@mysten-incubation/memwal-mcp 0.0.11 → 0.0.12-dev.0

package/dist/bridge.js

@@ -1,8 +1,9 @@
 import { clearCreds, credsPath } from "./auth.js";
 import { TOOL_DEFINITIONS } from "./auth-required.js";
+import { clientInfoHeaders, lastClientInfoHeaders, rememberInitializeClientInfo, } from "./client-info.js";
 import { ensureCompatibleRelayer, resolveConnectTimeoutMs } from "./compatibility.js";
 import { PROACTIVE_INSTRUCTIONS } from "./instructions.js";
-import { startOrReuseLoginFlow } from "./login.js";
+import { startOrReuseLoginFlow, resolveLoginTimeoutMs } from "./login.js";
 import { log, note } from "./logger.js";
 import { MEMWAL_MCP_VERSION } from "./version.js";
 /** Memory tools that take a `namespace` argument. `memwal_remember`,
@@ -61,7 +62,7 @@ const LOCAL_TOOL_DEFINITIONS = [
     },
     {
         name: "memwal_logout",
-        description: "Remove the saved Walrus Memory credentials from this machine (~/.memwal/credentials.json). The on-chain delegate key registration is NOT revoked — visit the Walrus Memory dashboard to remove it from your account if needed.",
+        description: "Sign out of Walrus Memory: removes the saved credentials from this machine (~/.memwal/credentials.json) AND closes this connection's memory session, so memory tools stop working until you call memwal_login again. The on-chain delegate key registration is NOT revoked — visit the Walrus Memory dashboard to remove it from your account if needed.",
         inputSchema: {
             type: "object",
             properties: {},
@@ -103,6 +104,16 @@ function buildLocalInitializeResult(params) {
  * imported memory-tool list (which already carries its own `memwal_login`
  * entry) before appending our canonical definitions. */
 const LOCAL_TOOL_NAMES = new Set(LOCAL_TOOL_DEFINITIONS.map((t) => t.name));
+/** Reply for every memory tool call once `memwal_logout` has torn the session
+ * down, and for anything still in flight at that moment. Names the way back in
+ * so the client isn't left guessing why the tools stopped working. */
+const SIGNED_OUT_TEXT = "❌ Signed out of Walrus Memory. Memory tools are unavailable on this connection until you call `memwal_login` again.";
+/** `failRequest` options for every signed-out refusal, so a request refused at
+ * logout time and one refused on arrival afterwards read identically. */
+const SIGNED_OUT_FAILURE = {
+    toolText: SIGNED_OUT_TEXT,
+    errorMessage: SIGNED_OUT_TEXT,
+};
 /** The `tools/list` we serve LOCALLY at cold start: the memory tools (from the
  * same source as auth-required mode) plus the locally-handled login/logout
  * tools. We strip any locally-served name from the imported list first —
@@ -120,7 +131,6 @@ const LOCAL_TOOLS_LIST = {
         ...LOCAL_TOOL_DEFINITIONS,
     ],
 };
-const LOGIN_BG_TIMEOUT_MS = 5 * 60_000;
 const URL_READY_TIMEOUT_MS = 5_000;
 /** Maximum silence we tolerate on the SSE stream before assuming the
  * relayer-side session has gone dead. The relayer sends keepalive events
@@ -163,13 +173,14 @@ function resolveCallTimeoutMs() {
         return DEFAULT_CALL_TIMEOUT_MS;
     return n;
 }
-function mcpAuthHeaders(creds) {
+function mcpAuthHeaders(creds, extra = {}) {
     return {
         authorization: `Bearer ${creds.delegatePrivateKey}`,
         "x-memwal-account-id": creds.accountId,
+        ...extra,
     };
 }
-async function openSseStream(relayerUrl, creds) {
+async function openSseStream(relayerUrl, creds, extraHeaders = {}) {
     const connectTimeoutMs = resolveConnectTimeoutMs();
     // One shared budget for the WHOLE attempt: the compatibility check (GET
     // /version + /health fallback) and the SSE connect below both honour this
@@ -208,7 +219,7 @@ async function openSseStream(relayerUrl, creds) {
         resp = await fetch(url, {
             method: "GET",
             headers: {
-                ...mcpAuthHeaders(creds),
+                ...mcpAuthHeaders(creds, extraHeaders),
                 accept: "text/event-stream",
                 "cache-control": "no-cache",
             },
@@ -411,11 +422,11 @@ async function openSseStream(relayerUrl, creds) {
         },
     };
 }
-async function postMessage(postUrl, msg, creds) {
+async function postMessage(postUrl, msg, creds, extraHeaders = {}) {
     const resp = await fetch(postUrl, {
         method: "POST",
         headers: {
-            ...mcpAuthHeaders(creds),
+            ...mcpAuthHeaders(creds, extraHeaders),
             "content-type": "application/json",
         },
         body: JSON.stringify(msg),
@@ -456,7 +467,7 @@ async function handleLocalLogin(config, onCredentials) {
         relayerUrl: config.relayerUrl,
         webUrl: config.webUrl,
         label: config.label,
-        timeoutMs: LOGIN_BG_TIMEOUT_MS,
+        timeoutMs: resolveLoginTimeoutMs(),
         openBrowser: false,
     }, async (creds) => {
         await onCredentials(creds);
@@ -464,6 +475,18 @@ async function handleLocalLogin(config, onCredentials) {
             accountId: creds.accountId,
             delegateAddress: creds.delegateAddress,
         });
+    }, (err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        log.warn("memwal_login.bridge.failed", { msg });
+        writeStdoutMessage({
+            jsonrpc: "2.0",
+            method: "notifications/message",
+            params: {
+                level: "warning",
+                logger: "memwal-mcp",
+                data: `Walrus Memory sign-in did not complete: ${msg}. Existing credentials are unchanged; call memwal_login again to retry.`,
+            },
+        });
     });
     const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("Listener never started")), URL_READY_TIMEOUT_MS).unref?.());
     let url;
@@ -513,13 +536,19 @@ function handleLocalLogout() {
         if (!cleared.removedPath) {
             return {
                 isError: false,
-                text: `✅ Already signed out. No credentials at \`${credsPath()}\`.`,
+                // The bridge only runs with credentials loaded, so a missing
+                // file here still means a live in-memory session to tear down —
+                // exactly the GH #616 case. Say so rather than implying nothing
+                // happened.
+                text: `✅ Already signed out. No credentials at \`${credsPath()}\`, and this ` +
+                    `connection's memory session has been closed — memory tools will refuse ` +
+                    `to run until you sign in again.`,
             };
         }
         return {
             isError: false,
             text: [
-                `✅ Signed out. Credentials removed from \`${cleared.removedPath}\`.`,
+                `✅ Signed out. Credentials removed from \`${cleared.removedPath}\`, and this connection's memory session has been closed — memory tools will refuse to run until you sign in again.`,
                 ...(cleared.fallbackPath
                     ? [
                         ``,
@@ -556,18 +585,18 @@ function handleLocalLogout() {
  * file directly. They appear in `tools/list` by splicing them into the
  * relayer's response on the way back to the client.
  */
-export async function runBridge(creds, config, 
+export async function runBridge(initialCreds, config, 
 /** Requests the auth-required server already read off stdin before it
  * detected fresh credentials and handed control here (e.g. the
  * `memwal_recall` that triggered the hot-handoff). Replayed once the SSE
  * stream is up so they're served for real instead of being lost in the
  * mode switch — this is what removes the historical "second restart". */
 pendingLines = []) {
-    note(`Connecting to ${creds.relayerUrl}...`);
+    note(`Connecting to ${initialCreds.relayerUrl}...`);
     log.info("bridge.connecting", {
-        relayer: creds.relayerUrl,
-        accountId: creds.accountId,
-        delegate: creds.delegateAddress,
+        relayer: initialCreds.relayerUrl,
+        accountId: initialCreds.accountId,
+        delegate: initialCreds.delegateAddress,
     });
     // Live handle to the current SSE stream — replaced whenever we reconnect.
     // Starts null: we answer `initialize` / `tools/list` LOCALLY and wire stdin
@@ -576,7 +605,37 @@ pendingLines = []) {
     // the background; anything that must reach the relayer (`tools/call`) is
     // buffered in `pendingForward` until `sse` is live, then flushed.
     let sse = null;
+    /** The delegate key this bridge is currently authorized to act with.
+     * Nulled by `invalidateSession()` so signing out drops the key itself
+     * rather than only setting a flag that every forwarding path has to
+     * remember to check — after logout there is simply nothing left to sign
+     * with. `adoptCredentials` republishes it on the next login. */
+    let creds = initialCreds;
+    /**
+     * Best-effort `x-memwal-client` / `x-memwal-client-version` forwarded to
+     * the sidecar. Seeded from `lastClientInfoHeaders()`, which is only
+     * populated after the auth-required → bridge handoff (that path does not
+     * replay `initialize`). On a normal already-signed-in start this object
+     * is empty at first SSE connect: `connectInBackground` opens the stream
+     * before stdin is wired. Headers are filled when we see `initialize` and
+     * then land on reconnects / later POSTs. The sidecar treats the MCP
+     * handshake (`initialize.clientInfo`) as the authoritative source.
+     */
+    const extraHeaders = { ...lastClientInfoHeaders() };
     let stdinClosed = false;
+    /** Set by `memwal_logout`. Unlike `stdinClosed` the process stays up and
+     * the client keeps talking to us — `memwal_login` must still work — but the
+     * relayer session is torn down and must never be re-established with the
+     * credentials the user just deleted. Every connect/reconnect path therefore
+     * checks this alongside `stdinClosed`; `adoptCredentials` clears it when a
+     * new login lands. */
+    let loggedOut = false;
+    /** Resolves once a post-logout `memwal_login` has published a fresh session
+     * (or stdin closed). The server pump parks on this instead of exiting, so
+     * signing back in resumes streaming without the user restarting their MCP
+     * client. Recreated on every logout; null while signed in. */
+    let logoutPark = null;
+    let releaseLogoutPark = null;
     let reconnectAttempt = 0;
     let reconnectPromise = null;
     let firstConnectDone = false;
@@ -593,7 +652,7 @@ pendingLines = []) {
     function postIfCurrent(epoch, postUrl, msg, postCreds) {
         if (epoch !== sessionEpoch)
             return Promise.resolve(0);
-        return postMessage(postUrl, msg, postCreds);
+        return postMessage(postUrl, msg, postCreds, extraHeaders);
     }
     let credentialGeneration = 0;
     let activeCredentialGeneration = 0;
@@ -619,6 +678,10 @@ pendingLines = []) {
         if (stdinClosed)
             return;
         stdinClosed = true;
+        // Wake a pump parked on logout, or shutdown would block on a login
+        // that is never coming.
+        releaseLogoutPark?.();
+        releaseLogoutPark = null;
         for (const fn of stdinCloseListeners) {
             try {
                 fn();
@@ -713,7 +776,7 @@ pendingLines = []) {
      * login credential swap). Credential-generation checks discard a session
      * whose key rotated mid-handshake. */
     async function reconnect(reason, immediate = false) {
-        if (stdinClosed)
+        if (stdinClosed || loggedOut)
             return;
         if (reconnectPromise)
             return reconnectPromise;
@@ -751,10 +814,23 @@ pendingLines = []) {
                 });
             }
             try {
-                while (!stdinClosed) {
+                while (!stdinClosed && !loggedOut) {
                     const openingGeneration = credentialGeneration;
                     const openingCreds = creds;
-                    const candidate = await openSseStream(openingCreds.relayerUrl, openingCreds);
+                    // Signed out between the guard above and here: the key is
+                    // gone, so there is nothing to authorize a new session
+                    // with. Belt-and-braces against `loggedOut` alone.
+                    if (!openingCreds)
+                        break;
+                    const candidate = await openSseStream(openingCreds.relayerUrl, openingCreds, extraHeaders);
+                    // Logout can also land mid-handshake. Same reasoning as the
+                    // stale-credentials case below, except there is no new key
+                    // to reconnect with — drop the session and stop.
+                    if (loggedOut) {
+                        candidate.abort();
+                        log.info("bridge.reconnect_discarded_signed_out", {});
+                        break;
+                    }
                     // Login can finish while an older handshake is awaiting its
                     // endpoint event. Never publish that stale session: its GET
                     // used the old key, while subsequent POSTs would use the new
@@ -788,6 +864,16 @@ pendingLines = []) {
                     // and the SSE pump may delete entries concurrently as replies
                     // start arriving on the new session.
                     for (const [id, entry] of Array.from(inFlight.entries())) {
+                        // Replay awaits a POST per entry, so a logout can land
+                        // partway through this loop. The snapshot and
+                        // `openingCreds` both predate it, so without this the
+                        // remaining entries would still go out under the key the
+                        // user just deleted — `invalidateSession` clearing
+                        // `inFlight` cannot stop a snapshot already taken.
+                        if (loggedOut || openingGeneration !== credentialGeneration) {
+                            log.info("bridge.replay_halted_signed_out", { id });
+                            break;
+                        }
                         const msg = entry.msg;
                         try {
                             // A replayed `initialize` produces a fresh upstream
@@ -851,7 +937,10 @@ pendingLines = []) {
         }
     }
     async function adoptCredentials(nextCreds) {
-        const previousAccountId = creds.accountId;
+        // `null` after a logout — treated as an account change, which is the
+        // safe direction: it purges rather than replays. (`invalidateSession`
+        // already emptied both queues, so the purge is a no-op there.)
+        const previousAccountId = creds?.accountId ?? null;
         const accountChanged = previousAccountId !== nextCreds.accountId;
         // Never replay an operation authorized for account A against account B.
         // Return explicit retryable errors instead; the caller can decide which
@@ -915,6 +1004,10 @@ pendingLines = []) {
         creds = nextCreds;
         credentialGeneration += 1;
         reconnectAttempt = 0;
+        // Lift the logout halt BEFORE reconnecting — reconnect() refuses to run
+        // while it is set. The parked pump is released further down, once the
+        // new session actually exists.
+        loggedOut = false;
         log.info("bridge.credentials_updated", {
             previousAccountId,
             accountId: creds.accountId,
@@ -926,6 +1019,56 @@ pendingLines = []) {
         if (activeCredentialGeneration !== credentialGeneration) {
             await reconnect("login-credentials-generation-mismatch", true);
         }
+        // Session is live again: wake a pump parked by a previous logout.
+        releaseLogoutPark?.();
+        releaseLogoutPark = null;
+        logoutPark = null;
+    }
+    /**
+     * Tear the relayer session down after a successful `memwal_logout`.
+     *
+     * Deleting the credentials file is not revocation on its own: the bridge
+     * holds the delegate key in memory and owns a live SSE session, so without
+     * this every later memory tool call would still be forwarded and executed
+     * under the key the user just removed (GH #616).
+     *
+     * `loggedOut` is set FIRST so the abort below cannot race the pump into
+     * `reconnect("server-pump-eof")` and immediately re-authorize a new session
+     * with those same in-memory credentials.
+     */
+    function invalidateSession() {
+        if (loggedOut)
+            return;
+        loggedOut = true;
+        logoutPark = new Promise((resolve) => {
+            releaseLogoutPark = resolve;
+        });
+        try {
+            sse?.abort();
+        }
+        catch {
+            /* already dead */
+        }
+        sse = null;
+        // Drop the delegate key itself, not just the flag. Revocation that
+        // rests only on `loggedOut` is one missed check away from forwarding
+        // under the key the user deleted; with `creds` null there is nothing
+        // left to sign with and every forwarding path fails closed instead.
+        creds = null;
+        // Bump the generation so any handshake or replay that captured the old
+        // key before this point discards its work on its next check, exactly as
+        // it would for a mid-flight key rotation.
+        credentialGeneration += 1;
+        // Answer everything still outstanding rather than stranding it: these
+        // were authorized under the old key and must not be replayed later.
+        for (const [, entry] of Array.from(inFlight.entries())) {
+            failRequest(entry.msg, "signed out", SIGNED_OUT_FAILURE);
+        }
+        inFlight.clear();
+        for (const msg of pendingForward.splice(0, pendingForward.length)) {
+            failRequest(msg, "signed out", SIGNED_OUT_FAILURE);
+        }
+        log.info("bridge.session_invalidated", { reason: "logout" });
     }
     // Server → client: stream SSE messages to stdout. Loop forever, restart
     // pump on stream end (which means SSE got cut → we already reconnected).
@@ -947,8 +1090,23 @@ pendingLines = []) {
                 // sibling closure (connectInBackground / reconnect) that TS
                 // analyzes independently. At runtime `sse` is a live handle here.
                 const stream = sse;
-                if (!stream)
+                if (!stream) {
+                    // Signed out: park rather than exit. Exiting would end the
+                    // pump for good, so a later `memwal_login` would reconnect a
+                    // session with nothing draining it — the client would hang
+                    // instead of recovering. `logoutPark` resolves once the new
+                    // session is published (or stdin closes).
+                    // Cast for the same reason as `stream` above: every
+                    // assignment to `logoutPark` happens in a sibling closure,
+                    // so TS narrows it to `null` here. No `!stdinClosed` guard:
+                    // the `while` above already established it and nothing is
+                    // awaited in between, so it cannot have changed.
+                    if (loggedOut) {
+                        await logoutPark;
+                        continue;
+                    }
                     break; // stdin closed before we ever connected
+                }
                 while (true) {
                     const { value, done } = await stream.iter.next();
                     if (done)
@@ -1014,6 +1172,10 @@ pendingLines = []) {
                     err: err instanceof Error ? err.message : String(err),
                 });
             }
+            // Deliberately NOT short-circuited on `loggedOut`: breaking here
+            // would end the pump for good and strand a later re-login. Fall
+            // through instead — `reconnect()` no-ops while signed out, and the
+            // next iteration parks on `logoutPark` at the top of the loop.
             if (stdinClosed)
                 break;
             // Stream ended. If a reconnect is ALREADY in progress (e.g. the
@@ -1039,11 +1201,25 @@ pendingLines = []) {
                 // session negotiates capabilities — but suppress that upstream
                 // reply, since the client already has this one.
                 if (msg.method === "initialize" && msg.id != null) {
+                    const clientInfo = rememberInitializeClientInfo(msg.params);
+                    if (clientInfo) {
+                        Object.assign(extraHeaders, clientInfoHeaders(clientInfo));
+                        log.info("bridge.agent_client", {
+                            clientName: clientInfo.name,
+                            clientVersion: clientInfo.version,
+                        });
+                    }
                     writeStdoutMessage({
                         jsonrpc: "2.0",
                         id: msg.id,
                         result: buildLocalInitializeResult(msg.params),
                     });
+                    // Signed out: the local reply is the whole answer. We will
+                    // not forward upstream, so do not arm a suppression that no
+                    // reply can ever consume — a leaked arm would swallow the
+                    // real reply if the client later reuses this id.
+                    if (loggedOut)
+                        return;
                     // Expect exactly one upstream reply to drop for this forward.
                     expectSuppressedReply(msg.id);
                     // Fall through: forward/buffer the initialize upstream too.
@@ -1092,6 +1268,12 @@ pendingLines = []) {
                     }
                     if (params.name === "memwal_logout") {
                         const result = handleLocalLogout();
+                        // Tear the session down before replying, so by the time
+                        // the client is told it is signed out that is actually
+                        // true. Only on success: if the credentials file could
+                        // not be removed the user is still signed in.
+                        if (!result.isError)
+                            invalidateSession();
                         writeStdoutMessage({
                             jsonrpc: "2.0",
                             id: msg.id,
@@ -1103,6 +1285,22 @@ pendingLines = []) {
                         return;
                     }
                 }
+                // Signed out: refuse EVERY remaining request locally, not just
+                // memory tool calls. `login`/`logout` returned above, and
+                // `initialize`/`tools/list` are answered locally further up, so
+                // anything still here would need the delegate key the user
+                // deleted. Falling through instead would park it in
+                // `pendingForward` — `sse` is null and `reconnect()` no-ops
+                // while signed out — where it would either hang the client until
+                // a login that may never come, or be flushed afterwards under a
+                // NEW key the client never authorized it against. `failRequest`
+                // picks the right shape per method: tool-result text for
+                // `tools/call`, a JSON-RPC error for `ping` and friends, and
+                // nothing at all for notifications.
+                if (loggedOut) {
+                    failRequest(msg, "signed out", SIGNED_OUT_FAILURE);
+                    return;
+                }
                 // Fill in the configured default namespace for memory tool
                 // calls that didn't pass one. Mutates msg in place so the
                 // forwarded — and any replayed-on-reconnect — copy carries it.
@@ -1147,6 +1345,12 @@ pendingLines = []) {
                 if (activeCredentialGeneration !== credentialGeneration) {
                     await reconnect("post-credential-generation-mismatch", true);
                 }
+                // A logout can land while the two awaits above are parked. The
+                // key is gone by then, so answer locally instead of posting.
+                if (loggedOut || !creds) {
+                    failRequest(msg, "signed out", SIGNED_OUT_FAILURE);
+                    return;
+                }
                 if (!sse) {
                     await reconnect("sse-missing");
                     return;
@@ -1185,7 +1389,9 @@ pendingLines = []) {
                     // into inFlight but not delivered) is closed out below.
                     break;
                 }
-                if (!sse)
+                // `invalidateSession` nulls both; either one means this queue
+                // must not be drained onto the relayer.
+                if (!sse || !creds)
                     break; // lost the session; reconnect replays inFlight
                 const msg = pendingForward.shift();
                 try {
@@ -1258,6 +1464,9 @@ pendingLines = []) {
      * Only `tools/call` shaped requests get the tool-result error envelope; any
      * other id-bearing request gets a JSON-RPC error object (the correct shape
      * for a non-tool request). */
+    /** `opts` overrides the default "relayer unavailable" wording for callers
+     * whose failure is not an outage — logout, for one, where blaming the
+     * relayer would be actively misleading. */
     function failRequest(msg, reason, opts = {}) {
         if (msg.id == null)
             return; // notification — nothing to answer
@@ -1359,7 +1568,7 @@ pendingLines = []) {
     // finished after `credentialGeneration` moved — that was the double-flush.
     const connectInBackground = (async () => {
         let attempt = 0;
-        while (!stdinClosed) {
+        while (!stdinClosed && !loggedOut) {
             if (reconnectPromise) {
                 await reconnectPromise;
                 continue;
@@ -1374,11 +1583,19 @@ pendingLines = []) {
             }
             const openingGeneration = credentialGeneration;
             try {
-                const candidate = await openSseStream(creds.relayerUrl, creds);
+                const candidate = await openSseStream(creds.relayerUrl, creds, extraHeaders);
                 if (stdinClosed) {
                     candidate.abort();
                     break;
                 }
+                // Signed out while this handshake was in flight. The loop guard
+                // above only runs between iterations, so without this the
+                // session would be published — an open, authenticated stream
+                // holding the delegate key the user just deleted.
+                if (loggedOut) {
+                    candidate.abort();
+                    break;
+                }
                 if (openingGeneration !== credentialGeneration || sse) {
                     candidate.abort();
                     continue;