@nurix/nustack 0.19.0 → 0.19.2

package/dist/lib/harness/mount.js

@@ -0,0 +1,155 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+export const MOUNT_STATE_PATH = ".claude/state/mount.json";
+const IGNORE_START = "# etna:mount:start";
+const IGNORE_END = "# etna:mount:end";
+const ETNA_MOUNT_SPECIFIER = "@nurix/etna/mount";
+const sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export function defaultCacheDir(env = process.env) {
+    return env.ETNA_CACHE_DIR?.trim() || path.join(homedir(), ".etna", "cache");
+}
+export function isMountedPath(file) {
+    if (file.policy)
+        return file.policy === "mount";
+    const contract = ["CLAUDE.md", "AGENTS.md", ".claude/harness.json", ".claude/settings.json", ".claude/hooks/mount.mjs", ".codex/hooks.json"];
+    if (contract.includes(file.path))
+        return false;
+    return file.path.startsWith(".claude/") || file.path.startsWith(".agents/") || file.path.startsWith(".codex/");
+}
+async function readIfPresent(file) {
+    try {
+        return await readFile(file);
+    }
+    catch {
+        return null;
+    }
+}
+export async function readMountState(root) {
+    return parseMountState(await readIfPresent(path.join(root, MOUNT_STATE_PATH)));
+}
+export function readMountStateSync(root) {
+    try {
+        return parseMountState(readFileSync(path.join(root, MOUNT_STATE_PATH)));
+    }
+    catch {
+        return null;
+    }
+}
+function parseMountState(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw.toString("utf8"));
+        if (typeof parsed.version !== "string" || typeof parsed.digest !== "string")
+            return null;
+        return { version: parsed.version, digest: parsed.digest, mountedAt: typeof parsed.mountedAt === "string" ? parsed.mountedAt : "", ...(typeof parsed.manifestUrl === "string" ? { manifestUrl: parsed.manifestUrl } : {}) };
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchBytes(fetchImpl, url) {
+    const response = await fetchImpl(url);
+    if (!response.ok)
+        throw new Error(`${url} answered ${response.status}`);
+    return Buffer.from(await response.arrayBuffer());
+}
+function objectUrlOf(manifestUrl, key) {
+    return `${new URL(manifestUrl).origin}/${key.replace(/^\/+/, "")}`;
+}
+async function writeAtomic(target, bytes) {
+    await mkdir(path.dirname(target), { recursive: true });
+    const staging = `${target}.mount-${process.pid}`;
+    await writeFile(staging, bytes);
+    await rename(staging, target);
+}
+function ignoredNamesOf(files) {
+    const names = new Set([".claude/state/"]);
+    for (const file of files) {
+        const parts = file.path.split("/");
+        if (parts[0] === ".agents")
+            names.add(".agents/skills/");
+        else if (parts[0] === ".codex")
+            names.add(parts.length > 2 ? `.codex/${parts[1]}/` : `.codex/${parts[1]}`);
+        else if (parts.length > 3)
+            names.add(`${parts.slice(0, 3).join("/")}/`);
+        else
+            names.add(file.path);
+    }
+    return [...names].sort();
+}
+async function writeExcludeBlock(root, files) {
+    let excludePath;
+    try {
+        excludePath = execFileSync("git", ["rev-parse", "--git-path", "info/exclude"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return;
+    }
+    const absolute = path.isAbsolute(excludePath) ? excludePath : path.join(root, excludePath);
+    const held = (await readIfPresent(absolute))?.toString("utf8") ?? "";
+    const start = held.indexOf(IGNORE_START);
+    const end = held.indexOf(IGNORE_END);
+    const outside = start >= 0 && end > start ? held.slice(0, start) + held.slice(end + IGNORE_END.length).replace(/^\n/, "") : held;
+    const block = [IGNORE_START, ...ignoredNamesOf(files), IGNORE_END].join("\n");
+    await writeAtomic(absolute, `${outside.replace(/\n*$/, outside ? "\n" : "")}${block}\n`);
+}
+export async function mountWithAdapter(root, manifestUrl, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const cacheDir = options.cacheDir ?? defaultCacheDir();
+    const manifestBytes = await fetchBytes(fetchImpl, manifestUrl);
+    const digest = sha256Of(manifestBytes);
+    const manifest = JSON.parse(manifestBytes.toString("utf8"));
+    if (!manifest || !Array.isArray(manifest.files))
+        throw new Error(`the manifest at ${manifestUrl} lists no files`);
+    const version = String(manifest.version ?? "");
+    const prior = await readMountState(root);
+    const mounted = manifest.files.filter(isMountedPath);
+    let written = 0;
+    let kept = 0;
+    for (const file of mounted) {
+        if (file.path.split("/").includes("..") || path.isAbsolute(file.path))
+            throw new Error(`the manifest names an unsafe path: ${file.path}`);
+        const target = path.join(root, file.path);
+        const held = await readIfPresent(target);
+        if (held && file.sha256 && sha256Of(held) === file.sha256) {
+            kept += 1;
+            continue;
+        }
+        const cached = file.sha256 ? await readIfPresent(path.join(cacheDir, "objects", file.sha256)) : null;
+        let bytes = cached && sha256Of(cached) === file.sha256 ? cached : null;
+        if (!bytes) {
+            bytes = await fetchBytes(fetchImpl, objectUrlOf(manifestUrl, file.key));
+            if (file.sha256 && sha256Of(bytes) !== file.sha256)
+                throw new Error(`the object for ${file.path} does not match its sha256`);
+            if (file.sha256)
+                await writeAtomic(path.join(cacheDir, "objects", file.sha256), bytes);
+        }
+        await writeAtomic(target, bytes);
+        written += 1;
+    }
+    await writeExcludeBlock(root, mounted);
+    await mkdir(path.join(root, ".claude", "state"), { recursive: true });
+    if (!(await readIfPresent(path.join(root, ".claude", "state", ".gitignore"))))
+        await writeFile(path.join(root, ".claude", "state", ".gitignore"), "*\n");
+    const state = { version, digest, mountedAt: new Date().toISOString(), manifestUrl };
+    if (!prior || prior.digest !== digest || prior.version !== version || written > 0)
+        await writeAtomic(path.join(root, MOUNT_STATE_PATH), `${JSON.stringify(state, null, 2)}\n`);
+    return { version, digest, written, kept, via: "adapter" };
+}
+export async function mountHarness(root, manifestUrl, options = {}) {
+    if (options.useEtna !== false) {
+        const specifier = ETNA_MOUNT_SPECIFIER;
+        const etna = (await import(specifier).catch(() => null));
+        if (etna && typeof etna.mount === "function") {
+            await etna.mount(root, manifestUrl);
+            const state = await readMountState(root);
+            return { version: state?.version ?? "", digest: state?.digest ?? "", written: 0, kept: 0, via: "etna" };
+        }
+    }
+    return mountWithAdapter(root, manifestUrl, options);
+}

package/dist/lib/hosting/client.js

@@ -0,0 +1,71 @@
+import { assertSafeOpaqueId } from "../guards.js";
+import { authorizedFetch, errorMessage } from "../nustack_client.js";
+const REQUEST_TIMEOUT_MS = 10_000;
+const DEFAULT_POLL_INTERVAL_MS = 4_000;
+export class HostingRequestError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "HostingRequestError";
+    }
+}
+export async function callProjectRoute(target, suffix, label, method = "GET") {
+    const safeId = encodeURIComponent(assertSafeOpaqueId("The Project id", target.projectId));
+    const response = await authorizedFetch(`${target.baseUrl}/api/v2/projects/${safeId}${suffix}`, {
+        method,
+        headers: { Authorization: `Bearer ${target.accessToken}` },
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    const payload = (await response.json().catch(() => null));
+    if (!response.ok || payload?.data === undefined) {
+        throw new HostingRequestError(payload?.error?.code ?? "REQUEST_FAILED", errorMessage(payload, response.status, label), response.status);
+    }
+    return { data: payload.data, meta: payload.meta ?? {} };
+}
+async function call(target, suffix, label, method = "GET") {
+    return (await callProjectRoute(target, suffix, label, method)).data;
+}
+export function getHostingStatus(target) {
+    return call(target, "/hosting", "hosting status failed");
+}
+export function startDeploy(target) {
+    return call(target, "/hosting/deploys", "deploy failed", "POST");
+}
+export function rollbackHosting(target) {
+    return call(target, "/hosting/rollback", "rollback failed", "POST");
+}
+export function setKeepWarm(target, isOn) {
+    return call(target, "/hosting/pin", "keep-warm failed", isOn ? "POST" : "DELETE");
+}
+export function listVersions(target) {
+    return call(target, "/versions", "version list failed");
+}
+export function pollIntervalMs(fallback = DEFAULT_POLL_INTERVAL_MS) {
+    const raw = Number.parseInt(process.env.NUSTACK_POLL_INTERVAL_MS ?? "", 10);
+    return Number.isInteger(raw) && raw > 0 ? Math.max(raw, 50) : fallback;
+}
+export async function watchDeploy(target, version, options) {
+    const deadline = Date.now() + options.timeoutMs;
+    const interval = pollIntervalMs();
+    let lastState = null;
+    let last = null;
+    for (;;) {
+        last = await getHostingStatus(target);
+        if (last.deployState !== null && last.deployState !== lastState) {
+            lastState = last.deployState;
+            options.onState?.(last.deployState);
+        }
+        if (last.deployState === null && last.lastOutcome?.version === version) {
+            return { kind: "settled", outcome: last.lastOutcome, status: last };
+        }
+        if (last.deployState === null && last.lastOutcome && last.lastOutcome.version > version) {
+            return { kind: "superseded", status: last, laterVersion: last.lastOutcome.version };
+        }
+        if (Date.now() + interval > deadline)
+            return { kind: "timeout", status: last };
+        await new Promise((resolve) => setTimeout(resolve, interval));
+    }
+}

package/dist/lib/hosting/logs.js

@@ -0,0 +1,76 @@
+import { callProjectRoute, pollIntervalMs } from "./client.js";
+const FOLLOW_INTERVAL_MS = 2_000;
+export async function getBuildLog(target, version) {
+    return (await callProjectRoute(target, `/hosting/builds/${version}`, "build log read failed")).data;
+}
+export async function getRuntimeLogs(target, cursor) {
+    const query = new URLSearchParams();
+    if (cursor.after !== undefined)
+        query.set("after", String(cursor.after));
+    if (cursor.instance)
+        query.set("instance", cursor.instance);
+    if (cursor.limit !== undefined)
+        query.set("limit", String(cursor.limit));
+    const suffix = query.size > 0 ? `/hosting/logs?${query.toString()}` : "/hosting/logs";
+    return (await callProjectRoute(target, suffix, "log read failed")).data;
+}
+export async function listActivity(target, page) {
+    const query = new URLSearchParams();
+    if (page.cursor)
+        query.set("cursor", page.cursor);
+    if (page.limit !== undefined)
+        query.set("limit", String(page.limit));
+    if (page.action)
+        query.set("action", page.action);
+    const suffix = query.size > 0 ? `/events?${query.toString()}` : "/events";
+    const answer = await callProjectRoute(target, suffix, "activity read failed");
+    return { items: answer.data.items, nextCursor: answer.meta.nextCursor ?? null };
+}
+export function orderedSteps(log) {
+    const failing = log.steps.filter((step) => step.state === "failed");
+    return [...log.steps.filter((step) => step.state !== "failed"), ...failing];
+}
+export function renderBuildLog(log) {
+    const blocks = orderedSteps(log).map((step) => {
+        const head = `── ${step.clause} · ${step.state}`;
+        return step.tail ? `${head}\n${step.tail}` : head;
+    });
+    return [`v${log.version} · ${log.ok ? "graded green" : "graded red"}`, ...blocks].join("\n");
+}
+export function renderRuntimeLine(line) {
+    return `${line.at}  ${line.stream.padEnd(6)} ${line.text}`;
+}
+export function stateNotice(page) {
+    if (page.state === "stopped")
+        return "the app is asleep — its recent lines went with the instance that printed them";
+    if (page.state === "starting")
+        return "the app is starting — a version switch is in flight";
+    return null;
+}
+export async function followRuntimeLogs(target, first, sink, limit) {
+    const interval = pollIntervalMs(FOLLOW_INTERVAL_MS);
+    let instance = first.instance;
+    let after = first.state === "running" ? first.latestSeq : undefined;
+    let lastNotice = stateNotice(first);
+    for (;;) {
+        await new Promise((resolve) => setTimeout(resolve, interval));
+        const page = await getRuntimeLogs(target, { after, instance, limit });
+        const notice = stateNotice(page);
+        if (notice) {
+            if (notice !== lastNotice)
+                sink.notice(notice);
+            lastNotice = notice;
+            after = undefined;
+            continue;
+        }
+        lastNotice = null;
+        if (instance !== null && page.instance !== instance)
+            sink.notice("— instance restarted —");
+        else if (page.isTruncated)
+            sink.notice("— lines were dropped before they could be read —");
+        for (const line of page.lines)
+            sink.line(renderRuntimeLine(line));
+        instance = page.instance;
+        after = page.latestSeq;
+    }
+}

package/dist/lib/interactive.js

@@ -1,5 +1,8 @@
 import * as p from "@clack/prompts";
+export const NON_INTERACTIVE_VARIABLE = "NUSTACK_NON_INTERACTIVE";
 export function isInteractive() {
+    if (process.env[NON_INTERACTIVE_VARIABLE] === "1")
+        return false;
     return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
 export async function confirmOrFallback(message, fallback) {

package/dist/lib/local_store/migrations.js

@@ -205,6 +205,36 @@ const MIGRATION_V7 = {
         `CREATE INDEX local_bindings_project_idx ON local_bindings (project_id)`,
     ],
 };
+const MIGRATION_V8 = {
+    version: 8,
+    statements: [
+        `CREATE TABLE record_outbox (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            kind TEXT NOT NULL CHECK (kind IN ('backlog','backlog.remove','bookkeeping','gate_event')),
+            idempotency_key TEXT NOT NULL,
+            door_url TEXT NOT NULL,
+            row_json TEXT NOT NULL CHECK (json_valid(row_json)),
+            attempts INTEGER NOT NULL DEFAULT 0,
+            next_retry_at_ms INTEGER,
+            last_error TEXT,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE UNIQUE INDEX record_outbox_idempotency_key_unique ON record_outbox (idempotency_key)`,
+        `CREATE TABLE record_store (
+            id TEXT PRIMARY KEY,
+            project_id TEXT,
+            repository_root TEXT NOT NULL,
+            kind TEXT NOT NULL CHECK (kind IN ('backlog','backlog.remove','bookkeeping','gate_event')),
+            idempotency_key TEXT NOT NULL,
+            row_json TEXT NOT NULL CHECK (json_valid(row_json)),
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE UNIQUE INDEX record_store_idempotency_key_unique ON record_store (idempotency_key)`,
+    ],
+};
 export const MIGRATIONS = [
     MIGRATION_V1,
     MIGRATION_V2,
@@ -213,6 +243,7 @@ export const MIGRATIONS = [
     MIGRATION_V5,
     MIGRATION_V6,
     MIGRATION_V7,
+    MIGRATION_V8,
 ];
 export const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
 export class LocalSchemaTooNewError extends Error {

package/dist/lib/mcp/clients.js

@@ -0,0 +1,130 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export const MCP_CLIENTS = ["claude", "cursor", "codex", "vscode"];
+export const SERVER_NAME = "nustack";
+const COMMAND = "nustack";
+const ARGS = ["mcp", "serve"];
+export function targetFor(client, scope, cwd, home = os.homedir()) {
+    const plain = { command: COMMAND, args: ARGS };
+    switch (client) {
+        case "claude":
+            return { format: "json", file: scope === "user" ? path.join(home, ".claude.json") : path.join(cwd, ".mcp.json"), table: "mcpServers", entry: plain };
+        case "cursor":
+            return { format: "json", file: path.join(scope === "user" ? home : cwd, ".cursor", "mcp.json"), table: "mcpServers", entry: plain };
+        case "codex":
+            return scope === "user" ? { format: "toml", file: path.join(home, ".codex", "config.toml") } : null;
+        case "vscode":
+            return scope === "project" ? { format: "json", file: path.join(cwd, ".vscode", "mcp.json"), table: "servers", entry: { type: "stdio", ...plain } } : null;
+    }
+}
+export function detectClients(home = os.homedir()) {
+    const found = [];
+    if (existsSync(path.join(home, ".claude.json")) || existsSync(path.join(home, ".claude")))
+        found.push("claude");
+    if (existsSync(path.join(home, ".cursor")))
+        found.push("cursor");
+    if (existsSync(path.join(home, ".codex")))
+        found.push("codex");
+    return found;
+}
+function detectIndent(raw) {
+    const indented = /\n(\x20+)"/.exec(raw);
+    return indented?.[1] ? indented[1].length : 2;
+}
+function isManaged(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const command = value.command;
+    return typeof command === "string" && (command === COMMAND || command.endsWith(`/${COMMAND}`));
+}
+export class ClientConfigError extends Error {
+}
+function editJson(target, raw, install) {
+    let document = {};
+    if (raw !== null && raw.trim()) {
+        try {
+            document = JSON.parse(raw);
+        }
+        catch {
+            throw new ClientConfigError(`${target.file} is not plain JSON (comments or a syntax error); edit it by hand.`);
+        }
+    }
+    const indent = raw ? detectIndent(raw) : 2;
+    const table = (document[target.table] && typeof document[target.table] === "object" ? { ...document[target.table] } : null) ?? null;
+    const current = table?.[SERVER_NAME];
+    if (current !== undefined && !isManaged(current)) {
+        throw new ClientConfigError(`${target.file} already has a "${SERVER_NAME}" server that this CLI did not write; remove it or rename it first.`);
+    }
+    const render = (value) => `${JSON.stringify(value, null, indent)}\n`;
+    if (install) {
+        if (current !== undefined && JSON.stringify(current) === JSON.stringify(target.entry))
+            return { action: "unchanged", next: raw };
+        const next = { ...document, [target.table]: { ...(table ?? {}), [SERVER_NAME]: target.entry } };
+        return { action: current === undefined ? "added" : "updated", next: render(next) };
+    }
+    if (current === undefined || !table)
+        return { action: "absent", next: raw };
+    delete table[SERVER_NAME];
+    const next = { ...document };
+    if (Object.keys(table).length > 0)
+        next[target.table] = table;
+    else
+        delete next[target.table];
+    return { action: "removed", next: Object.keys(next).length === 0 ? null : render(next) };
+}
+const TOML_HEADER = `[mcp_servers.${SERVER_NAME}]`;
+const TOML_BLOCK = `${TOML_HEADER}\ncommand = "${COMMAND}"\nargs = [${ARGS.map((arg) => `"${arg}"`).join(", ")}]\n`;
+function tomlBlock(lines) {
+    const start = lines.findIndex((line) => line.trim() === TOML_HEADER);
+    if (start === -1)
+        return null;
+    let end = start + 1;
+    while (end < lines.length && !/^\s*\[/.test(lines[end]))
+        end += 1;
+    return { start, end };
+}
+function editToml(raw, install) {
+    const text = raw ?? "";
+    const lines = text.split("\n");
+    const block = tomlBlock(lines);
+    if (install) {
+        if (block) {
+            const existing = `${lines.slice(block.start, block.end).join("\n").trimEnd()}\n`;
+            if (existing === TOML_BLOCK)
+                return { action: "unchanged", next: raw };
+            const rest = lines.slice(block.end).join("\n");
+            const head = lines.slice(0, block.start).join("\n");
+            return { action: "updated", next: `${head}${head ? "\n" : ""}${TOML_BLOCK}${rest ? `\n${rest}` : ""}` };
+        }
+        if (!text)
+            return { action: "added", next: TOML_BLOCK };
+        return { action: "added", next: `${text}${text.endsWith("\n") ? "" : "\n"}\n${TOML_BLOCK}` };
+    }
+    if (!block)
+        return { action: "absent", next: raw };
+    let start = block.start;
+    if (start > 0 && lines[start - 1] === "")
+        start -= 1;
+    const kept = [...lines.slice(0, start), ...lines.slice(block.end)];
+    const next = kept.join("\n").replace(/\n*$/, "\n");
+    return { action: "removed", next: next.trim() ? next : null };
+}
+export async function planEdit(target, install) {
+    const before = existsSync(target.file) ? await readFile(target.file, "utf8") : null;
+    const outcome = target.format === "json" ? editJson(target, before, install) : editToml(before, install);
+    return { ...outcome, before };
+}
+export async function applyEdit(target, outcome) {
+    if (outcome.action === "unchanged" || outcome.action === "absent")
+        return;
+    if (outcome.next === null) {
+        await rm(target.file, { force: true });
+        return;
+    }
+    await mkdir(path.dirname(target.file), { recursive: true });
+    const temporary = `${target.file}.nustack-${process.pid}`;
+    await writeFile(temporary, outcome.next, "utf8");
+    await rename(temporary, target.file);
+}

package/dist/lib/mcp/relay.js

@@ -0,0 +1,106 @@
+import { createInterface } from "node:readline";
+export const RELAY_UNAUTHORIZED = -32001;
+const INTERNAL_ERROR = -32603;
+const PARSE_ERROR = -32700;
+export function doorUrlFor(origin, override) {
+    if (override?.trim())
+        return override.trim();
+    const url = new URL(origin);
+    if (url.hostname === "apps.nustack.ai")
+        return "https://mcp.nustack.ai/nustack";
+    return `${url.origin}/nustack`;
+}
+function rpcError(id, code, message) {
+    return { jsonrpc: "2.0", id, error: { code, message } };
+}
+export function rewriteToolList(tools, defaultProjectId) {
+    return tools.map((tool) => {
+        const property = tool.inputSchema?.properties?.projectId;
+        if (!property || !tool.inputSchema)
+            return tool;
+        const note = defaultProjectId ? ` Defaults to ${defaultProjectId}, the Project this folder is bound to.` : "";
+        const rewritten = {
+            ...tool,
+            inputSchema: {
+                ...tool.inputSchema,
+                properties: { ...tool.inputSchema.properties, projectId: { ...property, description: `${property.description ?? ""}${note}`.trim() } },
+                required: (tool.inputSchema.required ?? []).filter((name) => name !== "projectId"),
+            },
+        };
+        if (rewritten.inputSchema.required.length === 0)
+            delete rewritten.inputSchema.required;
+        return rewritten;
+    });
+}
+export async function runRelay(options) {
+    let projectVerbs = null;
+    const forward = async (frame) => {
+        const bearer = await options.bearer();
+        if (!bearer)
+            return { status: 401, body: null };
+        const response = await options.fetch(options.doorUrl, {
+            method: "POST",
+            headers: { "content-type": "application/json", authorization: `Bearer ${bearer}` },
+            body: JSON.stringify(frame),
+        });
+        const text = await response.text();
+        return { status: response.status, body: text ? JSON.parse(text) : null };
+    };
+    const remember = (tools) => {
+        projectVerbs = new Set(tools.filter((tool) => tool.inputSchema?.properties?.projectId).map((tool) => tool.name));
+    };
+    const knownProjectVerbs = async () => {
+        if (projectVerbs)
+            return projectVerbs;
+        const listed = await forward({ jsonrpc: "2.0", id: "relay-tools", method: "tools/list" });
+        remember((listed.body?.result?.tools ?? []));
+        return projectVerbs ?? new Set();
+    };
+    const answer = async (line) => {
+        let frame;
+        try {
+            frame = JSON.parse(line);
+        }
+        catch {
+            return rpcError(null, PARSE_ERROR, "Body is not valid JSON");
+        }
+        const id = frame.id ?? null;
+        const isNotification = frame.id === undefined || frame.id === null;
+        try {
+            if (frame.method === "tools/call" && options.defaultProjectId) {
+                const args = (frame.params?.["arguments"] ?? {});
+                const name = frame.params?.["name"];
+                if (!("projectId" in args) && typeof name === "string" && (await knownProjectVerbs()).has(name)) {
+                    frame = { ...frame, params: { ...frame.params, arguments: { ...args, projectId: options.defaultProjectId } } };
+                }
+            }
+            const forwarded = await forward(frame);
+            if (forwarded.status === 401) {
+                return isNotification ? null : rpcError(id, RELAY_UNAUTHORIZED, "NuStack refused this CLI's credential — run `nustack login` in a terminal, then retry.");
+            }
+            if (isNotification || !forwarded.body)
+                return null;
+            if (frame.method === "tools/list") {
+                const result = forwarded.body.result;
+                if (result?.tools) {
+                    remember(result.tools);
+                    return { ...forwarded.body, result: { ...result, tools: rewriteToolList(result.tools, options.defaultProjectId) } };
+                }
+            }
+            return forwarded.body;
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            options.log(`[nustack mcp] ${frame.method ?? "frame"} failed: ${message}`);
+            return isNotification ? null : rpcError(id, INTERNAL_ERROR, `NuStack could not be reached: ${message}`);
+        }
+    };
+    const lines = createInterface({ input: options.input, crlfDelay: Number.POSITIVE_INFINITY });
+    for await (const line of lines) {
+        if (!line.trim())
+            continue;
+        const reply = await answer(line);
+        if (reply)
+            options.output.write(`${JSON.stringify(reply)}\n`);
+    }
+}

package/dist/lib/nustack_client.js

@@ -4,7 +4,7 @@ import { DEVICE_HEADER, envToken, knownDeviceId, refreshAccessTokenAfterRefusal,
 import { getOrCreateDeviceId } from "./device_identity.js";
 const DEFAULT_NUSTACK_URL = "https://apps.nustack.ai";
 const REQUEST_TIMEOUT_MS = 10_000;
-async function authorizedFetch(input, init = {}) {
+export async function authorizedFetch(input, init = {}) {
     const headers = new Headers(init.headers);
     headers.set(DEVICE_HEADER, knownDeviceId() ?? (await getOrCreateDeviceId()));
     headers.set("User-Agent", userAgent());
@@ -24,7 +24,7 @@ function isStreamBody(body) {
     return body != null && typeof body !== "string" && !(body instanceof ArrayBuffer) && !ArrayBuffer.isView(body) && !(body instanceof URLSearchParams);
 }
 const KEYS_PLANE = "the credential plane (/api/v1/keys)";
-function errorMessage(payload, status, label, plane) {
+export function errorMessage(payload, status, label, plane) {
     if (plane && status === 404 && typeof payload?.error === "string") {
         return `${label}: this NuStack deployment does not serve ${plane} — the server half of this command is not deployed, so it cannot succeed against this host.`;
     }