draftgo-cli 1.0.4

package/src/mcp/protocol.js

@@ -0,0 +1,223 @@
+'use strict';
+
+const DEFAULT_PROTOCOL_VERSION = '2026-07-28';
+const DEFAULT_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+
+class McpHttpError extends Error {
+  constructor(message, { status = 0, rpc = null, code = null } = {}) {
+    super(message);
+    this.name = 'McpHttpError';
+    this.status = status;
+    this.rpc = rpc;
+    this.code = code;
+  }
+}
+
+function redactText(value, secrets = []) {
+  let text = String(value == null ? '' : value);
+  for (const secret of secrets.filter(Boolean)) text = text.split(String(secret)).join('[REDACTED]');
+  text = text.replace(/(authorization\s*[:=]\s*bearer\s+)[^\s,;"']+/ig, '$1[REDACTED]');
+  text = text.replace(/(\"?(?:token|sat)\"?\s*[:=]\s*\"?)[^\s,;"'}]+/ig, '$1[REDACTED]');
+  return text;
+}
+
+function endpointFor(config) {
+  const server = new URL(String(config.server || config.mcp_url));
+  const serverPath = server.pathname.replace(/\/+$/, '');
+  const endpoint = config.mcp_url
+    ? new URL(String(config.mcp_url), server)
+    : new URL(`${serverPath}/mcp`, server);
+  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
+    throw new McpHttpError('DraftGo MCP endpoint must be a credential-free HTTP(S) URL.');
+  }
+  const allowedOrigins = new Set([
+    server.origin,
+    ...((config.mcp_allowed_origins || []).map((value) => new URL(value).origin)),
+  ]);
+  if (!allowedOrigins.has(endpoint.origin)) {
+    throw new McpHttpError('DraftGo MCP endpoint origin is not allowlisted; refusing to send the API Key.');
+  }
+  return endpoint.toString();
+}
+
+function jsonRpcMessages(value) {
+  if (Array.isArray(value)) return value.filter((item) => item && typeof item === 'object');
+  return value && typeof value === 'object' ? [value] : [];
+}
+
+function routingHeaders(message) {
+  const messages = jsonRpcMessages(message);
+  if (messages.length !== 1 || typeof messages[0].method !== 'string' || !messages[0].method) return {};
+  const request = messages[0];
+  const headers = { 'Mcp-Method': request.method };
+  const params = request.params && typeof request.params === 'object' && !Array.isArray(request.params)
+    ? request.params
+    : {};
+  if (request.method === 'tools/call' && typeof params.name === 'string' && params.name) {
+    headers['Mcp-Name'] = params.name;
+  } else if (request.method === 'prompts/get' && typeof params.name === 'string' && params.name) {
+    headers['Mcp-Name'] = params.name;
+  } else if (request.method === 'resources/read' && typeof params.uri === 'string' && params.uri) {
+    headers['Mcp-Name'] = params.uri;
+  }
+  return headers;
+}
+
+async function parseEventStream(body, onMessage, maxBytes = DEFAULT_MAX_RESPONSE_BYTES) {
+  if (!body) return [];
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let pending = '';
+  let dataLines = [];
+  const messages = [];
+  let size = 0;
+  const consume = () => {
+    if (!dataLines.length) return;
+    const data = dataLines.join('\n');
+    dataLines = [];
+    if (!data || data === '[DONE]') return;
+    let parsed;
+    try { parsed = JSON.parse(data); } catch {
+      throw new McpHttpError('DraftGo MCP returned invalid JSON in an event stream.');
+    }
+    for (const message of jsonRpcMessages(parsed)) {
+      messages.push(message);
+      if (onMessage) onMessage(message);
+    }
+  };
+  while (true) {
+    const { done, value } = await reader.read();
+    size += value ? value.byteLength : 0;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new McpHttpError(`DraftGo MCP response exceeds ${maxBytes} bytes.`);
+    }
+    pending += decoder.decode(value || new Uint8Array(), { stream: !done });
+    const lines = pending.split(/\r?\n/);
+    pending = lines.pop() || '';
+    for (const line of lines) {
+      if (!line) consume();
+      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));
+    }
+    if (done) break;
+  }
+  if (pending.startsWith('data:')) dataLines.push(pending.slice(5).replace(/^ /, ''));
+  consume();
+  return messages;
+}
+
+async function readLimitedText(response, maxBytes = 65536) {
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (size < maxBytes) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = Buffer.from(value);
+    chunks.push(chunk.subarray(0, Math.max(0, maxBytes - size)));
+    size += chunk.length;
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+async function readBoundedText(response, maxBytes) {
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = Buffer.from(value);
+    size += chunk.length;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new McpHttpError(`DraftGo MCP response exceeds ${maxBytes} bytes.`);
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+async function postJsonRpc(config, message, options = {}) {
+  const token = String(config.token || config.sat || '');
+  const controller = new AbortController();
+  const timeoutMs = Number(options.timeoutMs || config.mcp_timeout_ms || 60000);
+  const timer = setTimeout(() => controller.abort(new Error('MCP request timed out')), timeoutMs);
+  const externalSignal = options.signal;
+  const abort = () => controller.abort(externalSignal.reason);
+  if (externalSignal) {
+    if (externalSignal.aborted) abort();
+    else externalSignal.addEventListener('abort', abort, { once: true });
+  }
+
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/json, text/event-stream',
+    'Content-Type': 'application/json',
+    'MCP-Protocol-Version': options.protocolVersion || DEFAULT_PROTOCOL_VERSION,
+    ...routingHeaders(message),
+  };
+  if (options.sessionId) headers['Mcp-Session-Id'] = options.sessionId;
+
+  let response;
+  try {
+    response = await fetch(endpointFor(config), {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(message),
+      signal: controller.signal,
+    });
+    const sessionId = response.headers.get('mcp-session-id');
+    if (sessionId && options.onSession) options.onSession(sessionId);
+    if (response.status === 202 || response.status === 204) return [];
+
+    const contentType = String(response.headers.get('content-type') || '').toLowerCase();
+    if (!response.ok) {
+      const bodyText = await readLimitedText(response);
+      let rpc = null;
+      try {
+        const parsed = JSON.parse(bodyText);
+        rpc = jsonRpcMessages(parsed)[0] || null;
+      } catch { /* retain a bounded text error */ }
+      const structured = rpc && rpc.error && (rpc.error.message || rpc.error.code);
+      throw new McpHttpError(
+        redactText(structured || bodyText || `MCP HTTP ${response.status}`, [token]),
+        { status: response.status, rpc, code: rpc && rpc.error && rpc.error.code },
+      );
+    }
+
+    if (contentType.includes('text/event-stream')) {
+      return await parseEventStream(response.body, options.onMessage,
+        Number(options.maxResponseBytes || config.mcp_max_response_bytes || DEFAULT_MAX_RESPONSE_BYTES));
+    }
+    const text = await readBoundedText(response,
+      Number(options.maxResponseBytes || config.mcp_max_response_bytes || DEFAULT_MAX_RESPONSE_BYTES));
+    if (!text.trim()) return [];
+    let parsed;
+    try { parsed = JSON.parse(text); } catch {
+      throw new McpHttpError('DraftGo MCP returned invalid JSON.', { status: response.status });
+    }
+    const messages = jsonRpcMessages(parsed);
+    if (options.onMessage) messages.forEach(options.onMessage);
+    return messages;
+  } catch (error) {
+    if (error instanceof McpHttpError || controller.signal.aborted) throw error;
+    throw new McpHttpError(redactText(error.message || error, [token]), { status: response && response.status });
+  } finally {
+    clearTimeout(timer);
+    if (externalSignal) externalSignal.removeEventListener('abort', abort);
+  }
+}
+
+module.exports = {
+  DEFAULT_MAX_RESPONSE_BYTES,
+  DEFAULT_PROTOCOL_VERSION,
+  McpHttpError,
+  redactText,
+  endpointFor,
+  routingHeaders,
+  postJsonRpc,
+  parseEventStream,
+};

package/src/mcp/stdio.js

@@ -0,0 +1,300 @@
+'use strict';
+
+const { loadProjectConfig } = require('../projectConfig');
+const { DraftGoMcpClient, redactValue } = require('./client');
+const { redactText } = require('./protocol');
+
+const DEFAULT_MAX_FRAME_BYTES = 64 * 1024 * 1024;
+
+function indexOfHeaderEnd(buffer, start = 0) {
+  const crlf = buffer.indexOf('\r\n\r\n', start, 'ascii');
+  const lf = buffer.indexOf('\n\n', start, 'ascii');
+  if (crlf < 0) return lf < 0 ? null : { index: lf, length: 2 };
+  if (lf < 0 || crlf <= lf) return { index: crlf, length: 4 };
+  return { index: lf, length: 2 };
+}
+
+function leadingWhitespaceLength(buffer) {
+  let offset = 0;
+  while (offset < buffer.length) {
+    const byte = buffer[offset];
+    if (byte !== 0x20 && byte !== 0x09 && byte !== 0x0d && byte !== 0x0a) break;
+    offset += 1;
+  }
+  return offset;
+}
+
+function headerState(buffer, offset) {
+  const target = 'content-length:';
+  const available = buffer.subarray(offset, Math.min(buffer.length, offset + target.length))
+    .toString('ascii')
+    .toLowerCase();
+  if (target.startsWith(available)) return available.length === target.length ? 'header' : 'partial';
+  return available.startsWith(target) ? 'header' : 'json';
+}
+
+class StdioFrameParser {
+  constructor(onMessage, onError, options = {}) {
+    this.onMessage = onMessage;
+    this.onError = onError;
+    this.maxFrameBytes = Number(options.maxFrameBytes || DEFAULT_MAX_FRAME_BYTES);
+    this.buffer = Buffer.alloc(0);
+  }
+
+  push(chunk) {
+    if (chunk == null || chunk.length === 0) return;
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    this.buffer = this.buffer.length ? Buffer.concat([this.buffer, value]) : value;
+    this._consume(false);
+  }
+
+  end() {
+    this._consume(true);
+    if (this.buffer.length && this.buffer.toString('utf8').trim()) {
+      this._emitError(new Error('Incomplete JSON-RPC frame.'), 'newline');
+    }
+    this.buffer = Buffer.alloc(0);
+  }
+
+  _emitError(error, framing) {
+    if (typeof this.onError === 'function') this.onError(error, framing);
+  }
+
+  _emitBody(body, framing) {
+    let parsed;
+    try {
+      parsed = JSON.parse(body.toString('utf8'));
+    } catch (error) {
+      this._emitError(error, framing);
+      return;
+    }
+    this.onMessage(parsed, framing);
+  }
+
+  _consume(flush) {
+    while (this.buffer.length) {
+      const whitespace = leadingWhitespaceLength(this.buffer);
+      if (whitespace === this.buffer.length) {
+        if (flush) this.buffer = Buffer.alloc(0);
+        return;
+      }
+
+      if (whitespace) this.buffer = this.buffer.subarray(whitespace);
+      const state = headerState(this.buffer, 0);
+      if (state === 'partial' && !flush) return;
+
+      if (state === 'header') {
+        const end = indexOfHeaderEnd(this.buffer);
+        if (!end) {
+          if (flush) {
+            this._emitError(new Error('Incomplete Content-Length header.'), 'content-length');
+            this.buffer = Buffer.alloc(0);
+          }
+          return;
+        }
+        const rawHeaders = this.buffer.subarray(0, end.index).toString('ascii');
+        const headers = rawHeaders.split(/\r?\n/);
+        const lengthHeader = headers.find((line) => /^\s*content-length\s*:/i.test(line));
+        const rawLength = lengthHeader && lengthHeader.replace(/^[^:]*:/, '').trim();
+        const length = rawLength && /^\d+$/.test(rawLength) ? Number(rawLength) : NaN;
+        if (!Number.isSafeInteger(length) || length < 0 || length > this.maxFrameBytes) {
+          this._emitError(new Error('Invalid Content-Length header.'), 'content-length');
+          this.buffer = this.buffer.subarray(end.index + end.length);
+          continue;
+        }
+        const bodyStart = end.index + end.length;
+        if (this.buffer.length - bodyStart < length) {
+          if (flush) {
+            this._emitError(new Error('Incomplete Content-Length body.'), 'content-length');
+            this.buffer = Buffer.alloc(0);
+          }
+          return;
+        }
+        const body = this.buffer.subarray(bodyStart, bodyStart + length);
+        this.buffer = this.buffer.subarray(bodyStart + length);
+        this._emitBody(body, 'content-length');
+        continue;
+      }
+
+      const newline = this.buffer.indexOf(0x0a);
+      if (newline < 0) {
+        if (!flush) return;
+        const body = this.buffer;
+        this.buffer = Buffer.alloc(0);
+        if (body.toString('utf8').trim()) this._emitBody(body, 'newline');
+        continue;
+      }
+      const body = this.buffer.subarray(0, newline);
+      this.buffer = this.buffer.subarray(newline + 1);
+      if (body.toString('utf8').trim()) this._emitBody(body, 'newline');
+    }
+  }
+}
+
+function createFrameWriter(output, options = {}) {
+  const secrets = options.secrets || [];
+  return function writeFrame(message, framing = 'newline') {
+    const body = Buffer.from(JSON.stringify(redactValue(message, secrets)), 'utf8');
+    if (framing === 'content-length') {
+      output.write(Buffer.from(`Content-Length: ${body.length}\r\n\r\n`, 'ascii'));
+      output.write(body);
+      return;
+    }
+    output.write(body);
+    output.write('\n');
+  };
+}
+
+function rpcError(id, code, message, data) {
+  const error = { code, message };
+  if (data !== undefined) error.data = data;
+  return { jsonrpc: '2.0', id: id == null ? null : id, error };
+}
+
+function requestIds(message) {
+  const messages = Array.isArray(message) ? message : [message];
+  return messages
+    .filter((item) => item && typeof item === 'object'
+      && typeof item.method === 'string'
+      && Object.prototype.hasOwnProperty.call(item, 'id'))
+    .map((item) => item.id);
+}
+
+function idKey(id) {
+  return `${typeof id}:${JSON.stringify(id)}`;
+}
+
+function validRpcMessage(message) {
+  if (!message || typeof message !== 'object' || Array.isArray(message)) return false;
+  if (message.jsonrpc !== '2.0') return false;
+  if (typeof message.method === 'string') return true;
+  return Object.prototype.hasOwnProperty.call(message, 'id')
+    && (Object.prototype.hasOwnProperty.call(message, 'result')
+      || Object.prototype.hasOwnProperty.call(message, 'error'));
+}
+
+function validRpcPayload(payload) {
+  return Array.isArray(payload)
+    ? payload.length > 0 && payload.every(validRpcMessage)
+    : validRpcMessage(payload);
+}
+
+function isCancellation(payload) {
+  const messages = Array.isArray(payload) ? payload : [payload];
+  return messages.some((message) => message
+    && message.method === 'notifications/cancelled');
+}
+
+async function serveStdio(projectDir, options = {}) {
+  const input = options.input || process.stdin;
+  const output = options.output || process.stdout;
+  const errorOutput = options.error || process.stderr;
+  const config = options.config || loadProjectConfig(projectDir);
+  const token = String(config.token || config.sat || '');
+  const secrets = [token].filter(Boolean);
+  const client = options.client || new DraftGoMcpClient(config);
+  const writeFrame = createFrameWriter(output, { secrets });
+  const pending = new Set();
+  let initializePending = null;
+  let ended = false;
+
+  const reportStreamError = (error) => {
+    const text = redactText(error && error.message ? error.message : error, secrets);
+    errorOutput.write(`draftgo mcp serve: ${text}\n`);
+  };
+
+  const dispatch = async (message, framing) => {
+    if (!validRpcPayload(message)) {
+      writeFrame(rpcError(null, -32600, 'Invalid Request'), framing);
+      return;
+    }
+    const responded = new Set();
+    try {
+      await client.forward(message, {
+        onMessage(remoteMessage) {
+          if (remoteMessage && typeof remoteMessage === 'object' && !remoteMessage.method
+              && Object.prototype.hasOwnProperty.call(remoteMessage, 'id')) {
+            responded.add(idKey(remoteMessage.id));
+          }
+          writeFrame(remoteMessage, framing);
+        },
+      });
+      const missing = requestIds(message).filter((id) => !responded.has(idKey(id)));
+      if (missing.length) {
+        const errors = missing.map((id) => rpcError(id, -32000, 'DraftGo MCP returned no response.'));
+        writeFrame(errors.length === 1 ? errors[0] : errors, framing);
+      }
+    } catch (error) {
+      let missing = requestIds(message).filter((id) => !responded.has(idKey(id)));
+      if (!missing.length) {
+        reportStreamError(error);
+        return;
+      }
+      if (error && error.rpc) {
+        const rpc = redactValue(error.rpc, secrets);
+        writeFrame(rpc, framing);
+        for (const response of Array.isArray(rpc) ? rpc : [rpc]) {
+          if (response && Object.prototype.hasOwnProperty.call(response, 'id')) {
+            responded.add(idKey(response.id));
+          }
+        }
+        missing = missing.filter((id) => !responded.has(idKey(id)));
+        if (!missing.length) return;
+      }
+      const code = Number.isInteger(error && error.code) ? error.code : -32000;
+      const safeMessage = redactText(error && error.message ? error.message : error, secrets);
+      const errors = missing.map((id) => rpcError(id, code, safeMessage || 'DraftGo MCP bridge error.'));
+      writeFrame(errors.length === 1 ? errors[0] : errors, framing);
+    }
+  };
+
+  const track = (promise) => {
+    pending.add(promise);
+    promise.finally(() => pending.delete(promise));
+    return promise;
+  };
+
+  const parser = new StdioFrameParser((message, framing) => {
+    const messages = Array.isArray(message) ? message : [message];
+    const hasInitialize = messages.some((item) => item && item.method === 'initialize');
+    let task;
+    if (hasInitialize) {
+      task = dispatch(message, framing);
+      initializePending = task.finally(() => { initializePending = null; });
+    } else if (initializePending && !isCancellation(message)) {
+      task = initializePending.then(() => dispatch(message, framing));
+    } else {
+      task = dispatch(message, framing);
+    }
+    track(Promise.resolve(task).catch(reportStreamError));
+  }, (error, framing) => {
+    writeFrame(rpcError(null, -32700, 'Parse error'), framing);
+    reportStreamError(error);
+  }, options);
+
+  return new Promise((resolve, reject) => {
+    const finish = async () => {
+      if (ended) return;
+      ended = true;
+      parser.end();
+      await Promise.allSettled([...pending]);
+      resolve(0);
+    };
+    input.on('data', (chunk) => parser.push(chunk));
+    input.once('end', finish);
+    input.once('error', (error) => {
+      reportStreamError(error);
+      reject(error);
+    });
+    if (input.readableEnded || input.destroyed) queueMicrotask(finish);
+    else if (typeof input.resume === 'function') input.resume();
+  });
+}
+
+module.exports = {
+  DEFAULT_MAX_FRAME_BYTES,
+  StdioFrameParser,
+  createFrameWriter,
+  rpcError,
+  serveStdio,
+};

package/src/mcp/tools.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { DraftGoMcpClient, TOOL_ALIASES } = require('./client');
+const { WorktreeError } = require('../worktree/errors');
+const { unwrapToolResult, unwrapProtectedResult, toolNameMatches } = require('../worktree/backend');
+
+const TOOL_NAMES = Object.freeze({
+  projectOverview: 'draftgo_project_overview',
+  resourceList: 'draftgo_resource_list',
+  resourceSearch: 'draftgo_resource_search',
+  resourceMetadata: 'draftgo_resource_get_metadata',
+  resourceFragment: 'draftgo_resource_read_fragment',
+  apiSearch: 'draftgo_api_search',
+  apiDescribe: 'draftgo_api_describe',
+  apiCall: 'draftgo_api_call',
+});
+
+// Keep server-generation naming compatibility at the protocol boundary so
+// commands only deal with one canonical Registry contract.
+const PROTECTED_RESOURCE_TOOLS = new Set([
+  TOOL_NAMES.resourceList,
+  TOOL_NAMES.resourceSearch,
+  TOOL_NAMES.resourceMetadata,
+  TOOL_NAMES.resourceFragment,
+]);
+
+async function openToolSession(config, expected = [], options = {}) {
+  const client = options.client || new DraftGoMcpClient(config);
+  const initialized = options.clientInitialized ? null : await client.initialize(options);
+  const tools = options.tools || await client.listAllTools(options);
+  const names = {};
+  for (const expectedName of expected) {
+    const aliases = TOOL_ALIASES[expectedName] || [expectedName];
+    const found = aliases.map((alias) => tools.find((tool) => tool
+      && toolNameMatches(String(tool.name || ''), alias))).find(Boolean);
+    if (!found) throw new WorktreeError('MCP_TOOL_UNAVAILABLE', `${expectedName} is not available.`);
+    names[expectedName] = found.name;
+  }
+  return { client, initialized, tools, names };
+}
+
+async function callStructured(session, expectedName, args = {}, options = {}) {
+  const name = session.names[expectedName] || expectedName;
+  const result = await session.client.toolsCall(name, args, options);
+  const data = unwrapToolResult(result);
+  return PROTECTED_RESOURCE_TOOLS.has(expectedName)
+    ? unwrapProtectedResult(data, expectedName)
+    : data;
+}
+
+module.exports = { TOOL_NAMES, TOOL_ALIASES, openToolSession, callStructured };

package/src/paths.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const path = require('path');
+
+// Resource dir inside the package (bundled with npm publish)
+const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const RESOURCES_DIR = path.join(PACKAGE_ROOT, 'resources');
+
+// In-project runtime data root: <project>/.draftgo
+// The skill body itself NO LONGER lives here; it is rendered into each
+// AI tool's own directory (see src/platforms.js). Only runtime data and
+// CLI config stay under .draftgo/.
+const DG_DIR_NAME = '.draftgo';
+const VERSION_FILE = '.version';
+
+function dgDir(projectDir) {
+  return path.join(projectDir, DG_DIR_NAME);
+}
+
+// CLI version marker now lives at <project>/.draftgo/.version
+function versionFile(projectDir) {
+  return path.join(dgDir(projectDir), VERSION_FILE);
+}
+
+module.exports = {
+  PACKAGE_ROOT,
+  RESOURCES_DIR,
+  DG_DIR_NAME,
+  VERSION_FILE,
+  dgDir,
+  versionFile,
+};