@zhihand/mcp 0.33.0 → 0.33.1

package/bin/zhihand

@@ -30,7 +30,7 @@ import { fetchUserCredentials } from "../dist/core/ws.js";
 import { configureMCP, displayName } from "../dist/cli/mcp-config.js";
 
 const DEFAULT_ENDPOINT = "https://api.zhihand.com";
-const VERSION = "0.33.0";
+const VERSION = "0.33.1";
 
 const CLI_TOOL_MAP = {
   claude: "claudecode",
@@ -558,6 +558,9 @@ switch (command) {
     const { createControlCommand, createSystemCommand } = await import("../dist/core/command.js");
     const { fetchScreenshot, getSnapshotStaleThresholdMs } = await import("../dist/core/screenshot.js");
     const { fetchDeviceProfileOnce, extractStatic, computeCapabilities, formatDeviceStatus } = await import("../dist/core/device.js");
+    const { setDebugEnabled: setCoreDebug, setTimestampEnabled, log: coreLog } = await import("../dist/core/logger.js");
+    if (values.debug) setCoreDebug(true);
+    setTimestampEnabled(true);
 
     const KIND_CAPABILITY = {
       profile: "none", status: "none", screenshot: "screen", hid: "hid", system: "none",
@@ -633,17 +636,26 @@ switch (command) {
     const DAEMON_PORT = parseInt(process.env.ZHIHAND_PORT ?? "", 10) || 18686;
     const DAEMON_BASE = `http://127.0.0.1:${DAEMON_PORT}`;
     let daemonOk = false;
+    let daemonStatus = null;
     try {
       const resp = await fetch(`${DAEMON_BASE}/internal/status`, { signal: AbortSignal.timeout(2000) });
       daemonOk = resp.ok;
+      if (resp.ok) daemonStatus = await resp.json();
     } catch { /* daemon not reachable */ }
     if (!daemonOk) {
       console.error("❌ Daemon is not running. Start it first: zhihand start");
       process.exit(1);
     }
 
+    const testDbg = values.debug
+      ? (msg) => coreLog.debug(`[test] ${msg}`)
+      : () => {};
+
     // Execute command via daemon's /internal/exec endpoint
     async function execViaDaemon(command, timeoutMs = 10_000) {
+      const action = command?.payload?.action ?? command?.type ?? "?";
+      testDbg(`exec action=${action} timeout=${timeoutMs}ms`);
+      const t0 = Date.now();
       const resp = await fetch(`${DAEMON_BASE}/internal/exec`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -652,9 +664,12 @@ switch (command) {
       });
       if (!resp.ok) {
         const body = await resp.text();
+        testDbg(`exec FAILED ${resp.status} ${Date.now() - t0}ms`);
         throw new Error(`Daemon exec failed: ${resp.status} ${body}`);
       }
-      return resp.json();
+      const result = await resp.json();
+      testDbg(`exec done action=${action} acked=${result.acked} id=${result.id ?? "-"} ${Date.now() - t0}ms`);
+      return result;
     }
 
     const forceRun = values.force === true;
@@ -681,7 +696,11 @@ switch (command) {
 
     console.log("🔧 ZhiHand Device Test");
     console.log(`   Device: ${testConfig.credentialId}`);
-    console.log(`   Endpoint: ${testConfig.controlPlaneEndpoint}\n`);
+    console.log(`   Endpoint: ${testConfig.controlPlaneEndpoint}`);
+    if (daemonStatus) {
+      console.log(`   Daemon: v${daemonStatus.version} pid=${daemonStatus.pid} backend=${daemonStatus.backend ?? "none"}`);
+    }
+    console.log("");
 
     // Pre-fetch device profile
     let currentRawAttrs = {};

package/dist/core/logger.d.ts

@@ -1,12 +1,15 @@
 /**
  * Unified logger — all log output goes to stderr so stdout stays clean
- * for MCP JSON-RPC. Replaces ad-hoc process.stderr.write and dbg() calls
- * in core/ and tools/ code.
+ * for MCP JSON-RPC.
  *
- * The daemon has its own stdout-based log() in daemon/index.ts — that is
- * intentional (it writes to daemon.log). The daemon's debug logger
- * (daemon/logger.ts) remains for daemon-specific verbose output.
+ * All modules (core/, daemon/, tools/) should use this logger.
+ * The daemon's dbg() in daemon/logger.ts delegates here for the debug flag.
  */
+/**
+ * Redact sensitive tokens from log messages.
+ * Replaces Bearer tokens and controller_token values with <REDACTED>.
+ */
+export declare function redact(msg: string): string;
 export declare const log: {
     info: (...args: unknown[]) => void;
     warn: (...args: unknown[]) => void;
@@ -15,3 +18,5 @@ export declare const log: {
 };
 export declare function setDebugEnabled(v: boolean): void;
 export declare function isDebugEnabled(): boolean;
+/** Enable timestamps in log output (for daemon / CLI long-running processes). */
+export declare function setTimestampEnabled(v: boolean): void;

package/dist/core/logger.js

@@ -1,26 +1,50 @@
 /**
  * Unified logger — all log output goes to stderr so stdout stays clean
- * for MCP JSON-RPC. Replaces ad-hoc process.stderr.write and dbg() calls
- * in core/ and tools/ code.
+ * for MCP JSON-RPC.
  *
- * The daemon has its own stdout-based log() in daemon/index.ts — that is
- * intentional (it writes to daemon.log). The daemon's debug logger
- * (daemon/logger.ts) remains for daemon-specific verbose output.
+ * All modules (core/, daemon/, tools/) should use this logger.
+ * The daemon's dbg() in daemon/logger.ts delegates here for the debug flag.
  */
 let debugEnabled = false;
+let timestampEnabled = false;
+// ── Token redaction ──────────────────────────────────────
+const REDACT_PATTERNS = [
+    // Bearer tokens in headers / JSON
+    /(Bearer\s+)[^\s"',}]+/gi,
+    // controller_token in JSON / key=value
+    /(controller_token["']?\s*[:=]\s*["']?)[^\s"',}]+/gi,
+];
+/**
+ * Redact sensitive tokens from log messages.
+ * Replaces Bearer tokens and controller_token values with <REDACTED>.
+ */
+export function redact(msg) {
+    let result = msg;
+    for (const pattern of REDACT_PATTERNS) {
+        result = result.replace(pattern, "$1<REDACTED>");
+    }
+    return result;
+}
+// ── Logger ───────────────────────────────────────────────
+function prefix(level) {
+    if (timestampEnabled) {
+        return `[${new Date().toLocaleTimeString()}] [${level}] `;
+    }
+    return `[${level.padEnd(5)}] `;
+}
 export const log = {
     info: (...args) => {
-        process.stderr.write(`[info]  ${args.map(String).join(" ")}\n`);
+        process.stderr.write(`${prefix("info")}${redact(args.map(String).join(" "))}\n`);
     },
     warn: (...args) => {
-        process.stderr.write(`[warn]  ${args.map(String).join(" ")}\n`);
+        process.stderr.write(`${prefix("warn")}${redact(args.map(String).join(" "))}\n`);
     },
     error: (...args) => {
-        process.stderr.write(`[error] ${args.map(String).join(" ")}\n`);
+        process.stderr.write(`${prefix("error")}${redact(args.map(String).join(" "))}\n`);
     },
     debug: (...args) => {
         if (debugEnabled) {
-            process.stderr.write(`[debug] ${args.map(String).join(" ")}\n`);
+            process.stderr.write(`${prefix("debug")}${redact(args.map(String).join(" "))}\n`);
         }
     },
 };
@@ -30,3 +54,7 @@ export function setDebugEnabled(v) {
 export function isDebugEnabled() {
     return debugEnabled;
 }
+/** Enable timestamps in log output (for daemon / CLI long-running processes). */
+export function setTimestampEnabled(v) {
+    timestampEnabled = v;
+}

package/dist/core/ws.js

@@ -283,12 +283,15 @@ export async function fetchUserCredentials(endpoint, userId, controllerToken, on
 export async function waitForCommandAck(_config, options) {
     const timeoutMs = options.timeoutMs ?? 15_000;
     log.debug(`[ws-cmd] Waiting for ACK: commandId=${options.commandId}, timeout=${timeoutMs}ms`);
+    const t0 = Date.now();
     return new Promise((resolve, reject) => {
         const timeout = setTimeout(() => {
+            log.debug(`[ws-cmd] ACK timeout: commandId=${options.commandId} after ${Date.now() - t0}ms`);
             cleanup();
             resolve({ acked: false });
         }, timeoutMs);
         const unsubscribe = subscribeToCommandAck(options.commandId, (ackedCommand) => {
+            log.debug(`[ws-cmd] ACK received: commandId=${options.commandId} status=${ackedCommand.ack_status ?? "ok"} ${Date.now() - t0}ms`);
             cleanup();
             resolve({ acked: true, command: ackedCommand });
         });

package/dist/daemon/index.js

@@ -21,9 +21,9 @@ let activeBackend = null;
 let activeModel = null; // user-selected model alias, null = use default
 let isProcessing = false;
 const promptQueue = [];
+import { log as coreLog, setTimestampEnabled } from "../core/logger.js";
 function log(msg) {
-    const ts = new Date().toLocaleTimeString();
-    process.stdout.write(`[${ts}] ${msg}\n`);
+    coreLog.info(msg);
 }
 // ── Prompt Processing ──────────────────────────────────────
 async function processPrompt(config, prompt) {
@@ -106,7 +106,6 @@ function handleInternalAPI(req, res) {
     }
     // Execute command via daemon's WS (used by zhihand test)
     if (url === "/internal/exec" && req.method === "POST") {
-        dbg(`[api] POST /internal/exec`);
         let body = "";
         const MAX_BODY = 10 * 1024;
         req.on("data", (chunk) => {
@@ -118,19 +117,28 @@ function handleInternalAPI(req, res) {
             }
         });
         req.on("end", async () => {
+            const t0 = Date.now();
             try {
                 const { command, credentialId, timeoutMs } = JSON.parse(body);
+                const cmdType = command.type ?? "unknown";
+                const cmdAction = command.payload?.action ?? "-";
+                dbg(`[api] POST /internal/exec cred=${credentialId} type=${cmdType} action=${cmdAction} timeout=${timeoutMs ?? 10_000}ms`);
                 const cfg = resolveConfig(credentialId);
                 const effectiveTimeout = timeoutMs ?? 10_000;
                 const queued = await enqueueCommand(cfg, command);
+                dbg(`[api] /internal/exec enqueued id=${queued.id}`);
                 const ack = await waitForCommandAck(cfg, {
                     commandId: queued.id,
                     timeoutMs: effectiveTimeout,
                 });
+                const ms = Date.now() - t0;
+                const ackStatus = ack.acked ? (ack.command?.ack_status ?? "ok") : "timeout";
+                dbg(`[api] /internal/exec done id=${queued.id} acked=${ack.acked} status=${ackStatus} ${ms}ms`);
                 res.writeHead(200, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ id: queued.id, ...ack }));
             }
             catch (err) {
+                dbg(`[api] /internal/exec error: ${err.message} ${Date.now() - t0}ms`);
                 res.writeHead(500, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ error: err.message }));
             }
@@ -190,6 +198,7 @@ export function isAlreadyRunning() {
 }
 // ── Main Daemon Entry ──────���───────────────────────────────
 export async function startDaemon(options) {
+    setTimestampEnabled(true);
     if (options?.debug)
         setDebugEnabled(true);
     const port = options?.port ?? (parseInt(process.env.ZHIHAND_PORT ?? "", 10) || DEFAULT_PORT);

package/dist/daemon/logger.d.ts

@@ -1,10 +1,12 @@
 /**
  * Debug logger for ZhiHand daemon.
  *
- * Enable with `zhihand start --debug` to see detailed request/response,
- * CLI spawn args, stdin/stdout data, SSE events, and timing information.
+ * Delegates to core/logger.ts for the debug flag, redaction, and output.
+ * All output goes to stderr to keep stdout clean for MCP JSON-RPC.
+ *
+ * Enable with `zhihand start --debug`.
  */
 export declare function setDebugEnabled(enabled: boolean): void;
 export declare function isDebugEnabled(): boolean;
-/** Debug log — only outputs when --debug is active. */
+/** Debug log — only outputs when --debug is active. Writes to stderr with redaction. */
 export declare function dbg(msg: string): void;

package/dist/daemon/logger.js

@@ -1,22 +1,21 @@
 /**
  * Debug logger for ZhiHand daemon.
  *
- * Enable with `zhihand start --debug` to see detailed request/response,
- * CLI spawn args, stdin/stdout data, SSE events, and timing information.
+ * Delegates to core/logger.ts for the debug flag, redaction, and output.
+ * All output goes to stderr to keep stdout clean for MCP JSON-RPC.
+ *
+ * Enable with `zhihand start --debug`.
  */
-let debugEnabled = false;
+import { log, setDebugEnabled as coreSetDebug, isDebugEnabled as coreIsDebug, } from "../core/logger.js";
 export function setDebugEnabled(enabled) {
-    debugEnabled = enabled;
+    coreSetDebug(enabled);
 }
 export function isDebugEnabled() {
-    return debugEnabled;
-}
-function ts() {
-    return new Date().toLocaleTimeString();
+    return coreIsDebug();
 }
-/** Debug log — only outputs when --debug is active. */
+/** Debug log — only outputs when --debug is active. Writes to stderr with redaction. */
 export function dbg(msg) {
-    if (!debugEnabled)
+    if (!coreIsDebug())
         return;
-    process.stdout.write(`[${ts()}] [DEBUG] ${msg}\n`);
+    log.debug(msg);
 }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare const PACKAGE_VERSION = "0.33.0";
+export declare const PACKAGE_VERSION = "0.33.1";
 export declare function createServer(): McpServer;
 export declare function startStdioServer(): Promise<void>;

package/dist/index.js

@@ -8,7 +8,7 @@ import { handlePair } from "./tools/pair.js";
 import { resolveTargetDevice } from "./tools/resolve.js";
 import { buildControlToolDescription, buildSystemToolDescription, buildScreenshotToolDescription, formatDeviceStatus, extractDynamic, } from "./core/device.js";
 import { registry } from "./core/registry.js";
-export const PACKAGE_VERSION = "0.33.0";
+export const PACKAGE_VERSION = "0.33.1";
 function errorResult(message) {
     return { content: [{ type: "text", text: message }], isError: true };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhihand/mcp",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "private": false,
   "type": "module",
   "description": "ZhiHand MCP Server — phone control tools for Claude Code, Codex, Gemini CLI, and OpenClaw",