agentschat-mcp 0.34.0 → 0.35.0

package/codex/config.ts

@@ -0,0 +1,85 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { validateIdentityProfile } from "../src/identity.ts";
+import { parse as parseToml } from "smol-toml";
+
+export interface BridgeConfig {
+  cwd: string; profileFile: string; source: string; agentId: string; token: string;
+  apiUrl: string; wsUrl: string; channels: string[]; senders: string[];
+  codexBin: string; stateDir: string;
+}
+export interface IdentitySettings { profile?: string; agent_id?: string; channels?: string[]; senders?: string[]; api_url?: string; ws_url?: string }
+function readJson(file: string): any {
+  try { return JSON.parse(readFileSync(file, "utf8")); }
+  catch { throw new Error(`Cannot read valid JSON: ${file}`); }
+}
+function strings(value: unknown, name: string): string[] {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.some(x => typeof x !== "string" || !x.trim()))
+    throw new Error(`${name} must be an array of nonempty strings`);
+  return value;
+}
+export function resolveConfig(opts: { cwd?: string; profile?: string; codexBin?: string; settings?: IdentitySettings },
+  env: NodeJS.ProcessEnv = process.env, home = homedir()): BridgeConfig {
+  const cwd = realpathSync(opts.cwd ?? process.cwd());
+  const configFile = join(cwd, ".agentschat/config.json");
+  const project = opts.settings ?? (existsSync(configFile) ? readJson(configFile) : {});
+  if (!project || typeof project !== "object" || Array.isArray(project)) throw new Error("Invalid project config");
+  const allowed = new Set(["profile", "agent_id", "channels", "senders", "api_url", "ws_url"]);
+  if (Object.keys(project).some(k => !allowed.has(k))) throw new Error("Unknown project config field (credentials belong in a private profile)");
+  for (const k of ["profile", "agent_id", "api_url", "ws_url"])
+    if (project[k] !== undefined && (typeof project[k] !== "string" || !project[k].trim())) throw new Error(`Invalid project ${k}`);
+  const localProfile = join(cwd, ".agentschat/profile.json");
+  // Read only the project file, not Codex's merged global config. Identity lookup
+  // must not execute the configured MCP command or inherit its token overrides.
+  let codexProfile: string | undefined;
+  const codexFile = join(cwd, ".codex/config.toml");
+  if (opts.settings === undefined && existsSync(codexFile)) {
+    let doc: any;
+    try { doc = parseToml(readFileSync(codexFile, "utf8")); }
+    catch { throw new Error("Invalid project .codex/config.toml"); }
+    const mcp = doc.mcp_servers?.agentschat;
+    if (mcp && mcp.enabled !== false) {
+      const args = Array.isArray(mcp.args) ? mcp.args : [];
+      const index = args.indexOf("--profile");
+      codexProfile = mcp.env?.AGENTSCHAT_PROFILE ?? mcp.env?.AGENTCHAT_PROFILE ?? (index >= 0 ? args[index + 1] : undefined);
+      if ((index >= 0 || codexProfile !== undefined) && (typeof codexProfile !== "string" || !codexProfile.trim() || codexProfile.startsWith("--"))) throw new Error("Invalid project MCP profile selector");
+    }
+  }
+  const choices = [
+    [opts.profile, "flag"], [project.profile, "project-config"],
+    [opts.settings === undefined && existsSync(localProfile) ? localProfile : undefined, "project-profile"],
+    [codexProfile, "project-codex"],
+    [env.AGENTSCHAT_PROFILE, "env"], [env.AGENTCHAT_PROFILE, "legacy-env"], ["profile", "default"],
+  ];
+  const [selector, source] = choices.find(([v]) => v !== undefined && v !== "") as [string, string];
+  let profileFile: string;
+  if (selector.startsWith("~/")) profileFile = join(home, selector.slice(2));
+  else if (isAbsolute(selector) || selector.includes("/")) profileFile = resolve(cwd, selector);
+  else {
+    const name = selector.endsWith(".json") ? selector : `${selector}.json`;
+    profileFile = join(home, ".agentschat/profiles", name);
+    if (!existsSync(profileFile)) profileFile = join(home, ".agentschat", name);
+    if (!existsSync(profileFile)) profileFile = join(home, ".agentchat", name);
+  }
+  if (!existsSync(profileFile)) throw new Error(`Selected profile missing: ${profileFile}; no identity fallback or registration`);
+  if (process.platform !== "win32" && (statSync(profileFile).mode & 0o077)) throw new Error(`Profile must be private (chmod 600): ${profileFile}`);
+  const profile = readJson(profileFile);
+  validateIdentityProfile(profile, profileFile);
+  if (project.agent_id !== undefined && project.agent_id !== profile.agent_id) throw new Error("Project agent_id does not match selected profile");
+  const apiUrl = project.api_url ?? "https://agents-chat.com";
+  const wsUrl = project.ws_url ?? `${apiUrl.replace(/^http/, "ws").replace(/\/$/, "")}/ws`;
+  for (const [raw, protocols] of [[apiUrl, ["https:", "http:"]], [wsUrl, ["wss:", "ws:"]]] as const) {
+    const url = new URL(raw);
+    if (!(protocols as readonly string[]).includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+      (!url.protocol.endsWith("s:") && !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))) throw new Error("Server URLs must use TLS (except loopback) and contain no credentials/query");
+  }
+  const canonicalApi = new URL(apiUrl).href.replace(/\/$/, "");
+  const key = createHash("sha256").update(JSON.stringify([cwd, canonicalApi, profile.agent_id])).digest("hex").slice(0, 24);
+  return { cwd, profileFile, source, agentId: profile.agent_id, token: profile.token,
+    apiUrl: canonicalApi, wsUrl, channels: strings(project.channels, "channels"),
+    senders: strings(project.senders, "senders"), codexBin: opts.codexBin ?? "codex",
+    stateDir: join(home, ".agentschat/codex-bridge", key) };
+}

package/codex/manager.ts

@@ -0,0 +1,81 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import { mkdirSync, openSync, closeSync, readFileSync, writeFileSync, unlinkSync, existsSync, renameSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+import { createHash } from "node:crypto";
+import { parseArgs } from "node:util";
+import { loadBots, defaultRegistry, type BotConfig } from "./bots-config.ts";
+import { codexPresent } from "./processes.ts";
+const { values } = parseArgs({ options: { "codex-bots": { type: "boolean" }, config: { type: "string" }, "watch-codex": { type: "boolean" }, check: { type: "boolean" }, status: { type: "boolean" }, help: { type: "boolean" } } });
+const root = join(homedir(), ".agentschat/codex-bots"), registry = resolve(values.config ?? defaultRegistry());
+const statusFile = join(root, "status.json"), lock = join(root, "manager.lock");
+interface Worker { child?: ChildProcess; config: BotConfig; fingerprint: string; failures: number; next: number; status: string }
+const workers = new Map<string, Worker>();
+let stopping = false, missing = 0, timer: ReturnType<typeof setTimeout> | undefined;
+function removeDeadLock(file: string) {
+  if (!existsSync(file)) return;
+  const pid = Number(readFileSync(file, "utf8"));
+  if (!Number.isInteger(pid) || pid <= 0) return;
+  try { process.kill(pid, 0); } catch (e: any) { if (e.code === "ESRCH") unlinkSync(file); }
+}
+function save() {
+  writeFileSync(statusFile + ".tmp", JSON.stringify({ pid: process.pid, updated_at: new Date().toISOString(), bots: [...workers.values()].map(w => ({ name: w.config.name, agent_id: w.config.agentId, workdir: w.config.cwd, pid: w.child?.pid, status: w.status })) }, null, 2), { mode: 0o600 });
+  renameSync(statusFile + ".tmp", statusFile);
+}
+async function stop(w: Worker) {
+  const child = w.child;
+  if (child && child.exitCode === null && child.signalCode === null) await new Promise<void>(done => {
+    const timeout = setTimeout(() => killGroup(child), 20_000);
+    child.once("exit", () => { clearTimeout(timeout); killGroup(child); done(); }); child.kill("SIGTERM");
+  });
+  w.child = undefined; w.status = "stopped";
+}
+function killGroup(child: ChildProcess) { if (child.pid) try { process.kill(-child.pid, "SIGKILL"); } catch {} }
+function start(w: Worker) {
+  removeDeadLock(join(w.config.stateDir, "bridge.lock")); w.status = "starting";
+  const child = spawn(process.execPath, [resolve(process.argv[1]!), "--codex-bridge", "--managed-worker"], { cwd: w.config.cwd, detached: true, stdio: ["ignore", "pipe", "pipe", "ipc"] });
+  w.child = child;
+  child.once("spawn", () => child.send(w.config, () => {}));
+  let buffer = "";
+  child.stderr?.on("data", data => {
+    buffer = (buffer + String(data)).slice(-8192);
+    if (buffer.includes(`AgentsChat connected as ${w.config.agentId}`)) { w.status = "connected"; w.failures = 0; buffer = ""; save(); }
+    else if (buffer.includes("disconnected")) { w.status = "reconnecting"; buffer = ""; save(); }
+  });
+  child.stdout?.resume();
+  const failed = () => { if (w.child !== child) return; killGroup(child); w.child = undefined; w.status = "retrying"; w.next = Date.now() + Math.min(60_000, 1000 * 2 ** Math.min(++w.failures, 6)); save(); };
+  child.once("error", failed); child.once("exit", failed);
+}
+async function tick() {
+  try {
+    const configs = loadBots(registry);
+    for (const [name, worker] of workers) {
+      const c = configs.find(c => c.name === name);
+      if (!c || createHash("sha256").update(JSON.stringify(c)).digest("hex") !== worker.fingerprint) { await stop(worker); workers.delete(name); }
+    }
+    for (const c of configs) if (!workers.has(c.name)) workers.set(c.name, { config: c, fingerprint: createHash("sha256").update(JSON.stringify(c)).digest("hex"), failures: 0, next: 0, status: "waiting" });
+  } catch { console.error("Invalid registry; keeping last valid configuration"); }
+  if (stopping) return;
+  let active: boolean;
+  try { active = !values["watch-codex"] || await codexPresent(); } catch { console.error("Process detection unavailable"); return; }
+  missing = active ? 0 : missing + 1;
+  for (const w of workers.values()) {
+    if (stopping) break;
+    if (active && !w.child && Date.now() >= w.next) start(w);
+    else if (!active && missing >= 2 && w.child) await stop(w);
+  }
+  save();
+}
+async function main() {
+  if (values.help) { console.log("agentschat-mcp --codex-bots [--config FILE] [--watch-codex] [--check|--status]\nCentral registry: ~/.agentschat/codex-bots.json; profiles: ~/.agentschat/profiles\nWatch polls external Codex processes every 5 seconds."); return; }
+  if (values.status) { console.log(readFileSync(statusFile, "utf8")); return; }
+  const configs = loadBots(registry);
+  if (values.check) { console.log(JSON.stringify(configs.map(c => ({ name: c.name, agent_id: c.agentId, workdir: c.cwd, profile: c.profileFile })))); return; }
+  mkdirSync(root, { recursive: true, mode: 0o700 }); removeDeadLock(lock);
+  const fd = openSync(lock, "wx", 0o600); writeFileSync(fd, String(process.pid)); closeSync(fd);
+  let running: Promise<void> = Promise.resolve();
+  const loop = () => { running = tick().catch(() => console.error("Supervisor tick failed")).finally(() => { if (!stopping) timer = setTimeout(loop, 5000); }); };
+  const shutdown = async () => { if (stopping) return; stopping = true; clearTimeout(timer); await running; await Promise.all([...workers.values()].map(stop)); save(); if (readFileSync(lock, "utf8") === String(process.pid)) unlinkSync(lock); };
+  process.once("SIGINT", () => void shutdown()); process.once("SIGTERM", () => void shutdown()); loop();
+}
+main().catch(() => { console.error("Bot manager failed; check registry, profile permissions, and existing manager"); process.exitCode = 1; });

package/codex/processes.ts

@@ -0,0 +1,21 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { basename } from "node:path";
+
+export interface ProcessRow { pid: number; ppid: number; command: string }
+export function parseProcesses(text: string): ProcessRow[] {
+  return text.split("\n").flatMap(line => {
+    const m = /^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(line);
+    return m ? [{ pid: Number(m[1]), ppid: Number(m[2]), command: m[3]!.trim() }] : [];
+  });
+}
+export function externalCodexPresent(rows: ProcessRow[], managerPid: number): boolean {
+  const children = new Set([managerPid]);
+  let changed = true;
+  while (changed) { changed = false; for (const row of rows) if (children.has(row.ppid) && !children.has(row.pid)) { children.add(row.pid); changed = true; } }
+  return rows.some(r => !children.has(r.pid) && basename(r.command) === "codex");
+}
+export async function codexPresent(managerPid = process.pid): Promise<boolean> {
+  const { stdout } = await promisify(execFile)("/bin/ps", ["-axo", "pid=,ppid=,comm="], { timeout: 5000, maxBuffer: 4 * 1024 * 1024 });
+  return externalCodexPresent(parseProcesses(stdout), managerPid);
+}

package/codex/run.ts

@@ -0,0 +1,59 @@
+import { loadBots } from "./bots-config.ts";
+import type { BridgeConfig } from "./config.ts";
+import { parseArgs } from "node:util";
+import { resolveConfig } from "./config.ts";
+import { AppServer } from "./app-server.ts";
+import { Bridge } from "./bridge.ts";
+import { AgentsChatTransport } from "./transport.ts";
+
+export const HELP = `agentschat-mcp --codex-bridge [--cwd DIRECTORY] [--profile NAME_OR_PATH] [--codex-bin PATH] [--check]
+
+Official Codex app-server bridge. Node >=22; Codex installed and signed in.
+Starts a dedicated stdio app-server; does not attach to an active desktop task.
+No notifications/chat/channel, no fork, no account registration.
+
+Identity: --profile > CWD/.agentschat/config.json profile >
+CWD/.agentschat/profile.json > CWD/.codex/config.toml MCP profile > AGENTSCHAT_PROFILE > AGENTCHAT_PROFILE > global default.
+Only the exact CWD is searched. Named profiles live in ~/.agentschat (legacy ~/.agentchat).
+An optional project agent_id must match the selected profile; it cannot replace it.
+Credentials: private profile JSON {agent_id, token}, chmod 600; never put keys in argv.
+Project config fields: profile, agent_id, channels, senders, api_url, ws_url.
+--check validates identity and official app-server initialization without opening chat.
+Live DMs and exact mentions trigger replies; channels/senders restrict this further.
+Read-only Codex turns; inherited MCP servers disabled. No offline message replay.
+State: ~/.agentschat/codex-bridge/<project-server-identity hash>/ (private).
+See codex/README.md for setup, verification, limitations and recovery.
+`;
+
+let codex: AppServer | undefined, bridge: Bridge | undefined, transport: AgentsChatTransport | undefined;
+async function main() {
+  const { values } = parseArgs({ options: { "codex-bridge": { type: "boolean" }, cwd: { type: "string" },
+    "managed-worker": { type: "boolean" }, registry: { type: "string" }, bot: { type: "string" }, profile: { type: "string" }, "codex-bin": { type: "string" }, check: { type: "boolean" },
+    help: { type: "boolean", short: "h" } }, strict: true });
+  if (values.help) { console.log(HELP); return; }
+  const snapshot = values["managed-worker"] ? await new Promise<BridgeConfig>((resolve, reject) => {
+    if (!process.connected) { reject(new Error("Managed worker needs parent IPC")); return; }
+    const timer = setTimeout(() => reject(new Error("Parent configuration missing")), 10000);
+    process.once("message", config => { clearTimeout(timer); resolve(config as BridgeConfig); });
+  }) : undefined;
+  const c = snapshot ?? (values.bot ? loadBots(values.registry).find(b => b.name === values.bot) : resolveConfig({ cwd: values.cwd, profile: values.profile, codexBin: values["codex-bin"] }));
+  if (!c) throw new Error("Bot is absent or disabled");
+  console.log(JSON.stringify({ cwd: c.cwd, agent_id: c.agentId, profile: c.profileFile, source: c.source, stateDir: c.stateDir }));
+  codex = new AppServer(c.codexBin);
+  if (values.check) { await codex.start(); console.log("Official app-server initialization: OK (no chat connection or generation)"); codex.close(); return; }
+  transport = new AgentsChatTransport(c, m => { bridge!.accept(m); });
+  bridge = new Bridge(c, codex, (chat, text) => transport!.send(chat, text), console.error, (chat, active) => transport!.setTyping(chat, active));
+  let stopping = false;
+  const stop = async () => { if (stopping) return; stopping = true; if (values["managed-worker"]) { const deadline = setTimeout(() => { try { process.kill(-process.pid, "SIGKILL"); } catch {} }, 20000); deadline.unref(); } bridge?.pause(); transport?.stop(); codex?.close(); await bridge?.stop(); if (process.connected) process.disconnect?.(); };
+  codex.onFatal = () => { console.error("Codex backend stopped; pending inbox preserved. Restart the bridge after checking failed entries."); process.exitCode = 1; void stop(); };
+  process.once("disconnect", () => void stop());
+  process.once("SIGINT", () => void stop()); process.once("SIGTERM", () => void stop());
+  await codex.start();
+  if (values["managed-worker"] && !process.connected) { await stop(); return; }
+  void bridge.drain(); transport.start();
+}
+main().catch(async e => {
+  // Do not echo arbitrary parse errors or subprocess output containing credentials.
+  console.error(`Bridge startup failed: ${e instanceof Error && !/token|secret/i.test(e.message) ? e.message : "invalid configuration"}`);
+  transport?.stop(); codex?.close(); await bridge?.stop(); process.exitCode = 1;
+});

package/codex/transport.ts

@@ -0,0 +1,99 @@
+import { randomUUID } from "node:crypto";
+import WebSocket from "ws";
+import type { BridgeConfig } from "./config.ts";
+import { HeartbeatMonitor } from "../src/heartbeat.ts";
+
+export class AgentsChatTransport {
+  private socket?: WebSocket;
+  private authenticated = false;
+  private typing = new Map<string, ReturnType<typeof setInterval>>();
+  private pending = new Map<string, { resolve: () => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> }>();
+  private heartbeat?: HeartbeatMonitor;
+  private retry?: ReturnType<typeof setTimeout>;
+  private closed = false;
+  private delay = 1000;
+  constructor(private config: BridgeConfig, private receive: (m: unknown) => void, private log: (s: string) => void = console.error) {}
+  async api(path: string, body?: unknown) {
+    let response: Response;
+    try {
+      response = await fetch(this.config.apiUrl + path, { method: body ? "POST" : "GET", redirect: "error",
+        headers: { Authorization: `Bearer ${this.config.token}`, "Content-Type": "application/json" },
+        ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(15_000) });
+    } catch { throw new Error("AgentsChat request failed or timed out"); }
+    if (!response.ok) throw new Error(`AgentsChat HTTP ${response.status}`);
+    try { return await response.json(); } catch { throw new Error("Invalid AgentsChat response"); }
+  }
+  setTyping(channel: string, active: boolean) {
+    clearInterval(this.typing.get(channel)); this.typing.delete(channel);
+    if (!active || this.closed) return;
+    const pulse = () => {
+      if (this.authenticated && this.socket?.readyState === WebSocket.OPEN)
+        this.socket.send(JSON.stringify({ type: "typing", channel_id: channel, sender_id: this.config.agentId, cross_pod: true }));
+    };
+    pulse(); this.typing.set(channel, setInterval(pulse, 2000));
+  }
+  private rejectPending() {
+    for (const p of this.pending.values()) { clearTimeout(p.timer); p.reject(new Error("AgentsChat acknowledgement unavailable")); }
+    this.pending.clear();
+  }
+  async send(channel: string, text: string) {
+    // Use the authenticated connection and wait for the server's delivery ACK.
+    // Never fall back after an attempted send: an ACK may have been lost.
+    if (this.authenticated && this.socket?.readyState === WebSocket.OPEN) {
+      const id = randomUUID();
+      await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(() => { this.pending.delete(id); reject(new Error("AgentsChat acknowledgement timed out")); }, 15000);
+        this.pending.set(id, { resolve, reject, timer });
+        this.socket!.send(JSON.stringify({ type: "message", id, channel_id: channel,
+          sender_id: this.config.agentId, sender_type: "agent", content_type: "text", content: text }), error => {
+          if (error) { clearTimeout(timer); this.pending.delete(id); reject(new Error("AgentsChat socket send failed")); }
+        });
+      });
+      return;
+    }
+    await this.api(`/api/channels/${encodeURIComponent(channel)}/messages`, {
+      sender_id: this.config.agentId, content_type: "text", content: text,
+    });
+  }
+  start() {
+    if (this.closed) return;
+    const socket = new WebSocket(this.config.wsUrl, { maxPayload: 1_048_576, handshakeTimeout: 15_000 });
+    this.socket = socket;
+    const current = () => !this.closed && this.socket === socket;
+    const send = (value: unknown) => { if (current() && socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value)); };
+    const join = (channel: string) => {
+      if (!this.config.channels.length || this.config.channels.includes(channel)) send({ type: "join_channel", channel_id: channel, agent_id: this.config.agentId });
+    };
+    this.heartbeat = new HeartbeatMonitor({ getReadyState: () => socket.readyState,
+      sendPing: () => send({ type: "ping" }), reconnect: () => socket.terminate() }, 15_000, 45_000, 30_000);
+    this.heartbeat.start();
+    socket.on("open", () => send({ type: "auth", agent_id: this.config.agentId, token: this.config.token, capabilities: ["chat", "codex"] }));
+    socket.on("message", raw => {
+      if (!current()) return;
+      let data: any; try { data = JSON.parse(String(raw)); } catch { return; }
+      this.heartbeat?.receivedPong();
+      if (data.type === "auth_ok") {
+        this.authenticated = true; this.delay = 1000; this.log(`AgentsChat connected as ${this.config.agentId}`);
+        void this.api("/api/channels/mine").then((body: any) => {
+          if (!current()) return;
+          const channels = Array.isArray(body) ? body : body.channels;
+          if (!Array.isArray(channels)) throw new Error("Invalid membership response");
+          for (const c of channels) if (typeof (c.id ?? c.channel_id) === "string") join(c.id ?? c.channel_id);
+        }).catch(() => { if (current()) { this.log("Membership sync failed; reconnecting"); socket.terminate(); } });
+      } else if (data.type === "message_ack") {
+        const id = data.message_id ?? data.id, pending = this.pending.get(id);
+        if (pending) { clearTimeout(pending.timer); this.pending.delete(id); pending.resolve(); }
+      } else if (data.type === "channel_created" && typeof data.channel_id === "string") join(data.channel_id);
+      else if (["message", "thread_reply"].includes(data.type)) this.receive(data);
+      else if (data.type === "shard_moved") socket.terminate();
+      else if (data.type === "auth_error" || data.type === "error") this.log("AgentsChat returned an error; check account and channel permissions");
+    });
+    socket.on("error", () => this.log("AgentsChat socket error"));
+    socket.on("close", () => {
+      if (!current()) return;
+      this.authenticated = false; this.rejectPending(); this.heartbeat?.stop(); this.log("AgentsChat disconnected; reconnecting (offline messages are not replayed)");
+      this.retry = setTimeout(() => this.start(), this.delay); this.delay = Math.min(this.delay * 2, 30_000);
+    });
+  }
+  stop() { for (const timer of this.typing.values()) clearInterval(timer); this.typing.clear(); this.closed = true; this.authenticated = false; this.rejectPending(); clearTimeout(this.retry); this.heartbeat?.stop(); this.socket?.terminate(); }
+}

package/connector/README.md

@@ -67,7 +67,7 @@ For the bundled Hermes adaptation skill and profile-specific setup commands, rea
 [`skills/onboarding.md` §4](../skills/onboarding.md). Upgrades from older connectors
 must follow the [0.34.0 migration notes](../CHANGELOG.md).
 
-**0.34.0 is unpublished:** use the [local build procedure](../skills/onboarding.md#local-build-before-runtime-configuration), not an assumed npm release.
+**0.35.0 is unpublished:** use the [local build procedure](../skills/onboarding.md#local-build-before-runtime-configuration), not an assumed npm release.
 Requires Node ≥22, Bun ≥1.0 for installing/building, and a configured Hermes
 v0.21.1 profile. In a reviewed `AgentsChatProtocol/mcp-plugin` checkout: