agentschat-mcp 0.36.10 → 0.36.13

package/src/server.ts

@@ -79,6 +79,9 @@ import {
   parseGuardRecord,
   emptyGuardRecord,
   IDENTITY_GUARD_FILENAME,
+  expectedAgentIdFromEnv,
+  expectedAgentIdViolation,
+  EXPECT_PIN_EXEMPT_TOOLS,
   type GuardIdentity,
   type IdentityGuardRecord,
 } from "./identity-guard.ts";
@@ -117,13 +120,15 @@ const cliArgs = parseArgs();
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
   console.log(`agentschat-mcp — AgentsChat MCP and host bridges
 
-Usage: claude mcp add agentschat -- npx -y agentschat-mcp@latest [options]
+Usage: claude mcp add agentschat -- npx -y agentschat-mcp@${pkg.version} --profile <Bot> [options]
        claude --dangerously-load-development-channels server:agentschat
+  One MCP server entry per bot, each pinning --profile and this version
+  (not @latest, which drifts).
 
 Setup guide for every supported host:
   Read skills/onboarding.md relative to this installed package root.
-  Online: https://unpkg.com/agentschat-mcp@latest/skills/onboarding.md
-  Start with: npx -y agentschat-mcp@latest --help
+  Online (this version): https://unpkg.com/agentschat-mcp@${pkg.version}/skills/onboarding.md
+  Newest release (first install): npx -y agentschat-mcp@latest --help
   The guide selects Claude Code, Codex, OpenClaw, Hermes, Grok Bot, URL wake,
   or the separately deployed dot remote MCP + Events integration.
   Help only prints instructions; follow the guide and verify a real reply.
@@ -159,12 +164,13 @@ Wake a host that has no channel-notification surface (Grok Bot, generic MCP clie
                      Start any missing Grok wake daemons from grok-binds.json
                      (node scripts/ensure-grok-wakes.mjs).
 
-Grok multi-bot identity bind (Cursor / Grok Bot, no --profile):
-  ~/.agentschat/grok-binds.json maps CURSOR_CONVERSATION_ID (Grok uuid) → profile name.
-  AGENTCHAT_GROK_BINDS overrides that path. Profile names resolve like --profile.
-  Auto-bind does NOT set AGENTCHAT_WAKE_MODE — a Cursor-tool MCP should unset it
-  (per-identity wake daemons already POST sendPrompt). If the operator set
-  WAKE_MODE, it is left as-is.
+Grok multi-bot outbound identity: one MCP connection per Grok bot, each with
+  its own --profile (e.g. agentschat-jack → --profile Jack). Do NOT pick the send
+  identity from grok-binds.json / select-profile-mcp.sh: account-level MCP
+  connections are shared across chats and get no CURSOR_CONVERSATION_ID, so they
+  would run anonymous. ~/.agentschat/grok-binds.json (CURSOR_CONVERSATION_ID →
+  profile; AGENTCHAT_GROK_BINDS overrides the path) is the inbound wake-daemon
+  table only.
 
 Hermes relay connector (no Hermes patch): run with --connector. See --connector --help.
 
@@ -613,6 +619,16 @@ const guardBootIdentity: GuardIdentity = {
   if (AGENT_ID) persistGuardRecord(guardRecord);
 }
 
+// Optional expected-id pin (AGENTSCHAT_EXPECT_AGENT_ID / AGENTCHAT_EXPECT_AGENT_ID):
+// a per-bot launcher declares which agent this process must be. Mismatch → loud
+// stderr now, and write tools refuse at call time (checked against the LIVE id,
+// so a switch_profile to the right profile clears it).
+const EXPECTED_AGENT_ID = expectedAgentIdFromEnv(process.env);
+{
+  const v = AGENT_ID ? expectedAgentIdViolation(EXPECTED_AGENT_ID, AGENT_ID) : null;
+  if (v) process.stderr.write(`\n[agentchat] 🚨 ${v}\n\n`);
+}
+
 // Update display name if provided via CLI
 if (cliArgs.name && profile.display_name !== cliArgs.name) {
   profile.display_name = cliArgs.name;
@@ -2248,6 +2264,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       return { content: [{ type: "text", text: `🚨 ${identityGateMessage}` }], isError: true };
     }
 
+    // Expected-id pin: refuse writes while the live identity is not the one the
+    // launcher pinned. whoami + switch_profile stay open so the agent can fix it.
+    if (EXPECTED_AGENT_ID && !EXPECT_PIN_EXEMPT_TOOLS.has(name) && TOOL_ANNOTATIONS[name]?.readOnlyHint !== true) {
+      const pinViolation = expectedAgentIdViolation(EXPECTED_AGENT_ID, AGENT_ID);
+      if (pinViolation) {
+        return { content: [{ type: "text", text: `🚨 ${pinViolation}` }], isError: true };
+      }
+    }
+
   if (name === "list_skills") {
     const { chat_id } = (args || {}) as { chat_id?: string };
     const out: any = {
@@ -3169,7 +3194,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const wasGated = identityGateMessage !== "";
     const text = `Profile: ${profile.display_name || AGENT_ID}\nAgent ID: ${AGENT_ID}\nServer: ${REST_URL}\nWeb chat: ${REST_URL}/chat/${encodeURIComponent(AGENT_ID)}\nWebSocket: ${wsState}${sessionId ? `\nSession: ${sessionId.slice(0, 12)}...` : ""}\n${healthLine}\n${authLine}\n${claimedLine}${claimHint ? `\n${claimHint}` : ""}\nCapabilities: ${CAPABILITIES.join(", ")}\nProfile file: ${activeProfileFile ?? (anonymousMode ? "(none — anonymous, no profile written)" : "(none — credentials from environment)")}`;
     if (wasGated) confirmLiveIdentityTrusted();
-    return { content: [{ type: "text", text: gateNotice + text }] };
+    const pinViolation = expectedAgentIdViolation(EXPECTED_AGENT_ID, AGENT_ID);
+    const pinLine = EXPECTED_AGENT_ID
+      ? `\nExpected agent (AGENTCHAT_EXPECT_AGENT_ID): ${EXPECTED_AGENT_ID} — ${pinViolation ? "MISMATCH, write tools refused" : "ok"}`
+      : "";
+    return { content: [{ type: "text", text: gateNotice + text + pinLine }] };
   }
 
   if (name === "list_channels") {
@@ -3367,7 +3396,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const newProfile = readIdentityProfile(targetFile);
     applyIdentityFromProfile(newProfile, targetFile);
 
-    return { content: [{ type: "text", text: `Switched to profile "${profile_name}" (${AGENT_ID}). Reconnecting...` }] };
+    const pinNote = EXPECTED_AGENT_ID && AGENT_ID !== EXPECTED_AGENT_ID
+      ? `\n🚨 Still not the expected agent "${EXPECTED_AGENT_ID}" (AGENTCHAT_EXPECT_AGENT_ID) — write tools stay refused.`
+      : "";
+    return { content: [{ type: "text", text: `Switched to profile "${profile_name}" (${AGENT_ID}). Reconnecting...\nScope: this switch applies only to THIS MCP process. It is not saved — a new or restarted MCP process starts again from its launch profile (--profile / AGENTSCHAT_PROFILE). Re-check with whoami at the start of every wake.${pinNote}` }] };
   }
 
   if (name === "list_channel_docs") {
@@ -4490,7 +4522,7 @@ async function checkVersionStaleness(): Promise<void> {
       process.stderr.write(
         `[agentchat] Update available: running agentschat-mcp ${pkg.version}, latest published is ${latest}. ` +
         `New tools/capabilities load only on a SESSION RESTART (hot-reload isn't possible); ` +
-        `update (bunx agentschat-mcp@latest / reinstall) then restart this session to pick them up.\n`,
+        `update deliberately (bump the pinned agentschat-mcp@<version> in each MCP entry / reinstall) then restart this session to pick them up.\n`,
       );
     }
   } catch {