@marsnme/mcp-gateway 0.1.6 → 0.1.8

package/README.md

@@ -39,7 +39,11 @@ After startup:
 
 ## Common optional environment variables
 - `PORT`
-  - Overrides default port (`18790`)
+  - Overrides the HTTP port used by the gateway
+  - If omitted, the gateway resolves a profile-based default:
+    - `coco` → `18790`
+    - `toto` → `18791`
+    - other profile IDs → deterministic port in `20000-29999`
 - `MCP_REQUIRE_BEARER`
   - Set `true` to require `Authorization: Bearer <token>` on MCP calls
 - `MCP_OAUTH_ENABLED`
@@ -60,6 +64,22 @@ curl -sS http://127.0.0.1:18790/mcp \
   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
 ```
 
+## Deployment safety gate (before restart)
+For upgrades, run database migrations with an explicit DDL-capable role and gate schema compatibility before restarting services.
+
+Recommended role guidance:
+- Use a role that can execute DDL on target schemas.
+- On Supabase-hosted Postgres this is typically `supabase_admin` (not `postgres`).
+
+Schema gate command:
+```bash
+bash deploy/phase2/pre_deploy_schema_gate.sh \
+  --db-url "<postgres://supabase_admin:<password>@<host>:5432/postgres>" \
+  --profiles coco,toto \
+  --expected-role supabase_admin
+```
+- If gate exits non-zero, stop deployment and do not restart services.
+
 ## Database setup and full onboarding
 For migrations and full setup details:
 - Repository README: https://github.com/Marsmanleo/MarsNMe/blob/main/README.md

package/deploy/phase2/pre_deploy_schema_gate.sh

@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DB_URL="${SUPABASE_DB_URL:-}"
+PROFILES="coco,toto"
+EXPECTED_ROLE="${MIGRATION_EXPECTED_ROLE:-supabase_admin}"
+SKIP_ROLE_CHECK="false"
+
+usage() {
+  cat <<EOF
+usage: $0 --db-url <postgres-url> [--profiles <comma-separated>] [--expected-role <role>] [--skip-role-check]
+
+examples:
+  $0 --db-url "<postgres-connection-string>"
+  $0 --db-url "<postgres-connection-string>" --profiles coco,toto --expected-role supabase_admin
+  $0 --db-url "<postgres-connection-string>" --profiles profile-a --expected-role app_owner
+  $0 --db-url "<postgres-connection-string>" --profiles profile-a --skip-role-check
+
+notes:
+  - run this gate before any service restart in deployment flow
+  - exit code 0 means schema is compatible with current gateway code
+  - exit code 1 means compatibility gate failed (do NOT restart)
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --db-url)
+      DB_URL="$2"
+      shift 2
+      ;;
+    --profiles)
+      PROFILES="$2"
+      shift 2
+      ;;
+    --expected-role)
+      EXPECTED_ROLE="$2"
+      shift 2
+      ;;
+    --skip-role-check)
+      SKIP_ROLE_CHECK="true"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown arg: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if ! command -v psql >/dev/null 2>&1; then
+  echo "psql not found in PATH; install PostgreSQL client tools first" >&2
+  exit 2
+fi
+
+if [[ -z "${DB_URL}" ]]; then
+  echo "--db-url is required (or set SUPABASE_DB_URL env)" >&2
+  exit 2
+fi
+
+escape_sql_literal() {
+  printf "%s" "$1" | sed "s/'/''/g"
+}
+
+quote_ident() {
+  local raw="$1"
+  printf '"%s"' "${raw//\"/\"\"}"
+}
+
+run_sql() {
+  local sql="$1"
+  psql "${DB_URL}" --set ON_ERROR_STOP=1 --no-psqlrc --tuples-only --no-align --quiet -c "${sql}"
+}
+
+PASS_COUNT=0
+FAIL_COUNT=0
+
+log_pass() {
+  printf '[PASS] %s\n' "$1"
+  PASS_COUNT=$((PASS_COUNT + 1))
+}
+
+log_fail() {
+  printf '[FAIL] %s\n' "$1" >&2
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+}
+
+check_sql() {
+  local label="$1"
+  local sql="$2"
+  local output
+  if output="$(run_sql "${sql}" 2>&1)"; then
+    log_pass "${label}"
+    return
+  fi
+  output="$(printf '%s' "${output}" | tr '\n' ' ' | sed -E 's/[[:space:]]+/ /g')"
+  log_fail "${label} :: ${output}"
+}
+
+PROFILE_LIST=()
+IFS=',' read -ra RAW_PROFILES <<< "${PROFILES}"
+for raw_profile in "${RAW_PROFILES[@]}"; do
+  profile="$(printf '%s' "${raw_profile}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+  if [[ -z "${profile}" ]]; then
+    continue
+  fi
+  if [[ ! "${profile}" =~ ^[a-z][a-z0-9_-]*$ ]]; then
+    echo "invalid profile id: ${profile} (must match ^[a-z][a-z0-9_-]*$)" >&2
+    exit 2
+  fi
+  PROFILE_LIST+=("${profile}")
+done
+
+if [[ ${#PROFILE_LIST[@]} -eq 0 ]]; then
+  echo "no valid profiles found from --profiles input: ${PROFILES}" >&2
+  exit 2
+fi
+
+CURRENT_ROLE="$(run_sql "SELECT current_user;" | tr -d '[:space:]')"
+if [[ -z "${CURRENT_ROLE}" ]]; then
+  echo "failed to resolve current_user from database" >&2
+  exit 2
+fi
+
+printf '[INFO] pre-deploy schema gate start\n'
+printf '[INFO] target profiles=%s\n' "$(IFS=,; printf '%s' "${PROFILE_LIST[*]}")"
+printf '[INFO] connected role=%s\n' "${CURRENT_ROLE}"
+
+if [[ "${SKIP_ROLE_CHECK}" == "true" ]]; then
+  printf '[INFO] migration role check skipped by --skip-role-check\n'
+elif [[ -n "${EXPECTED_ROLE}" ]]; then
+  expected_role_lit="$(escape_sql_literal "${EXPECTED_ROLE}")"
+  role_status="$(run_sql "SELECT CASE WHEN current_user = '${expected_role_lit}' OR pg_has_role(current_user, '${expected_role_lit}', 'member') THEN 'ok' ELSE 'mismatch' END;" | tr -d '[:space:]' || true)"
+  if [[ "${role_status}" == "ok" ]]; then
+    log_pass "migration role check (expected=${EXPECTED_ROLE})"
+  else
+    log_fail "migration role check failed (expected=${EXPECTED_ROLE}, got=${CURRENT_ROLE})"
+  fi
+else
+  printf '[INFO] migration role check disabled (empty expected role)\n'
+fi
+
+for profile in "${PROFILE_LIST[@]}"; do
+  profile_lit="$(escape_sql_literal "${profile}")"
+  profile_ident="$(quote_ident "${profile}")"
+
+  check_sql "${profile}.memories required columns" \
+    "SELECT id,body,source,session_id,tags,agent_body,environment,promoted,promoted_at,created_at,expires_at FROM ${profile_ident}.memories LIMIT 0;"
+
+  check_sql "${profile}.marsvault_chunks required columns" \
+    "SELECT id,content,source_file,section,body,visibility,tags,type,date,origin,source_memory_id,source_session_id,source_tool,source_user_note,agent_body,environment,created_at,updated_at FROM ${profile_ident}.marsvault_chunks LIMIT 0;"
+
+  check_sql "${profile}.memories DDL ownership check" \
+    "DO \$\$ DECLARE owner_oid oid; BEGIN SELECT c.relowner INTO owner_oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = '${profile_lit}' AND c.relname = 'memories' AND c.relkind = 'r'; IF owner_oid IS NULL THEN RAISE EXCEPTION 'table %.% is missing', '${profile_lit}', 'memories'; END IF; IF NOT ((SELECT rolsuper FROM pg_roles WHERE rolname = current_user) OR owner_oid = (SELECT oid FROM pg_roles WHERE rolname = current_user) OR pg_has_role(current_user, owner_oid, 'MEMBER')) THEN RAISE EXCEPTION 'current_user % cannot ALTER %.memories (owner=%)', current_user, '${profile_lit}', pg_get_userbyid(owner_oid); END IF; END \$\$;"
+
+  check_sql "${profile}.marsvault_chunks DDL ownership check" \
+    "DO \$\$ DECLARE owner_oid oid; BEGIN SELECT c.relowner INTO owner_oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = '${profile_lit}' AND c.relname = 'marsvault_chunks' AND c.relkind = 'r'; IF owner_oid IS NULL THEN RAISE EXCEPTION 'table %.% is missing', '${profile_lit}', 'marsvault_chunks'; END IF; IF NOT ((SELECT rolsuper FROM pg_roles WHERE rolname = current_user) OR owner_oid = (SELECT oid FROM pg_roles WHERE rolname = current_user) OR pg_has_role(current_user, owner_oid, 'MEMBER')) THEN RAISE EXCEPTION 'current_user % cannot ALTER %.marsvault_chunks (owner=%)', current_user, '${profile_lit}', pg_get_userbyid(owner_oid); END IF; END \$\$;"
+
+  check_sql "${profile}.search_memories_semantic(v2) exists" \
+    "DO \$\$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = '${profile_lit}' AND p.proname = 'search_memories_semantic' AND p.pronargs = 7) THEN RAISE EXCEPTION 'missing function %.search_memories_semantic(text, integer, text, boolean, text, text, text)', '${profile_lit}'; END IF; END \$\$;"
+
+  check_sql "${profile}.search_marsvault_chunks_semantic(v2) exists" \
+    "DO \$\$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = '${profile_lit}' AND p.proname = 'search_marsvault_chunks_semantic' AND p.pronargs = 10) THEN RAISE EXCEPTION 'missing function %.search_marsvault_chunks_semantic(text, integer, text, boolean, boolean, boolean, text, text, text, text)', '${profile_lit}'; END IF; END \$\$;"
+done
+
+LATEST_MIGRATION_VERSION="$(run_sql "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version DESC LIMIT 1;" 2>/dev/null | tr -d '[:space:]' || true)"
+if [[ -n "${LATEST_MIGRATION_VERSION}" ]]; then
+  printf '[INFO] latest schema_migrations.version=%s\n' "${LATEST_MIGRATION_VERSION}"
+else
+  printf '[WARN] schema_migrations version not available (table missing or inaccessible)\n' >&2
+fi
+
+printf '[INFO] pre-deploy schema gate summary: pass=%d fail=%d\n' "${PASS_COUNT}" "${FAIL_COUNT}"
+
+if [[ "${FAIL_COUNT}" -gt 0 ]]; then
+  printf '[ERROR] schema gate failed; do NOT restart services until all checks pass\n' >&2
+  exit 1
+fi
+
+printf '[OK] schema gate passed; safe to continue deployment restart flow\n'

package/deploy/phase3/smoke_gate.sh

@@ -159,23 +159,99 @@ TOTO_TOOL_CALL_JSON="$(mcp_jsonrpc "${TOTO_URL}" '{"jsonrpc":"2.0","id":"toto-li
 
 COCO_CALL_CHECK="$(CALL_PAYLOAD="${COCO_TOOL_CALL_JSON}" node -e '
 const payload = JSON.parse(process.env.CALL_PAYLOAD || "{}");
-if (payload.error) throw new Error("tools/call error: " + JSON.stringify(payload.error));
+const clip = (value, max = 800) => {
+  const text = String(value ?? "");
+  return text.length > max ? text.slice(0, max) + "...(truncated)" : text;
+};
+const extractErrorText = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) return value.map(extractErrorText).filter(Boolean).join(" | ");
+  if (typeof value === "object") {
+    if (typeof value.message === "string" && value.message) return value.message;
+    if (typeof value.error === "string" && value.error) return value.error;
+    if (value.error) {
+      const nested = extractErrorText(value.error);
+      if (nested) return nested;
+    }
+    if (value.details) {
+      const details = extractErrorText(value.details);
+      if (details) return details;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+};
+if (payload.error) throw new Error("tools/call error: " + clip(JSON.stringify(payload.error)));
 const content = payload.result?.content;
 if (!Array.isArray(content) || content.length === 0) throw new Error("tools/call missing content");
-const text = content[0]?.text ?? "";
-const parsed = JSON.parse(text);
-if (parsed.ok !== true) throw new Error("list_memories response missing ok=true");
+const textItems = content
+  .map((item) => (typeof item?.text === "string" ? item.text.trim() : ""))
+  .filter(Boolean);
+if (payload.result?.isError === true) {
+  throw new Error("tools/call returned isError=true; detail=" + clip(textItems.join(" | ")));
+}
+const firstText = textItems[0] || "";
+let parsed;
+try {
+  parsed = JSON.parse(firstText);
+} catch (err) {
+  throw new Error("tools/call first content is not valid JSON: " + clip(firstText));
+}
+if (parsed.ok !== true) {
+  const inner = extractErrorText(parsed.error) || extractErrorText(parsed.details) || extractErrorText(parsed.message) || clip(JSON.stringify(parsed));
+  throw new Error("list_memories returned ok!=true; detail=" + clip(inner));
+}
 process.stdout.write(JSON.stringify({ count: parsed.count ?? null }));
 ')"
 
 TOTO_CALL_CHECK="$(CALL_PAYLOAD="${TOTO_TOOL_CALL_JSON}" node -e '
 const payload = JSON.parse(process.env.CALL_PAYLOAD || "{}");
-if (payload.error) throw new Error("tools/call error: " + JSON.stringify(payload.error));
+const clip = (value, max = 800) => {
+  const text = String(value ?? "");
+  return text.length > max ? text.slice(0, max) + "...(truncated)" : text;
+};
+const extractErrorText = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) return value.map(extractErrorText).filter(Boolean).join(" | ");
+  if (typeof value === "object") {
+    if (typeof value.message === "string" && value.message) return value.message;
+    if (typeof value.error === "string" && value.error) return value.error;
+    if (value.error) {
+      const nested = extractErrorText(value.error);
+      if (nested) return nested;
+    }
+    if (value.details) {
+      const details = extractErrorText(value.details);
+      if (details) return details;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+};
+if (payload.error) throw new Error("tools/call error: " + clip(JSON.stringify(payload.error)));
 const content = payload.result?.content;
 if (!Array.isArray(content) || content.length === 0) throw new Error("tools/call missing content");
-const text = content[0]?.text ?? "";
-const parsed = JSON.parse(text);
-if (parsed.ok !== true) throw new Error("list_memories response missing ok=true");
+const textItems = content
+  .map((item) => (typeof item?.text === "string" ? item.text.trim() : ""))
+  .filter(Boolean);
+if (payload.result?.isError === true) {
+  throw new Error("tools/call returned isError=true; detail=" + clip(textItems.join(" | ")));
+}
+const firstText = textItems[0] || "";
+let parsed;
+try {
+  parsed = JSON.parse(firstText);
+} catch (err) {
+  throw new Error("tools/call first content is not valid JSON: " + clip(firstText));
+}
+if (parsed.ok !== true) {
+  const inner = extractErrorText(parsed.error) || extractErrorText(parsed.details) || extractErrorText(parsed.message) || clip(JSON.stringify(parsed));
+  throw new Error("list_memories returned ok!=true; detail=" + clip(inner));
+}
 process.stdout.write(JSON.stringify({ count: parsed.count ?? null }));
 ')"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marsnme/mcp-gateway",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "mcpName": "io.github.Marsmanleo/marsnme",
   "private": false,
   "description": "Agent-agnostic, LLM-agnostic memory backend for MCP-compatible tools",
@@ -14,10 +14,19 @@
   "keywords": [
     "mcp",
     "memory",
-    "ai",
-    "symbiosis",
+    "ai-memory",
+    "persistent-memory",
+    "ai-agent",
+    "model-context-protocol",
+    "semantic-search",
+    "supabase",
+    "jina",
     "embedding",
-    "supabase"
+    "typescript",
+    "session-memory",
+    "cross-session",
+    "llm",
+    "symbiosis"
   ],
   "bin": {
     "marsnme": "server.mjs"

package/server.mjs

@@ -45,6 +45,19 @@ const PROFILE_CONFIGS = {
     memoryIngestFixedTags: ['toto', 'insight']
   }
 };
+const PROFILE_DEFAULT_PORT_RANGE_START = 20000;
+const PROFILE_DEFAULT_PORT_RANGE_SIZE = 10000;
+const PROFILE_LEGACY_DEFAULT_PORTS = {
+  coco: 18790,
+  toto: 18791
+};
+function resolveProfileDefaultPort(profileId) {
+  const legacyPort = PROFILE_LEGACY_DEFAULT_PORTS[profileId];
+  if (Number.isInteger(legacyPort)) return legacyPort;
+  const hash = crypto.createHash('sha256').update(profileId).digest();
+  const slot = hash.readUInt16BE(0) % PROFILE_DEFAULT_PORT_RANGE_SIZE;
+  return PROFILE_DEFAULT_PORT_RANGE_START + slot;
+}
 const PROFILE_ID_PATTERN = /^[a-z][a-z0-9_-]*$/;
 function buildProfileConfig(profileId) {
   const legacyProfile = PROFILE_CONFIGS[profileId];
@@ -53,7 +66,7 @@ function buildProfileConfig(profileId) {
     ...PROFILE_CONFIGS.coco,
     schema: profileId,
     displayName: profileId,
-    defaultPort: 18790,
+    defaultPort: resolveProfileDefaultPort(profileId),
     gatewayDir: `${profileId}-mcp-gateway`,
     publicHostSuffix: `${profileId}-mcp.marsgroup.asia`,
     recallBodyEnum: [profileId, 'system'],
@@ -151,7 +164,12 @@ function setMemorySourceWhitelist(nextSources) {
 }
 setMemorySourceWhitelist(buildMemorySourceListForMode());
 
-const PORT = Number.parseInt(process.env.PORT || '18790', 10);
+const PORT_RAW = String(process.env.PORT || '').trim();
+const PORT_SOURCE = PORT_RAW ? 'env' : 'profile-default';
+const PORT = Number.parseInt(PORT_RAW || String(PROFILE.defaultPort), 10);
+if (!Number.isInteger(PORT) || PORT < 1 || PORT > 65535) {
+  throw new Error(`Invalid PORT: ${PORT_RAW || String(PORT)}. Must be an integer between 1 and 65535.`);
+}
 const SUPABASE_BASE_URL = process.env.SUPABASE_BASE_URL || 'http://127.0.0.1:8100';
 const OAUTH_ENABLED = process.env.MCP_OAUTH_ENABLED !== 'false';
 const REQUIRE_BEARER = process.env.MCP_REQUIRE_BEARER === 'true';
@@ -4336,8 +4354,27 @@ const server = http.createServer(async (req, res) => {
   }
 });
 
+server.on('error', (error) => {
+  if (error?.code === 'EADDRINUSE') {
+    const hint =
+      PORT_SOURCE === 'env'
+        ? `Set PORT to an unused value (current PORT=${PORT}).`
+        : `Set PORT to an unused value or use another MCP_PROFILE (profile=${MCP_PROFILE}, default_port=${PROFILE.defaultPort}).`;
+    console.error(`[fatal] ${SERVER_NAME} cannot start: port ${PORT} is already in use. ${hint}`);
+    process.exit(1);
+    return;
+  }
+  console.error(
+    `[fatal] ${SERVER_NAME} failed to start: ${String(error?.message || error)}`
+  );
+  process.exit(1);
+});
+
 server.listen(PORT, '0.0.0.0', () => {
   console.log(`${SERVER_NAME} listening on 0.0.0.0:${PORT}`);
+  console.log(
+    `[config] profile=${MCP_PROFILE} resolved_port=${PORT} source=${PORT_SOURCE} profile_default_port=${PROFILE.defaultPort}`
+  );
   console.log(`[config] source_mode=${SOURCE_MODE}`);
   if (SOURCE_MODE === 'registry') {
     void reloadSourceRegistryCache()