converse-mcp-server 2.9.7 → 2.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "converse-mcp-server",
-  "version": "2.9.7",
+  "version": "2.10.0",
   "description": "Converse MCP Server - Converse with other LLMs with chat and consensus tools",
   "type": "module",
   "main": "src/index.js",
@@ -11,6 +11,60 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "keywords": [
+    "mcp",
+    "server",
+    "ai",
+    "chat",
+    "consensus",
+    "openai",
+    "google",
+    "gemini",
+    "grok"
+  ],
+  "author": "Converse MCP Server",
+  "license": "MIT",
+  "homepage": "https://github.com/FallDownTheSystem/converse#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FallDownTheSystem/converse.git"
+  },
+  "bugs": {
+    "url": "https://github.com/FallDownTheSystem/converse/issues"
+  },
+  "files": [
+    "src/",
+    "bin/",
+    "docs/",
+    "README.md",
+    ".env.example"
+  ],
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.2.23",
+    "@anthropic-ai/sdk": "^0.72.0",
+    "@google/genai": "^1.38.0",
+    "@mistralai/mistralai": "^1.13.0",
+    "@modelcontextprotocol/sdk": "^1.25.3",
+    "@openai/codex-sdk": "^0.92.0",
+    "ai": "^6.0.62",
+    "ai-sdk-provider-gemini-cli": "^2.0.1",
+    "cors": "^2.8.6",
+    "dotenv": "^17.2.3",
+    "express": "^5.2.1",
+    "lru-cache": "^11.2.5",
+    "nanoid": "^5.1.6",
+    "openai": "^6.17.0",
+    "p-limit": "^7.2.0",
+    "vite": "^7.3.1"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.18",
+    "cross-env": "^10.1.0",
+    "eslint": "^9.39.2",
+    "prettier": "^3.8.1",
+    "rimraf": "^6.1.2",
+    "vitest": "^4.0.18"
+  },
   "scripts": {
     "kill-server": "node scripts/kill-server.js",
     "start": "npm run kill-server && node src/index.js",
@@ -64,59 +118,5 @@
     "validate:fix": "node scripts/validate.js --fix",
     "validate:fast": "node scripts/validate.js --skip-tests --skip-lint",
     "precommit": "npm run validate"
-  },
-  "keywords": [
-    "mcp",
-    "server",
-    "ai",
-    "chat",
-    "consensus",
-    "openai",
-    "google",
-    "gemini",
-    "grok"
-  ],
-  "author": "Converse MCP Server",
-  "license": "MIT",
-  "homepage": "https://github.com/FallDownTheSystem/converse#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/FallDownTheSystem/converse.git"
-  },
-  "bugs": {
-    "url": "https://github.com/FallDownTheSystem/converse/issues"
-  },
-  "files": [
-    "src/",
-    "bin/",
-    "docs/",
-    "README.md",
-    ".env.example"
-  ],
-  "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.1.51",
-    "@anthropic-ai/sdk": "^0.70.0",
-    "@google/genai": "^1.30.0",
-    "@mistralai/mistralai": "^1.10.0",
-    "@modelcontextprotocol/sdk": "^1.22.0",
-    "@openai/codex-sdk": "^0.63.0",
-    "ai": "^5.0.101",
-    "ai-sdk-provider-gemini-cli": "^1.4.0",
-    "cors": "^2.8.5",
-    "dotenv": "^17.2.3",
-    "express": "^5.1.0",
-    "lru-cache": "^11.2.2",
-    "nanoid": "^5.1.6",
-    "openai": "^6.9.1",
-    "p-limit": "^7.2.0",
-    "vite": "^7.2.2"
-  },
-  "devDependencies": {
-    "@vitest/coverage-v8": "^4.0.10",
-    "cross-env": "^10.1.0",
-    "eslint": "^9.39.1",
-    "prettier": "^3.6.2",
-    "rimraf": "^6.1.0",
-    "vitest": "^4.0.10"
   }
-}
+}

package/src/async/fileCache.js

@@ -11,6 +11,7 @@ import { promises as fs } from 'fs';
 import path from 'path';
 import { debugLog, debugError } from '../utils/console.js';
 import { ConverseMCPError, ERROR_CODES } from '../utils/errorHandler.js';
+import { isSafeIdSegment } from '../utils/idValidation.js';
 
 /**
  * File cache specific error class
@@ -149,6 +150,14 @@ export class FileCache extends FileCacheInterface {
    * @private
    */
   getJobDir(jobId) {
+    if (!isSafeIdSegment(jobId)) {
+      throw new FileCacheError(
+        'Job ID contains unsafe characters',
+        ERROR_CODES.VALIDATION_ERROR,
+        { jobId },
+      );
+    }
+
     const today = new Date().toISOString().split('T')[0]; // yyyy-mm-dd
     return path.join(this.baseDir, today, jobId);
   }
@@ -201,7 +210,15 @@ export class FileCache extends FileCacheInterface {
     if (!jobId || typeof jobId !== 'string') {
       throw new FileCacheError(
         'Job ID must be a non-empty string',
-        ERROR_CODES.CACHE_WRITE_FAILED,
+        ERROR_CODES.VALIDATION_ERROR,
+        { jobId },
+      );
+    }
+
+    if (!isSafeIdSegment(jobId)) {
+      throw new FileCacheError(
+        'Job ID contains unsafe characters',
+        ERROR_CODES.VALIDATION_ERROR,
         { jobId },
       );
     }
@@ -265,7 +282,15 @@ export class FileCache extends FileCacheInterface {
     if (!jobId || typeof jobId !== 'string') {
       throw new FileCacheError(
         'Job ID must be a non-empty string',
-        ERROR_CODES.CACHE_WRITE_FAILED,
+        ERROR_CODES.VALIDATION_ERROR,
+        { jobId },
+      );
+    }
+
+    if (!isSafeIdSegment(jobId)) {
+      throw new FileCacheError(
+        'Job ID contains unsafe characters',
+        ERROR_CODES.VALIDATION_ERROR,
         { jobId },
       );
     }
@@ -324,7 +349,15 @@ export class FileCache extends FileCacheInterface {
     if (!jobId || typeof jobId !== 'string') {
       throw new FileCacheError(
         'Job ID must be a non-empty string',
-        ERROR_CODES.CACHE_READ_FAILED,
+        ERROR_CODES.VALIDATION_ERROR,
+        { jobId },
+      );
+    }
+
+    if (!isSafeIdSegment(jobId)) {
+      throw new FileCacheError(
+        'Job ID contains unsafe characters',
+        ERROR_CODES.VALIDATION_ERROR,
         { jobId },
       );
     }

package/src/providers/gemini-cli.js

@@ -7,7 +7,7 @@
  * Key features:
  * - Uses OAuth authentication from Gemini CLI (no API keys needed)
  * - Supports gemini-3-pro-preview model via Google Cloud Code endpoints
- * - Uses AI SDK v5 standard interfaces (generateText/streamText)
+ * - Uses AI SDK v6 standard interfaces (generateText/streamText)
  * - Compatible with both chat and consensus tools
  *
  * Authentication:
@@ -156,12 +156,13 @@ async function* createStreamingGenerator(
 
     // Yield usage event
     if (usage) {
+      const tokens = extractUsageTokens(usage);
       yield {
         type: 'usage',
         usage: {
-          input_tokens: usage.promptTokens || 0,
-          output_tokens: usage.completionTokens || 0,
-          total_tokens: usage.totalTokens || 0,
+          input_tokens: tokens.input,
+          output_tokens: tokens.output,
+          total_tokens: tokens.total,
           cached_input_tokens: 0,
         },
       };
@@ -171,7 +172,7 @@ async function* createStreamingGenerator(
     yield {
       type: 'end',
       stop_reason: mapFinishReason(finishReason),
-      finish_reason: finishReason,
+      finish_reason: getRawFinishReason(finishReason),
     };
   } catch (error) {
     if (signal?.aborted) {
@@ -182,10 +183,16 @@ async function* createStreamingGenerator(
 }
 
 /**
- * Map AI SDK finish reasons to our StopReasons enum
+ * Map AI SDK v6 finish reasons to our StopReasons enum
+ * AI SDK v6 returns finishReason as { unified: 'stop', raw: 'STOP' }
+ * @param {Object|string} finishReason - The finish reason (object in v6, string in v5)
  */
 function mapFinishReason(finishReason) {
-  switch (finishReason) {
+  // AI SDK v6 returns an object with 'unified' property
+  const reason =
+    typeof finishReason === 'object' ? finishReason?.unified : finishReason;
+
+  switch (reason) {
   case 'stop':
     return StopReasons.STOP;
   case 'length':
@@ -203,12 +210,51 @@ function mapFinishReason(finishReason) {
 }
 
 /**
- * Convert messages from Converse internal format to AI SDK v5 ModelMessage format
+ * Extract raw finish reason string for metadata
+ * AI SDK v6 returns finishReason as { unified: 'stop', raw: 'STOP' }
+ * @param {Object|string} finishReason - The finish reason
+ * @returns {string} The raw finish reason string
+ */
+function getRawFinishReason(finishReason) {
+  if (typeof finishReason === 'object') {
+    return finishReason?.unified || finishReason?.raw || 'stop';
+  }
+  return finishReason || 'stop';
+}
+
+/**
+ * Extract usage tokens from AI SDK v6 hierarchical structure
+ * AI SDK v6 usage: { inputTokens: { total: N }, outputTokens: { total: N } }
+ * AI SDK v5 usage: { promptTokens: N, completionTokens: N, totalTokens: N }
+ * @param {Object} usage - The usage object from AI SDK
+ * @returns {Object} Normalized token counts
+ */
+function extractUsageTokens(usage) {
+  if (!usage) {
+    return { input: 0, output: 0, total: 0 };
+  }
+
+  // AI SDK v6 hierarchical structure
+  if (usage.inputTokens && typeof usage.inputTokens === 'object') {
+    const input = usage.inputTokens.total || 0;
+    const output = usage.outputTokens?.total || 0;
+    return { input, output, total: input + output };
+  }
+
+  // AI SDK flat structure (backwards compatibility)
+  const input = usage.promptTokens || usage.inputTokens || 0;
+  const output = usage.completionTokens || usage.outputTokens || 0;
+  const total = usage.totalTokens || input + output;
+  return { input, output, total };
+}
+
+/**
+ * Convert messages from Converse internal format to AI SDK ModelMessage format
  *
  * Converse format (used by other providers like Anthropic):
  * - Images: { type: 'image', source: { type: 'base64', media_type: '...', data: '...' } }
  *
- * AI SDK v5 ModelMessage format (required by generateText/streamText):
+ * AI SDK ModelMessage format (required by generateText/streamText):
  * - Images: { type: 'image', image: '...' }  (base64 string, Buffer, or URL)
  * - Text: { type: 'text', text: '...' }
  *
@@ -216,7 +262,7 @@ function mapFinishReason(finishReason) {
  * We must use 'image' property (not 'data') for the AI SDK to accept the message.
  *
  * @param {Array} messages - Messages in Converse internal format
- * @returns {Array} Messages in AI SDK v5 ModelMessage format
+ * @returns {Array} Messages in AI SDK ModelMessage format
  */
 function convertToModelMessages(messages) {
   return messages.map((message) => {
@@ -233,11 +279,11 @@ function convertToModelMessages(messages) {
           return part;
         }
 
-        // Convert image from Converse format to AI SDK v5 ModelMessage format
+        // Convert image from Converse format to AI SDK ModelMessage format
         if (part.type === 'image' && part.source) {
           return {
             type: 'image',
-            image: part.source.data, // AI SDK v5 expects 'image' property (not 'data')
+            image: part.source.data, // AI SDK expects 'image' property (not 'data')
           };
         }
 
@@ -329,7 +375,7 @@ export const geminiCliProvider = {
       // Create model instance with SDK model name
       const modelInstance = gemini(sdkModelName);
 
-      // Convert messages from Converse format to AI SDK v5 ModelMessage format
+      // Convert messages from Converse format to AI SDK ModelMessage format
       const convertedMessages = convertToModelMessages(messages);
 
       // Build AI SDK options
@@ -377,9 +423,12 @@ export const geminiCliProvider = {
 
       const responseTime = Date.now() - startTime;
 
-      // Extract content from AI SDK v5 response format
+      // Extract content from AI SDK v6 response format
       const content = result.content?.[0]?.text || result.text || '';
 
+      // Extract usage tokens with AI SDK v6 compatibility
+      const tokens = extractUsageTokens(result.usage);
+
       return {
         content,
         stop_reason: mapFinishReason(result.finishReason),
@@ -389,14 +438,14 @@ export const geminiCliProvider = {
           model,
           usage: result.usage
             ? {
-              input_tokens: result.usage.promptTokens || 0,
-              output_tokens: result.usage.completionTokens || 0,
-              total_tokens: result.usage.totalTokens || 0,
+              input_tokens: tokens.input,
+              output_tokens: tokens.output,
+              total_tokens: tokens.total,
               cached_input_tokens: 0,
             }
             : null,
           response_time_ms: responseTime,
-          finish_reason: result.finishReason || 'stop',
+          finish_reason: getRawFinishReason(result.finishReason),
         },
       };
     } catch (error) {

package/src/tools/chat.js

@@ -21,6 +21,7 @@ import { applyTokenLimit, getTokenLimit } from '../utils/tokenLimiter.js';
 import { validateAllPaths } from '../utils/fileValidator.js';
 import { SummarizationService } from '../services/summarizationService.js';
 import { exportConversation } from '../utils/conversationExporter.js';
+import { isRecoverableError, retryWithBackoff } from '../utils/errorHandler.js';
 
 const logger = createLogger('chat');
 
@@ -265,12 +266,14 @@ export async function chatTool(args, dependencies) {
 
     messages.push(userMessage);
 
-    // Select provider
+    // Select provider(s)
     let selectedProvider;
     let providerName;
 
+    const providerCandidates = [];
+
     if (model === 'auto') {
-      // Auto-select first available provider in priority order
+      // Auto-select providers in priority order
       // Prioritize subscription-based providers (codex, gemini-cli, claude) over API-key providers
       const providerOrder = [
         'codex',
@@ -288,20 +291,17 @@ export async function chatTool(args, dependencies) {
       for (const name of providerOrder) {
         const provider = providers[name];
         if (provider && provider.isAvailable && provider.isAvailable(config)) {
-          providerName = name;
-          selectedProvider = provider;
-          break;
+          providerCandidates.push({ name, provider });
         }
       }
 
-      if (!providerName) {
+      if (providerCandidates.length === 0) {
         return createToolError(
           'No providers available. Please configure at least one API key.',
         );
       }
     } else {
       // Use specified provider/model
-      // Try to map model to provider
       providerName = mapModelToProvider(model, providers);
       selectedProvider = providers[providerName];
 
@@ -314,32 +314,60 @@ export async function chatTool(args, dependencies) {
           `Provider ${providerName} is not available. Check API key configuration.`,
         );
       }
-    }
 
-    // Resolve model name and prepare provider options
-    const resolvedModel = resolveAutoModel(model, providerName);
-    const providerOptions = {
-      model: resolvedModel,
-      temperature,
-      reasoning_effort,
-      verbosity,
-      use_websearch,
-      config,
-      continuation_id, // Pass for thread resumption
-      continuationStore, // Pass store for state management
-    };
+      providerCandidates.push({ name: providerName, provider: selectedProvider });
+    }
 
-    // Call provider
+    // Call provider with recovery (retry and, for auto, failover)
     let response;
     const startTime = Date.now();
-    try {
-      response = await selectedProvider.invoke(messages, providerOptions);
-    } catch (error) {
-      logger.error('Provider error', {
-        error,
-        data: { provider: providerName },
-      });
-      return createToolError(`Provider error: ${error.message}`);
+    let lastError;
+    let resolvedModel;
+
+    for (const candidate of providerCandidates) {
+      providerName = candidate.name;
+      selectedProvider = candidate.provider;
+
+      // Resolve model name and prepare provider options
+      resolvedModel = resolveAutoModel(model, providerName);
+      const providerOptions = {
+        model: resolvedModel,
+        temperature,
+        reasoning_effort,
+        verbosity,
+        use_websearch,
+        config,
+        continuation_id, // Pass for thread resumption
+        continuationStore, // Pass store for state management
+      };
+
+      try {
+        response = await retryWithBackoff(
+          () => selectedProvider.invoke(messages, providerOptions),
+          getProviderRetryOptions(config, providerName),
+        );
+        break;
+      } catch (error) {
+        lastError = error;
+        logger.error('Provider error', {
+          error,
+          data: { provider: providerName },
+        });
+
+        if (
+          model !== 'auto' ||
+          !shouldFailoverToNextProvider(error) ||
+          candidate === providerCandidates[providerCandidates.length - 1]
+        ) {
+          return createToolError(`Provider error: ${error.message}`);
+        }
+      }
+    }
+
+    if (!response) {
+      return createToolError(
+        `Provider error: ${(lastError && lastError.message) || 'Unknown error'}`,
+      );
     }
     const executionTime = (Date.now() - startTime) / 1000; // Convert to seconds
 
@@ -472,6 +500,29 @@ function resolveAutoModel(model, providerName) {
   return defaults[providerName] || 'gpt-5';
 }
 
+function getProviderRetryOptions(config, providerName) {
+  const nodeEnv = config?.environment?.nodeEnv || process.env.NODE_ENV;
+  const isTest = nodeEnv === 'test';
+
+  return {
+    retries: isTest ? 1 : 3,
+    delay: isTest ? 0 : 500,
+    maxDelay: isTest ? 0 : 10000,
+    operation: `provider-invoke:${providerName}`,
+  };
+}
+
+function shouldFailoverToNextProvider(error) {
+  if (isRecoverableError(error)) {
+    return true;
+  }
+
+  const message = (error && error.message) || '';
+  return /(api key|authentication|unauthorized|forbidden|invalid|not available)/i.test(
+    message,
+  );
+}
+
 export function mapModelToProvider(model, providers) {
   const modelLower = model.toLowerCase();
 

package/src/tools/checkStatus.js

@@ -17,6 +17,7 @@ import {
   formatJobListHumanReadable,
   formatConversationHistory,
 } from '../utils/formatStatus.js';
+import { isSafeIdSegment } from '../utils/idValidation.js';
 
 const logger = createLogger('check-status');
 
@@ -36,8 +37,22 @@ export async function checkStatusTool(args, dependencies) {
     const { continuation_id, full_history = false } = args;
 
     // Validate arguments
-    if (continuation_id && typeof continuation_id !== 'string') {
-      return createToolError('continuation_id must be a string');
+    if (continuation_id !== undefined) {
+      if (typeof continuation_id !== 'string') {
+        return createToolError('continuation_id must be a string');
+      }
+
+      if (continuation_id.length === 0) {
+        return createToolError(
+          'Invalid continuation_id: must be a non-empty string',
+        );
+      }
+
+      if (!isSafeIdSegment(continuation_id)) {
+        return createToolError(
+          'Invalid continuation_id: contains unsafe characters',
+        );
+      }
     }
 
     const asyncJobStore = getAsyncJobStore();

package/src/utils/idValidation.js

@@ -0,0 +1,32 @@
+/**
+ * ID validation helpers
+ *
+ * These are intentionally conservative and are primarily used to ensure IDs that
+ * are used as filesystem path segments cannot escape their intended directory.
+ */
+
+/**
+ * Check whether an ID is safe to use as a single filesystem path segment.
+ *
+ * Allowed characters: A–Z a–z 0–9 _ -
+ * Disallowed: path separators, dots, whitespace, and other punctuation.
+ *
+ * @param {unknown} id
+ * @param {object} [options]
+ * @param {number} [options.maxLength]
+ * @returns {boolean}
+ */
+export function isSafeIdSegment(id, options = {}) {
+  const { maxLength = 128 } = options;
+
+  if (typeof id !== 'string') {
+    return false;
+  }
+
+  if (id.length === 0 || id.length > maxLength) {
+    return false;
+  }
+
+  return /^[A-Za-z0-9_-]+$/.test(id);
+}
+