@markmnl/fmsg-mcp 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- Add `FMSG_DEFAULT_DOMAIN=caller` (case-insensitive): short names resolve on the domain of the
+  address the server acts as for each request, so a deployment serving callers on several domains
+  resolves `bob` to `@bob@example.org` for `@mark@example.org` and `@bob@example.net` for a caller
+  on `example.net`. `whoami`'s `default_domain` and the server instructions show the caller's
+  domain. Over stdio, `resolve_address` first looks up the configured key's address. Directory
+  entries still take precedence; a fixed or unset default domain is unchanged.
 - Add HTTP `FMSG_MCP_AUTH_MODE=oauth+api-key`, serving OAuth and API-key callers on one endpoint.
   `Bearer fmsgk_...` requests use API-key authentication; all others, including unauthenticated
   requests, use OAuth with its discovery challenge and scope checks. Providers and caches stay

package/README.md

@@ -159,7 +159,7 @@ attach resources; prompts `chat` and `reply` script the wait → reply loop and
 | `FMSG_MCP_AUTH_MODE` | `api-key` | HTTP authentication: `api-key`, `oauth`, or `oauth+api-key` to accept both on one endpoint; see [OAuth settings](docs/oauth.md#operator-configuration) and [combined mode](docs/oauth.md#combined-oauth-and-api-key-mode) |
 | `FMSG_MCP_PUBLIC_URL` | OAuth resource URL, otherwise unset | Public MCP endpoint, including `/mcp`; enables the HTTP download-link tool. HTTPS required except loopback; when OAuth is enabled must equal `FMSG_MCP_OAUTH_RESOURCE_URL` |
 | `FMSG_ALLOW_INSECURE_HTTP` | disabled | Set to `1` only to permit cleartext API access on a trusted development/private network; loopback HTTP is allowed by default |
-| `FMSG_DEFAULT_DOMAIN` | — | Lets short names resolve: `bob` → `@bob@<domain>` |
+| `FMSG_DEFAULT_DOMAIN` | — | Lets short names resolve: `bob` → `@bob@<domain>`. `caller` resolves them on the domain of the address the server acts as for each request, so `@mark@example.org` gets `@bob@example.org`; directory entries still take precedence |
 | `FMSG_DIRECTORY` | — | JSON file mapping short names to full addresses |
 | `FMSG_MCP_DOWNLOAD_DIR` | — | Enable `save_attachment` in stdio; folder for new files named from message ID and filename |
 | `FMSG_MCP_WAIT_MAX_SECONDS` | `230` | Cap on one `wait_for_message` call |

package/dist/address.d.ts

@@ -8,10 +8,21 @@ export declare function normalizeFmsgAddress(value: string): string | undefined;
 /** Case-insensitive address equality. */
 export declare function sameAddress(a: string, b: string): boolean;
 export declare function isFmsgAddress(value: string): boolean;
+/** Reserved FMSG_DEFAULT_DOMAIN value: short names resolve on the caller's own domain. */
+export declare const CALLER_DOMAIN = "caller";
+/**
+ * The domain short names resolve to: the configured default domain, or with
+ * `caller` the domain of the address the server acts as. Undefined when neither
+ * is known (no default domain, or `caller` before the caller address is known).
+ */
+export declare function effectiveDefaultDomain(defaultDomain: string | undefined, callerAddress?: string): string | undefined;
 export type Resolution = "literal" | "directory" | "default_domain";
 export type AddressResolver = {
+    /** A domain, or CALLER_DOMAIN to use the domain of `callerAddress`. */
     defaultDomain?: string;
     directory?: Record<string, string>;
+    /** The address the server acts as, when known. */
+    callerAddress?: string;
 };
 export type ResolvedAddress = {
     address: string;
@@ -19,7 +30,8 @@ export type ResolvedAddress = {
 };
 /**
  * Resolve a full address or short name: literal `@user@domain` first, then a
- * configured directory entry, then `@name@<default domain>`.
+ * configured directory entry, then `@name@<default domain>` (the caller's own
+ * domain when the default domain is `caller`).
  */
 export declare function resolveAddress(name: string, resolver?: AddressResolver): ResolvedAddress;
 export declare function resolveAddresses(names: string[], resolver?: AddressResolver): string[];

package/dist/address.js

@@ -19,9 +19,23 @@ export function sameAddress(a, b) {
 export function isFmsgAddress(value) {
     return normalizeFmsgAddress(value) !== undefined;
 }
+/** Reserved FMSG_DEFAULT_DOMAIN value: short names resolve on the caller's own domain. */
+export const CALLER_DOMAIN = "caller";
+/**
+ * The domain short names resolve to: the configured default domain, or with
+ * `caller` the domain of the address the server acts as. Undefined when neither
+ * is known (no default domain, or `caller` before the caller address is known).
+ */
+export function effectiveDefaultDomain(defaultDomain, callerAddress) {
+    if (defaultDomain !== CALLER_DOMAIN)
+        return defaultDomain;
+    const match = callerAddress ? ADDRESS.exec(callerAddress.trim()) : null;
+    return match ? match[2].toLowerCase() : undefined;
+}
 /**
  * Resolve a full address or short name: literal `@user@domain` first, then a
- * configured directory entry, then `@name@<default domain>`.
+ * configured directory entry, then `@name@<default domain>` (the caller's own
+ * domain when the default domain is `caller`).
  */
 export function resolveAddress(name, resolver = {}) {
     const trimmed = name.trim();
@@ -41,8 +55,9 @@ export function resolveAddress(name, resolver = {}) {
             return { address, resolution: "directory" };
         }
     }
-    if (resolver.defaultDomain) {
-        const address = normalizeFmsgAddress(`@${trimmed}@${resolver.defaultDomain}`);
+    const domain = effectiveDefaultDomain(resolver.defaultDomain, resolver.callerAddress);
+    if (domain) {
+        const address = normalizeFmsgAddress(`@${trimmed}@${domain}`);
         if (address)
             return { address, resolution: "default_domain" };
     }

package/dist/config.d.ts

@@ -25,6 +25,7 @@ export type Config = {
     allowInsecureHttp?: boolean;
     /** Only set in stdio mode. */
     apiKey?: string;
+    /** Domain for short names, or CALLER_DOMAIN for each caller's own domain. */
     defaultDomain?: string;
     directory?: Record<string, string>;
     /** Trusted local destination; enables save_attachment over stdio only. */

package/dist/config.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { normalizeFmsgAddress } from "./address.js";
+import { CALLER_DOMAIN, normalizeFmsgAddress } from "./address.js";
 import { normalizeApiUrl, normalizeOrigin } from "./client/url.js";
 import { loadOAuthConfig, oauthUrl } from "./oauth/config.js";
 export const DEFAULT_HTTP_PORT = 8765;
@@ -74,7 +74,8 @@ export function loadConfig(env, transport, overrides = {}, options = {}) {
     if (transport === "http" && apiKey) {
         throw new Error("FMSG_API_KEY must not be set in HTTP mode: each client supplies its own bearer credential");
     }
-    const defaultDomain = env.FMSG_DEFAULT_DOMAIN?.trim().replace(/^@/u, "") || undefined;
+    const rawDefaultDomain = env.FMSG_DEFAULT_DOMAIN?.trim().replace(/^@/u, "") || undefined;
+    const defaultDomain = rawDefaultDomain?.toLowerCase() === CALLER_DOMAIN ? CALLER_DOMAIN : rawDefaultDomain;
     const directoryPath = env.FMSG_DIRECTORY?.trim();
     const port = overrides.port ?? intEnv(env, "FMSG_MCP_PORT", DEFAULT_HTTP_PORT, 0);
     if (!Number.isInteger(port) || port < 0 || port > 65535)

package/dist/index.js

@@ -29,7 +29,8 @@ Environment:
   FMSG_MCP_OAUTH_*           OAuth resource/issuer URLs, client ID/secret and exchange
                             audience; see docs/oauth.md for required settings
   FMSG_ALLOW_INSECURE_HTTP   1 to allow a trusted private HTTP API outside loopback
-  FMSG_DEFAULT_DOMAIN        lets short names resolve: bob -> @bob@<domain>
+  FMSG_DEFAULT_DOMAIN        lets short names resolve: bob -> @bob@<domain>; caller
+                            uses the domain of each caller's own address
   FMSG_DIRECTORY             JSON file mapping short names to @user@domain
   FMSG_MCP_DOWNLOAD_DIR      enables save_attachment to this local folder (stdio)
   FMSG_MCP_WAIT_MAX_SECONDS  cap on one wait_for_message call (default 230)

package/dist/instructions.d.ts

@@ -1,12 +1,7 @@
-/**
- * Server instructions: returned in the MCP `initialize` result and folded into
- * the model's system prompt by hosts. Three jobs only: precedence over other
- * fmsg access paths, the irreversible-send rule, and the usage facts a model
- * otherwise gets wrong. Per-tool detail lives in the tool descriptions.
- */
 export type InstructionsContext = {
     /** The address this server acts as, when already known (HTTP callers; stdio after a token exchange). */
     address?: string;
+    /** FMSG_DEFAULT_DOMAIN: a domain, or CALLER_DOMAIN for the caller's own domain. */
     defaultDomain?: string;
 };
 export declare function buildInstructions(ctx?: InstructionsContext): string;

package/dist/instructions.js

@@ -1,10 +1,20 @@
+/**
+ * Server instructions: returned in the MCP `initialize` result and folded into
+ * the model's system prompt by hosts. Three jobs only: precedence over other
+ * fmsg access paths, the irreversible-send rule, and the usage facts a model
+ * otherwise gets wrong. Per-tool detail lives in the tool descriptions.
+ */
+import { CALLER_DOMAIN, effectiveDefaultDomain } from "./address.js";
 export function buildInstructions(ctx = {}) {
     const identity = ctx.address
         ? `you are acting as ${ctx.address}`
         : "call whoami to see which";
-    const shortNames = ctx.defaultDomain
-        ? `; short names resolve to @name@${ctx.defaultDomain}`
-        : "";
+    const domain = effectiveDefaultDomain(ctx.defaultDomain, ctx.address);
+    const shortNames = domain
+        ? `; short names resolve to @name@${domain}`
+        : ctx.defaultDomain === CALLER_DOMAIN
+            ? "; short names resolve to @name@<your domain>, the domain of the address you act as"
+            : "";
     return [
         `This server sends and receives fmsg messages as one fmsg address: ${identity}. ` +
             "Use its tools for everything fmsg: inbox, threads, attachments, sending, replying, reactions, " +

package/dist/tools/common.d.ts

@@ -1,5 +1,6 @@
 import type { CallToolResult, McpServer, ServerContext, ToolAnnotations } from "@modelcontextprotocol/server";
 import * as z from "zod/v4";
+import type { AddressResolver } from "../address.js";
 import type { FmsgMessage } from "../client/types.js";
 import type { Config } from "../config.js";
 import { type Caller, type CallerProvider } from "../context.js";
@@ -57,6 +58,8 @@ export type MessageItem = z.infer<typeof messageItem>;
 export declare function toItem(m: FmsgMessage, self: string): MessageItem;
 export declare function deliveryOf(m: FmsgMessage): z.infer<typeof deliveryItem>[];
 export declare function ok(text: string, structured: Record<string, unknown>): CallToolResult;
+/** Short-name resolution for this caller: the configured directory and default domain. */
+export declare function resolverFor(deps: ToolDeps, caller: Caller): AddressResolver;
 /** Resolve the caller and run a tool body, turning any failure into an `isError` result. */
 export declare function withCaller(deps: ToolDeps, ctx: ServerContext, body: (caller: Caller, signal: AbortSignal) => Promise<CallToolResult>): Promise<CallToolResult>;
 export type Register = (server: McpServer, deps: ToolDeps) => void;

package/dist/tools/common.js

@@ -72,6 +72,10 @@ export function deliveryOf(m) {
 export function ok(text, structured) {
     return { content: [{ type: "text", text }], structuredContent: structured };
 }
+/** Short-name resolution for this caller: the configured directory and default domain. */
+export function resolverFor(deps, caller) {
+    return { ...deps.config, callerAddress: caller.address };
+}
 /** Resolve the caller and run a tool body, turning any failure into an `isError` result. */
 export async function withCaller(deps, ctx, body) {
     let caller;

package/dist/tools/identity.js

@@ -1,7 +1,7 @@
 import * as z from "zod/v4";
-import { resolveAddress } from "../address.js";
+import { CALLER_DOMAIN, effectiveDefaultDomain, resolveAddress } from "../address.js";
 import { isoTime } from "../render.js";
-import { READ_ONLY, ok, withCaller } from "./common.js";
+import { READ_ONLY, ok, resolverFor, withCaller } from "./common.js";
 import { toolError } from "../errors.js";
 export const registerIdentityTools = (server, deps) => {
     server.registerTool("whoami", {
@@ -21,12 +21,13 @@ export const registerIdentityTools = (server, deps) => {
         annotations: { ...READ_ONLY, openWorldHint: false },
     }, async (ctx) => withCaller(deps, ctx, async (caller) => {
         const expires = isoTime((await caller.tokenExpiresAt()) / 1000);
+        const defaultDomain = effectiveDefaultDomain(deps.config.defaultDomain, caller.address);
         const structured = {
             address: caller.address,
             api_url: deps.config.apiPublicUrl ?? null,
             token_expires_at: expires,
             transport: deps.config.transport,
-            default_domain: deps.config.defaultDomain ?? null,
+            default_domain: defaultDomain ?? null,
             directory_names: Object.keys(deps.config.directory ?? {}),
         };
         const lines = [
@@ -35,8 +36,8 @@ export const registerIdentityTools = (server, deps) => {
                 : `You are **${caller.address}** (${deps.config.transport}).`,
             `Access token expires ${expires ?? "unknown"} and is renewed automatically.`,
         ];
-        if (deps.config.defaultDomain)
-            lines.push(`Short names resolve to @name@${deps.config.defaultDomain}.`);
+        if (defaultDomain)
+            lines.push(`Short names resolve to @name@${defaultDomain}.`);
         if (structured.directory_names.length)
             lines.push(`Directory names: ${structured.directory_names.join(", ")}.`);
         return ok(lines.join("\n"), structured);
@@ -49,13 +50,19 @@ export const registerIdentityTools = (server, deps) => {
         inputSchema: z.object({ name: z.string().describe("Full fmsg address (@user@domain) or a short name") }),
         outputSchema: z.object({ address: z.string(), resolution: z.enum(["literal", "directory", "default_domain"]) }),
         annotations: { ...READ_ONLY, openWorldHint: false },
-    }, async ({ name }) => {
-        try {
-            const resolved = resolveAddress(name, deps.config);
-            return ok(`${name} → ${resolved.address} (${resolved.resolution})`, resolved);
-        }
-        catch (error) {
-            return toolError(error instanceof Error ? error.message : String(error));
-        }
+    }, async ({ name }, ctx) => {
+        const resolve = (resolver) => {
+            try {
+                const resolved = resolveAddress(name, resolver);
+                return ok(`${name} → ${resolved.address} (${resolved.resolution})`, resolved);
+            }
+            catch (error) {
+                return toolError(error instanceof Error ? error.message : String(error));
+            }
+        };
+        // Only the caller's own domain needs the caller; otherwise resolution is local.
+        if (deps.config.defaultDomain !== CALLER_DOMAIN)
+            return resolve(deps.config);
+        return withCaller(deps, ctx, async (caller) => resolve(resolverFor(deps, caller)));
     });
 };

package/dist/tools/send.js

@@ -2,7 +2,7 @@ import * as z from "zod/v4";
 import { resolveAddresses, sameAddress } from "../address.js";
 import { toolError } from "../errors.js";
 import { isoTime, participantsOf } from "../render.js";
-import { READ_ONLY, SENDS, idSchema, ok, withCaller } from "./common.js";
+import { READ_ONLY, SENDS, idSchema, ok, resolverFor, withCaller } from "./common.js";
 const IMMUTABLE = "fmsg messages are immutable: once sent they cannot be edited or recalled. Send within the user's requested task or authorized automation.";
 const attachmentInput = z.object({
     filename: z.string().regex(/^[A-Za-z0-9._-]+$/u, "letters, digits, dot, underscore, hyphen only"),
@@ -47,7 +47,7 @@ export const registerSendTools = (server, deps) => {
         outputSchema: sentOutput,
         annotations: SENDS,
     }, async ({ to, topic, body, type, important, no_reply, attachments }, ctx) => withCaller(deps, ctx, async (caller, signal) => {
-        const recipients = resolveAddresses(to, deps.config);
+        const recipients = resolveAddresses(to, resolverFor(deps, caller));
         const sent = await caller.client.send({
             to: recipients,
             topic,
@@ -101,7 +101,7 @@ export const registerSendTools = (server, deps) => {
         }
         const warnings = [];
         const to = recipients?.length
-            ? resolveAddresses(recipients, deps.config)
+            ? resolveAddresses(recipients, resolverFor(deps, caller))
             : participantsOf(parent).filter((a) => !sameAddress(a, caller.address));
         if (to.length === 0)
             return toolError(`message ${id} has no other participants to reply to; pass recipients`);
@@ -141,7 +141,7 @@ export const registerSendTools = (server, deps) => {
         outputSchema: z.object({ id: z.string(), added: z.number(), add_to: z.array(z.string()) }),
         annotations: { ...SENDS, idempotentHint: true },
     }, async ({ id, add_to }, ctx) => withCaller(deps, ctx, async (caller, signal) => {
-        const addresses = resolveAddresses(add_to, deps.config);
+        const addresses = resolveAddresses(add_to, resolverFor(deps, caller));
         const result = await caller.client.addRecipients(id, addresses, signal);
         return ok(`Added ${result.added} recipient(s) to message ${id}: ${addresses.join(", ")}`, { ...result, add_to: addresses });
     }));

package/dist/tools/wait.js

@@ -3,7 +3,7 @@ import { resolveAddress } from "../address.js";
 import { assembleThread, renderThread } from "../thread.js";
 import { DATA_NOT_INSTRUCTIONS, fence, headerValue, messageData, messageLine } from "../render.js";
 import { waitForMessage } from "../wait.js";
-import { READ_ONLY, idSchema, messageItem, ok, toItem, withCaller } from "./common.js";
+import { READ_ONLY, idSchema, messageItem, ok, resolverFor, toItem, withCaller } from "./common.js";
 export const registerWaitTools = (server, deps) => {
     const maxWait = deps.config.waitMaxSeconds;
     server.registerTool("wait_for_message", {
@@ -41,7 +41,7 @@ export const registerWaitTools = (server, deps) => {
         const result = await waitForMessage(caller.client, caller.address, {
             ...(after_id !== undefined ? { afterId: after_id } : {}),
             ...(thread_of !== undefined ? { threadOf: thread_of } : {}),
-            ...(from !== undefined ? { from: resolveAddress(from, deps.config).address } : {}),
+            ...(from !== undefined ? { from: resolveAddress(from, resolverFor(deps, caller)).address } : {}),
             timeoutMs: timeout_seconds * 1000,
             settleMs: settle_seconds * 1000,
             onTick: (elapsed) => {

package/docs/http-deployment.md

@@ -15,6 +15,11 @@ npx -y @markmnl/fmsg-mcp --http 127.0.0.1:8765
 
 `FMSG_API_KEY` must be unset in HTTP mode. Include only browser origins you use.
 
+When callers have addresses on several domains, set `FMSG_DEFAULT_DOMAIN=caller` rather than one
+fixed domain: short names then resolve on each caller's own domain, so `bob` is `@bob@example.org`
+for `@mark@example.org` and `@bob@example.net` for a caller on `example.net`. `whoami` and the
+server instructions show that caller's domain. `FMSG_DIRECTORY` entries still take precedence.
+
 If the server reaches the Web API at an internal address instead, for example
 `FMSG_API_URL=http://10.0.0.5:8000` with `FMSG_ALLOW_INSECURE_HTTP=1` on a private network, also set
 `FMSG_API_PUBLIC_URL=https://api.example.com` so `whoami` reports the URL users know. Without it,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@markmnl/fmsg-mcp",
   "mcpName": "io.github.markmnl/fmsg-mcp",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "MCP server for fmsg: send and receive federated messages from any AI agent via a deployed fmsg Web API",
   "type": "module",
   "license": "MIT",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/markmnl/fmsg-mcp",
     "source": "github"
   },
-  "version": "0.2.4",
+  "version": "0.2.5",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@markmnl/fmsg-mcp",
-      "version": "0.2.4",
+      "version": "0.2.5",
       "transport": {
         "type": "stdio"
       },