hive-intelligence 1.8.0 → 1.10.0

package/build/serve-2ICWEUMC.js

@@ -0,0 +1,126 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import "./chunk-OMO7XLC5.js";
+
+// src/cli/serve.ts
+import dotenv from "dotenv";
+function resolveStdioMode(opts = {}, env = process.env) {
+  return opts.local || env.HIVE_STDIO_MODE?.toLowerCase() === "local" ? "local" : "proxy";
+}
+function updateNotice(pending, running) {
+  return pending ? `A newer Hive version (${pending}) is available; this server is running ${running}. Tell the user to run "hive upgrade" and restart this client to get the latest tools and data.` : void 0;
+}
+function bridgeTransports(local, remote, opts) {
+  local.onmessage = (message) => {
+    remote.send(message).catch((err) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      const hint = /\b401\b|unauthori[sz]ed/i.test(reason) ? ` Run "hive auth login" or set HIVE_API_KEY in this server's env.` : "";
+      process.stderr.write(`Hive proxy: ${reason}
+`);
+      if ("method" in message && "id" in message) {
+        void local.send({
+          jsonrpc: "2.0",
+          id: message.id,
+          error: {
+            code: -32603,
+            message: `Hive could not reach ${opts.remoteUrl}: ${reason}.${hint}`
+          }
+        });
+      }
+    });
+  };
+  remote.onmessage = (message) => {
+    const result = "result" in message ? message.result : void 0;
+    if (typeof result?.protocolVersion === "string") {
+      remote.setProtocolVersion?.(result.protocolVersion);
+      const notice = opts.notice?.();
+      if (notice && "result" in message) {
+        const instructions = [result.instructions, notice].filter((part) => typeof part === "string" && part).join("\n\n");
+        message = { ...message, result: { ...message.result, instructions } };
+      }
+    }
+    void local.send(message);
+  };
+  remote.onerror = (err) => process.stderr.write(`Hive proxy: ${err.message}
+`);
+  local.onclose = () => void remote.close();
+}
+async function startStdio(envFile, opts = {}) {
+  dotenv.config({ path: envFile || ".env", quiet: true });
+  console.log = (...args) => console.error("[LOG]", ...args);
+  if (resolveStdioMode(opts) === "proxy") return startStdioProxy();
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { createHiveMcpServer, SERVER_NAME, SERVER_VERSION } = await import("./mcpServer-T3DYYFCC.js");
+  const { getPendingUpdateVersion } = await import("./update-check-36QU6PKA.js");
+  const transport = new StdioServerTransport();
+  const pendingUpdate = getPendingUpdateVersion();
+  const instructionsSuffix = updateNotice(pendingUpdate, SERVER_VERSION);
+  const mcpServer = createHiveMcpServer(
+    { kind: "root" },
+    { instructionsSuffix }
+  );
+  const server = mcpServer.getServer();
+  let isShuttingDown = false;
+  const shutdown = async () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    const forceTimer = setTimeout(() => process.exit(1), 3e3);
+    forceTimer.unref();
+    try {
+      await server.close();
+    } catch {
+    }
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  process.stdin.on("end", shutdown);
+  await server.connect(transport);
+  console.error(
+    `Hive MCP stdio server connected (${SERVER_NAME} v${SERVER_VERSION}, local providers)`
+  );
+}
+async function startStdioProxy() {
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+  const { resolveApiKey, resolveApiUrl } = await import("./config-dir-2QLA5PXD.js");
+  const { getPendingUpdateVersion } = await import("./update-check-36QU6PKA.js");
+  const { SERVER_VERSION } = await import("./version-ITRM4X2U.js");
+  const remoteUrl = `${resolveApiUrl().replace(/\/+$/, "")}/mcp`;
+  const apiKey = resolveApiKey();
+  const remote = new StreamableHTTPClientTransport(new URL(remoteUrl), {
+    requestInit: {
+      headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+    }
+  });
+  const local = new StdioServerTransport();
+  bridgeTransports(local, remote, {
+    remoteUrl,
+    notice: () => updateNotice(getPendingUpdateVersion(), SERVER_VERSION)
+  });
+  if (Object.keys(process.env).some(
+    (k) => /^(COINGECKO|ALCHEMY|GOPLUS|HELIUS|MORALIS|TENDERLY)_/.test(k)
+  )) {
+    console.error(
+      "Hive: provider keys found in env but ignored; hosted Hive serves every provider. Set HIVE_STDIO_MODE=local to run providers with your own keys."
+    );
+  }
+  process.stdin.on("end", () => process.exit(0));
+  await remote.start();
+  await local.start();
+  console.error(
+    `Hive MCP stdio proxy v${SERVER_VERSION} -> ${remoteUrl} (${apiKey ? "API key" : 'keyless: discovery + free hero calls; run "hive auth login" for the full catalog'}). Self-host with your own provider keys: hive serve --local`
+  );
+}
+async function startHttp(port, envFile) {
+  dotenv.config({ path: envFile || ".env", quiet: true });
+  process.env.PORT = String(port);
+  const { startHttpServer } = await import("./server.js");
+  await startHttpServer();
+}
+export {
+  bridgeTransports,
+  resolveStdioMode,
+  startHttp,
+  startStdio,
+  updateNotice
+};

package/build/server.js

@@ -5,8 +5,10 @@ import {
   consumeCredits,
   ensureWallet,
   executeToolByName,
-  getWalletStatus
-} from "./chunk-ORJIFYF4.js";
+  getWalletStatus,
+  refundCredits,
+  refundSettled
+} from "./chunk-E2FAHUXM.js";
 import {
   CategoryEndpoints,
   HERO_TOOL_NAMES,
@@ -102,7 +104,7 @@ import {
   validateEndpointArgs,
   verifyApiKey,
   waitForRedisAvailability
-} from "./chunk-HWV3XFXH.js";
+} from "./chunk-Z42XNN47.js";
 import {
   HIVE_AGENT_SKILLS
 } from "./chunk-4QDGA6GP.js";
@@ -2598,10 +2600,11 @@ async function debitApiKeyCreditForExecution(req, res) {
   const result = authReq.unkeyResult;
   if (!result || !authReq.userId) return;
   try {
+    const idempotencyKey = authReq.creditDebitIdempotencyKey ?? randomUUID();
     const consumeResult = await consumeCredits({
       userId: authReq.userId,
       cost: REQUEST_COST,
-      idempotencyKey: authReq.creditDebitIdempotencyKey ?? randomUUID(),
+      idempotencyKey,
       requestId: req.requestId,
       keyId: authReq.unkeyKeyId
     });
@@ -2627,6 +2630,7 @@ async function debitApiKeyCreditForExecution(req, res) {
       };
     }
     authReq.quotaRemaining = consumeResult.balance ?? void 0;
+    authReq.creditDebitedKey = idempotencyKey;
     authReq.idempotencyExecutionStarted = true;
     res.setHeader(
       "X-Quota-Remaining",
@@ -5556,6 +5560,23 @@ async function consumeAnonMaterialQuota(ipHash, overrides = {}) {
     return { allowed: false, reason: "unavailable" };
   }
 }
+async function refundAnonMaterialQuota(ipHash) {
+  try {
+    if (!isSupabaseConfigured()) return void 0;
+    const { data, error } = await getSupabaseAdmin().rpc(
+      "refund_anon_daily_quota",
+      { p_ip_hash: ipHash, p_ip_limit: getAnonDailyMaterialCap() }
+    );
+    if (error) throw new Error(error.message);
+    const row = Array.isArray(data) ? data[0] : data;
+    return typeof row?.remaining === "number" ? row.remaining : void 0;
+  } catch (err) {
+    secureLogger.warn("Anonymous quota refund failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return void 0;
+  }
+}
 
 // src/serverCard.ts
 function buildServerCard() {
@@ -6925,10 +6946,11 @@ function buildMcpQuotaExhaustedCopy(args) {
 }
 async function debitMcpCredits(args) {
   try {
+    const idempotencyKey = randomUUID4();
     const debit = await consumeCredits({
       userId: args.userId,
       cost: 1,
-      idempotencyKey: randomUUID4(),
+      idempotencyKey,
       requestId: args.requestId,
       keyId: args.keyId
     });
@@ -6952,7 +6974,7 @@ async function debitMcpCredits(args) {
         rateLimited: true
       };
     }
-    return { ok: true, balance: debit.balance };
+    return { ok: true, balance: debit.balance, idempotencyKey };
   } catch (err) {
     secureLogger.warn("MCP consume_credits debit failed", {
       error: err instanceof Error ? err.message : String(err)
@@ -6963,6 +6985,32 @@ async function debitMcpCredits(args) {
     };
   }
 }
+async function refundKeyedCredit(res, args) {
+  const refund = await refundCredits({
+    userId: args.userId,
+    debitIdempotencyKey: args.debitIdempotencyKey,
+    detail: {
+      tool: args.toolName,
+      runtime_status: args.runtimeStatus,
+      transport: args.transport
+    }
+  });
+  if (!refundSettled(refund.code)) return { refunded: false };
+  if (!res.headersSent) {
+    res.setHeader(
+      "X-Quota-Remaining",
+      refund.balance === null ? "unlimited" : String(refund.balance)
+    );
+  }
+  return { refunded: true, creditsRemaining: refund.balance };
+}
+async function refundAnonCall(res, ipHash) {
+  const remaining = await refundAnonMaterialQuota(ipHash);
+  if (remaining !== void 0 && !res.headersSent) {
+    res.setHeader("X-Quota-Remaining", String(remaining));
+  }
+  return remaining;
+}
 function extractApiKey(req) {
   return req.headers["x-api-key"] ?? (req.headers.authorization?.startsWith("Bearer ") ? req.headers.authorization.slice(7) : void 0);
 }
@@ -7412,10 +7460,10 @@ function createStatelessMcpHandler(scope) {
     if (!auth.ok && !mcpCredentialPresented(req)) {
       const decision = await authorizeAnonymousMcpRequest(req);
       if (decision.kind === "allow") {
+        const ipHash = anonymousIpHash(ipRateLimitKeyFromRequest(req));
         anonymousLane = {
-          principalRaw: `anon:${anonymousIpHash(
-            ipRateLimitKeyFromRequest(req)
-          )}`,
+          principalRaw: `anon:${ipHash}`,
+          ipHash,
           materialGranted: decision.materialGranted,
           quotaRemaining: decision.quotaRemaining
         };
@@ -7641,6 +7689,8 @@ function createStatelessMcpHandler(scope) {
         clientName: resolveMcpClientName(req, body),
         isInternal: isMonitorSecretRequest(req)
       };
+      let anonCallHeld = anonymousLane?.materialGranted === true;
+      let anonCallBilled = false;
       const server = createHiveMcpServer(scope, {
         requestId: req.requestId,
         analytics,
@@ -7698,6 +7748,7 @@ function createStatelessMcpHandler(scope) {
         beforeToolExecution: keyedAuth?.userId ? async (executedToolName) => {
           const creditCost = getMcpCreditCost(executedToolName);
           let keyedBalance;
+          let debitKey;
           res.setHeader("X-Hive-Credit-Cost", String(creditCost));
           if (creditCost > 0) {
             const debit = await debitMcpCredits({
@@ -7741,10 +7792,22 @@ function createStatelessMcpHandler(scope) {
               debit.balance === null ? "unlimited" : String(debit.balance)
             );
             keyedBalance = debit.balance;
+            debitKey = debit.idempotencyKey;
           }
+          const refund = debitKey ? (reason) => refundKeyedCredit(res, {
+            userId: keyedAuth.userId,
+            debitIdempotencyKey: debitKey,
+            toolName: reason.toolName,
+            runtimeStatus: reason.runtimeStatus,
+            transport: "mcp"
+          }) : void 0;
           if (subjectContext) {
             const materialized = await materializeSubjectContext(subjectContext);
             if (!materialized.ok) {
+              await refund?.({
+                toolName: executedToolName,
+                runtimeStatus: "failing"
+              }).catch(() => void 0);
               return {
                 type: materialized.status === 403 ? "authentication_error" : "internal_error",
                 code: materialized.code,
@@ -7768,7 +7831,8 @@ function createStatelessMcpHandler(scope) {
           return {
             type: "billing",
             credits_used: creditCost,
-            ...creditCost > 0 && { credits_remaining: keyedBalance }
+            ...creditCost > 0 && { credits_remaining: keyedBalance },
+            ...refund && { refund }
           };
         } : anonymousLane ? async (executedToolName) => {
           const creditCost = getMcpCreditCost(executedToolName);
@@ -7790,10 +7854,36 @@ function createStatelessMcpHandler(scope) {
               runtimeStatus: "failing"
             };
           }
+          if (!anonCallHeld) {
+            const quota = await consumeAnonMaterialQuota(
+              anonymousLane.ipHash
+            );
+            if (!quota.allowed) {
+              return {
+                type: "rate_limit_error",
+                code: "ANON_QUOTA_EXCEEDED",
+                message: ANON_QUOTA_EXHAUSTED_MESSAGE,
+                runtimeStatus: "rate_limited"
+              };
+            }
+            anonCallHeld = true;
+            anonymousLane.quotaRemaining = quota.remaining;
+          }
+          anonCallBilled = true;
           return {
             type: "billing",
             credits_used: creditCost,
-            credits_remaining: anonymousLane.quotaRemaining ?? null
+            credits_remaining: anonymousLane.quotaRemaining ?? null,
+            refund: async () => {
+              const remaining = await refundAnonCall(
+                res,
+                anonymousLane.ipHash
+              );
+              if (remaining === void 0) return { refunded: false };
+              anonCallHeld = false;
+              anonymousLane.quotaRemaining = remaining;
+              return { refunded: true, creditsRemaining: remaining };
+            }
           };
         } : void 0
       }).getServer();
@@ -7820,6 +7910,10 @@ function createStatelessMcpHandler(scope) {
           () => transport.handleRequest(req, res, body)
         )
       );
+      if (anonymousLane && anonCallHeld && !anonCallBilled) {
+        anonCallHeld = false;
+        await refundAnonCall(res, anonymousLane.ipHash);
+      }
       secureLogger.debug("MCP request completed", {
         sessionId: sessionCorrelationId,
         scope: scope.kind === "root" ? "root" : `category:${scope.category}`
@@ -8341,6 +8435,7 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
       return;
     }
     res.setHeader("X-Quota-Remaining", String(quota.remaining));
+    let refundAttempted = false;
     const result = await executeEndpoint(heroEndpoint, body?.args ?? {}, {
       transport: "rest",
       requestId: req.requestId,
@@ -8349,7 +8444,12 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
       beforeExecution: async () => ({
         type: "billing",
         credits_used: getMcpCreditCost(toolName),
-        credits_remaining: quota.remaining
+        credits_remaining: quota.remaining,
+        refund: async () => {
+          refundAttempted = true;
+          const remaining = await refundAnonCall(res, ipHash);
+          return remaining === void 0 ? { refunded: false } : { refunded: true, creditsRemaining: remaining };
+        }
       }),
       analytics: {
         principalRaw: `anon:${ipHash}`,
@@ -8358,6 +8458,9 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
         isInternal: isMonitorSecretRequest(req)
       }
     });
+    if (!result.ok && !refundAttempted) {
+      await refundAnonCall(res, ipHash);
+    }
     const meta = buildRestExecutionMeta(
       toolName,
       result.durationMs,
@@ -8413,6 +8516,14 @@ app.post(
     const endpointArgs = authReq.resolvedRestToolArgs ?? { ...args ?? {} };
     const keyedBeforeExecution = async (endpoint) => {
       const blocked = await debitApiKeyCreditForExecution(req, res);
+      const debitKey = authReq.creditDebitedKey;
+      const refund = debitKey && authReq.userId ? (reason) => refundKeyedCredit(res, {
+        userId: authReq.userId,
+        debitIdempotencyKey: debitKey,
+        toolName: reason.toolName,
+        runtimeStatus: reason.runtimeStatus,
+        transport: "rest"
+      }) : void 0;
       if (blocked) {
         if (blocked.code === "QUOTA_EXCEEDED") {
           recordPaywall(req, {
@@ -8431,6 +8542,10 @@ app.post(
           authReq.hiveSubjectContext
         );
         if (!materialized.ok) {
+          await refund?.({
+            toolName: endpoint.tool.name,
+            runtimeStatus: "failing"
+          }).catch(() => void 0);
           return {
             type: materialized.status === 403 ? "authentication_error" : "internal_error",
             code: materialized.code,
@@ -8458,7 +8573,8 @@ app.post(
         credits_used: creditCost,
         ...creditCost > 0 && remainingHeader !== void 0 && {
           credits_remaining: String(remainingHeader) === "unlimited" ? null : Number(remainingHeader)
-        }
+        },
+        ...refund && { refund }
       };
     };
     const heroEndpoint = HERO_TOOL_NAMES.has(executionToolName) ? getRestHeroEndpoint(executionToolName) : void 0;

package/build/stdio.js

@@ -6,7 +6,7 @@ import {
 import {
   createHiveMcpServer,
   secureLogger
-} from "./chunk-HWV3XFXH.js";
+} from "./chunk-Z42XNN47.js";
 import "./chunk-4QDGA6GP.js";
 import "./chunk-EPF36Q3Z.js";
 import {

package/build/{tools-NJQPIJ53.js → tools-J6VPDGYP.js}

@@ -92,9 +92,13 @@ Showing ${rangeStart}-${rangeEnd} of ${totalFiltered} tools
 async function searchTools(query) {
   const allTools = await loadToolCatalog();
   const q = query.toLowerCase();
-  const matches = allTools.filter(
-    (t) => t.name.toLowerCase().includes(q) || (t.description ?? "").toLowerCase().includes(q) || (t.title ?? "").toLowerCase().includes(q)
-  );
+  const score = (t) => {
+    const desc = (t.description ?? "").split(/not recommended for:|don't use when:|common mistakes:/i)[0].toLowerCase();
+    if (t.name.toLowerCase().includes(q)) return 3;
+    if ((t.title ?? "").toLowerCase().includes(q)) return 2;
+    return desc.includes(q) ? 1 : 0;
+  };
+  const matches = allTools.map((t) => ({ t, s: score(t) })).filter(({ s }) => s > 0).sort((a, b) => b.s - a.s).map(({ t }) => t);
   const items = matches.map((t) => ({
     name: t.name,
     title: t.title,

package/build/{upgrade-3NR3LAGU.js → upgrade-BJADUTO6.js}

@@ -2,7 +2,7 @@ import { createRequire } from 'node:module'; const require = createRequire(impor
 import {
   detectInstallMode,
   runUpgrade
-} from "./chunk-L4KVJDA7.js";
+} from "./chunk-5IQUEFCD.js";
 import "./chunk-M6REON2I.js";
 import "./chunk-ZXKFJQDE.js";
 import "./chunk-ZDXMZPC6.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hive-intelligence",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Evidence-backed crypto due diligence for AI agents, with sources, freshness, and a runtime receipt on every call.",
   "mcpName": "xyz.hiveintelligence/mcp",
   "type": "module",
@@ -131,7 +131,7 @@
   "dependencies": {
     "@cloudflare/cabidela": "^0.2.4",
     "@coingecko/coingecko-typescript": "^8.0.0",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@supabase/supabase-js": "^2.115.0",
     "@types/compression": "^1.8.1",
     "@unkey/api": "2.5.0",
@@ -140,7 +140,7 @@
     "axios": "^1.20.0",
     "ccxt": "^4.5.77",
     "commander": "^15.0.0",
-    "compression": "^1.8.1",
+    "compression": "^1.8.2",
     "cors": "2.8.6",
     "dotenv": "17.4.2",
     "express": "^5.2.1",
@@ -159,25 +159,25 @@
     "github-actionlint": {
       "adm-zip": "0.6.1"
     },
-    "@modelcontextprotocol/sdk": {
-      "express-rate-limit": "8.5.2"
-    },
     "esbuild": "0.28.1",
-    "fast-uri": "3.1.7",
-    "hono": "4.12.34",
-    "ip-address": "10.5.0",
-    "qs": "6.16.0"
+    "fast-uri": "3.1.8",
+    "hono": "4.13.13",
+    "ip-address": "10.7.3",
+    "qs": "6.16.0",
+    "proxy-addr": "2.0.8",
+    "undici": "7.29.1",
+    "source-map-js": "1.2.2"
   },
   "devDependencies": {
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/node": "^24.13.3",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/coverage-v8": "4.1.11",
     "cross-env": "10.1.0",
     "github-actionlint": "1.7.12",
     "tsup": "8.5.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "bin": {
     "hive": "bin/hive-mcp.js",

package/build/serve-MOP4WYH6.js

@@ -1,49 +0,0 @@
-import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import "./chunk-OMO7XLC5.js";
-
-// src/cli/serve.ts
-import dotenv from "dotenv";
-async function startStdio(envFile) {
-  dotenv.config({ path: envFile || ".env", quiet: true });
-  console.log = (...args) => console.error("[LOG]", ...args);
-  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const { createHiveMcpServer, SERVER_NAME, SERVER_VERSION } = await import("./mcpServer-LNRRWXSV.js");
-  const { getPendingUpdateVersion } = await import("./update-check-36QU6PKA.js");
-  const transport = new StdioServerTransport();
-  const pendingUpdate = getPendingUpdateVersion();
-  const instructionsSuffix = pendingUpdate ? `A newer Hive version (${pendingUpdate}) is available; this server is running ${SERVER_VERSION}. Tell the user to run "hive upgrade" and restart this client to get the latest tools and data.` : void 0;
-  const mcpServer = createHiveMcpServer(
-    { kind: "root" },
-    { instructionsSuffix }
-  );
-  const server = mcpServer.getServer();
-  let isShuttingDown = false;
-  const shutdown = async () => {
-    if (isShuttingDown) return;
-    isShuttingDown = true;
-    const forceTimer = setTimeout(() => process.exit(1), 3e3);
-    forceTimer.unref();
-    try {
-      await server.close();
-    } catch {
-    }
-    process.exit(0);
-  };
-  process.on("SIGINT", shutdown);
-  process.on("SIGTERM", shutdown);
-  process.stdin.on("end", shutdown);
-  await server.connect(transport);
-  console.error(
-    `Hive MCP stdio server connected (${SERVER_NAME} v${SERVER_VERSION})`
-  );
-}
-async function startHttp(port, envFile) {
-  dotenv.config({ path: envFile || ".env", quiet: true });
-  process.env.PORT = String(port);
-  const { startHttpServer } = await import("./server.js");
-  await startHttpServer();
-}
-export {
-  startHttp,
-  startStdio
-};