draftgo-cli 3.0.39 → 3.0.43

package/src/mcp/client.js

@@ -7,11 +7,14 @@ const {
   postJsonRpc,
   redactText,
 } = require('./protocol');
+const { allWithAbort } = require('./parallel');
 
 const SAFE_TEST_TOOLS = [
   'draftgo_project_overview',
   'draftgo_resource_list',
   'draftgo_api_search',
+  'draftgo_api_describe',
+  'draftgo_api_call',
 ];
 
 const REQUIRED_DRAFTGO_TOOLS = [
@@ -25,6 +28,33 @@ const REQUIRED_DRAFTGO_TOOLS = [
   'draftgo_api_call',
 ];
 
+function diagnosticArguments(canonicalName) {
+  if (canonicalName === 'draftgo_resource_list') {
+    return { resource_type: 'pages', limit: 1 };
+  }
+  if (canonicalName === 'draftgo_api_search') return { query: 'project', limit: 1 };
+  return {};
+}
+
+function diagnosticData(result) {
+  let value = result;
+  if (value && value.structuredContent) value = value.structuredContent;
+  else if (value && value.structured_content) value = value.structured_content;
+  if (value && value.data) value = value.data;
+  if (value && Object.prototype.hasOwnProperty.call(value, 'value')) value = value.value;
+  return value;
+}
+
+function findDBMetaListOperation(result) {
+  const value = diagnosticData(result);
+  const items = value && Array.isArray(value.items) ? value.items : [];
+  return items.find((operation) => operation
+    && String(operation.method || '').toUpperCase() === 'GET'
+    && String(operation.resource_type || '').toLowerCase() === 'db_meta'
+    && String(operation.path || operation.path_template || '') === '/api/db-meta'
+    && operation.destructive !== true) || null;
+}
+
 class McpRpcError extends Error {
   constructor(message, { code = -32000, data, id = null } = {}) {
     super(message);
@@ -35,6 +65,40 @@ class McpRpcError extends Error {
   }
 }
 
+function diagnosticNextCursor(result) {
+  const value = diagnosticData(result);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const hasMore = value.has_more === true || value.hasMore === true;
+
+  let cursor;
+  let present = false;
+  if (Object.prototype.hasOwnProperty.call(value, 'next_cursor')) {
+    cursor = value.next_cursor;
+    present = true;
+  } else if (Object.prototype.hasOwnProperty.call(value, 'nextCursor')) {
+    cursor = value.nextCursor;
+    present = true;
+  } else if (hasMore) {
+    if (!Object.prototype.hasOwnProperty.call(value, 'cursor')) {
+      throw new McpRpcError('DraftGo api_search reported more pages without a cursor.');
+    }
+    cursor = value.cursor;
+    present = true;
+  }
+
+  if (!present) return null;
+  if (cursor == null || cursor === '') {
+    if (hasMore) {
+      throw new McpRpcError('DraftGo api_search reported more pages with an empty cursor.');
+    }
+    return null;
+  }
+  if (typeof cursor !== 'string' || !cursor.trim()) {
+    throw new McpRpcError('DraftGo api_search returned an invalid cursor.');
+  }
+  return cursor;
+}
+
 function redactValue(value, secrets = [], seen = new WeakMap()) {
   if (typeof value === 'string') return redactText(value, secrets);
   if (!value || typeof value !== 'object') return value;
@@ -222,30 +286,118 @@ class DraftGoMcpClient {
     if (missing.length) {
       throw new McpRpcError(`DraftGo MCP is missing required tools: ${missing.join(', ')}.`, { code: -32601 });
     }
-    const required = options.safeTools || SAFE_TEST_TOOLS;
-    const selected = tools.find((tool) => tool && typeof tool.name === 'string'
-      && required.some((candidate) => toolMatches(tool.name, candidate)));
-    if (!selected) {
+    const safeTools = options.safeTools || SAFE_TEST_TOOLS;
+    const hasDiagnosticOverrides = Boolean(options.requiredTools || options.safeTools);
+    const firstSafeTool = tools.find((tool) => tool && typeof tool.name === 'string'
+      && safeTools.some((canonical) => toolMatches(tool.name, canonical)));
+    if (!firstSafeTool) {
       throw new McpRpcError(
-        `DraftGo MCP exposes no safe diagnostic tool (${required.join(', ')}).`,
+        `DraftGo MCP exposes no safe diagnostic tool (${safeTools.join(', ')}).`,
         { code: -32601 },
       );
     }
 
-    const canonical = required.find((candidate) => toolMatches(selected.name, candidate));
-    const defaultArguments = canonical === 'draftgo_api_search' ? { query: 'project' } : {};
-    const toolResult = await this.toolsCall(
-      selected.name,
-      options.toolArguments || defaultArguments,
-      options,
-    );
+    const selected = safeTools.map((canonical) => ({
+      canonical,
+      tool: tools.find((candidate) => candidate && typeof candidate.name === 'string'
+        && toolMatches(candidate.name, canonical)),
+    })).filter((entry) => entry.tool);
+    const byCanonical = Object.fromEntries(selected.map((entry) => [entry.canonical, entry.tool]));
+    const overrideCanonical = safeTools.find((canonical) => toolMatches(firstSafeTool.name, canonical));
+    const defaultPlan = hasDiagnosticOverrides ? [{
+      label: overrideCanonical,
+      canonical: overrideCanonical,
+      tool: firstSafeTool,
+      args: diagnosticArguments(overrideCanonical),
+    }] : [
+      { label: 'project', canonical: 'draftgo_project_overview', tool: byCanonical.draftgo_project_overview, args: {} },
+      ...['pages', 'navigations', 'docs/articles'].map((resourceType) => ({
+        label: `resource:${resourceType}`,
+        canonical: 'draftgo_resource_list',
+        tool: byCanonical.draftgo_resource_list,
+        args: { resource_type: resourceType, limit: 1 },
+      })),
+      {
+        label: 'api:db_meta',
+        canonical: 'draftgo_api_search',
+        tool: byCanonical.draftgo_api_search,
+        args: { resource_type: 'db_meta', limit: 100 },
+      },
+    ];
+    const runPlan = (plan, startIndex = 0) => allWithAbort(plan.map((entry, offset) =>
+      async (queryOptions) => ({
+        label: entry.label,
+        canonical: entry.canonical,
+        name: entry.tool.name,
+        arguments: options.toolArguments && startIndex + offset === 0
+          ? options.toolArguments
+          : entry.args,
+        result: await this.toolsCall(
+          entry.tool.name,
+          options.toolArguments && startIndex + offset === 0
+            ? options.toolArguments
+            : entry.args,
+          queryOptions,
+        ),
+      })), options);
+    const tested = await runPlan(defaultPlan);
+    if (!hasDiagnosticOverrides) {
+      let discovery = tested.find((entry) => entry.label === 'api:db_meta');
+      let operation = discovery && findDBMetaListOperation(discovery.result);
+      const seenCursors = new Set();
+      const maxPages = Number(options.maxPages || 100);
+      let page = 1;
+      while (!operation) {
+        const cursor = diagnosticNextCursor(discovery && discovery.result);
+        if (cursor == null) break;
+        if (seenCursors.has(cursor)) {
+          throw new McpRpcError('DraftGo api_search repeated a db_meta cursor.');
+        }
+        seenCursors.add(cursor);
+        if (page >= maxPages) {
+          throw new McpRpcError(`DraftGo api_search exceeded ${maxPages} db_meta pages.`);
+        }
+        page += 1;
+        [discovery] = await runPlan([{
+          label: `api:db_meta:page-${page}`,
+          canonical: 'draftgo_api_search',
+          tool: byCanonical.draftgo_api_search,
+          args: { resource_type: 'db_meta', limit: 100, cursor },
+        }], tested.length);
+        tested.push(discovery);
+        operation = findDBMetaListOperation(discovery.result);
+      }
+      if (!operation || !operation.operation_id) {
+        throw new McpRpcError('DraftGo MCP exposes no read-only GET /api/db-meta operation.', {
+          code: -32601,
+        });
+      }
+      const operationID = String(operation.operation_id);
+      tested.push(...await runPlan([
+        {
+          label: 'api:describe-db_meta',
+          canonical: 'draftgo_api_describe',
+          tool: byCanonical.draftgo_api_describe,
+          args: { operation_id: operationID },
+        },
+        {
+          label: 'api:call-db_meta',
+          canonical: 'draftgo_api_call',
+          tool: byCanonical.draftgo_api_call,
+          args: { operation_id: operationID, query: { page: 1, page_size: 1 } },
+        },
+      ], tested.length));
+    }
     return {
       initialized,
       protocolVersion: this.protocolVersion,
       sessionId: this.sessionId,
       tools,
-      testedTool: selected.name,
-      toolResult,
+      testedTool: tested[0].name,
+      toolResult: tested[0].result,
+      testedTools: [...new Set(tested.map((entry) => entry.name))],
+      testedCalls: tested.map((entry) => entry.label),
+      diagnosticResults: tested,
     };
   }
 }
@@ -268,6 +420,10 @@ module.exports = {
   McpHttpError,
   SAFE_TEST_TOOLS,
   REQUIRED_DRAFTGO_TOOLS,
+  diagnosticArguments,
+  diagnosticData,
+  diagnosticNextCursor,
+  findDBMetaListOperation,
   redactValue,
   testConnection,
   callTool,

package/src/mcp/parallel.js

@@ -0,0 +1,31 @@
+'use strict';
+
+async function allWithAbort(taskFactories, options = {}) {
+  if (!Array.isArray(taskFactories) || taskFactories.some((task) => typeof task !== 'function')) {
+    throw new TypeError('Parallel MCP tasks must be functions.');
+  }
+  const externalSignal = options.signal;
+  if (externalSignal && externalSignal.aborted) {
+    if (typeof externalSignal.throwIfAborted === 'function') externalSignal.throwIfAborted();
+    const error = new Error('Parallel MCP tasks were aborted before they started.');
+    error.name = 'AbortError';
+    throw error;
+  }
+
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort(externalSignal.reason);
+  if (externalSignal) {
+    externalSignal.addEventListener('abort', forwardAbort, { once: true });
+  }
+  try {
+    const taskOptions = { ...options, signal: controller.signal };
+    return await Promise.all(taskFactories.map((task) => task(taskOptions)));
+  } catch (error) {
+    if (!controller.signal.aborted) controller.abort(error);
+    throw error;
+  } finally {
+    if (externalSignal) externalSignal.removeEventListener('abort', forwardAbort);
+  }
+}
+
+module.exports = { allWithAbort };

package/src/mcp/protocol.js

@@ -22,9 +22,10 @@ function redactText(value, secrets = []) {
 
 function endpointFor(config) {
   const server = new URL(String(config.server || config.mcp_url));
+  const serverPath = server.pathname.replace(/\/+$/, '');
   const endpoint = config.mcp_url
     ? new URL(String(config.mcp_url), server)
-    : new URL(`${server.pathname.replace(/\/+$/, '')}/mcp`, server);
+    : new URL(`${serverPath}/mcp`, server);
   if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
     throw new McpHttpError('DraftGo MCP endpoint must be a credential-free HTTP(S) URL.');
   }

package/src/projectConfig.js

@@ -11,16 +11,42 @@ const IGNORE_ENTRIES = [
   '.draftgo/conflicts/',
 ];
 
-function normalizeServer(raw) {
+function parseHttpUrl(raw) {
   let value = String(raw || '').trim();
-  if (!value) return '';
+  if (!value) return null;
   if (!/^https?:\/\//i.test(value)) value = `http://${value}`;
   const parsed = new URL(value);
   if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password
       || parsed.search || parsed.hash) {
     throw new Error('DraftGo server must be an absolute HTTP(S) URL without credentials, query, or fragment.');
   }
-  return value.replace(/\/+$/, '');
+  return parsed;
+}
+
+function normalizeServer(raw) {
+  const parsed = parseHttpUrl(raw);
+  if (!parsed) return '';
+  return parsed.toString().replace(/\/+$/, '');
+}
+
+function normalizeMcpEndpoint(raw) {
+  const parsed = parseHttpUrl(raw);
+  return parsed ? parsed.toString() : '';
+}
+
+function normalizeConnection(raw) {
+  const value = normalizeMcpEndpoint(raw);
+  if (!value) return { server: '', mcp_url: '' };
+  const parsed = new URL(value);
+  const pathname = parsed.pathname.replace(/\/+$/, '');
+  if (!pathname.toLowerCase().endsWith('/mcp')) {
+    return { server: '', mcp_url: value };
+  }
+  parsed.pathname = pathname.slice(0, -4) || '/';
+  return {
+    server: parsed.toString().replace(/\/+$/, ''),
+    mcp_url: value,
+  };
 }
 
 function configPath(projectDir) {
@@ -65,7 +91,7 @@ function writePrivateJson(file, value) {
   try { fs.chmodSync(file, 0o600); } catch { /* Windows ACLs are inherited. */ }
 }
 
-function writeProjectConfig(projectDir, server, token) {
+function writeProjectConfig(projectDir, server, token, options = {}) {
   const normalizedServer = normalizeServer(server);
   const sat = String(token || '').trim();
   if (!normalizedServer) throw new Error('DraftGo server is required.');
@@ -77,6 +103,8 @@ function writeProjectConfig(projectDir, server, token) {
     token: sat,
     auto_push: existing.auto_push === true,
   };
+  if (options.mcp_url) config.mcp_url = normalizeMcpEndpoint(options.mcp_url);
+  else delete config.mcp_url;
   const file = configPath(projectDir);
   writePrivateJson(file, config);
   ensureProjectIgnores(projectDir);
@@ -88,16 +116,22 @@ function loadProjectConfig(projectDir, { requireToken = true } = {}) {
   if (!exists(file)) throw new Error('Missing .draftgo/config.json; run `draftgo connect` first.');
   const config = readExisting(projectDir);
   const server = normalizeServer(config.server);
+  const mcpUrl = config.mcp_url ? normalizeMcpEndpoint(config.mcp_url) : '';
   const token = String(config.token || config.sat || '').trim();
   if (!server) throw new Error('DraftGo project config is missing server.');
   if (requireToken && !token) throw new Error('DraftGo project config is missing SAT.');
-  return { ...config, server, token, path: file };
+  const result = { ...config, server, token, path: file };
+  if (mcpUrl) result.mcp_url = mcpUrl;
+  else delete result.mcp_url;
+  return result;
 }
 
 module.exports = {
   IGNORE_ENTRIES,
   configPath,
   normalizeServer,
+  normalizeMcpEndpoint,
+  normalizeConnection,
   ensureProjectIgnores,
   writeProjectConfig,
   loadProjectConfig,

package/src/skill.js

@@ -9,6 +9,7 @@
 //   {{SKILL_DIR}}     → platform's project-relative skill dir (forward slashes)
 //   {{SKILL_SCRIPTS}} → {{SKILL_DIR}}/scripts
 
+const crypto = require('crypto');
 const path = require('path');
 const fs = require('fs');
 const { RESOURCES_DIR } = require('./paths');
@@ -19,6 +20,8 @@ const {
 } = require('./fsx');
 
 const SKILL_SOURCE_DIR = path.join(RESOURCES_DIR, 'skill');
+const MAX_VERSION_FILE_BYTES = 128;
+const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 
 function getPackageVersion() {
   try {
@@ -29,12 +32,71 @@ function getPackageVersion() {
 }
 
 function readInstalledVersion(projectDir) {
-  const f = paths.versionFile(projectDir);
-  return exists(f) ? readText(f).trim() : null;
+  const file = paths.versionFile(projectDir);
+  let linkStat;
+  try {
+    linkStat = fs.lstatSync(file);
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return null;
+    throw error;
+  }
+  if (linkStat.isSymbolicLink() || !linkStat.isFile()) {
+    throw new Error('Invalid .draftgo/.version: expected a regular file.');
+  }
+
+  let descriptor;
+  let raw;
+  try {
+    const noFollow = Number.isInteger(fs.constants.O_NOFOLLOW) ? fs.constants.O_NOFOLLOW : 0;
+    descriptor = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.size > MAX_VERSION_FILE_BYTES) {
+      throw new Error('Invalid .draftgo/.version: file is too large or not regular.');
+    }
+    const buffer = Buffer.alloc(MAX_VERSION_FILE_BYTES + 1);
+    const bytes = fs.readSync(descriptor, buffer, 0, buffer.length, 0);
+    if (bytes > MAX_VERSION_FILE_BYTES) {
+      throw new Error('Invalid .draftgo/.version: file exceeds 128 bytes.');
+    }
+    raw = buffer.subarray(0, bytes).toString('utf8');
+  } catch (error) {
+    if (error && error.code === 'ELOOP') {
+      throw new Error('Invalid .draftgo/.version: symbolic links are not allowed.');
+    }
+    throw error;
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
+
+  const version = raw.trim();
+  const validLineEnding = raw === version || raw === `${version}\n` || raw === `${version}\r\n`;
+  if (!validLineEnding || !VERSION_PATTERN.test(version)) {
+    throw new Error('Invalid .draftgo/.version: expected one semantic version.');
+  }
+  return version;
 }
 
 function writeInstalledVersion(projectDir) {
-  writeText(paths.versionFile(projectDir), getPackageVersion() + '\n');
+  const file = paths.versionFile(projectDir);
+  ensureDir(path.dirname(file));
+  const temporary = path.join(
+    path.dirname(file),
+    `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(8).toString('hex')}.tmp`,
+  );
+  let descriptor;
+  try {
+    descriptor = fs.openSync(temporary, 'wx', 0o600);
+    fs.writeFileSync(descriptor, getPackageVersion() + '\n', 'utf8');
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    fs.renameSync(temporary, file);
+  } finally {
+    if (descriptor !== undefined) {
+      try { fs.closeSync(descriptor); } catch { /* Preserve the original failure. */ }
+    }
+    try { fs.rmSync(temporary, { force: true }); } catch { /* Best-effort cleanup. */ }
+  }
 }
 
 function renderFrontmatter(fm) {

package/src/timeout.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const MAX_TIMEOUT_MS = 2_147_483_647;
+
+function parseTimeout(value) {
+  if (value == null) return undefined;
+  const text = String(value).trim();
+  if (!/^\d+$/.test(text)) {
+    throw new TypeError('--timeout must be a positive integer in milliseconds.');
+  }
+  const timeoutMs = Number(text);
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_TIMEOUT_MS) {
+    throw new TypeError(`--timeout must be between 1 and ${MAX_TIMEOUT_MS} milliseconds.`);
+  }
+  return timeoutMs;
+}
+
+module.exports = { MAX_TIMEOUT_MS, parseTimeout };