        for (const [sid, entry] of Object.entries(sessions)) {
-            if (now - entry.lastActivity > idleTimeoutMs) {
-                delete sessions[sid];
-                void entry.transport.close().catch(() => { });
-            }
-        }
-        for (const [sid, entry] of Object.entries(streamableSessions)) {
-            if (now - entry.lastActivity > idleTimeoutMs) {
-                delete streamableSessions[sid];
-                void entry.transport.close().catch(() => { });
-            }
-        }
-    }, 60 * 1000);
-    idleSweep.unref?.();
-    const activeSessionCount = () => Object.keys(sessions).length + Object.keys(streamableSessions).length;
-    const activeSessionCountForUser = (userId) => Object.values(sessions).filter((s) => s.userId === userId).length +
-        Object.values(streamableSessions).filter((s) => s.userId === userId).length;
-    const httpServer = createServer(async (req, res) => {
-        const url = parseUrl(req, port);
-        const path = url.pathname;
-        if (req.method === "GET" && path === "/sse") {
-            // Pre-auth rate limit by client IP (we don't know the user yet).
-            if (!rateLimiter.check(`sse:${clientIp(req)}`)) {
-                json(res, 429, { error: "Too many requests. Slow down and retry." });
-                return;
-            }
-            if (hasForbiddenQueryAuth(url)) {
-                json(res, 400, {
-                    error: "Internal auth via query params is not allowed. Use X-Kynver-User-Id and X-Kynver-Service-Secret headers.",
-                });
-                return;
-            }
-            let userId = null;
-            let auth = null;
-            const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
-            if (internal) {
-                userId = internal.userId;
-                auth = internal.auth;
-            }
-            else {
-                const apiKey = bearerToken(req);
-                if (apiKey) {
-                    userId = await resolveUserFromApiKey(baseUrl, apiKey);
-                    if (userId)
-                        auth = { kind: "apiKey", apiKey };
-                }
-            }
-            if (!userId || !auth) {
-                json(res, 401, {
-                    error: "Unauthorized. Pass API key via Authorization: Bearer <key> or internal X-Kynver-User-Id + X-Kynver-Service-Secret headers.",
-                });
-                return;
-            }
-            // Connection caps — bound total + per-user concurrent sessions (across
-            // both transports) so an authenticated caller can't exhaust
-            // memory/sockets by opening many.
-            if (activeSessionCount() >= maxSessions) {
-                json(res, 503, { error: "Server at capacity. Try again shortly." });
-                return;
-            }
-            if (activeSessionCountForUser(userId) >= maxSessionsPerUser) {
-                json(res, 429, { error: "Too many concurrent connections for this account." });
-                return;
-            }
-            console.log(`[MCP SSE] New connection (${options.label}, user: ${userId.slice(0, 8)}...)`);
-            const transport = new SSEServerTransport("/messages", res);
-            sessions[transport.sessionId] = { transport, userId, auth, lastActivity: Date.now() };
-            res.on("close", () => {
-                delete sessions[transport.sessionId];
-            });
-            const server = await options.createMcpServer();
-            await server.connect(transport);
-            return;
-        }
-        if (req.method === "POST" && path === "/messages") {
-            const sessionId = url.searchParams.get("sessionId");
-            const entry = sessionId ? sessions[sessionId] : undefined;
-            if (!entry) {
-                json(res, 400, { error: "No active SSE session for this sessionId" });
-                return;
-            }
-            if (!verifyPostAuth(req, url, entry.auth, serviceSecret)) {
-                json(res, 401, { error: "Unauthorized. Re-send the same credentials used to open the SSE session." });
-                return;
-            }
-            // Per-user rate limit on tool/message traffic.
-            if (!rateLimiter.check(`msg:${entry.userId}`)) {
-                json(res, 429, { error: "Too many requests. Slow down and retry." });
-                return;
-            }
-            entry.lastActivity = Date.now();
-            try {
-                const body = await parseJsonBody(req);
-                await options.requestContext.run({ userId: entry.userId }, async () => {
-                    await entry.transport.handlePostMessage(req, res, body);
-                });
-            }
-            catch (error) {
-                json(res, 400, {
-                    error: error instanceof Error ? error.message : "Invalid request body",
-                });
-            }
-            return;
-        }
-        // Streamable HTTP transport (MCP spec 2025-03-26+) — the transport modern
-        // connector clients (Grok, ChatGPT, Gemini, Claude) expect for remote
-        // servers. One path, three verbs: POST carries JSON-RPC (initialize opens a
-        // session; the response's mcp-session-id header identifies it), GET opens
-        // the standalone server→client SSE stream, DELETE terminates the session.
-        // Auth model mirrors the legacy /sse pair: credentials are verified on the
-        // initialize POST, bound to the session, and every subsequent request must
-        // re-present the same credentials.
-        if (path === "/mcp") {
-            if (req.method !== "POST" && req.method !== "GET" && req.method !== "DELETE") {
-                res.writeHead(405, { "Content-Type": "application/json", Allow: "GET, POST, DELETE" });
-                res.end(JSON.stringify({ error: "Method not allowed" }));
-                return;
-            }
-            if (hasForbiddenQueryAuth(url)) {
-                json(res, 400, {
-                    error: "Internal auth via query params is not allowed. Use X-Kynver-User-Id and X-Kynver-Service-Secret headers.",
-                });
-                return;
-            }
-            const sessionId = headerValue(req, "mcp-session-id");
-            if (sessionId) {
-                const entry = streamableSessions[sessionId];
-                if (!entry) {
-                    // 404 (not 400) per spec so a well-behaved client re-initializes.
-                    json(res, 404, { error: "Unknown or expired MCP session. Re-initialize." });
-                    return;
-                }
-                if (!verifyPostAuth(req, url, entry.auth, serviceSecret)) {
-                    json(res, 401, {
-                        error: "Unauthorized. Re-send the same credentials used to initialize the MCP session.",
-                    });
-                    return;
-                }
-                if (!rateLimiter.check(`msg:${entry.userId}`)) {
-                    json(res, 429, { error: "Too many requests. Slow down and retry." });
-                    return;
-                }
-                entry.lastActivity = Date.now();
-                try {
-                    const body = req.method === "POST" ? await parseJsonBody(req) : undefined;
-                    await options.requestContext.run({ userId: entry.userId }, async () => {
-                        await entry.transport.handleRequest(req, res, body);
-                    });
-                }
-                catch (error) {
-                    if (!res.headersSent) {
-                        json(res, 400, {
-                            error: error instanceof Error ? error.message : "Invalid request body",
-                        });
-                    }
-                }
-                return;
-            }
-            // No session header — only an initialize POST may open a session. (The
-            // transport itself rejects a sessionless non-initialize POST with 400.)
-            if (req.method !== "POST") {
-                json(res, 400, {
-                    error: "Missing mcp-session-id header. Open a session with an initialize POST first.",
-                });
-                return;
-            }
-            // Pre-auth rate limit by client IP (we don't know the user yet).
-            if (!rateLimiter.check(`mcp:${clientIp(req)}`)) {
-                json(res, 429, { error: "Too many requests. Slow down and retry." });
-                return;
-            }
-            let userId = null;
-            let auth = null;
-            const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
-            if (internal) {
-                userId = internal.userId;
-                auth = internal.auth;
-            }
-            else {
-                const apiKey = bearerToken(req);
-                if (apiKey) {
-                    userId = await resolveUserFromApiKey(baseUrl, apiKey);
-                    if (userId)
-                        auth = { kind: "apiKey", apiKey };
-                }
-            }
-            if (!userId || !auth) {
-                json(res, 401, {
-                    error: "Unauthorized. Pass API key via Authorization: Bearer <key> or internal X-Kynver-User-Id + X-Kynver-Service-Secret headers.",
-                });
-                return;
-            }
-            if (activeSessionCount() >= maxSessions) {
-                json(res, 503, { error: "Server at capacity. Try again shortly." });
-                return;
-            }
-            if (activeSessionCountForUser(userId) >= maxSessionsPerUser) {
-                json(res, 429, { error: "Too many concurrent connections for this account." });
-                return;
-            }
-            let body;
-            try {
-                body = await parseJsonBody(req);
-            }
-            catch (error) {
-                json(res, 400, {
-                    error: error instanceof Error ? error.message : "Invalid request body",
-                });
-                return;
-            }
-            const boundUserId = userId;
-            const boundAuth = auth;
-            const transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: () => randomUUID(),
-                onsessioninitialized: (sid) => {
-                    streamableSessions[sid] = {
-                        transport,
-                        userId: boundUserId,
-                        auth: boundAuth,
-                        lastActivity: Date.now(),
-                    };
-                    console.log(`[MCP HTTP] New session (${options.label}, user: ${boundUserId.slice(0, 8)}...)`);
-                },
-            });
-            transport.onclose = () => {
-                if (transport.sessionId)
-                    delete streamableSessions[transport.sessionId];
-            };
-            const server = await options.createMcpServer();
-            await server.connect(transport);
-            try {
-                await options.requestContext.run({ userId: boundUserId }, async () => {
-                    await transport.handleRequest(req, res, body);
-                });
-            }
-            catch (error) {
-                if (!res.headersSent) {
-                    json(res, 400, {
-                        error: error instanceof Error ? error.message : "Invalid request",
-                    });
-                }
-            }
-            return;
-        }
-        if (req.method === "GET" && path === "/health") {
-            res.writeHead(200, { "Content-Type": "text/plain" });
-            res.end("ok");
-            return;
-        }
-        json(res, 404, { error: "Not found" });
-    });
-    httpServer.listen(port, host, () => {
-        console.log(`[MCP SSE] ${options.label} listening on ${host}:${port}`);
-    });
-    return httpServer;
-}

package/dist/lib/package-version.d.ts

@@ -1,7 +0,0 @@
-/** Read a field from the nearest `package.json` above this module. */
-export declare function readOwnPackageJsonField(moduleUrl: string, field: "version" | "name"): string;
-export declare function readOwnPackageVersion(moduleUrl?: string): string;
-export declare function wantsCliVersion(argv: string[]): boolean;
-export declare function printCliVersionAndExit(version: string, binName?: string): never;
-/** When `--version` / `-v` is present, print package version and exit before side effects. */
-export declare function handleCliVersionFlag(argv: string[], moduleUrl?: string, binName?: string): boolean;

package/dist/lib/package-version.js

@@ -1,44 +0,0 @@
-// @generated — synced from packages/kynver-mcp-sse-lib/src/package-version.ts via scripts/sync-mcp-sse-server.mjs
-// Do not edit by hand; change the canonical file and re-run the sync script.
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-function resolvePackageRoot(moduleUrl) {
-    let dir = dirname(fileURLToPath(moduleUrl));
-    for (let depth = 0; depth < 6; depth += 1) {
-        if (existsSync(join(dir, "package.json")))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    throw new Error(`package.json not found above ${dirname(fileURLToPath(moduleUrl))}`);
-}
-/** Read a field from the nearest `package.json` above this module. */
-export function readOwnPackageJsonField(moduleUrl, field) {
-    const pkgPath = join(resolvePackageRoot(moduleUrl), "package.json");
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-    const value = pkg[field];
-    if (typeof value !== "string" || !value.trim()) {
-        throw new Error(`Missing package.json ${field} at ${pkgPath}`);
-    }
-    return value;
-}
-export function readOwnPackageVersion(moduleUrl = import.meta.url) {
-    return readOwnPackageJsonField(moduleUrl, "version");
-}
-export function wantsCliVersion(argv) {
-    return argv.some((arg) => arg === "--version" || arg === "-v");
-}
-export function printCliVersionAndExit(version, binName) {
-    console.log(binName ? `${binName} ${version}` : version);
-    process.exit(0);
-}
-/** When `--version` / `-v` is present, print package version and exit before side effects. */
-export function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
-    if (!wantsCliVersion(argv))
-        return false;
-    printCliVersionAndExit(readOwnPackageVersion(moduleUrl), binName);
-    return true;
-}

package/dist/server.d.ts

@@ -1,11 +0,0 @@
-/**
- * Kynver Agentic OS MCP server: slug-keyed agent identity, goals, projects,
- * sessions, contacts, and long-term memory.
- *
- * Each tool proxies to `/api/agent-os/{slug}/*` on Kynver. The optional `slug`
- * argument resolves in order: explicit arg → `KYNVER_AGENT_OS_SLUG` → cached
- * `GET /api/agent-os` `{ primarySlug }` → list first item → legacy `"ghost"`.
- */
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function resolveAgentContext(explicitAgentContext?: string): string | undefined;
-export declare function createAgentOsServer(): McpServer;