@motherbase/cli 0.2.4 → 0.2.6

package/src/main.js

@@ -1,160 +1,224 @@
-'use strict';
-
-const path = require('path');
-const { registry, groups } = require('./commands');
-const { createContext, CliError } = require('./context');
-const ui = require('./ui');
-
-// Flags that never consume a following value.
-const PURE_BOOLEAN = new Set([
-  'json', 'yes', 'help', 'version', 'force', 'preview', 'app', 'no-data', 'no-auth', 'f',
-  // Codegen: `--check` and `--local` never take a value, so a trailing
-  // `--check database.types.ts` must not silently swallow the path.
-  'check', 'local',
-  // `rls preset <table> <preset> --replace` must not swallow a following word.
-  'replace',
-]);
-// Short flag aliases → canonical (with whether they take a value).
-const SHORT = {
-  y: { name: 'yes', boolean: true },
-  h: { name: 'help', boolean: true },
-  v: { name: 'version', boolean: true },
-  p: { name: 'project', boolean: false },
-  u: { name: 'url', boolean: false },
-  e: { name: 'e', boolean: false },
-  f: { name: 'f', boolean: true },
-};
-
-// Tokenize argv into positionals + flags. Repeated flags collapse into arrays.
-function tokenize(argv) {
-  const positionals = [];
-  const flags = {};
-  const setFlag = (key, value) => {
-    if (key in flags) {
-      flags[key] = [].concat(flags[key], value);
-    } else {
-      flags[key] = value;
-    }
-  };
-
-  for (let i = 0; i < argv.length; i++) {
-    const tok = argv[i];
-    if (tok === '--') { positionals.push(...argv.slice(i + 1)); break; }
-
-    if (tok.startsWith('--')) {
-      const body = tok.slice(2);
-      const eq = body.indexOf('=');
-      if (eq >= 0) { setFlag(body.slice(0, eq), body.slice(eq + 1)); continue; }
-      const next = argv[i + 1];
-      if (!PURE_BOOLEAN.has(body) && next !== undefined && !next.startsWith('-')) {
-        setFlag(body, next); i++;
-      } else {
-        setFlag(body, true);
-      }
-    } else if (tok.startsWith('-') && tok.length > 1 && tok !== '-') {
-      const spec = SHORT[tok.slice(1)];
-      if (!spec) { setFlag(tok.slice(1), true); continue; }
-      const next = argv[i + 1];
-      if (!spec.boolean && next !== undefined && !next.startsWith('-')) { setFlag(spec.name, next); i++; }
-      else setFlag(spec.name, true);
-    } else {
-      positionals.push(tok);
-    }
-  }
-  return { positionals, flags };
-}
-
-function version() {
-  try {
-    return require(path.join(__dirname, '..', 'package.json')).version;
-  } catch { return '0.0.0'; }
-}
-
-function pad(s, n) { return String(s).padEnd(n); }
-
-function topLevelHelp() {
-  ui.print(ui.color.bold('Motherbase CLI') + ` v${version()}`);
-  ui.print('');
-  ui.print('Usage: motherbase <command> [subcommand] [args] [flags]');
-  ui.print('');
-  const width = Object.keys(registry).reduce((m, k) => Math.max(m, k.length), 0) + 2;
-  for (const group of groups) {
-    ui.print(ui.color.bold(group.title));
-    for (const name of group.names) {
-      const entry = registry[name];
-      if (!entry) continue;
-      ui.print('  ' + ui.color.cyan(pad(name, width)) + ui.color.dim(entry.summary || ''));
-    }
-    ui.print('');
-  }
-  ui.print('Global flags: --json  --yes/-y  --project/-p <id>  --url/-u <consoleUrl>  --token <t>  -h/--help  -v/--version');
-  ui.print('Run `motherbase <command> -h` for command-specific help.');
-}
-
-function commandHelp(name, entry, trail) {
-  const full = ['motherbase', ...trail].join(' ');
-  ui.print(ui.color.bold(full) + (entry.summary ? ` — ${entry.summary}` : ''));
-  ui.print('');
-  if (entry.usage) { ui.print('Usage: ' + entry.usage); ui.print(''); }
-  if (entry.subcommands) {
-    ui.print(ui.color.bold('Subcommands'));
-    const subs = Object.keys(entry.subcommands);
-    const width = subs.reduce((m, k) => Math.max(m, k.length), 0) + 2;
-    for (const sub of subs) {
-      const s = entry.subcommands[sub];
-      ui.print('  ' + ui.color.cyan(pad(sub, width)) + ui.color.dim(s.summary || ''));
-    }
-  }
-}
-
-async function main(argv) {
-  const { positionals, flags } = tokenize(argv);
-
-  if (flags.version) { ui.print(version()); return 0; }
-
-  if (positionals.length === 0) { topLevelHelp(); return 0; }
-
-  const name = positionals[0];
-  const entry = registry[name];
-  if (!entry) {
-    ui.printErr(ui.color.red(`Unknown command: ${name}`));
-    ui.printErr('Run `motherbase --help` to see available commands.');
-    return 1;
-  }
-
-  // Descend into subcommands.
-  let current = entry;
-  const trail = [name];
-  const rest = positionals.slice(1);
-  while (current.subcommands && rest.length && current.subcommands[rest[0]]) {
-    current = current.subcommands[rest[0]];
-    trail.push(rest.shift());
-  }
-
-  // Help requested, or a group with no runnable action here.
-  if (flags.help || (!current.run && !current.subcommands)) {
-    commandHelp(name, current, trail);
-    return 0;
-  }
-  if (!current.run) {
-    // Group node: either no subcommand given or an unknown one.
-    if (rest.length) ui.printErr(ui.color.red(`Unknown subcommand: ${trail.join(' ')} ${rest[0]}`));
-    commandHelp(name, current, trail);
-    return rest.length ? 1 : 0;
-  }
-
-  const ctx = createContext(flags);
-  try {
-    await current.run(ctx, rest, flags);
-    return 0;
-  } catch (err) {
-    if (err instanceof CliError || err.isCliError) {
-      ui.printErr(ui.color.red(err.message));
-    } else {
-      ui.printErr(ui.color.red(`Error: ${err.message}`));
-    }
-    return 1;
-  }
-}
-
-module.exports = { main, tokenize, version };
+'use strict';
+
+const path = require('path');
+const { registry, groups } = require('./commands');
+const { createContext, CliError } = require('./context');
+const { FORMATS } = require('./format');
+const ui = require('./ui');
+
+// Flags that never consume a following value.
+const PURE_BOOLEAN = new Set([
+  'json', 'yes', 'help', 'version', 'force', 'preview', 'app', 'no-data', 'no-auth', 'f', 'debug',
+  // Codegen: `--check` and `--local` never take a value, so a trailing
+  // `--check database.types.ts` must not silently swallow the path.
+  'check', 'local',
+  // `rls preset <table> <preset> --replace` must not swallow a following word.
+  'replace',
+  // `storage cp --recursive ./dir ss:///bucket` must not swallow the source.
+  'recursive',
+  // Migration workflow switches: `db push --dry-run` must not eat a positional.
+  'dry-run', 'include-seed', 'include-all', 'schema-only', 'data-only', 'use-copy', 'confirm', 'no-seed', 'linked',
+  // `postgres-config` and `db publications` switches, never followed by a value.
+  'replace-existing-overrides', 'no-restart', 'all-tables',
+  // Branching, keys and database access: trailing switches that must not
+  // swallow the next word.
+  'with-data', 'append', 'enable-db-ssl-enforcement', 'disable-db-ssl-enforcement',
+]);
+// Short flag aliases → canonical (with whether they take a value).
+const SHORT = {
+  y: { name: 'yes', boolean: true },
+  h: { name: 'help', boolean: true },
+  v: { name: 'version', boolean: true },
+  p: { name: 'project', boolean: false },
+  u: { name: 'url', boolean: false },
+  e: { name: 'e', boolean: false },
+  f: { name: 'f', boolean: true },
+  o: { name: 'output', boolean: false },
+  r: { name: 'recursive', boolean: true },
+};
+
+/**
+ * Is this token the next flag rather than a value that happens to start with
+ * `-`? `--anything` is: long flags are free-form here, so the parser accepts
+ * any name. A single-dash token only is when `SHORT` declares it, which is why
+ * `-s3cret!` and `-5` are not.
+ *
+ * PURE_BOOLEAN cannot answer this on its own. It lists the flags that must not
+ * swallow a following *positional* (`db push --dry-run` before a path), and a
+ * switch with no positional after it was never added to it -- `--superuser`,
+ * `--write`, `--no-storage`. Treating every switch missing from that list as a
+ * flag that needs a value is what turned `db roles create app --login
+ * --superuser` into an error.
+ */
+function isFlagToken(token) {
+  if (token.startsWith('--')) return token.length > 2;
+  return Object.prototype.hasOwnProperty.call(SHORT, token.slice(1));
+}
+
+/**
+ * A value flag followed by a dash-leading token that is *not* a flag is
+ * ambiguous: the token could be the value or a typo. This used to resolve
+ * silently in the worst direction -- the flag became a bare `true` and the
+ * value was re-parsed as short flags, so `--password -s3cret!` sent no password
+ * and set `-s`, `-3`, `-c`... The `--flag=value` form is unambiguous, so say so
+ * instead of guessing (PKG-16).
+ */
+function dashValue(flag, value) {
+  return new CliError(`${flag} needs a value, and "${value}" starts with "-". Write ${flag}=${value} instead.`);
+}
+
+// Tokenize argv into positionals + flags. Repeated flags collapse into arrays.
+function tokenize(argv) {
+  const positionals = [];
+  const flags = {};
+  const setFlag = (key, value) => {
+    if (key in flags) {
+      flags[key] = [].concat(flags[key], value);
+    } else {
+      flags[key] = value;
+    }
+  };
+
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok === '--') { positionals.push(...argv.slice(i + 1)); break; }
+
+    if (tok.startsWith('--')) {
+      const body = tok.slice(2);
+      const eq = body.indexOf('=');
+      if (eq >= 0) { setFlag(body.slice(0, eq), body.slice(eq + 1)); continue; }
+      const next = argv[i + 1];
+      if (PURE_BOOLEAN.has(body)) { setFlag(body, true); continue; }
+      if (next === undefined || isFlagToken(next)) { setFlag(body, true); continue; }
+      if (next.startsWith('-')) throw dashValue(`--${body}`, next);
+      setFlag(body, next); i++;
+    } else if (tok.startsWith('-') && tok.length > 1 && tok !== '-') {
+      const spec = SHORT[tok.slice(1)];
+      if (!spec) { setFlag(tok.slice(1), true); continue; }
+      const next = argv[i + 1];
+      if (spec.boolean || next === undefined || isFlagToken(next)) { setFlag(spec.name, true); continue; }
+      if (next.startsWith('-')) throw dashValue(`--${spec.name}`, next);
+      setFlag(spec.name, next); i++;
+    } else {
+      positionals.push(tok);
+    }
+  }
+  return { positionals, flags };
+}
+
+// Fold the Supabase spellings of global flags into the names commands read:
+// `--project-ref` is `--project`, and `-o/--output <format>` becomes `format`
+// (with `json` kept in step, since commands test it for machine output).
+// `--output` stays a file path on commands that declare `outputIsPath`.
+function normalizeFlags(flags, command = {}) {
+  const out = { ...flags };
+  if (out.project === undefined && out['project-ref'] !== undefined) out.project = out['project-ref'];
+  if (out.output !== undefined && FORMATS.includes(out.output)) {
+    out.format = out.output;
+    delete out.output;
+  } else if (out.output !== undefined && !command.outputIsPath) {
+    throw new CliError(`--output must be one of: ${FORMATS.join(', ')}`);
+  }
+  out.format = out.format || (out.json ? 'json' : 'pretty');
+  out.json = out.format === 'json';
+  return out;
+}
+
+function version() {
+  try {
+    return require(path.join(__dirname, '..', 'package.json')).version;
+  } catch { return '0.0.0'; }
+}
+
+function pad(s, n) { return String(s).padEnd(n); }
+
+function topLevelHelp() {
+  ui.print(ui.color.bold('Motherbase CLI') + ` v${version()}`);
+  ui.print('');
+  ui.print('Usage: motherbase <command> [subcommand] [args] [flags]');
+  ui.print('');
+  const width = Object.keys(registry).reduce((m, k) => Math.max(m, k.length), 0) + 2;
+  for (const group of groups) {
+    ui.print(ui.color.bold(group.title));
+    for (const name of group.names) {
+      const entry = registry[name];
+      if (!entry) continue;
+      ui.print('  ' + ui.color.cyan(pad(name, width)) + ui.color.dim(entry.summary || ''));
+    }
+    ui.print('');
+  }
+  ui.print('Global flags: -o/--output pretty|json|yaml|env  --json  --yes/-y  --project/-p/--project-ref <id>  --url/-u <consoleUrl>');
+  ui.print('              --token <t>  --workdir <dir>  --debug  -h/--help  -v/--version');
+  ui.print('Run `motherbase <command> -h` for command-specific help.');
+}
+
+function commandHelp(name, entry, trail) {
+  const full = ['motherbase', ...trail].join(' ');
+  ui.print(ui.color.bold(full) + (entry.summary ? `, ${entry.summary}` : ''));
+  ui.print('');
+  if (entry.usage) { ui.print('Usage: ' + entry.usage); ui.print(''); }
+  if (entry.subcommands) {
+    ui.print(ui.color.bold('Subcommands'));
+    const subs = Object.keys(entry.subcommands);
+    const width = subs.reduce((m, k) => Math.max(m, k.length), 0) + 2;
+    for (const sub of subs) {
+      const s = entry.subcommands[sub];
+      ui.print('  ' + ui.color.cyan(pad(sub, width)) + ui.color.dim(s.summary || ''));
+    }
+  }
+}
+
+async function main(argv) {
+  const { positionals, flags } = tokenize(argv);
+
+  // Only bare: `migration squash --version <v>` is Supabase's own flag.
+  if (flags.version && positionals.length === 0) { ui.print(version()); return 0; }
+
+  if (positionals.length === 0) { topLevelHelp(); return 0; }
+
+  const name = positionals[0];
+  const entry = registry[name];
+  if (!entry) {
+    ui.printErr(ui.color.red(`Unknown command: ${name}`));
+    ui.printErr('Run `motherbase --help` to see available commands.');
+    return 1;
+  }
+
+  // Descend into subcommands.
+  let current = entry;
+  const trail = [name];
+  const rest = positionals.slice(1);
+  while (current.subcommands && rest.length && current.subcommands[rest[0]]) {
+    current = current.subcommands[rest[0]];
+    trail.push(rest.shift());
+  }
+
+  // Help requested, or a group with no runnable action here.
+  if (flags.help || (!current.run && !current.subcommands)) {
+    commandHelp(name, current, trail);
+    return 0;
+  }
+  if (!current.run) {
+    // Group node: either no subcommand given or an unknown one.
+    if (rest.length) ui.printErr(ui.color.red(`Unknown subcommand: ${trail.join(' ')} ${rest[0]}`));
+    commandHelp(name, current, trail);
+    return rest.length ? 1 : 0;
+  }
+
+  try {
+    const resolved = normalizeFlags(flags, current);
+    if (resolved.debug) process.env.MOTHERBASE_DEBUG = '1';
+    const cwd = resolved.workdir ? path.resolve(String(resolved.workdir)) : process.cwd();
+    await current.run(createContext(resolved, process.env, cwd), rest, resolved);
+    return 0;
+  } catch (err) {
+    if (err instanceof CliError || err.isCliError) {
+      ui.printErr(ui.color.red(err.message));
+    } else {
+      ui.printErr(ui.color.red(`Error: ${err.message}`));
+    }
+    return 1;
+  }
+}
+
+module.exports = { main, tokenize, normalizeFlags, version };

package/src/mcp/platform-tools.js

@@ -0,0 +1,233 @@
+'use strict';
+
+// The Supabase MCP server's account and project tools, for what Motherbase
+// already serves. Same names and arguments where they fit, so an agent that
+// knows Supabase's tools can use these without learning new ones.
+//
+// Two scopes, because a session may have either or both:
+//   - console tools (organizations, projects) go through `api.consoleRequest`
+//     and need a console login, not a linked project;
+//   - project tools act on the linked (or direct-mode) project through
+//     `api.adminRequest`, like every tool in tools.js.
+//
+// Not here, because there is nothing behind them yet: branching, cost
+// confirmation, docs search, and Supabase's per-call `project_id` on project
+// tools (a session serves the one project it was started for).
+
+const api = require('../api');
+const { upsertFunction } = require('../commands/functions');
+
+const str = description => ({ type: 'string', description });
+const noArgs = { type: 'object', properties: {} };
+const enc = encodeURIComponent;
+
+const FUNCTION_NAME = /^[a-z0-9][a-z0-9-]*$/;
+
+/** A project from the console listing, by name or id; the listing is the only read. */
+async function findProject(ctx, id) {
+  const projects = await api.consoleRequest(ctx, 'GET', '/projects');
+  const project = (Array.isArray(projects) ? projects : []).find(p => p.name === id || p.id === id);
+  if (!project) throw new Error(`No project "${id}" on this console. list_projects shows the ones you can see.`);
+  return project;
+}
+
+/** An edge function by the slug Supabase's tools take: its route, name or id. */
+async function findFunction(ctx, slug) {
+  const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+  const fn = ((listing && listing.functions) || []).find(f => f.route === slug || f.name === slug || f.id === slug);
+  if (!fn) throw new Error(`No edge function "${slug}". list_edge_functions shows what is deployed.`);
+  return fn;
+}
+
+/**
+ * The single source file a function deploys as. Supabase's tool takes a file
+ * set; Motherbase stores one module per function, so a set that needs more than
+ * its entrypoint is refused rather than deployed half-complete.
+ */
+function entrypointSource(files, entrypoint) {
+  if (!Array.isArray(files) || !files.length) throw new Error('files must hold at least the entrypoint.');
+  const wanted = entrypoint || 'index.ts';
+  // A lone file is the entrypoint whatever it is called, unless one was named.
+  const entry = files.find(f => f && f.name === wanted) || (!entrypoint && files.length === 1 ? files[0] : undefined);
+  if (!entry) throw new Error(`No file named ${wanted} among files.`);
+  if (files.length > 1) {
+    throw new Error('Edge functions deploy as a single module here: inline the other files into the entrypoint.');
+  }
+  return String(entry.content);
+}
+
+/** Account-level reads. Need a console login. */
+function consoleReadTools(ctx) {
+  return [
+    {
+      name: 'list_organizations',
+      description: 'List the organizations the logged-in operator belongs to, with their role and project count.',
+      inputSchema: noArgs,
+      run: () => api.consoleRequest(ctx, 'GET', '/orgs'),
+    },
+    {
+      name: 'get_organization',
+      description: 'Details of one organization: name, members count and settings.',
+      inputSchema: { type: 'object', properties: { id: str('Organization id.') }, required: ['id'] },
+      run: args => api.consoleRequest(ctx, 'GET', `/orgs/${enc(args.id)}`),
+    },
+    {
+      name: 'list_projects',
+      description: 'List the projects on this console the operator can see, with their status and domain.',
+      inputSchema: {
+        type: 'object',
+        properties: { organization_id: str('Only the projects of this organization.') },
+      },
+      run: args => api.consoleRequest(ctx, 'GET', '/projects', { query: { org: args.organization_id } }),
+    },
+    {
+      name: 'get_project',
+      description: 'Details of one project: status, domain and organization.',
+      inputSchema: { type: 'object', properties: { id: str('Project name or id.') }, required: ['id'] },
+      run: args => findProject(ctx, args.id),
+    },
+  ];
+}
+
+/** Account-level changes. Only with `--write`. */
+function consoleWriteTools(ctx) {
+  return [
+    {
+      name: 'create_project',
+      description:
+        'Create a project: a new, isolated stack (database, auth, storage, functions). Provisioning takes a while; poll get_project for its status.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Project name: lowercase letters, digits and hyphens. Also its id.'),
+          organization_id: str('Organization to create it in. Defaults to the default organization.'),
+          domain: str('Domain it is served on. Required unless the console runs in dev mode.'),
+        },
+        required: ['name'],
+      },
+      run: args =>
+        api.consoleRequest(ctx, 'POST', '/projects', {
+          body: { name: args.name, domain: args.domain, orgId: args.organization_id },
+        }),
+    },
+    {
+      name: 'pause_project',
+      description: 'Stop a project\'s containers. Its data is kept; restore_project starts it again.',
+      inputSchema: { type: 'object', properties: { project_id: str('Project name or id.') }, required: ['project_id'] },
+      run: args => api.consoleRequest(ctx, 'POST', `/projects/${enc(args.project_id)}/stop`),
+    },
+    {
+      name: 'restore_project',
+      description: 'Start a paused project again.',
+      inputSchema: { type: 'object', properties: { project_id: str('Project name or id.') }, required: ['project_id'] },
+      run: args => api.consoleRequest(ctx, 'POST', `/projects/${enc(args.project_id)}/start`),
+    },
+  ];
+}
+
+/** Reads on the served project. */
+function projectReadTools(ctx) {
+  return [
+    {
+      name: 'get_project_url',
+      description: 'The API URL (and realtime URL) a client app uses to reach this project.',
+      inputSchema: noArgs,
+      run: async () => {
+        const info = await api.adminRequest(ctx, 'GET', '/connect-info');
+        return { url: info.apiUrl, realtimeUrl: info.wsUrl };
+      },
+    },
+    {
+      name: 'get_publishable_keys',
+      description:
+        'The publishable API keys a client app ships with. Safe to embed: row level security decides what they reach. Secret keys are never returned.',
+      inputSchema: noArgs,
+      run: async () => {
+        const data = await api.adminRequest(ctx, 'GET', '/api-keys');
+        const keys = ((data && data.keys) || [])
+          .filter(k => k.type === 'publishable' && !k.revokedAt)
+          .map(k => ({ name: k.name, api_key: k.token }));
+        return { keys };
+      },
+    },
+    {
+      name: 'list_extensions',
+      description: 'Postgres extensions available in the project database, and which are installed.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/schema/extensions'),
+    },
+    {
+      name: 'list_migrations',
+      description: 'Schema migrations recorded for the project, with their status and when they were applied.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/migrations'),
+    },
+    {
+      name: 'list_edge_functions',
+      description: 'Deployed edge functions: name, route, whether enabled, and limits. get_edge_function returns the source.',
+      inputSchema: noArgs,
+      run: async () => {
+        const data = await api.adminRequest(ctx, 'GET', '/edge-functions');
+        // The source of every function is noise in a listing; get_edge_function has it.
+        const functions = ((data && data.functions) || []).map(({ code: _code, ...meta }) => meta);
+        return { functions };
+      },
+    },
+    {
+      name: 'get_edge_function',
+      description: 'One deployed edge function with its source code.',
+      inputSchema: {
+        type: 'object',
+        properties: { function_slug: str('The function\'s route (also accepts its name or id).') },
+        required: ['function_slug'],
+      },
+      run: async args => {
+        const fn = await findFunction(ctx, args.function_slug);
+        return api.adminRequest(ctx, 'GET', `/edge-functions/${enc(fn.id)}`);
+      },
+    },
+    {
+      name: 'list_storage_buckets',
+      description: 'Storage buckets with their visibility, quota and usage.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/storage/buckets'),
+    },
+  ];
+}
+
+/** Changes to the served project. Only with `--write`. */
+function projectWriteTools(ctx) {
+  return [
+    {
+      name: 'deploy_edge_function',
+      description:
+        'Deploy an edge function, creating it or replacing the one at the same route. The name is also its route. The code runs on Deno with the Web platform; export a default handler (req: Request) => Response.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Function name: lowercase letters, digits and hyphens.'),
+          entrypoint_path: str('Which of files is the entrypoint. Defaults to index.ts.'),
+          files: {
+            type: 'array',
+            description: 'The function source: its single entrypoint module.',
+            items: {
+              type: 'object',
+              properties: { name: str('File name, e.g. index.ts.'), content: str('File contents.') },
+              required: ['name', 'content'],
+            },
+          },
+        },
+        required: ['name', 'files'],
+      },
+      run: args => {
+        if (!FUNCTION_NAME.test(args.name || '')) {
+          throw new Error('Function names are lowercase letters, digits and hyphens (the name is also the route).');
+        }
+        const code = entrypointSource(args.files, args.entrypoint_path);
+        return upsertFunction(ctx, { name: args.name, route: args.name, code });
+      },
+    },
+  ];
+}
+
+module.exports = { consoleReadTools, consoleWriteTools, projectReadTools, projectWriteTools, entrypointSource };

package/src/mcp/protocol.js

@@ -49,8 +49,11 @@ function serve({ input, output, handlers, onError }) {
   };
 
   const dispatch = async message => {
+    // Valid JSON is not necessarily a request: `null` or `42` would throw on
+    // destructuring and, un-awaited, take the process down.
+    if (message === null || typeof message !== 'object') return;
     const { id, method, params } = message;
-    const handler = handlers[method];
+    const handler = Object.hasOwn(handlers, method) ? handlers[method] : undefined;
     if (!handler) {
       // Unknown notifications are ignored rather than answered: the spec sends
       // several the server is not required to know about.