@pandanpc/mcp-server 0.1.30 → 0.1.31

package/README.md

@@ -68,6 +68,19 @@ command = "pandanpc-mcp"
 
 Account operations require `note_login` when not already authenticated. Reading guides does not require a note login.
 
+## Automatic runtime updates
+
+The npm launcher starts the last verified runtime immediately and checks for a newer stable release in a separate background process (at most once every six hours; failed checks back off for 15 minutes). It downloads the platform binary into the user's cache, verifies SHA-256, and runs a bounded startup check before atomically selecting it for the next launch. Current MCP sessions are never restarted or replaced. Offline or failed updates keep the existing runtime usable.
+
+The cache defaults to `~/.pandanpc-mcp/runtime/<platform>-<arch>` and does not require write access to a global npm installation. Each version uses its own file, including on Windows. Older cached executables are retained because another session may still use them; remove the cache only after closing those sessions if you want to reclaim disk space.
+
+- `pandanpc-mcp --version` shows the selected runtime and npm launcher versions.
+- `pandanpc-mcp --update` checks/downloads now; reconnect afterwards to use the result. Status messages go to stderr, never the MCP protocol stream.
+- Set `PANDANPC_MCP_AUTO_UPDATE=0` in the MCP client's environment to disable checks and pin the runtime bundled with the installed npm version.
+- `PANDANPC_MCP_CACHE_DIR` optionally selects a different user-writable cache directory.
+
+Existing users must first upgrade to a launcher containing this feature with `npm install -g @pandanpc/mcp-server@latest`, then reconnect. Automatic updates cover the executable and its embedded guides, not the npm launcher code or separately copied Skill files. A future release requiring a different updater protocol must be installed through npm; `--update` reports that condition. Directly launching a downloaded Rust binary bypasses the npm updater.
+
 ## Optional Agent Skill
 
 The package includes `skills/pandanpc/SKILL.md` and its references. These are the same guide files embedded in the MCP binary, so examples stay aligned with the installed version. MCP-only clients can call `get_guide`; they do not need filesystem or Skill support.

package/index.js

@@ -8,30 +8,53 @@ const path = require('path')
 const { spawn } = require('child_process')
 const fs = require('fs')
 const { binaryName } = require('./binary-name')
+const pkg = require('./package.json')
+const { selectRuntime, startBackgroundUpdate, checkForUpdates } = require('./updater')
 
 const binName = binaryName()
-const binPath = path.join(__dirname, 'bin', binName)
+const bundledPath = path.join(__dirname, 'bin', binName)
+const runtime = selectRuntime()
+let child
 
-if (!fs.existsSync(binPath)) {
-  console.error(`[pandanpc-mcp] binary not found at ${binPath}`)
-  console.error(`[pandanpc-mcp] try reinstalling: npm install -g @pandanpc/mcp-server`)
-  process.exit(1)
+if (process.argv[2] === '--version') {
+  console.log(`pandanpc-mcp ${runtime.version} (launcher ${pkg.version})`)
+  process.exit(0)
+}
+if (process.argv[2] === '--update') {
+  checkForUpdates({ force: true }).then(result => {
+    console.error(`[pandanpc-mcp] update: ${result.status}${result.version ? ` ${result.version}` : ''}${result.error ? ` (${result.error})` : ''}`)
+    if (result.status === 'manual-update-required') console.error('Update the launcher: npm install -g @pandanpc/mcp-server@latest')
+    process.exit(result.status === 'failed' ? 1 : 0)
+  }).catch(error => { console.error(error.message); process.exit(1) })
+} else {
+  launch(runtime)
+  startBackgroundUpdate()
+  // Keep long-lived sessions aware of releases without holding the process open.
+  setInterval(startBackgroundUpdate, 15 * 60 * 1000).unref()
 }
 
-const child = spawn(binPath, process.argv.slice(2), {
-  stdio: 'inherit',
-  windowsHide: true,
-})
-
-child.on('exit', (code, signal) => {
-  if (signal) process.kill(process.pid, signal)
-  else process.exit(code ?? 0)
-})
-
-child.on('error', (err) => {
-  console.error(`[pandanpc-mcp] failed to spawn: ${err.message}`)
-  process.exit(1)
-})
-
-process.on('SIGINT', () => child.kill('SIGINT'))
-process.on('SIGTERM', () => child.kill('SIGTERM'))
+function launch(selected) {
+  if (!fs.existsSync(selected.file)) {
+    console.error(`[pandanpc-mcp] binary not found at ${selected.file}; reinstall @pandanpc/mcp-server`)
+    process.exit(1)
+  }
+  child = spawn(selected.file, process.argv.slice(2), {
+    stdio: 'inherit', windowsHide: true,
+    env: { ...process.env, PANDANPC_MCP_RUNTIME_VERSION: selected.version },
+  })
+  child.on('exit', (code, signal) => {
+    if (signal) process.kill(process.pid, signal)
+    else process.exit(code ?? 0)
+  })
+  child.on('error', err => {
+    if (selected.file !== bundledPath) {
+      console.error('[pandanpc-mcp] cached runtime could not start; using bundled version')
+      launch({ file: bundledPath, version: pkg.version })
+    } else {
+      console.error(`[pandanpc-mcp] failed to spawn: ${err.message}`)
+      process.exit(1)
+    }
+  })
+}
+process.on('SIGINT', () => { if (child) child.kill('SIGINT') })
+process.on('SIGTERM', () => { if (child) child.kill('SIGTERM') })

package/install.js

@@ -8,7 +8,7 @@
 
 const fs = require('fs')
 const path = require('path')
-const https = require('https')
+const { download, fetchText } = require('./network')
 const crypto = require('crypto')
 const { binaryName } = require('./binary-name')
 
@@ -32,31 +32,6 @@ function detectPlatform() {
   return { key, name }
 }
 
-function download(url, dest) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest)
-    const req = https.get(url, (res) => {
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        file.close()
-        fs.unlinkSync(dest)
-        return download(res.headers.location, dest).then(resolve, reject)
-      }
-      if (res.statusCode !== 200) {
-        file.close()
-        fs.unlinkSync(dest)
-        return reject(new Error(`HTTP ${res.statusCode} for ${url}`))
-      }
-      res.pipe(file)
-      file.on('finish', () => file.close(resolve))
-    })
-    req.on('error', (err) => {
-      file.close()
-      try { fs.unlinkSync(dest) } catch {}
-      reject(err)
-    })
-  })
-}
-
 function sha256(file) {
   return new Promise((resolve, reject) => {
     const hash = crypto.createHash('sha256')
@@ -79,20 +54,6 @@ function checksumFor(sumsText, artifactName) {
   return checksum
 }
 
-async function fetchText(url) {
-  return new Promise((resolve, reject) => {
-    https.get(url, (res) => {
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        return fetchText(res.headers.location).then(resolve, reject)
-      }
-      if (res.statusCode !== 200) return reject(new Error(`HTTP ${res.statusCode}`))
-      let body = ''
-      res.on('data', (c) => (body += c))
-      res.on('end', () => resolve(body))
-    }).on('error', reject)
-  })
-}
-
 function removeTemporaryFile(file) {
   try { fs.unlinkSync(file) } catch (error) {
     if (error?.code !== 'ENOENT') throw error
@@ -162,6 +123,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  detectPlatform,
   checksumFor,
   ensureBinary,
 }

package/network.js

@@ -0,0 +1,45 @@
+const https = require('https')
+const fs = require('fs')
+const { pipeline } = require('stream')
+
+// Bound both idle time and total transfer time; never follow a downgrade to HTTP.
+function transfer(url, destination, limit, timeout, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url)
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password) return reject(new Error('HTTPS URL required'))
+    let timer, piping = false
+    const finish = (error, value) => { clearTimeout(timer); error ? reject(error) : resolve(value) }
+    const req = https.get(parsed, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.destroy()
+        clearTimeout(timer)
+        if (redirects >= 3) return reject(new Error('Too many redirects'))
+        return transfer(new URL(res.headers.location, parsed).href, destination, limit, timeout, redirects + 1).then(resolve, reject)
+      }
+      if (res.statusCode !== 200) { res.destroy(); return finish(new Error(`HTTP ${res.statusCode}`)) }
+      let bytes = 0
+      res.on('data', chunk => {
+        bytes += chunk.length
+        if (bytes > limit) req.destroy(new Error('Response too large'))
+      })
+      if (destination) {
+        piping = true
+        pipeline(res, fs.createWriteStream(destination, { flags: 'wx', mode: 0o600 }), error => finish(error || (bytes > limit || !res.complete ? new Error('Incomplete or oversized response') : null)))
+      } else {
+        const chunks = []
+        res.on('data', chunk => chunks.push(chunk))
+        res.on('error', error => finish(error))
+        res.on('aborted', () => finish(new Error('Response interrupted')))
+        res.on('end', () => finish(bytes > limit || !res.complete ? new Error('Incomplete or oversized response') : null, Buffer.concat(chunks).toString('utf8')))
+      }
+    })
+    req.on('error', error => { if (!piping) finish(error) })
+    req.setTimeout(15000, () => req.destroy(new Error('Network idle timeout')))
+    timer = setTimeout(() => req.destroy(new Error('Network deadline exceeded')), timeout)
+  })
+}
+
+module.exports = {
+  fetchText: (url, { limit = 1024 * 1024, timeout = 20000 } = {}) => transfer(url, null, limit, timeout),
+  download: (url, destination, { limit = 64 * 1024 * 1024, timeout = 90000 } = {}) => transfer(url, destination, limit, timeout),
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pandanpc/mcp-server",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "description": "PandaNpc MCP Server — PandaNote and Agent connection management for Codex, Claude Code, and other MCP clients",
   "keywords": [
     "mcp",
@@ -24,7 +24,9 @@
     "index.js",
     "install.js",
     "README.md",
-    "skills"
+    "skills",
+    "network.js",
+    "updater.js"
   ],
   "scripts": {
     "postinstall": "node install.js"
@@ -47,5 +49,6 @@
   "bugs": {
     "url": "https://github.com/pandanpc-inc/mcp-server/issues"
   },
-  "mcpName": "com.pandanpc/mcp-server"
+  "mcpName": "com.pandanpc/mcp-server",
+  "pandanpcUpdaterProtocol": 1
 }

package/updater.js

@@ -0,0 +1,145 @@
+const fs = require('fs')
+const path = require('path')
+const os = require('os')
+const crypto = require('crypto')
+const { spawn, spawnSync } = require('child_process')
+const { binaryName } = require('./binary-name')
+const { ensureBinary, detectPlatform } = require('./install')
+const { fetchText } = require('./network')
+const pkg = require('./package.json')
+
+const PROTOCOL = 1
+const INTERVAL = 6 * 60 * 60 * 1000
+const RETRY_INTERVAL = 15 * 60 * 1000
+const REGISTRY = 'https://registry.npmjs.org/@pandanpc%2fmcp-server/latest'
+const quiet = { log() {}, warn() {} }
+
+function versionParts(v) {
+  if (typeof v !== 'string' || !/^\d+\.\d+\.\d+$/.test(v)) return null
+  const parts = v.split('.').map(Number)
+  return parts.every(Number.isSafeInteger) ? parts : null
+}
+function compareVersions(a, b) {
+  const x = versionParts(a), y = versionParts(b)
+  if (!x || !y) throw new Error('Invalid stable version')
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i] ? 1 : -1
+  return 0
+}
+function cacheRoot() {
+  return path.join(process.env.PANDANPC_MCP_CACHE_DIR || path.join(os.homedir(), '.pandanpc-mcp', 'runtime'), `${process.platform}-${process.arch}`)
+}
+function readJson(file) { try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return null } }
+function writeJson(file, value) {
+  const temp = `${file}.${crypto.randomUUID()}.tmp`
+  try { fs.writeFileSync(temp, JSON.stringify(value), { mode: 0o600 }); fs.renameSync(temp, file) }
+  finally { try { fs.unlinkSync(temp) } catch {} }
+}
+function activeRuntime(root, bundledVersion = pkg.version, platform = process.platform) {
+  try {
+    const active = readJson(path.join(root, 'active.json'))
+    if (!active || !versionParts(active.version) || compareVersions(active.version, bundledVersion) <= 0) return null
+    if (!/^[a-zA-Z0-9.-]+$/.test(active.directory) || !active.directory.startsWith(active.version + '-')) return null
+    if (!/^[a-f0-9]{64}$/.test(active.checksum)) return null
+    const file = path.join(root, active.directory, binaryName(platform, active.version))
+    const stat = fs.lstatSync(file)
+    if (!stat.isFile() || stat.size <= 0 || stat.size > 64 * 1024 * 1024) return null
+    if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== active.checksum) return null
+    if (platform !== 'win32') fs.accessSync(file, fs.constants.X_OK)
+    return { file, version: active.version }
+  } catch { return null }
+}
+function selectRuntime({ root = cacheRoot(), bundledVersion = pkg.version, platform = process.platform, disabled = process.env.PANDANPC_MCP_AUTO_UPDATE === '0' } = {}) {
+  const bundled = { file: path.join(__dirname, 'bin', binaryName(platform, bundledVersion)), version: bundledVersion }
+  return (!disabled && activeRuntime(root, bundledVersion, platform)) || bundled
+}
+function due(root, now = Date.now()) {
+  const state = readJson(path.join(root, 'check.json'))
+  return !state || !Number.isFinite(state.nextCheck) || state.nextCheck <= now || state.nextCheck > now + INTERVAL
+}
+function acquireLock(root, now) {
+  const file = path.join(root, 'update.lock')
+  const nonce = crypto.randomUUID()
+  try {
+    const fd = fs.openSync(file, 'wx', 0o600)
+    try { fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, nonce })) } finally { fs.closeSync(fd) }
+    return () => { if (readJson(file)?.nonce === nonce) { try { fs.unlinkSync(file) } catch {} } }
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw error
+    // Reap only a dead owner, never an updater that is still running.
+    const first = fs.statSync(file)
+    const owner = readJson(file)
+    if (now - first.mtimeMs < 5 * 60 * 1000) return null
+    if (owner && Number.isInteger(owner.pid) && owner.pid > 0) {
+      try { process.kill(owner.pid, 0); return null } catch (e) { if (e.code !== 'ESRCH') return null }
+    }
+    // A concurrent reaper must not unlink a replacement lock.
+    const again = fs.statSync(file)
+    if (first.ino !== again.ino || first.mtimeMs !== again.mtimeMs) return null
+    fs.unlinkSync(file)
+    return null // next launch retries; don't race the replacement owner
+  }
+}
+function probeBinary(file) {
+  const r = spawnSync(file, ['--help'], { timeout: 5000, killSignal: 'SIGKILL', windowsHide: true, encoding: 'utf8', maxBuffer: 1024 * 1024 })
+  if (r.error || r.status !== 0) throw new Error('Downloaded runtime failed its startup check')
+}
+async function checkForUpdates(options = {}) {
+  const root = options.root || cacheRoot()
+  const bundledVersion = options.bundledVersion || pkg.version
+  const platform = options.platform || process.platform
+  const platformInfo = options.platformInfo || detectPlatform()
+  const fetchTextFn = options.fetchTextFn || fetchText
+  const now = (options.now || Date.now)()
+  fs.mkdirSync(root, { recursive: true, mode: 0o700 })
+  if (!options.force && !due(root, now)) return { status: 'throttled' }
+  const unlock = acquireLock(root, now)
+  if (!unlock) return { status: 'busy' }
+  let directory
+  try {
+    if (!options.force && !due(root, now)) return { status: 'throttled' }
+    writeJson(path.join(root, 'check.json'), { nextCheck: now + RETRY_INTERVAL })
+    const metadata = JSON.parse(await fetchTextFn(REGISTRY))
+    if (!versionParts(metadata.version)) throw new Error('Invalid release version')
+    const current = activeRuntime(root, bundledVersion, platform)
+    const currentVersion = current?.version || bundledVersion
+    if (compareVersions(metadata.version, currentVersion) <= 0) {
+      writeJson(path.join(root, 'check.json'), { nextCheck: now + INTERVAL })
+      return { status: 'current', version: currentVersion }
+    }
+    if (metadata.pandanpcUpdaterProtocol !== PROTOCOL) {
+      writeJson(path.join(root, 'check.json'), { nextCheck: now + INTERVAL, manualUpdateRequired: metadata.version })
+      return { status: 'manual-update-required', version: metadata.version }
+    }
+    const version = metadata.version
+    const name = `${version}-${crypto.randomUUID()}`
+    directory = path.join(root, name)
+    fs.mkdirSync(directory, { mode: 0o700 })
+    const file = path.join(directory, binaryName(platform, version))
+    const result = await ensureBinary({ key: platformInfo.key, artifactName: platformInfo.name, localBin: file, platform,
+      baseUrl: `https://cos.pandanpc.com/mcp-server/v${version}`, fetchTextFn,
+      ...(options.downloadFn ? { downloadFn: options.downloadFn } : {}), logger: quiet })
+    await (options.probeFn || probeBinary)(file)
+    const newer = activeRuntime(root, bundledVersion, platform)
+    if (newer && compareVersions(newer.version, version) >= 0) return { status: 'current', version: newer.version }
+    writeJson(path.join(root, 'active.json'), { version, directory: name, checksum: result.checksum })
+    directory = null // published versions may be in use; never delete them automatically
+    writeJson(path.join(root, 'check.json'), { nextCheck: now + INTERVAL })
+    return { status: 'ready', version }
+  } catch (error) {
+    return { status: 'failed', error: error.message }
+  } finally {
+    if (directory) fs.rmSync(directory, { recursive: true, force: true })
+    unlock()
+  }
+}
+function startBackgroundUpdate() {
+  if (process.env.PANDANPC_MCP_AUTO_UPDATE === '0') return
+  try {
+    if (!due(cacheRoot())) return
+    const child = spawn(process.execPath, [__filename], { detached: true, windowsHide: true, stdio: 'ignore' })
+    child.on('error', () => {})
+    child.unref()
+  } catch {} // updates must never prevent an MCP session from starting
+}
+if (require.main === module) checkForUpdates().catch(() => {})
+module.exports = { compareVersions, selectRuntime, checkForUpdates, startBackgroundUpdate }