@wirecat/cli-core 0.453.0 → 0.454.0

package/CHANGELOG.md

@@ -7,6 +7,17 @@ shape of this file.
 
 ## Unreleased
 
+## 0.454.0 — 27.10.2026
+
+### Added
+
+- **`mcp server status` says what each logged-in browser app last did.** Each client in `clients` carries
+  `last_request_at` (its last MCP request of any kind, so an app that logged in has also reached the server),
+  `last_tool` and `last_tool_at` (its last `tools/call`) and `tool_calls_today` (calls since local midnight); `null`
+  and `0` for an app that has done nothing yet. The running server keeps them in `<token file>.activity.json`, mode
+  600, beside the token file: tool names and times only, never arguments or results, and a name that does not look
+  like a tool's is not kept. WireCat Desktop shows them as "last call 2 min ago · tg_read".
+
 ## 0.453.0 — 27.10.2026
 
 ### Added

package/dist/cli/mcp-server-command.js

@@ -36,7 +36,7 @@ const clientLines = (clients) => clients.length === 0
     ? ["No browser app is logged in."]
     : [
         `Logged-in apps (names are what each app calls itself): ${clients
-            .map((one) => `${one.claimedName === null ? "no name" : JSON.stringify(one.claimedName)} (${clock(one.lastLoginAt)})`)
+            .map((one) => `${one.claimedName === null ? "no name" : JSON.stringify(one.claimedName)} (${clock(one.lastLoginAt)}${one.lastTool && one.lastToolAt ? `; last call ${one.lastTool} at ${clock(one.lastToolAt)}, ${one.toolCallsToday} today` : ""})`)
             .join(", ")}.`,
     ];
 /**
@@ -155,6 +155,10 @@ export const mcpServerCommand = ({ example, defaultPort = MCP_HTTP_DEFAULT_PORT,
             clients: clients.map((client) => ({
                 claimed_name: client.claimedName,
                 last_login_at: client.lastLoginAt,
+                last_request_at: client.lastRequestAt,
+                last_tool: client.lastTool,
+                last_tool_at: client.lastToolAt,
+                tool_calls_today: client.toolCallsToday,
             })),
             log: httpLogFile(one.tokenFile),
         }, [

package/dist/mcp/http/activity.d.ts

@@ -0,0 +1,24 @@
+/** What each logged-in app did last, keyed by its client id. Tool names and times only: never arguments. */
+export interface ClientActivity {
+    lastRequestAt: string;
+    lastTool?: string;
+    lastToolAt?: string;
+    /** The local day `toolCalls` counts, `YYYY-MM-DD`. */
+    day: string;
+    toolCalls: number;
+}
+export type Activity = Record<string, ClientActivity>;
+export declare const httpActivityFile: (tokenFile: string) => string;
+export declare const localDay: (ms: number) => string;
+export declare const readActivity: (path: string) => Activity;
+/** The names of the tools a JSON-RPC body calls; a batch may call several. */
+export declare const calledTools: (body: unknown) => string[];
+/**
+ * Keeps the activity file of one running server. A call is written at once, so status shows it while the owner
+ * watches; other requests at most every two seconds. Its own file, not the token file: `mcp --revoke` rewrites that
+ * from another process.
+ */
+export declare const activityRecorder: (path: string, now?: () => number) => {
+    record: (clientId: string, tools: string[]) => void;
+    flush: () => void;
+};

package/dist/mcp/http/activity.js

@@ -0,0 +1,86 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+const WRITE_EVERY_MS = 2000;
+/** Any app may send any name; one that does not look like a tool's is not kept. */
+const TOOL_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+export const httpActivityFile = (tokenFile) => `${tokenFile.replace(/\.json$/, "")}.activity.json`;
+export const localDay = (ms) => {
+    const d = new Date(ms);
+    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+};
+export const readActivity = (path) => {
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+};
+/** The names of the tools a JSON-RPC body calls; a batch may call several. */
+export const calledTools = (body) => (Array.isArray(body) ? body : [body]).flatMap((message) => {
+    if (!message || typeof message !== "object")
+        return [];
+    const { method, params } = message;
+    const name = params?.name;
+    return method === "tools/call" && typeof name === "string" && TOOL_NAME.test(name) ? [name] : [];
+});
+/**
+ * Keeps the activity file of one running server. A call is written at once, so status shows it while the owner
+ * watches; other requests at most every two seconds. Its own file, not the token file: `mcp --revoke` rewrites that
+ * from another process.
+ */
+export const activityRecorder = (path, now = Date.now) => {
+    const activity = readActivity(path);
+    let timer;
+    const write = () => {
+        timer = undefined;
+        try {
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+            const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+            writeFileSync(temporary, JSON.stringify(activity), { mode: 0o600, flag: "wx" });
+            chmodSync(temporary, 0o600);
+            renameSync(temporary, path);
+        }
+        catch {
+            // Activity is a convenience for the owner; serving must not fail over it.
+        }
+    };
+    return {
+        record: (clientId, tools) => {
+            const at = now();
+            const iso = new Date(at).toISOString();
+            const day = localDay(at);
+            const before = activity[clientId];
+            const counted = before?.day === day ? before.toolCalls : 0;
+            const last = tools.at(-1);
+            activity[clientId] = {
+                lastRequestAt: iso,
+                day,
+                toolCalls: counted + tools.length,
+                ...(last
+                    ? { lastTool: last, lastToolAt: iso }
+                    : before?.lastTool
+                        ? { lastTool: before.lastTool, ...(before.lastToolAt ? { lastToolAt: before.lastToolAt } : {}) }
+                        : {}),
+            };
+            if (last) {
+                clearTimeout(timer);
+                write();
+            }
+            else if (!timer) {
+                timer = setTimeout(write, WRITE_EVERY_MS);
+                timer.unref();
+            }
+        },
+        flush: () => {
+            if (!timer)
+                return;
+            clearTimeout(timer);
+            write();
+        },
+    };
+};

package/dist/mcp/http/serve.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { createMcpHandler, getOAuthProtectedResourceMetadataUrl, hostHeaderValidationResponse, isLegacyRequest, oauthMetadataResponse, requireBearerAuth, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
 import { CliError } from "@wirecat/cli-base";
 import { listen } from "../../http/listen.js";
+import { activityRecorder, calledTools, httpActivityFile } from "./activity.js";
 import { ownerLogin } from "./oauth.js";
 import { httpLock } from "./state.js";
 export const MCP_PATH = "/mcp";
@@ -74,6 +75,16 @@ const metadataRequest = (request, path, base) => {
     url.pathname = inserted ? AS_METADATA : path;
     return new Request(url, { method: request.method, headers: request.headers });
 };
+const toolsIn = async (request) => {
+    if (request.method !== "POST")
+        return [];
+    try {
+        return calledTools(await request.clone().json());
+    }
+    catch {
+        return [];
+    }
+};
 /**
  * MCP over Streamable HTTP on 127.0.0.1, behind the owner's tunnel (CLI-58). Every MCP request needs
  * a token from the owner login; the Host header must be the tunnel's or this machine's, so a page in
@@ -116,6 +127,7 @@ export const serveOverHttp = async (build, options) => {
         verifier: login.verifier,
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resource),
     });
+    const activity = activityRecorder(httpActivityFile(tokenFile), now);
     const allowedHosts = [...new Set([publicUrl.hostname, ...LOCAL])];
     const allowedOrigins = [publicUrl.origin];
     const listening = await listen(async (request) => {
@@ -145,6 +157,7 @@ export const serveOverHttp = async (build, options) => {
         const auth = await bearer(request);
         if (auth instanceof Response)
             return auth;
+        activity.record(auth.clientId, await toolsIn(request));
         return (await isLegacyRequest(request)) ? legacy.handle(request, auth) : mcp.fetch(request, { authInfo: auth });
     }, { host: "127.0.0.1", port }).catch((error) => {
         login.close();
@@ -156,6 +169,7 @@ export const serveOverHttp = async (build, options) => {
         url: listening.url,
         close: async () => {
             login.close();
+            activity.flush();
             try {
                 await listening.close();
                 await legacy.close();

package/dist/mcp/http/state.d.ts

@@ -44,6 +44,11 @@ export interface SignedInClient {
     /** What the app said its name was when it registered — anyone may register, so it proves nothing. */
     claimedName: string | null;
     lastLoginAt: string;
+    /** Any MCP request with its token, so the app reached the server after logging in. */
+    lastRequestAt: string | null;
+    lastTool: string | null;
+    lastToolAt: string | null;
+    toolCallsToday: number;
 }
 /**
  * The apps that hold a token now, and when each last got one. Ids and hashes stay in the file: what

package/dist/mcp/http/state.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { holdLock, readLock, releaseLock, takeLock } from "../../background/lock.js";
+import { httpActivityFile, localDay, readActivity } from "./activity.js";
 export const ACCESS_SECONDS = 60 * 60;
 export const REFRESH_SECONDS = 30 * 24 * 60 * 60;
 export const readStored = (path) => existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : { clients: [], tokens: [] };
@@ -32,6 +33,8 @@ export const httpLock = (path, first) => {
 export const signedInClients = (tokenFile, now = Date.now()) => {
     const seconds = Math.floor(now / 1000);
     const { clients, tokens } = readStored(tokenFile);
+    const activity = readActivity(httpActivityFile(tokenFile));
+    const today = localDay(now);
     const last = new Map();
     for (const token of tokens) {
         if (token.expiresAt <= seconds)
@@ -41,9 +44,16 @@ export const signedInClients = (tokenFile, now = Date.now()) => {
     }
     return clients
         .filter((client) => last.has(client.id))
-        .map((client) => ({
-        claimedName: client.name ?? null,
-        lastLoginAt: new Date((last.get(client.id) ?? 0) * 1000).toISOString(),
-    }))
+        .map((client) => {
+        const did = activity[client.id];
+        return {
+            claimedName: client.name ?? null,
+            lastLoginAt: new Date((last.get(client.id) ?? 0) * 1000).toISOString(),
+            lastRequestAt: did?.lastRequestAt ?? null,
+            lastTool: did?.lastTool ?? null,
+            lastToolAt: did?.lastToolAt ?? null,
+            toolCallsToday: did?.day === today ? did.toolCalls : 0,
+        };
+    })
         .sort((a, b) => b.lastLoginAt.localeCompare(a.lastLoginAt));
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.453.0",
+  "version": "0.454.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",