@moikapy/lich 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,6 +1,80 @@
 # Changelog
 
-## 0.6.0 (unreleased)
+## 0.7.1
+
+- close agent-core review must-fixes A-1–A-4: multi-turn runs stop
+  duplicating history, tool pairs survive compression and gateway history
+  caps, and a mid-call abort becomes `stopped_reason: aborted` with the
+  abort signal reaching in-flight tools.
+- harden the webhook gateway (G-1/G-2/G-3/G-5): binds to loopback by
+  default and requires a token when exposed, defaults public platforms
+  (telegram/discord/twitch) to deny with a configurable allowlist plus a
+  reduced safe toolset, catches telegram/discord reply send failures
+  instead of crashing the run, and forces `platform=webhook` on the HTTP
+  adapter.
+- close MCP exit (M-1), empty Anthropic text, and env provider fallback:
+  one-shot/chat/TUI/gateway runs call `Agent.close()` so stdio MCP
+  sessions release; node children are still `unref`'d so the event loop
+  can drain (bun keeps the child attached — see below). an empty
+  Anthropic text block no longer 400s the session permanently, and
+  mcp-only project configs no longer shadow `LICH_MODEL` / env providers.
+- close tools must-fixes S-1–S-5: file writes/edits resolve realpath so
+  symlink escapes are confined, `fetch_url`/`http_request` block private
+  and loopback URLs, `.lich/config.json` and `.env` are forbidden write
+  targets, terminal child env is scrubbed of provider secrets, and
+  dash-leading `run_tests` filters are rejected so they cannot open the
+  commit gate. `http_request` also strips IPv6 brackets before SSRF IP
+  classification so `[::1]` literals are not skipped, and asserts headers
+  through `Headers` after the `safe_fetch` merge.
+- isolate usage per run (A-5) and memoize MCP attach (A-6): concurrent
+  `Agent.run` calls no longer mix `usage_total`, and attach races can
+  neither skip nor permanently fail.
+- TUI: ignore message submit while a run is in flight (U-1), and walk the
+  newest-first recall ring so Up moves to older entries instead of
+  clamping on the newest (U-2).
+- pin outbound HTTP: `fetch_url` and `http_request` keep the https
+  hostname for TLS/SNI and the `Host` header while `safe_fetch` pins the
+  connect to a vetted public IP through a custom DNS `lookup`, and
+  re-validates every redirect hop. the operator opt-out is exact:
+  `LICH_ALLOW_PRIVATE_URLS=1`; unset or any other value is fail-closed
+  (private/loopback URLs blocked).
+- harden `grep_files`: the directory walk skips symbolic links (same
+  skip path as `SKIP_DIRS`), and every candidate read runs
+  `assert_file_tool_access`, so `.lich/config.json` is denied with
+  `forbidden_path: .lich/config.json`.
+- twitch gateway: `PRIVMSG` matching is anchored (`^:... PRIVMSG #...
+  :...$` after the optional tags strip), so `USERNOTICE` and
+  `WHISPER` lines are not chat and cannot spoof the allowlist.
+- bun stdio MCP children are no longer `unref`'d: one-shot and
+  short-lived runs wait for the MCP answer instead of letting the child
+  detach and exit early.
+- add CI (tsc + vitest on Node 20/22), sync the 0.7.0 user docs with this
+  tree, and make `edit_file` treat `$` sequences literally while allowing
+  an empty `new_string` (#57).
+- sync docs/architecture with the outbound-HTTP pin, grep hardening,
+  twitch anchor, and bun MCP exit changes (#61).
+- add a manual Release workflow: Actions → Release → Run workflow (from
+  `main`) with a `patch|minor|major` bump runs `bun release`, then
+  publishes the packed tarball to npm with `NPM_TOKEN`. maintainer
+  plumbing, not a runtime change (#62).
+
+## 0.7.0
+
+- add a general MCP client. `mcp_servers` is a closed record of named
+  stdio or loopback-http entries, default off. tool names are
+  `mcp_<server>_<tool>`. `tools_enabled: []` drops them. the commander
+  persona does not copy `mcp_servers`. redot is a catalog entry (local
+  `redot` binary, `--headless --mcp-server --path <project>`, five
+  upstream controllers, no execute). godot has no official server; lich
+  does not download a community addon. play stays the webhook and
+  game_bridge, the opposite direction. see docs/user-guide/redot.md.
+- add `lich mcp` to list, add, enable, disable, and remove servers.
+  add uses the catalog or `--command`/`--url`, stays disabled, and
+  updates `.lich/config.json` through the existing writer without
+  dropping other keys.
+- sync user docs with this tree. MCP is included in the 0.7.0 package.
+
+## 0.6.0
 
 - document a per-persona orchestrator example: one agent per NPC, the
   webhook `POST /message` shape, and history serialization the game repo

package/README.md

@@ -15,7 +15,7 @@ mythology lives in display strings only.
 | --- | --- | --- |
 | **phylacteries** | JSONL session files in `.lich/sessions/` — conversations survive process death | This glossary; TUI `/sessions` listing label |
 | **vessel-hopping** | Provider failover: 429/5xx retried with backoff, then the next provider takes over | This glossary |
-| **the lair / wards** | `work_dir` confinement + `path_escape` guardrails | This glossary |
+| **the lair / wards** | `work_dir` confinement + `path_escape` guardrails for file tools. Wards do **not** apply to `terminal` or `run_tests` (shell still runs in `work_dir`; secret env names are scrubbed on spawn). | This glossary |
 | **lair actions** | Plugin hooks that observe or veto tool calls | This glossary |
 | **familiars** | Gateway adapters (webhook/telegram/discord/twitch) routing into one shared agent | This glossary |
 | **spells** | Builtin tools in the registry | This glossary |
@@ -30,10 +30,13 @@ mythology lives in display strings only.
 | --- | --- |
 | [Docs home](docs/index.md) | Overview, feature map, and a 60-second quickstart. |
 | [Getting started](docs/getting-started.md) | Zero-to-first-reply: install, config paths, one-shot, TUI, gateway. |
-| [CLI reference](docs/user-guide/cli.md) | All four modes, flags, provider resolution, config schema, recipes. |
+| [CLI reference](docs/user-guide/cli.md) | Modes, flags, provider resolution, config schema, `lich mcp`, recipes. |
 | [TUI guide](docs/user-guide/tui.md) | Launch, slash commands, status bar, memory semantics. |
 | [Gateway guide](docs/user-guide/gateway.md) | Webhook/Telegram/Discord/Twitch setup and the webhook API. |
 | [Library guide](docs/user-guide/library.md) | Embedding: `create_agent`, events, multi-turn history, errors. |
+| [Plugins guide](docs/user-guide/plugins.md) | User tools and hooks, and the self-improvement loop. |
+| [Godot guide](docs/user-guide/godot.md) | The game connects to lich (webhook + `game_bridge`). |
+| [Redot guide](docs/user-guide/redot.md) | lich connects to editor MCP servers. Redot is a catalog entry. |
 | [Games guide](docs/user-guide/games.md) | Session JSONL as a combat log, and jq recipes over it. |
 | [Persona example](examples/persona_orchestrator/README.md) | Per-NPC agents the game repo copies. Not a second core. |
 
@@ -63,7 +66,8 @@ lich gateway webhook
 
 The CLI has four modes: **one-shot** (`lich "task"`), **chat**
 (`lich chat`), **tui** (`lich tui`), and **gateway**
-(`lich gateway <platform...>`).
+(`lich gateway <platform...>`). Other commands do not start an agent:
+`lich init`, `lich config`, `lich update`, and `lich mcp`.
 
 Or use a JSON config file: `lich --config lich.json "task"` (see
 `AgentConfig` in `src/agent/config.ts` for the schema).
@@ -97,7 +101,7 @@ snake_case args and are registered under the `builtin` toolset.
 | `edit_file` | Replace a unique string in a file, with an optional replace-all. |
 | `list_dir` | List a directory tree iteratively (dirs first, file sizes). |
 | `terminal` | Run a shell command via `bash -lc` and capture output plus exit code. |
-| `grep_files` | Regex search across files, skipping node_modules/.git/dist and binaries. |
+| `grep_files` | Regex search across files, skipping node_modules/.git/dist, symlinks, and binaries; `.lich/config.json` is denied. |
 | `fetch_url` | GET an http(s) URL and return the body text with a status header. |
 | `web_search` | Web search via DuckDuckGo's HTML endpoint (no api key). |
 | `http_request` | Generic HTTP calls (method/headers/body) for REST-ish APIs. |
@@ -113,7 +117,9 @@ snake_case args and are registered under the `builtin` toolset.
 Customize lich with your own tools and lifecycle hooks: keep a `Plugin`
 object (`{name, tools?, hooks?}`) in your repo, list its file path in the
 `plugins` config array, and the agent merges your tools and lets your hooks
-observe or veto tool calls. See
+observe or veto tool calls. Bare `lich`, one-shot, chat, tui, and gateway
+all load `config.plugins` (`create_agent_with_plugins`). `create_agent` does
+not. See
 [docs/user-guide/plugins.md](docs/user-guide/plugins.md).
 
 Skills are markdown files you write to `.lich/skills/` with `write_file`;
@@ -131,6 +137,7 @@ the next self-commit. One gated `git_commit` per run requires
 | `LICH_BASE_URL` | provider base url (ollama default: `http://localhost:11434`) |
 | `LICH_API_KEY_ENV` | env var holding the api key (unused by ollama) |
 | `LICH_ALLOW_SELF_COMMIT` | set to `1` to allow one gated `git_commit` per run; unset is fail-closed |
+| `LICH_ALLOW_PRIVATE_URLS` | set to exactly `1` to let `fetch_url` / `http_request` reach private or loopback URLs; unset or any other value is fail-closed (blocked) |
 | `LICH_TEST_COMMAND` | command `run_tests` runs (default: `node node_modules/vitest/vitest.mjs run`) |
 
 ## Ollama
@@ -241,6 +248,24 @@ compression notices still start with `context compressed`.
 `welcome` substitutes `{version}`, `{model}`, and `{kind}`. `notices.compressed`
 substitutes `{chars}`; `notices.sessions` substitutes `{count}`.
 
+## Editor MCP
+
+Two directions. lich connects **to** an editor MCP server (stdio local
+command, or loopback HTTP). The game connects **to** lich through the webhook
+and [`examples/game_bridge`](examples/game_bridge/README.md). Default is off.
+`mcp_servers` is a closed record. Names are `mcp_<server>_<tool>`. `npx`,
+`npm`, `bunx`, `uvx`, `curl`, `wget`, remote URLs, and shell metacharacters
+are refused. On Bun, stdio children are not `unref`'d, so a one-shot or
+other short-lived run waits for the MCP answer instead of exiting while
+the child is still working; `agent.close()` (which every CLI mode calls)
+kills the child.
+
+This source has `lich mcp list|add|enable|disable|remove` (changelog 0.7.0).
+From a clone: `bun src/cli.ts mcp list`. Redot is a catalog
+entry (`redot --headless --mcp-server`), not a fork inside lich. Godot has
+no official MCP server; lich does not download a community addon. See
+[docs/user-guide/redot.md](docs/user-guide/redot.md).
+
 ## Development
 
 ```sh
@@ -254,15 +279,42 @@ packages in /tmp and break dependency resolution.
 
 ## Releasing
 
+Update `CHANGELOG.md` first so the new version notes match what you ship
+(GitHub release labels / automated notes are a follow-up).
+
+### GitHub Actions (preferred)
+
+Requires the `NPM_TOKEN` repository secret (npm **automation** or
+granular token with publish access to `@moikapy/lich` — not a classic
+token that needs interactive OTP, which `npm publish` in CI cannot
+answer). It is typically already configured; if not, add it under
+**Settings → Secrets and variables → Actions → New repository secret**.
+1. Ensure Actions can push commits/tags to `main` (repo
+   **Settings → Actions → General → Workflow permissions**: read and
+   write; if branch protection blocks `GITHUB_TOKEN`, allow GitHub Actions
+   to bypass or push to `main`).
+2. Run: **Actions → Release → Run workflow** (from `main` only) → choose
+   `bump` (`patch` / `minor` / `major`, default `patch`).
+
+The workflow runs `bun release <bump>` (typecheck, test, bump, build,
+pack + audit, commit, tag, push — no force-push), then
+`npm publish test/.tmp/lich-<version>.tgz --access public` with
+`NODE_AUTH_TOKEN` from `NPM_TOKEN`. It refuses to publish if the pack
+file is missing. Permissions include `id-token: write` for a future npm
+OIDC trusted-publishing switch; today the token path is what works.
+
+### Local
+
 ```sh
 bun release patch    # or minor | major
+npm publish test/.tmp/lich-<version>.tgz
 ```
 
 Fails closed on a dirty tree, a non-main branch, a typecheck error, or a
 test failure; bumps via `npm version`, builds, and packs + audits
 `test/.tmp/lich-<version>.tgz` (SHA-512 + scope verification) before
-committing, tagging `v<version>`, and pushing main. Publishing stays manual
-(`npm publish test/.tmp/lich-<version>.tgz`) so npm can prompt for the OTP.
+committing, tagging `v<version>`, and pushing main. Local publish stays
+interactive so npm can prompt for OTP.
 
 ## License
 

package/dist/{chunk-JC2G3XH2.js → chunk-CVX7LZWC.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-7HLVKVIG.js";
+} from "./chunk-WNFBIX4E.js";
 
 // src/util/theme.ts
 import { readFileSync } from "fs";
@@ -89,4 +89,4 @@ export {
   notice_flavor,
   load_theme
 };
-//# sourceMappingURL=chunk-JC2G3XH2.js.map
+//# sourceMappingURL=chunk-CVX7LZWC.js.map

package/dist/chunk-PZNYVGD4.js

@@ -0,0 +1,58 @@
+import {
+  catalog_by_name
+} from "./chunk-WNFBIX4E.js";
+
+// src/index.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+
+// src/mcp/mcp_catalog_entry.ts
+var PLACEHOLDER = /\$\{([a-z_]+)\}/g;
+function expand(value, substitutes) {
+  const tokens = value.match(PLACEHOLDER) ?? [];
+  let next = value;
+  for (const token of tokens) {
+    const key = token.slice(2, -1);
+    const found = substitutes[key];
+    if (found === void 0 || found.length === 0) {
+      return void 0;
+    }
+    next = next.replace(token, found);
+  }
+  return next;
+}
+function catalog_client_entry(name, substitutes = {}) {
+  const manifest = catalog_by_name(name);
+  if (manifest === void 0) {
+    return `unknown mcp catalog entry '${name}'`;
+  }
+  if (manifest.transport !== "stdio" || manifest.command === void 0) {
+    return manifest.note ?? `${name} has no official mcp server to enable`;
+  }
+  const args = [];
+  for (const arg of manifest.args ?? []) {
+    const expanded = expand(arg, substitutes);
+    if (expanded === void 0) {
+      return `mcp catalog '${name}' needs a substitute for ${arg}`;
+    }
+    args.push(expanded);
+  }
+  return { enabled: false, command: manifest.command, args };
+}
+
+// src/index.ts
+function read_package_version() {
+  const pkg_path = fileURLToPath(new URL("../package.json", import.meta.url));
+  const pkg = JSON.parse(readFileSync(pkg_path, "utf8"));
+  if (typeof pkg.version !== "string" || pkg.version.length === 0) {
+    throw new Error("package.json is missing version");
+  }
+  return pkg.version;
+}
+var LICH_VERSION = read_package_version();
+
+export {
+  catalog_client_entry,
+  LICH_VERSION
+};
+//# sourceMappingURL=chunk-PZNYVGD4.js.map

package/dist/chunk-PZNYVGD4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/mcp/mcp_catalog_entry.ts"],"sourcesContent":["/**\n * Public surface of the lich agent harness. Pure re-exports, plus the package version.\n */\nimport { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nfunction read_package_version(): string {\n  const pkg_path = fileURLToPath(new URL(\"../package.json\", import.meta.url));\n  const pkg = JSON.parse(readFileSync(pkg_path, \"utf8\")) as { version?: unknown };\n  if (typeof pkg.version !== \"string\" || pkg.version.length === 0) {\n    throw new Error(\"package.json is missing version\");\n  }\n  return pkg.version;\n}\n\nexport const LICH_VERSION = read_package_version();\n\nexport { Agent, create_agent, run_agent, create_agent_with_plugins } from \"./agent/agent.js\";\nexport type { AgentRunOptions, AgentRunResult } from \"./agent/agent.js\";\nexport type { AgentConfig } from \"./agent/config.js\";\nexport { parse_agent_config } from \"./agent/config.js\";\nexport { catalog_client_entry } from \"./mcp/mcp_catalog_entry.js\";\nexport { AgentEmitter } from \"./agent/events.js\";\nexport type { AgentEvent, AgentEventHandler, AgentEvents } from \"./agent/events.js\";\nexport type { LoopOutcome, LoopParams } from \"./agent/loop.js\";\nexport type {\n  ChatOptions,\n  ChatResult,\n  Message,\n  ProviderConfig,\n  ToolCall,\n  ToolDefinition,\n  Usage,\n} from \"./providers/types.js\";\nexport { ProviderError } from \"./providers/types.js\";\nexport { ToolExecutor } from \"./tools/executor.js\";\nexport { ToolRegistry } from \"./tools/registry.js\";\nexport type { Tool, ToolContext, ToolResult } from \"./tools/types.js\";\nexport { register_builtin_tools } from \"./tools/builtin/index.js\";\nexport { HookedToolRunner } from \"./plugins/hooks.js\";\nexport { load_plugins, plugin_errors_summary } from \"./plugins/loader.js\";\nexport type { LoadedPlugin, PluginLoadError } from \"./plugins/loader.js\";\nexport type {\n  AfterToolCallInfo,\n  BeforeToolCallInfo,\n  BeforeToolCallResult,\n  HookContext,\n  Plugin,\n  PluginHooks,\n  RunEndInfo,\n} from \"./plugins/types.js\";","/**\n * Install shape: turn a catalog manifest into a disabled mcp_servers entry.\n * Does not spawn, download, or copy secrets.\n */\nimport { catalog_by_name } from \"./mcp_catalog.js\";\n\nconst PLACEHOLDER = /\\$\\{([a-z_]+)\\}/g;\n\nfunction expand(value: string, substitutes: Record<string, string>): string | undefined {\n  const tokens = value.match(PLACEHOLDER) ?? [];\n  let next = value;\n  for (const token of tokens) {\n    const key = token.slice(2, -1);\n    const found = substitutes[key];\n    if (found === undefined || found.length === 0) {\n      return undefined;\n    }\n    next = next.replace(token, found);\n  }\n  return next;\n}\n\n/** Write the client entry. The user sets enabled. Godot has nothing to write. */\nexport function catalog_client_entry(\n  name: string,\n  substitutes: Record<string, string> = {},\n): Record<string, unknown> | string {\n  const manifest = catalog_by_name(name);\n  if (manifest === undefined) {\n    return `unknown mcp catalog entry '${name}'`;\n  }\n  if (manifest.transport !== \"stdio\" || manifest.command === undefined) {\n    return manifest.note ?? `${name} has no official mcp server to enable`;\n  }\n  const args: string[] = [];\n  for (const arg of manifest.args ?? []) {\n    const expanded = expand(arg, substitutes);\n    if (expanded === undefined) {\n      return `mcp catalog '${name}' needs a substitute for ${arg}`;\n    }\n    args.push(expanded);\n  }\n  return { enabled: false, command: manifest.command, args };\n}\n"],"mappings":";;;;;AAGA,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;;;ACE9B,IAAM,cAAc;AAEpB,SAAS,OAAO,OAAe,aAAyD;AACtF,QAAM,SAAS,MAAM,MAAM,WAAW,KAAK,CAAC;AAC5C,MAAI,OAAO;AACX,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,MAAM,MAAM,GAAG,EAAE;AAC7B,UAAM,QAAQ,YAAY,GAAG;AAC7B,QAAI,UAAU,UAAa,MAAM,WAAW,GAAG;AAC7C,aAAO;AAAA,IACT;AACA,WAAO,KAAK,QAAQ,OAAO,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAGO,SAAS,qBACd,MACA,cAAsC,CAAC,GACL;AAClC,QAAM,WAAW,gBAAgB,IAAI;AACrC,MAAI,aAAa,QAAW;AAC1B,WAAO,8BAA8B,IAAI;AAAA,EAC3C;AACA,MAAI,SAAS,cAAc,WAAW,SAAS,YAAY,QAAW;AACpE,WAAO,SAAS,QAAQ,GAAG,IAAI;AAAA,EACjC;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,SAAS,QAAQ,CAAC,GAAG;AACrC,UAAM,WAAW,OAAO,KAAK,WAAW;AACxC,QAAI,aAAa,QAAW;AAC1B,aAAO,gBAAgB,IAAI,4BAA4B,GAAG;AAAA,IAC5D;AACA,SAAK,KAAK,QAAQ;AAAA,EACpB;AACA,SAAO,EAAE,SAAS,OAAO,SAAS,SAAS,SAAS,KAAK;AAC3D;;;ADrCA,SAAS,uBAA+B;AACtC,QAAM,WAAW,cAAc,IAAI,IAAI,mBAAmB,YAAY,GAAG,CAAC;AAC1E,QAAM,MAAM,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;AACrD,MAAI,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,IAAI;AACb;AAEO,IAAM,eAAe,qBAAqB;","names":[]}