@rotifer/mcp-server 0.17.0 → 0.19.0

package/dist/telemetry/config.js

@@ -0,0 +1,128 @@
+/**
+ * Storage and consent state for the anonymous usage heartbeat (ADR-329).
+ *
+ * Lives in ~/.rotifer/telemetry.json, shared in practice with
+ * rotifer-playground on the same machine: both processes read and write this
+ * file, so a machine_id minted by one is picked up by the other rather than
+ * each inventing its own. The on-disk shape (enabled / machine_id /
+ * consent_source / first_run_notice_shown / updated_at) is copied field-for-
+ * field from playground's src/telemetry/config.ts — keep the two in sync, or
+ * one process's write starts looking like corruption to the other's reader.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { telemetryOptedOutByEnv, telemetryExplicitlyOnByEnv } from "./consent.js";
+const ROTIFER_HOME = join(process.env.HOME || process.env.USERPROFILE || "/tmp", ".rotifer");
+const TELEMETRY_CONFIG_FILE = "telemetry.json";
+// mcp-server has no equivalent of playground's utils/private-fs.ts — this is
+// that module's two functions, copied rather than imported (again: separate
+// npm packages). Kept deliberately this small; if a third file in this
+// package ever needs the same thing, promote it to its own module then.
+function ensurePrivateDir(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true, mode: 0o700 });
+    }
+    try {
+        chmodSync(dirPath, 0o700);
+    }
+    catch {
+        // Best-effort hardening on existing directories.
+    }
+}
+function tightenPrivateFile(filePath, mode = 0o600) {
+    try {
+        chmodSync(filePath, mode);
+    }
+    catch {
+        // Best-effort hardening on files that were just created or updated.
+    }
+}
+function telemetryConfigPath() {
+    return join(ROTIFER_HOME, TELEMETRY_CONFIG_FILE);
+}
+function readStoredConfig() {
+    const p = telemetryConfigPath();
+    if (!existsSync(p))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(p, "utf-8"));
+        if (typeof parsed.machine_id !== "string" || !parsed.machine_id)
+            return null;
+        return {
+            enabled: parsed.enabled !== false,
+            machine_id: parsed.machine_id,
+            consent_source: parsed.consent_source ?? "default-notice",
+            first_run_notice_shown: parsed.first_run_notice_shown === true,
+            updated_at: parsed.updated_at ?? new Date(0).toISOString(),
+        };
+    }
+    catch {
+        // Corrupt file: treated as absent, a fresh machine_id is minted. Losing
+        // continuity once is an acceptable cost; refusing to run telemetry at
+        // all until a human fixes the file is not — this is opt-out telemetry.
+        return null;
+    }
+}
+function writeStoredConfig(config) {
+    ensurePrivateDir(ROTIFER_HOME);
+    const p = telemetryConfigPath();
+    writeFileSync(p, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+    tightenPrivateFile(p);
+}
+/**
+ * Reads the stored config, minting one (with a fresh machine_id) on first
+ * ever call. Cheap and idempotent — no reason to cache across calls within a
+ * process; a concurrent `rotifer telemetry off` run from the CLI on the same
+ * machine should be picked up by the next tool call, not shadowed by a stale
+ * in-memory copy held by a long-lived MCP server process.
+ */
+export function loadOrInitHeartbeatConfig() {
+    const existing = readStoredConfig();
+    if (existing)
+        return existing;
+    const fresh = {
+        enabled: true,
+        machine_id: randomUUID(),
+        consent_source: "default-notice",
+        first_run_notice_shown: false,
+        updated_at: new Date().toISOString(),
+    };
+    writeStoredConfig(fresh);
+    return fresh;
+}
+/**
+ * Persists that the notice has now been shown — separated from printing/
+ * returning it (heartbeat.ts) so the persistence, which must happen exactly
+ * once and survive even if the network call that follows fails, is not
+ * tangled up with how the notice reaches the user.
+ */
+export function markFirstRunNoticeShown(config) {
+    if (config.first_run_notice_shown)
+        return;
+    writeStoredConfig({ ...config, first_run_notice_shown: true, updated_at: new Date().toISOString() });
+}
+/**
+ * Resolution order, mirrored in TELEMETRY.md and kept in sync deliberately:
+ *   DO_NOT_TRACK / ROTIFER_TELEMETRY (env, either direction) > stored choice
+ *   > default on.
+ *
+ * The heartbeat's default is the opposite of the signed-in invocation
+ * report's (default-off) on purpose — see migration 20260830010000's header
+ * in rotifer-playground: this table carries no per-row accountability to
+ * protect, and default-off here would just reproduce the blind spot
+ * ADR-329 exists to close.
+ */
+export function resolveHeartbeatDecision(config, env = process.env) {
+    if (telemetryOptedOutByEnv(env))
+        return "off-env";
+    if (telemetryExplicitlyOnByEnv(env))
+        return "on-env";
+    if (!config.enabled)
+        return "off-stored";
+    return config.consent_source === "default-notice" ? "on-default" : "on-stored";
+}
+export function heartbeatDecisionEnabled(d) {
+    return d === "on-env" || d === "on-stored" || d === "on-default";
+}
+//# sourceMappingURL=config.js.map

package/dist/telemetry/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/telemetry/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAElF,MAAM,YAAY,GAAG,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,EACrD,UAAU,CACX,CAAC;AACF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,OAAe,KAAK;IAChE,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAeD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAA6B,CAAC;QAChF,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,gBAAgB;YACzD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,KAAK,IAAI;YAC9D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB;IAChD,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,kBAAkB,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,KAAK,GAAoB;QAC7B,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,UAAU,EAAE;QACxB,cAAc,EAAE,gBAAgB;QAChC,sBAAsB,EAAE,KAAK;QAC7B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,IAAI,MAAM,CAAC,sBAAsB;QAAE,OAAO;IAC1C,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,0BAA0B,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IACzC,OAAO,MAAM,CAAC,cAAc,KAAK,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAoB;IAC3D,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,YAAY,CAAC;AACnE,CAAC"}

package/dist/telemetry/consent.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The one environment-variable check both telemetry paths share.
+ *
+ * Mirrors rotifer-playground's src/telemetry/consent.ts exactly — same
+ * logic, independently implemented because these are two separate npm
+ * packages that cannot import each other's source. If this file and that one
+ * ever diverge, fix both; a user who sets ROTIFER_TELEMETRY=0 expects it to
+ * mean "off" from whichever binary they happen to be running.
+ *
+ * ADR-329's decision is explicit: "ROTIFER_TELEMETRY=0 同时关闭匿名信号与
+ * 登录上报——「关掉」意味着全部，与 316 的语义一致." Before this module
+ * existed, ROTIFER_TELEMETRY was checked in exactly one place here
+ * (cloud.ts's telemetryOptedOut, for the signed-in invocation/download
+ * reports). Adding the anonymous heartbeat with its own copy of that check
+ * would have been the easy path and the wrong one.
+ *
+ * DO_NOT_TRACK is the cross-tool convention (https://consoledonottrack.com/)
+ * and is new here — it outranks ROTIFER_TELEMETRY because it is a stance the
+ * user took before ever hearing of this project.
+ */
+export declare function telemetryOptedOutByEnv(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * True when the environment explicitly asked for telemetry (as opposed to
+ * "unset, so whatever the default is"). An explicit ROTIFER_TELEMETRY=1
+ * should win even over a stored "disabled" choice — a per-shell override
+ * should not require first running a separate command to change stored state.
+ */
+export declare function telemetryExplicitlyOnByEnv(env?: NodeJS.ProcessEnv): boolean;

package/dist/telemetry/consent.js

@@ -0,0 +1,40 @@
+/**
+ * The one environment-variable check both telemetry paths share.
+ *
+ * Mirrors rotifer-playground's src/telemetry/consent.ts exactly — same
+ * logic, independently implemented because these are two separate npm
+ * packages that cannot import each other's source. If this file and that one
+ * ever diverge, fix both; a user who sets ROTIFER_TELEMETRY=0 expects it to
+ * mean "off" from whichever binary they happen to be running.
+ *
+ * ADR-329's decision is explicit: "ROTIFER_TELEMETRY=0 同时关闭匿名信号与
+ * 登录上报——「关掉」意味着全部，与 316 的语义一致." Before this module
+ * existed, ROTIFER_TELEMETRY was checked in exactly one place here
+ * (cloud.ts's telemetryOptedOut, for the signed-in invocation/download
+ * reports). Adding the anonymous heartbeat with its own copy of that check
+ * would have been the easy path and the wrong one.
+ *
+ * DO_NOT_TRACK is the cross-tool convention (https://consoledonottrack.com/)
+ * and is new here — it outranks ROTIFER_TELEMETRY because it is a stance the
+ * user took before ever hearing of this project.
+ */
+export function telemetryOptedOutByEnv(env = process.env) {
+    const dnt = (env.DO_NOT_TRACK || "").trim().toLowerCase();
+    if (dnt !== "" && dnt !== "0" && dnt !== "false")
+        return true;
+    const flag = (env.ROTIFER_TELEMETRY || "").trim().toLowerCase();
+    return flag === "0" || flag === "false" || flag === "off";
+}
+/**
+ * True when the environment explicitly asked for telemetry (as opposed to
+ * "unset, so whatever the default is"). An explicit ROTIFER_TELEMETRY=1
+ * should win even over a stored "disabled" choice — a per-shell override
+ * should not require first running a separate command to change stored state.
+ */
+export function telemetryExplicitlyOnByEnv(env = process.env) {
+    if (telemetryOptedOutByEnv(env))
+        return false;
+    const flag = (env.ROTIFER_TELEMETRY || "").trim().toLowerCase();
+    return flag !== "" && flag !== "0" && flag !== "false" && flag !== "off";
+}
+//# sourceMappingURL=consent.js.map

package/dist/telemetry/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/telemetry/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3E,CAAC"}

package/dist/telemetry/heartbeat.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reports one Gene invocation's worth of activity for this machine, today,
+ * on the given channel. Fire-and-forget; every failure mode is silence.
+ *
+ * Returns the first-run notice text exactly once — the first time a report
+ * for this machine is actually about to leave the process, never before (a
+ * machine whose heartbeat is off, by env or stored choice, must never be
+ * told "we're about to collect data" for data that in fact never leaves it)
+ * — and null every other time, including every call after the first.
+ */
+export declare function recordHeartbeat(channel: string): string | null;

package/dist/telemetry/heartbeat.js

@@ -0,0 +1,90 @@
+/**
+ * Anonymous usage heartbeat (ADR-329).
+ *
+ * Answers a narrower question than the signed-in invocation report: not "who
+ * called what", just "did this machine run something today, and through
+ * which channel". No identity, on by default, and it costs nothing to lose
+ * one — this is not §33.4 input, so unlike logGeneInvocation's report this
+ * file tracks no in-flight requests for anything to await. A dropped
+ * heartbeat is not a hole in an audited ledger, it is one machine's "active
+ * today" signal that will show up again tomorrow if the machine is still in
+ * use.
+ *
+ * The one thing genuinely different from playground's version of this file:
+ * the first-run notice cannot go to stderr here. stderr is where CLI users
+ * look and exactly where MCP hosts do not — nobody reads a long-lived MCP
+ * server's stderr stream in normal use. So recordHeartbeat() *returns* the
+ * notice text instead of printing it, and the caller (server.ts) folds it
+ * into the tool response the user's client will actually render.
+ */
+import { loadCloudConfig } from "../cloud.js";
+import { getPackageVersion } from "../version.js";
+import { loadOrInitHeartbeatConfig, resolveHeartbeatDecision, heartbeatDecisionEnabled, markFirstRunNoticeShown, } from "./config.js";
+const FIRST_RUN_NOTICE = "Anonymous usage heartbeat is on by default — no code, no identity, just " +
+    '"this machine ran something today". Set ROTIFER_TELEMETRY=0 or DO_NOT_TRACK=1 ' +
+    "to disable. Details: https://rotifer.dev/telemetry";
+/**
+ * Reports one Gene invocation's worth of activity for this machine, today,
+ * on the given channel. Fire-and-forget; every failure mode is silence.
+ *
+ * Returns the first-run notice text exactly once — the first time a report
+ * for this machine is actually about to leave the process, never before (a
+ * machine whose heartbeat is off, by env or stored choice, must never be
+ * told "we're about to collect data" for data that in fact never leaves it)
+ * — and null every other time, including every call after the first.
+ */
+export function recordHeartbeat(channel) {
+    // The whole body is one try/catch, deliberately wider than the network
+    // call — loadOrInitHeartbeatConfig()/markFirstRunNoticeShown() write to
+    // ~/.rotifer/telemetry.json, and a tool call failing because this
+    // fire-and-forget signal couldn't touch the filesystem would be a much
+    // worse trade than just not sending a heartbeat this once.
+    try {
+        const config = loadOrInitHeartbeatConfig();
+        const decision = resolveHeartbeatDecision(config);
+        if (!heartbeatDecisionEnabled(decision))
+            return null;
+        // Persisted synchronously, before the fetch below, so a crash mid-request
+        // can never cause the notice to be owed again on the next call.
+        let notice = null;
+        if (!config.first_run_notice_shown) {
+            notice = FIRST_RUN_NOTICE;
+            markFirstRunNoticeShown(config);
+        }
+        const cloudConfig = loadCloudConfig();
+        const url = `${cloudConfig.endpoint.replace(/\/+$/, "")}/rest/v1/rpc/record_heartbeat`;
+        // No Authorization header: record_heartbeat is anon-callable by design
+        // (playground migration 20260830010000) — that grant is the entire point
+        // of ADR-329. Sending credentials here would be pointless (the RPC does
+        // not use them) and would defeat the "no identity" promise for a caller
+        // who happens to be signed in but hasn't opted into the invocation report.
+        fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", apikey: cloudConfig.anonKey },
+            body: JSON.stringify({
+                p_machine_id: config.machine_id,
+                p_channel: channel,
+                p_client_version: getPackageVersion(),
+                p_invocation_delta: 1,
+            }),
+        })
+            .then((res) => {
+            if (!res.ok && process.env.ROTIFER_DEBUG) {
+                process.stderr.write(`[rotifer] record_heartbeat failed (${res.status})\n`);
+            }
+        })
+            .catch((err) => {
+            if (process.env.ROTIFER_DEBUG) {
+                process.stderr.write(`[rotifer] record_heartbeat error: ${err?.message ?? err}\n`);
+            }
+        });
+        return notice;
+    }
+    catch (err) {
+        if (process.env.ROTIFER_DEBUG) {
+            process.stderr.write(`[rotifer] record_heartbeat setup error: ${err?.message ?? err}\n`);
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=heartbeat.js.map

package/dist/telemetry/heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.js","sourceRoot":"","sources":["../../src/telemetry/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GACpB,0EAA0E;IAC1E,gFAAgF;IAChF,oDAAoD,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,uEAAuE;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACnC,MAAM,GAAG,gBAAgB,CAAC;YAC1B,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC;QAEvF,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,KAAK,CAAC,GAAG,EAAE;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE;YAC5E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,YAAY,EAAE,MAAM,CAAC,UAAU;gBAC/B,SAAS,EAAE,OAAO;gBAClB,gBAAgB,EAAE,iBAAiB,EAAE;gBACrC,kBAAkB,EAAE,CAAC;aACtB,CAAC;SACH,CAAC;aACC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAsC,GAAa,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;QAEL,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA4C,GAAa,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -1,4 +1,10 @@
+export declare function getConfigDir(): string;
 export declare function getPackageVersion(): string;
+export declare function compareSemver(a: string, b: string): number;
+/** A live registry lookup, bypassing the 24h cache in getVersionInfo().
+ *  `self-update` needs the truth at the moment the user asked, not a cached
+ *  answer from yesterday. */
+export declare function fetchLatestVersion(): Promise<string | null>;
 export interface VersionInfo {
     current: string;
     latest: string | null;

package/dist/version.js

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 const __dirname = fileURLToPath(new URL(".", import.meta.url));
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
-function getConfigDir() {
+export function getConfigDir() {
     return process.env.ROTIFER_CONFIG_DIR || join(homedir(), ".config", "rotifer");
 }
 function getCacheFile() {
@@ -17,7 +17,7 @@ export function getPackageVersion() {
     const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version;
 }
-function compareSemver(a, b) {
+export function compareSemver(a, b) {
     const pa = a.split(".").map(Number);
     const pb = b.split(".").map(Number);
     for (let i = 0; i < 3; i++) {
@@ -45,7 +45,10 @@ function writeCache(cache) {
     }
     catch { /* non-critical */ }
 }
-async function fetchLatestVersion() {
+/** A live registry lookup, bypassing the 24h cache in getVersionInfo().
+ *  `self-update` needs the truth at the moment the user asked, not a cached
+ *  answer from yesterday. */
+export async function fetchLatestVersion() {
     try {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAMvC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE;YAChF,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0B,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,MAAM,GAAkB,IAAI,CAAC;QAEjC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAC9D,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACpC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;gBACpD,UAAU,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAEtE,OAAO;YACL,OAAO;YACP,MAAM;YACN,eAAe,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,OAAO,+BAA+B,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,MAAM,qBAAqB;QACtF,kDAAkD,CAAC;AACvD,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAMvC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAChC,CAAC;AAED;;6BAE6B;AAC7B,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE;YAChF,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0B,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,MAAM,GAAkB,IAAI,CAAC;QAEjC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAC9D,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACpC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;gBACpD,UAAU,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAEtE,OAAO;YACL,OAAO;YACP,MAAM;YACN,eAAe,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,OAAO,+BAA+B,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,MAAM,qBAAqB;QACtF,kDAAkD,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rotifer/mcp-server",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "mcpName": "io.github.rotifer-protocol/mcp-server",
   "description": "Rotifer MCP Server — AI agents search, compare, and rank Genes (modular AI skills) from a living ecosystem of 50+ capabilities. Zero config.",
   "type": "module",
@@ -52,7 +52,8 @@
   },
   "overrides": {
     "qs": "^6.15.2",
-    "hono": "^4.12.26"
+    "hono": "^4.12.26",
+    "fast-uri": "^3.1.7"
   },
   "engines": {
     "node": ">=20"