@profullstack/builtindie 0.0.0-stage → 0.1.3

package/src/mcp.ts

@@ -0,0 +1,79 @@
+/**
+ * `builtindie mcp`: built.indie for an agent, on stdio.
+ *
+ *   claude mcp add builtindie -- bunx @profullstack/builtindie mcp
+ *
+ * Reading, launching and voting need nothing. Claiming and editing need
+ * BUILTINDIE_KEY: an account API key from built.indie.pit.world/me.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
+import { z } from 'zod'
+import { BuiltIndieClient } from './client.js'
+import { VERSION } from './version.js'
+
+const text = (value: unknown) => ({ content: [{ type: 'text', text: JSON.stringify(value, null, 2) }] })
+const failure = (error: unknown) => ({ isError: true, content: [{ type: 'text', text: error instanceof Error ? error.message : String(error) }] })
+const slug = z.string().min(1).max(60).describe('A product slug, e.g. linear (built.indie/p/linear)')
+const wrap = <A,>(fn: (a: A) => Promise<unknown>) => async (a: A) => {
+  try {
+    return text(await fn(a))
+  } catch (e) {
+    return failure(e)
+  }
+}
+
+export function createMcpServer(client = new BuiltIndieClient()): McpServer {
+  const server: any = new McpServer({ name: 'built.indie', version: VERSION })
+  server.tool(
+    'launch_product',
+    'Launch a product on built.indie from its URL. We read the homepage (meta tags, Open Graph, JSON-LD, llms.txt, opensite.json, openprofile.md), save the logo and screenshots and put it on today\'s board. Free. To edit it later, the domain owner claims it (claim_product).',
+    {
+      url: z.string().min(3).describe('The product homepage, e.g. yourproduct.com'),
+      maker_name: z.string().max(60).optional(),
+      maker_profile: z.string().optional().describe("The maker's OpenProfile.md URL (logicsrc.com/openprofile)"),
+      tagline: z.string().max(90).optional().describe('Override the tagline we find'),
+      publish: z.boolean().optional().describe('Go live now (default true); false leaves a draft to check'),
+    },
+    wrap((a: { url: string; maker_name?: string; maker_profile?: string; tagline?: string; publish?: boolean }) => client.launch(a.url, { makerName: a.maker_name, makerProfile: a.maker_profile, tagline: a.tagline, publish: a.publish })),
+  )
+  server.tool('preview_site', 'Read any site the way built.indie does (name, tagline, description, logo, screenshots, videos, socials, llms.txt, OpenProfile) without saving anything.', { url: z.string().min(3) }, wrap((a: { url: string }) => client.preview(a.url)))
+  server.tool(
+    'list_products',
+    'Products launched on built.indie, best first: today, week, month, all, new (newest first) or featured.',
+    { window: z.enum(['today', 'week', 'month', 'all', 'new', 'featured']).default('today'), limit: z.number().int().min(1).max(100).default(20) },
+    wrap((a: { window: string; limit: number }) => client.list(a.window, a.limit)),
+  )
+  server.tool('get_product', 'Everything about one launch: description, pictures, videos, socials, maker, votes, award.', { slug }, wrap((a: { slug: string }) => client.product(a.slug)))
+  server.tool('search', 'Search launches by name, tagline, domain or tag.', { query: z.string().min(1).max(60) }, wrap((a: { query: string }) => client.search(a.query)))
+  server.tool('upvote', 'Upvote a product (one vote per visitor).', { slug }, wrap((a: { slug: string }) => client.vote(a.slug)))
+  server.tool(
+    'edit_product',
+    'Change a launch you claimed or submitted (needs BUILTINDIE_KEY). Any field left out stays as it is. refetch reads the homepage again; publish puts a draft live.',
+    {
+      slug,
+      name: z.string().max(60).optional(),
+      tagline: z.string().max(90).optional(),
+      description: z.string().max(1200).optional(),
+      tags: z.array(z.string()).max(6).optional(),
+      videos: z.array(z.string()).max(4).optional().describe('YouTube, Vimeo, Loom or .mp4 links'),
+      action: z.enum(['save', 'refetch', 'publish']).default('save'),
+    },
+    wrap(async (a: { slug: string; action: string; name?: string; tagline?: string; description?: string; tags?: string[]; videos?: string[] }) => {
+      if (a.action !== 'save') return client.act(a.slug, a.action as 'publish' | 'refetch')
+      return client.edit(a.slug, { name: a.name, tagline: a.tagline, description: a.description, tags: a.tags, videos: a.videos })
+    }),
+  )
+  server.tool(
+    'claim_product',
+    'Claim a listing for its domain owner (needs BUILTINDIE_KEY). Returns the DNS TXT record to add, plus `markdown`: step-by-step instructions for whoever has DNS access. Call again once it is in DNS and claimed comes back true.',
+    { slug },
+    wrap((a: { slug: string }) => client.claim(a.slug)),
+  )
+  server.tool('my_products', 'Your launches and claims (needs BUILTINDIE_KEY).', {}, wrap(() => client.me()))
+  return server
+}
+
+export async function runMcp(client = new BuiltIndieClient()): Promise<void> {
+  await createMcpServer(client).connect(new StdioServerTransport())
+}

package/src/media.ts

@@ -0,0 +1,160 @@
+/**
+ * Pictures we keep: a product's logo, its card image, its screenshots and one
+ * screenshot of the homepage we take ourselves. Hot-linking breaks the day a
+ * maker redesigns, and our CSP allows images only from ourselves, so every
+ * picture is downloaded once, checked by its first bytes, and served from
+ * /m/<product>/<file>.
+ *
+ * The homepage screenshot is headless Chrome. When we run as root it runs as
+ * `nobody`, with its own throwaway profile, so a hostile page renders with no
+ * privileges; Chrome's Local Network Access keeps the page off our loopback.
+ */
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { normalizeUrl, safeFetch, type FetchOptions } from './fetch.js'
+
+export const IMAGE_TYPES: Record<string, string> = {
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  avif: 'image/avif',
+  ico: 'image/x-icon',
+  svg: 'image/svg+xml',
+}
+
+/** The image kind by its first bytes, or null when it is not a picture we serve. */
+export function sniff(b: Uint8Array): string | null {
+  const at = (i: number, ...v: number[]) => v.every((x, j) => b[i + j] === x)
+  if (at(0, 0x89, 0x50, 0x4e, 0x47)) return 'png'
+  if (at(0, 0xff, 0xd8, 0xff)) return 'jpg'
+  if (at(0, 0x47, 0x49, 0x46, 0x38)) return 'gif'
+  if (at(0, 0x52, 0x49, 0x46, 0x46) && at(8, 0x57, 0x45, 0x42, 0x50)) return 'webp'
+  if (at(4, 0x66, 0x74, 0x79, 0x70) && /^(avif|avis)/.test(String.fromCharCode(...b.slice(8, 12)))) return 'avif'
+  if (at(0, 0x00, 0x00, 0x01, 0x00)) return 'ico'
+  const head = new TextDecoder().decode(b.slice(0, 512)).trimStart().toLowerCase()
+  if (head.startsWith('<svg') || (head.startsWith('<?xml') && head.includes('<svg'))) return 'svg'
+  return null
+}
+
+/** Pixel size of a PNG, JPEG, GIF or WebP from its header; null when we cannot tell. */
+export function dimensions(b: Uint8Array, kind: string): { width: number; height: number } | null {
+  const v = new DataView(b.buffer, b.byteOffset, b.byteLength)
+  try {
+    if (kind === 'png') return { width: v.getUint32(16), height: v.getUint32(20) }
+    if (kind === 'gif') return { width: v.getUint16(6, true), height: v.getUint16(8, true) }
+    if (kind === 'webp') {
+      const chunk = String.fromCharCode(...b.slice(12, 16))
+      if (chunk === 'VP8 ') return { width: v.getUint16(26, true) & 0x3fff, height: v.getUint16(28, true) & 0x3fff }
+      if (chunk === 'VP8L') {
+        const bits = v.getUint32(21, true)
+        return { width: (bits & 0x3fff) + 1, height: ((bits >> 14) & 0x3fff) + 1 }
+      }
+      if (chunk === 'VP8X') return { width: 1 + (b[24]! | (b[25]! << 8) | (b[26]! << 16)), height: 1 + (b[27]! | (b[28]! << 8) | (b[29]! << 16)) }
+    }
+    if (kind === 'jpg') {
+      let i = 2
+      while (i < b.length - 9) {
+        if (b[i] !== 0xff) return null
+        const marker = b[i + 1]!
+        const len = v.getUint16(i + 2)
+        if (marker >= 0xc0 && marker <= 0xcf && ![0xc4, 0xc8, 0xcc].includes(marker)) return { width: v.getUint16(i + 7), height: v.getUint16(i + 5) }
+        i += 2 + len
+      }
+    }
+  } catch {}
+  return null
+}
+
+export type Saved = { file: string; width: number | null; height: number | null }
+
+export class Media {
+  constructor(readonly dir: string) {}
+
+  path(productId: string, file: string): string {
+    return join(this.dir, productId, file)
+  }
+
+  /** Download one picture into the product's folder. Null when it is missing, too big or not an image. */
+  async save(productId: string, name: string, url: string | null, o: FetchOptions & { minSide?: number } = {}): Promise<Saved | null> {
+    if (!url) return null
+    try {
+      const r = await safeFetch(url, { ...o, accept: 'image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8', maxBytes: 6 * 1024 * 1024, timeoutMs: 10_000 })
+      if (r.status >= 300) return null
+      const kind = sniff(r.body)
+      if (!kind) return null
+      const size = dimensions(r.body, kind)
+      if (o.minSide && size && Math.min(size.width, size.height) < o.minSide) return null
+      return await this.write(productId, `${name}.${kind}`, r.body, size)
+    } catch {
+      return null
+    }
+  }
+
+  async write(productId: string, file: string, body: Uint8Array, size: { width: number; height: number } | null = null): Promise<Saved> {
+    await mkdir(join(this.dir, productId), { recursive: true })
+    await writeFile(this.path(productId, file), body)
+    return { file, width: size?.width ?? null, height: size?.height ?? null }
+  }
+
+  async read(productId: string, file: string): Promise<Uint8Array | null> {
+    if (!/^[A-Za-z0-9_-]{6,40}$/.test(productId) || !/^[a-z0-9-]{1,40}\.(png|jpg|gif|webp|avif|ico|svg)$/.test(file)) return null
+    try {
+      return new Uint8Array(await readFile(this.path(productId, file)))
+    } catch {
+      return null
+    }
+  }
+
+  async remove(productId: string): Promise<void> {
+    if (/^[A-Za-z0-9_-]{6,40}$/.test(productId)) await rm(join(this.dir, productId), { recursive: true, force: true })
+  }
+}
+
+const CHROMES = ['/usr/bin/google-chrome', '/usr/bin/google-chrome-stable', '/usr/bin/chromium', '/usr/bin/chromium-browser', '/snap/bin/chromium', '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome']
+
+export function findChrome(): string | null {
+  const own = process.env.BUILTINDIE_CHROME
+  if (own === 'off') return null
+  if (own) return own
+  return CHROMES.find((c) => existsSync(c)) ?? null
+}
+
+let queue: Promise<unknown> = Promise.resolve()
+
+/** A 1280×800 PNG of the page, or null. One at a time: Chrome is the heaviest thing we run. */
+export function screenshot(url: string, chrome = findChrome(), timeoutMs = 35_000): Promise<Uint8Array | null> {
+  if (!chrome) return Promise.resolve(null)
+  const target = normalizeUrl(url).href
+  const run = async (): Promise<Uint8Array | null> => {
+    const dir = await mkdtemp(join(tmpdir(), 'builtindie-shot-'))
+    try {
+      const root = process.getuid?.() === 0
+      if (root) await chmod(dir, 0o777)
+      const args = [
+        '--headless=new', '--disable-gpu', '--hide-scrollbars', '--mute-audio', '--no-first-run', '--no-default-browser-check',
+        '--disable-extensions', '--disable-sync', '--disable-background-networking', '--deny-permission-prompts',
+        `--user-data-dir=${join(dir, 'profile')}`, '--window-size=1280,800', '--virtual-time-budget=6000', `--screenshot=${join(dir, 'shot.png')}`, target,
+      ]
+      // runuser lives in /usr/sbin, which a service's PATH often leaves out.
+      const runuser = ['/usr/sbin/runuser', '/sbin/runuser', '/usr/bin/runuser'].find((p) => existsSync(p)) ?? 'runuser'
+      const [cmd, argv] = root ? [runuser, ['-u', 'nobody', '--', '/usr/bin/env', `HOME=${dir}`, chrome, ...args]] : [chrome, args]
+      await new Promise<void>((resolve) => {
+        const child = spawn(cmd, argv as string[], { stdio: 'ignore' })
+        const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs)
+        child.on('exit', () => (clearTimeout(timer), resolve()))
+        child.on('error', () => (clearTimeout(timer), resolve()))
+      })
+      const png = new Uint8Array(await readFile(join(dir, 'shot.png')).catch(() => Buffer.alloc(0)))
+      return sniff(png) === 'png' ? png : null
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => {})
+    }
+  }
+  const next = queue.then(run, run)
+  queue = next.catch(() => null)
+  return next
+}

package/src/ring.ts

@@ -0,0 +1,86 @@
+/**
+ * The Moshpit ring bar: the thin strip across the top of every page that links
+ * this site to the others on the ring (https://pit.world/ring).
+ *
+ * pit.world owns the member list. We read https://pit.world/api/ring every ten
+ * minutes in the background and draw the bar ourselves, so a page never waits
+ * on pit.world and needs no script or CSP exception; until the first read (or
+ * if pit.world is down) the list below is used.
+ *
+ * A Moshpit name opens only for a visitor on Moshpit DNS. Everyone else reaches
+ * it through pit.world's relay, https://<name>.pit.world/, which (like the
+ * registry gateway) tells us so with an x-moshpit-name header. So: a request for
+ * our own name without that header came from Moshpit DNS and gets direct links;
+ * anything else gets relay links.
+ *
+ * Same file in seo.rank, family.ancestry and pay.agent; pit.world has the original in src/ring.ts.
+ */
+const RING_HOME = 'https://pit.world/ring'
+const RING_API = 'https://pit.world/api/ring'
+const relayUrl = (name: string) => `https://${name}.pit.world/`
+export const RING_PLACEHOLDER = '<!--ring-bar-->'
+
+export type RingSite = { name: string; about: string; moshpit: boolean }
+
+let sites: RingSite[] = [
+  { name: 'pit.world', about: 'Private search, and the front door of the Moshpit network.', moshpit: false },
+  { name: 'seo.rank', about: 'Free, open-source on-page SEO audit. API, CLI and MCP.', moshpit: true },
+  { name: 'family.ancestry', about: 'Your family tree, on your own name. Import GEDCOM, share by link.', moshpit: true },
+]
+
+const ESC: Record<string, string> = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }
+const esc = (value: unknown) => String(value ?? '').replace(/[&<>"']/g, (c) => ESC[c]!)
+
+export function ringSites(): RingSite[] {
+  return sites
+}
+
+/** Replace the member list from an /api/ring document; a malformed one is ignored. */
+export function setRing(doc: unknown): boolean {
+  const list = (doc as { sites?: unknown })?.sites
+  if (!Array.isArray(list)) return false
+  const next = list
+    .filter((s) => s && typeof s.name === 'string' && /^[a-z0-9.-]{1,253}$/.test(s.name))
+    .map((s) => ({ name: s.name as string, about: String(s.about ?? '').slice(0, 200), moshpit: s.moshpit === true }))
+  if (!next.length) return false
+  sites = next
+  return true
+}
+
+/** Refresh from pit.world now and every `everyMs`. Failures keep the last good list. */
+export function startRingRefresh(fetchImpl: typeof fetch = fetch, everyMs = 10 * 60_000): () => void {
+  const refresh = () =>
+    fetchImpl(RING_API, { signal: AbortSignal.timeout(5000) })
+      .then((r) => (r.ok ? r.json() : null))
+      .then((doc) => doc && setRing(doc))
+      .catch(() => {})
+  refresh()
+  const timer = setInterval(refresh, everyMs)
+  timer.unref?.()
+  return () => clearInterval(timer)
+}
+
+/** True when the request reached us by our own Moshpit name, not through the gateway. */
+export function visitorOnMoshpit(self: string, host: string | undefined, gatewayHeader: string | undefined): boolean {
+  return !gatewayHeader && String(host ?? '').toLowerCase().replace(/:\d+$/, '') === self
+}
+
+export function siteHref(site: RingSite, direct: boolean): string {
+  return site.moshpit && !direct ? relayUrl(site.name) : `https://${site.name}/`
+}
+
+export function ringBar(self: string, direct: boolean): string {
+  const at = sites.findIndex((s) => s.name === self)
+  const i = at < 0 ? 0 : at
+  const prev = sites[(i - 1 + sites.length) % sites.length]!
+  const next = sites[(i + 1) % sites.length]!
+  const link = (s: RingSite, text = s.name) =>
+    `<a href="${esc(siteHref(s, direct))}"${s.name === self ? ' aria-current="page"' : ''} title="${esc(s.about)}">${esc(text)}</a>`
+  return `<nav class="ring-bar" aria-label="Moshpit ring">
+  <a class="ring-home" href="${RING_HOME}">◉ <span>Moshpit </span>ring</a>
+  ${link(prev, `‹ ${prev.name}`)}
+  <span class="ring-sites">${sites.map((s) => link(s)).join('')}</span>
+  ${link(next, `${next.name} ›`)}
+  <a href="${RING_HOME}/random?from=${encodeURIComponent(self)}${direct ? '&amp;direct=1' : ''}">random</a>
+</nav>`
+}