@unson/brainbase-mcp 0.6.0 → 0.8.0

package/dist/streamable-http.js

@@ -0,0 +1,288 @@
+import { randomUUID } from 'node:crypto';
+import { createServer as createHttpServer } from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+const DEFAULT_BODY_LIMIT_BYTES = 1024 * 1024;
+const DEFAULT_MCP_PATH = '/mcp';
+const DEFAULT_HEALTH_PATH = '/health';
+class BodyLimitError extends Error {
+    constructor() {
+        super('Request body exceeds the configured limit');
+        this.name = 'BodyLimitError';
+    }
+}
+class InvalidJsonError extends Error {
+    constructor() {
+        super('Parse error: Invalid JSON');
+        this.name = 'InvalidJsonError';
+    }
+}
+function jsonRpcError(code, message) {
+    return {
+        jsonrpc: '2.0',
+        error: { code, message },
+        id: null
+    };
+}
+function writeJson(response, statusCode, body, headers = {}) {
+    if (response.headersSent)
+        return;
+    response.statusCode = statusCode;
+    response.setHeader('Content-Type', 'application/json');
+    for (const [name, value] of Object.entries(headers))
+        response.setHeader(name, value);
+    response.end(JSON.stringify(body));
+}
+function requestPath(request) {
+    try {
+        return new URL(request.url ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return '/';
+    }
+}
+function headerValue(request, name) {
+    const value = request.headers[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
+async function readJsonBody(request, limitBytes) {
+    const contentLengthHeader = headerValue(request, 'content-length');
+    if (contentLengthHeader !== undefined) {
+        const contentLength = Number(contentLengthHeader);
+        if (Number.isFinite(contentLength) && contentLength > limitBytes) {
+            request.resume();
+            throw new BodyLimitError();
+        }
+    }
+    const chunks = [];
+    let totalBytes = 0;
+    await new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => {
+            request.removeListener('data', onData);
+            request.removeListener('end', onEnd);
+            request.removeListener('error', onError);
+            request.removeListener('aborted', onAborted);
+        };
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const onData = (chunk) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalBytes += buffer.byteLength;
+            if (totalBytes > limitBytes) {
+                request.resume();
+                finish(new BodyLimitError());
+                return;
+            }
+            chunks.push(buffer);
+        };
+        const onEnd = () => finish();
+        const onError = () => finish(new Error('Request body could not be read'));
+        const onAborted = () => finish(new Error('Request was aborted'));
+        request.on('data', onData);
+        request.once('end', onEnd);
+        request.once('error', onError);
+        request.once('aborted', onAborted);
+    });
+    if (chunks.length === 0)
+        throw new InvalidJsonError();
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new InvalidJsonError();
+    }
+}
+function assignAuth(request, auth) {
+    const authenticatedRequest = request;
+    if (auth !== undefined)
+        authenticatedRequest.auth = auth;
+    return authenticatedRequest;
+}
+export function createStreamableHttpHandler(dependencies) {
+    const bodyLimitBytes = dependencies.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES;
+    const mcpPath = dependencies.mcpPath ?? DEFAULT_MCP_PATH;
+    const healthPath = dependencies.healthPath ?? DEFAULT_HEALTH_PATH;
+    if (!Number.isInteger(bodyLimitBytes) || bodyLimitBytes <= 0) {
+        throw new Error('bodyLimitBytes must be a positive integer');
+    }
+    const sessions = new Map();
+    const closeServer = async (session) => {
+        if (session.serverClosePromise)
+            return session.serverClosePromise;
+        session.serverCloseStarted = true;
+        session.serverClosePromise = session.server.close();
+        await session.serverClosePromise;
+    };
+    const disposeSession = async (session) => {
+        if (session.id)
+            sessions.delete(session.id);
+        if (session.closed && session.serverCloseStarted) {
+            await session.serverClosePromise;
+            return;
+        }
+        session.closed = true;
+        try {
+            await session.transport.close();
+        }
+        finally {
+            await closeServer(session);
+        }
+    };
+    const createSession = async (scope) => {
+        const server = await dependencies.createServer(scope);
+        let session;
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: randomUUID,
+            enableJsonResponse: true,
+            onsessioninitialized: (id) => {
+                session.id = id;
+                sessions.set(id, session);
+            },
+            onsessionclosed: (id) => {
+                sessions.delete(id);
+                session.closed = true;
+            }
+        });
+        session = {
+            server,
+            transport,
+            closed: false,
+            serverCloseStarted: false
+        };
+        transport.onclose = () => {
+            session.closed = true;
+            if (session.id)
+                sessions.delete(session.id);
+            void closeServer(session).catch(() => undefined);
+        };
+        await server.connect(transport);
+        return session;
+    };
+    const resolveScope = async (request, auth, sessionId, requestId) => {
+        const base = {
+            requestId,
+            method: request.method ?? 'GET',
+            path: requestPath(request),
+            ...(auth === undefined ? {} : { auth }),
+            ...(sessionId === undefined ? {} : { sessionId })
+        };
+        const custom = await dependencies.requestScope?.({ request, requestId, auth, sessionId });
+        return custom ? { ...base, ...custom } : base;
+    };
+    const handle = async (request, response) => {
+        const path = requestPath(request);
+        const requestId = randomUUID();
+        if (path === healthPath && request.method === 'GET') {
+            try {
+                const result = await dependencies.health?.({ request, requestId });
+                writeJson(response, 200, result ?? { status: 'ok' });
+            }
+            catch {
+                writeJson(response, 503, { status: 'unavailable' });
+            }
+            return;
+        }
+        if (path !== mcpPath) {
+            writeJson(response, 404, { error: 'Not Found' });
+            return;
+        }
+        if (request.method === 'GET') {
+            writeJson(response, 405, jsonRpcError(-32000, 'GET is not supported'), { Allow: 'POST, DELETE' });
+            return;
+        }
+        if (request.method !== 'POST' && request.method !== 'DELETE') {
+            writeJson(response, 405, jsonRpcError(-32000, 'Method not allowed'), { Allow: 'POST, DELETE' });
+            return;
+        }
+        let auth;
+        if (dependencies.authenticate) {
+            try {
+                const authenticated = await dependencies.authenticate(request);
+                if (authenticated === null) {
+                    writeJson(response, 401, jsonRpcError(-32000, 'Unauthorized'), { 'WWW-Authenticate': 'Bearer' });
+                    return;
+                }
+                auth = authenticated;
+            }
+            catch {
+                writeJson(response, 401, jsonRpcError(-32000, 'Unauthorized'), { 'WWW-Authenticate': 'Bearer' });
+                return;
+            }
+        }
+        const sessionId = headerValue(request, 'mcp-session-id');
+        let session = sessionId ? sessions.get(sessionId) : undefined;
+        if (sessionId && !session) {
+            writeJson(response, 404, jsonRpcError(-32001, 'Session not found'));
+            return;
+        }
+        try {
+            const body = request.method === 'POST' ? await readJsonBody(request, bodyLimitBytes) : undefined;
+            const scope = await resolveScope(request, auth, sessionId, requestId);
+            if (!session)
+                session = await createSession(scope);
+            let aborted = false;
+            const onClose = () => {
+                if (!response.writableFinished) {
+                    aborted = true;
+                    if (session)
+                        void disposeSession(session).catch(() => undefined);
+                }
+            };
+            response.once('close', onClose);
+            try {
+                await session.transport.handleRequest(assignAuth(request, auth), response, body);
+            }
+            finally {
+                response.removeListener('close', onClose);
+            }
+            // An uninitialized, stateless request creates no session and must not leak
+            // its server. Initialized sessions remain available for list/call/delete.
+            if (!session.transport.sessionId && !sessionId && !aborted)
+                await disposeSession(session);
+        }
+        catch (error) {
+            if (response.headersSent) {
+                if (!response.writableEnded)
+                    response.destroy();
+                return;
+            }
+            if (error instanceof BodyLimitError) {
+                writeJson(response, 413, jsonRpcError(-32013, error.message));
+                return;
+            }
+            if (error instanceof InvalidJsonError) {
+                writeJson(response, 400, jsonRpcError(-32700, error.message));
+                return;
+            }
+            writeJson(response, 500, jsonRpcError(-32603, 'Internal server error'));
+        }
+    };
+    return {
+        handle,
+        close: async () => {
+            await Promise.all([...sessions.values()].map((session) => disposeSession(session)));
+            sessions.clear();
+        },
+        get activeSessionCount() {
+            return sessions.size;
+        }
+    };
+}
+export function createStreamableHttpServer(dependencies) {
+    const handler = createStreamableHttpHandler(dependencies);
+    const server = createHttpServer((request, response) => {
+        void handler.handle(request, response);
+    });
+    server.once('close', () => {
+        void handler.close().catch(() => undefined);
+    });
+    return server;
+}

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import type { FoundationDefinition, FoundationRelationReference, FoundationRevision } from './ontology-foundation.js';
 export type EntityKind = 'person' | 'org' | 'project' | 'relationship' | 'decision';
 export type CanonicalEntityKind = 'person' | 'org' | 'project' | 'decision';
 export type CoreRelation = 'member_of' | 'participates_in' | 'accountable_for' | 'owned_by' | 'governs' | 'supersedes';
@@ -43,6 +44,24 @@ export interface CanonicalEdge {
         evidenceHash?: string;
     };
 }
+/**
+ * Versioned definitions that extend the historical Graph v2 contract.
+ *
+ * This is deliberately an extension of the canonical aggregate rather than a
+ * second objectives/world-model file.  The old Graph entities and edges keep
+ * their historical interpretation; foundation records are validated by their
+ * own shared ontology contract.
+ */
+export interface FoundationCatalogRecord {
+    definition: FoundationDefinition;
+    digest: string;
+}
+export interface FoundationCatalog {
+    version: 1;
+    records: FoundationCatalogRecord[];
+    latest: Record<string, FoundationRevision>;
+    relations: FoundationRelationReference[];
+}
 export interface GraphFileV2 {
     version: 2;
     ontology: {
@@ -57,6 +76,7 @@ export interface GraphFileV2 {
     };
     entities: CanonicalEntity[];
     edges: CanonicalEdge[];
+    foundation?: FoundationCatalog;
 }
 export type GraphFile = GraphFileV1 | GraphFileV2;
 export type CanonicalGraphFile = GraphFile;

package/dist/value-proof-review-http.d.ts

@@ -0,0 +1,25 @@
+import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+export declare const VALUE_PROOF_REVIEW_HTTP_VERSION: "value-proof-review-http.v1";
+export declare const VALUE_PROOF_REVIEW_TOKEN_HEADER = "x-brainbase-review-token";
+export interface ValueProofReviewHttpOptions {
+    /** Judgment journal root. Defaults to `~/.brainbase/personal-os/judgment-journal`. */
+    readonly journalRoot?: string;
+    /** Personal OS data directory that stores owner feedback. */
+    readonly dataDir?: string;
+    /** Required on mutating requests. */
+    readonly token: string;
+    readonly basePath?: string;
+    readonly now?: () => Date;
+}
+export type ValueProofReviewHttpHandler = (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+export declare function createValueProofReviewHttpHandler(options: ValueProofReviewHttpOptions): ValueProofReviewHttpHandler;
+export interface ValueProofReviewHostOptions extends Omit<ValueProofReviewHttpOptions, 'token'> {
+    readonly token?: string;
+    /** Directory containing the packaged `ui/` files. */
+    readonly uiDir?: string;
+}
+/** Local single-owner host. The caller owns `listen()` and must bind to a loopback address. */
+export declare function createValueProofReviewHost(options?: ValueProofReviewHostOptions): {
+    readonly server: Server;
+    readonly token: string;
+};

package/dist/value-proof-review-http.js

@@ -0,0 +1,185 @@
+import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildJudgmentValueProofReviewHome, readJudgmentValueProofFeedback, readJudgmentValueProofJournal, recordJudgmentValueProofFeedback } from './judgment-value-proof-review.js';
+import { assertSameOrigin, isLoopbackHost, LOCAL_WEB_CONTENT_SECURITY_POLICY, LocalWebHttpError as HttpError, readJsonObjectBody, requestUrl, tokenMatches, writeHttpError as writeError, writeJson } from './local-web-security.js';
+export const VALUE_PROOF_REVIEW_HTTP_VERSION = 'value-proof-review-http.v1';
+export const VALUE_PROOF_REVIEW_TOKEN_HEADER = 'x-brainbase-review-token';
+const DEFAULT_BASE_PATH = '/api/value-proofs';
+const MAX_BODY_BYTES = 16 * 1024;
+// The review part imports the shared screen pattern (workspace-kit), which reads the shared tokens.
+const UI_FILES = Object.freeze({
+    '/ui/brainbase-tokens.css': { file: 'brainbase-tokens.css', type: 'text/css; charset=utf-8' },
+    '/ui/workspace-kit.js': { file: 'workspace-kit.js', type: 'text/javascript; charset=utf-8' },
+    '/ui/workspace-kit.css': { file: 'workspace-kit.css', type: 'text/css; charset=utf-8' },
+    '/ui/value-proof-review.js': { file: 'value-proof-review.js', type: 'text/javascript; charset=utf-8' },
+    '/ui/value-proof-review.css': { file: 'value-proof-review.css', type: 'text/css; charset=utf-8' }
+});
+function publicHome(home) {
+    if (home.status === 'unavailable')
+        return home;
+    const strip = (items) => Object.fromEntries(Object.entries(items).map(([section, list]) => [
+        section,
+        list.map(({ section: itemSection, proof, feedback_history }) => ({ section: itemSection, proof, feedback_history }))
+    ]));
+    return {
+        status: home.status,
+        root: home.root,
+        coverage: home.coverage,
+        sections: strip(home.sections),
+        // Holds only decision IDs, counts and states; no local paths.
+        delegation_map: home.delegation_map,
+        rejected: home.rejected.map((entry) => ({ file: relative(home.root, entry.file), reason: entry.reason }))
+    };
+}
+export function createValueProofReviewHttpHandler(options) {
+    if (typeof options.token !== 'string' || options.token.length < 16) {
+        throw new TypeError('token must be at least 16 characters');
+    }
+    const basePath = (options.basePath ?? DEFAULT_BASE_PATH).replace(/\/+$/u, '');
+    const now = options.now ?? (() => new Date());
+    async function readHome() {
+        const journal = await readJudgmentValueProofJournal({ root: options.journalRoot });
+        const feedback = journal.status === 'available'
+            ? await readJudgmentValueProofFeedback({ dataDir: options.dataDir })
+            : [];
+        return buildJudgmentValueProofReviewHome(journal, feedback, { now: now() });
+    }
+    async function recordFeedback(request) {
+        assertSameOrigin(request);
+        if (!tokenMatches(options.token, request.headers[VALUE_PROOF_REVIEW_TOKEN_HEADER])) {
+            throw new HttpError(403, 'review_token_required', 'A valid review token is required');
+        }
+        const body = await readJsonObjectBody(request, MAX_BODY_BYTES);
+        const intentId = typeof body.intent_id === 'string' ? body.intent_id : '';
+        const attemptId = typeof body.decision_attempt_id === 'string' ? body.decision_attempt_id : '';
+        const journal = await readJudgmentValueProofJournal({ root: options.journalRoot });
+        if (journal.status === 'unavailable') {
+            throw new HttpError(503, 'judgment_journal_unavailable', journal.reason);
+        }
+        const known = journal.entries.some((entry) => entry.proof.intent_id === intentId
+            && entry.proof.decision_attempt_id === attemptId);
+        if (!known)
+            throw new HttpError(404, 'value_proof_not_found', 'No saved value proof matches this decision');
+        try {
+            const result = await recordJudgmentValueProofFeedback({
+                dataDir: options.dataDir,
+                intent_id: intentId,
+                decision_attempt_id: attemptId,
+                status: body.status,
+                summary: typeof body.summary === 'string' ? body.summary : null,
+                target_layer: typeof body.target_layer === 'string' ? body.target_layer : null,
+                now: now()
+            });
+            return { statusCode: result.created ? 201 : 200, body: result };
+        }
+        catch (error) {
+            if (error instanceof TypeError)
+                throw new HttpError(400, 'invalid_feedback', error.message);
+            throw error;
+        }
+    }
+    return async (request, response) => {
+        const path = requestUrl(request).pathname;
+        if (path !== `${basePath}/home` && path !== `${basePath}/feedback`)
+            return false;
+        try {
+            if (path === `${basePath}/home`) {
+                if (request.method !== 'GET')
+                    throw new HttpError(405, 'method_not_allowed', 'Use GET');
+                writeJson(response, 200, publicHome(await readHome()));
+                return true;
+            }
+            if (request.method !== 'POST')
+                throw new HttpError(405, 'method_not_allowed', 'Use POST');
+            const result = await recordFeedback(request);
+            writeJson(response, result.statusCode, result.body);
+        }
+        catch (error) {
+            if (error instanceof HttpError)
+                writeError(response, error);
+            else
+                writeJson(response, 500, { error: { code: 'internal_error', message: 'Unexpected error' } });
+        }
+        return true;
+    };
+}
+function escapeAttribute(value) {
+    return value.replace(/[&"<>]/gu, (character) => ({ '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' }[character] ?? character));
+}
+function shellHtml(token, basePath) {
+    return `<!doctype html>
+<html lang="ja">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="brainbase-review-token" content="${escapeAttribute(token)}">
+<meta name="brainbase-review-base-path" content="${escapeAttribute(basePath)}">
+<title>Brainbase 判断の見返し</title>
+<link rel="stylesheet" href="/ui/brainbase-tokens.css">
+<link rel="stylesheet" href="/ui/workspace-kit.css">
+<link rel="stylesheet" href="/ui/value-proof-review.css">
+</head>
+<body>
+<main id="brainbase-value-proof-review"></main>
+<script type="module" src="/app.js"></script>
+</body>
+</html>
+`;
+}
+const BOOTSTRAP_JS = `import { createValueProofReviewUI } from '/ui/value-proof-review.js';
+const meta = (name) => document.querySelector(\`meta[name="\${name}"]\`)?.getAttribute('content') ?? '';
+createValueProofReviewUI({
+  root: document.getElementById('brainbase-value-proof-review'),
+  basePath: meta('brainbase-review-base-path'),
+  token: meta('brainbase-review-token')
+});
+`;
+/** Local single-owner host. The caller owns `listen()` and must bind to a loopback address. */
+export function createValueProofReviewHost(options = {}) {
+    const token = options.token ?? randomBytes(24).toString('base64url');
+    const basePath = (options.basePath ?? DEFAULT_BASE_PATH).replace(/\/+$/u, '');
+    const uiDir = options.uiDir ?? fileURLToPath(new URL('../ui/', import.meta.url));
+    const handler = createValueProofReviewHttpHandler({ ...options, token, basePath });
+    const server = createServer((request, response) => {
+        void (async () => {
+            if (!isLoopbackHost(request)) {
+                writeJson(response, 403, { error: { code: 'host_rejected', message: 'Host must be a loopback address for this server' } });
+                return;
+            }
+            if (await handler(request, response))
+                return;
+            const path = requestUrl(request).pathname;
+            if (request.method !== 'GET') {
+                writeJson(response, 405, { error: { code: 'method_not_allowed', message: 'Use GET' } });
+                return;
+            }
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            if (path === '/') {
+                response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                response.setHeader('Content-Security-Policy', LOCAL_WEB_CONTENT_SECURITY_POLICY);
+                response.setHeader('Referrer-Policy', 'no-referrer');
+                response.end(shellHtml(token, basePath));
+                return;
+            }
+            if (path === '/app.js') {
+                response.setHeader('Content-Type', 'text/javascript; charset=utf-8');
+                response.end(BOOTSTRAP_JS);
+                return;
+            }
+            const asset = UI_FILES[path];
+            if (!asset) {
+                writeJson(response, 404, { error: { code: 'not_found', message: 'Not found' } });
+                return;
+            }
+            response.setHeader('Content-Type', asset.type);
+            response.end(await readFile(join(uiDir, asset.file)));
+        })().catch(() => {
+            writeJson(response, 500, { error: { code: 'internal_error', message: 'Unexpected error' } });
+        });
+    });
+    return { server, token };
+}