jaitus 0.3.23 → 0.3.25

package/src/mcp.js

@@ -1,7 +1,8 @@
-// ─── Model Context Protocol over stdio ─────────────────────────────────────────
+// ─── Model Context Protocol: local (stdio) and remote (HTTP) servers ────────────
 //
-// Jaitus supports the portable part of MCP that is most useful in a terminal: local
-// stdio servers exposing tools.
+// Jaitus supports the portable part of MCP that is most useful in a terminal: servers
+// exposing tools — local ones over stdio, and remote ones over Streamable HTTP or the
+// older HTTP+SSE transport.
 //
 // Servers come from two places, merged: your own (~/.jaitus/mcp.json, added with
 // `jaitus mcp add --global`) and the project's (.mcp.json). A project's file comes with
@@ -16,6 +17,8 @@
 
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { SESSIONS, loadSettings, saveSettings } from './config.js';
@@ -45,10 +48,40 @@ export function readMcpConfig(cwd) {
   return { file: projectFile(cwd), servers };
 }
 
+// ── Remote servers ──
+// The two HTTP transports other agents read from the same .mcp.json shape:
+//   { "type": "http", "url": "https://…/mcp", "headers": { "Authorization": "Bearer ${TOKEN}" } }
+//   { "type": "sse",  "url": "https://…/sse", … }   (the older HTTP+SSE transport)
+// ${VAR} and ${VAR:-fallback} in the url and headers are read from the environment, so
+// a token never has to be written into a file that is committed.
+const REMOTE_TYPES = new Set(['http', 'streamable-http', 'sse']);
+export const isRemote = (config) => Boolean(config?.url) && REMOTE_TYPES.has(String(config?.type || 'http').toLowerCase()) && !config?.command;
+export function expandEnv(value, env = process.env) {
+  return String(value ?? '').replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (_, name, fallback) => (env[name] !== undefined && env[name] !== '' ? env[name] : (fallback ?? '')));
+}
+function remoteTarget(config) {
+  const url = expandEnv(config.url);
+  let u;
+  try { u = new URL(url); } catch { throw new Error(`MCP server url is not a valid address: ${url}`); }
+  // A token in a header must not cross the internet in plain text: http only to this
+  // computer, https everywhere else.
+  const local = ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname);
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) throw new Error(`MCP server url must be https:// (http:// only for this computer): ${url}`);
+  const headers = {};
+  for (const [k, v] of Object.entries(config.headers || {})) headers[String(k)] = expandEnv(v);
+  return { url: u, headers };
+}
+
 // ── Trust ──
-/** What is approved: the command line itself. Change the command and it asks again. */
+/**
+ * What is approved: the command line itself, or for a remote server its address and
+ * headers. Change it and it asks again. (A stdio server's fingerprint is unchanged from
+ * before remote servers existed, so nothing already approved has to be approved again.)
+ */
 export function fingerprint(config) {
-  const body = JSON.stringify({ command: config?.command || '', args: config?.args || [], env: config?.env || {} });
+  const body = isRemote(config)
+    ? JSON.stringify({ type: String(config.type || 'http').toLowerCase(), url: config.url, headers: config.headers || {} })
+    : JSON.stringify({ command: config?.command || '', args: config?.args || [], env: config?.env || {} });
   return crypto.createHash('sha256').update(body).digest('hex').slice(0, 24);
 }
 const trustKey = (cwd) => path.resolve(cwd).toLowerCase();
@@ -65,7 +98,7 @@ export function trustServer(cwd, server) {
   discovery.clear();
 }
 export function untrustedServers(cwd) {
-  return allServers(cwd).filter((s) => s.config?.command && !isTrusted(cwd, s));
+  return allServers(cwd).filter((s) => (s.config?.command || isRemote(s.config)) && !isTrusted(cwd, s));
 }
 
 export function listMcpServers(cwd) {
@@ -73,7 +106,7 @@ export function listMcpServers(cwd) {
     name: s.name,
     scope: s.scope,
     trusted: isTrusted(cwd, s),
-    transport: s.config?.type || (s.config?.command ? 'stdio' : 'unknown'),
+    transport: s.config?.command ? 'stdio' : isRemote(s.config) ? String(s.config.type || 'http').toLowerCase() : 'unknown',
     command: [s.config?.command || s.config?.url || '', ...(s.config?.args || [])].join(' ').trim(),
   }));
 }
@@ -218,6 +251,214 @@ class StdioClient {
   }
 }
 
+/**
+ * Server-sent events from a stream of text chunks: yields { event, data } per event.
+ * Lines are `field: value`; an event ends at a blank line; `data` lines are joined.
+ */
+function sseParser(onEvent) {
+  let buffer = '';
+  let event = 'message';
+  let data = [];
+  return (chunk) => {
+    buffer += chunk;
+    let at;
+    while ((at = buffer.search(/\r?\n/)) >= 0) {
+      const line = buffer.slice(0, at);
+      buffer = buffer.slice(at + (buffer[at] === '\r' ? 2 : 1));
+      if (line === '') {
+        if (data.length) onEvent({ event, data: data.join('\n') });
+        event = 'message'; data = [];
+      } else if (!line.startsWith(':')) {
+        const colon = line.indexOf(':');
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const value = colon < 0 ? '' : line.slice(colon + 1).replace(/^ /, '');
+        if (field === 'event') event = value;
+        else if (field === 'data') data.push(value);
+      }
+    }
+  };
+}
+
+const remoteError = (status, text) => {
+  if (status === 401 || status === 403) return new Error(`MCP server refused the request (${status}) — check the token in its "headers" (an unset \${VAR} becomes empty).`);
+  return new Error(`MCP server answered ${status}${text ? `: ${String(text).replace(/\s+/g, ' ').slice(0, 200)}` : ''}`);
+};
+
+/**
+ * Streamable HTTP (MCP 2025-03-26 and later): every message is a POST; the answer is JSON,
+ * or an event stream carrying it. The server may hand out a session id on initialize,
+ * which then goes with every request.
+ */
+class HttpClient {
+  constructor(config) {
+    this.config = config;
+    this.nextId = 1;
+    this.sessionId = null;
+    this.protocol = '2025-06-18';
+    this.initialized = false;
+    this.alive = false;
+  }
+
+  async start() {
+    this.target = remoteTarget(this.config);
+    const result = await this.request('initialize', { protocolVersion: this.protocol, capabilities: {}, clientInfo: { name: 'jaitus', version: '0.3' } }, 20_000);
+    if (result?.protocolVersion) this.protocol = result.protocolVersion;
+    this.initialized = true;
+    this.alive = true;
+    await this.notify('notifications/initialized', {});
+    return this;
+  }
+
+  async post(message, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    const headers = { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...this.target.headers };
+    if (this.sessionId) headers['mcp-session-id'] = this.sessionId;
+    if (this.initialized) headers['mcp-protocol-version'] = this.protocol;
+    try {
+      const res = await fetch(this.target.url, { method: 'POST', headers, body: JSON.stringify(message), signal: ctl.signal });
+      const sid = res.headers.get('mcp-session-id');
+      if (sid) this.sessionId = sid;
+      if (message.id === undefined) { try { await res.body?.cancel(); } catch { /* done */ } return null; }
+      if (res.status === 404 && this.sessionId) { this.alive = false; throw new Error('MCP session ended on the server; it is started again on the next call'); }
+      if (!res.ok) throw remoteError(res.status, await res.text().catch(() => ''));
+      const type = String(res.headers.get('content-type') || '');
+      if (type.includes('text/event-stream')) {
+        // The answer is one event among possibly several (progress, server requests).
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let found = null;
+        const feed = sseParser(({ data }) => {
+          try { const m = JSON.parse(data); for (const one of Array.isArray(m) ? m : [m]) if (one?.id === message.id && ('result' in one || 'error' in one)) found = one; } catch { /* not JSON */ }
+        });
+        while (!found) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          feed(decoder.decode(value, { stream: true }));
+        }
+        try { await reader.cancel(); } catch { /* done */ }
+        if (!found) throw new Error(`MCP server closed the stream without answering ${message.method}`);
+        return found;
+      }
+      const body = await res.json();
+      const list = Array.isArray(body) ? body : [body];
+      const found = list.find((m) => m?.id === message.id);
+      if (!found) throw new Error(`MCP server did not answer ${message.method}`);
+      return found;
+    } catch (e) {
+      if (e?.name === 'AbortError') throw new Error(`MCP request timed out after ${Math.round(timeoutMs / 1000)}s: ${message.method}`);
+      if (e?.cause?.code === 'ECONNREFUSED' || /fetch failed/.test(e?.message || '')) throw new Error(`Could not reach MCP server at ${this.target.url.origin}`);
+      throw e;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  async request(method, params, timeoutMs = 120_000) {
+    const id = this.nextId++;
+    const m = await this.post({ jsonrpc: '2.0', id, method, params }, timeoutMs);
+    if (m.error) throw new Error(m.error.message || 'MCP request failed');
+    return m.result;
+  }
+
+  notify(method, params) {
+    return this.post({ jsonrpc: '2.0', method, params }, 10_000).catch(() => null);
+  }
+
+  close() {
+    this.alive = false;
+    // Tell the server the session is over (it may keep state for it). Best effort.
+    if (this.sessionId && this.target) {
+      fetch(this.target.url, { method: 'DELETE', headers: { ...this.target.headers, 'mcp-session-id': this.sessionId }, signal: AbortSignal.timeout(2000) }).catch(() => {});
+    }
+  }
+}
+
+/**
+ * The older HTTP+SSE transport (MCP 2024-11-05): a GET opens an event stream whose first
+ * event names where to POST; answers arrive on the stream. The stream's socket does not
+ * hold the process open (a finished one-shot run still exits).
+ */
+class SseClient {
+  constructor(config) {
+    this.config = config;
+    this.nextId = 1;
+    this.pending = new Map();
+    this.alive = false;
+  }
+
+  start() {
+    this.target = remoteTarget(this.config);
+    return new Promise((resolve, reject) => {
+      const u = this.target.url;
+      const lib = u.protocol === 'https:' ? https : http;
+      const giveUp = setTimeout(() => { reject(new Error('MCP server did not send its message address within 20s')); this.close(); }, 20_000);
+      this.req = lib.request(u, { method: 'GET', headers: { accept: 'text/event-stream', ...this.target.headers } }, (res) => {
+        if (res.statusCode !== 200) {
+          clearTimeout(giveUp);
+          let text = '';
+          res.setEncoding('utf8');
+          res.on('data', (d) => { text += d; });
+          res.on('end', () => reject(remoteError(res.statusCode, text)));
+          return;
+        }
+        res.socket?.unref?.();
+        res.setEncoding('utf8');
+        const feed = sseParser(({ event, data }) => {
+          if (event === 'endpoint') {
+            clearTimeout(giveUp);
+            try { this.postUrl = new URL(data.trim(), u); } catch { reject(new Error(`MCP server sent a bad message address: ${data}`)); return; }
+            this.alive = true;
+            this.initialize().then(() => resolve(this), (e) => { this.close(); reject(e); });
+            return;
+          }
+          try {
+            const m = JSON.parse(data);
+            if (m?.id !== undefined && this.pending.has(m.id)) {
+              const p = this.pending.get(m.id);
+              this.pending.delete(m.id);
+              if (m.error) p.reject(new Error(m.error.message || 'MCP request failed')); else p.resolve(m.result);
+            }
+          } catch { /* not JSON */ }
+        });
+        res.on('data', feed);
+        res.on('close', () => { this.alive = false; this.rejectAll(new Error('MCP server closed its event stream')); });
+      });
+      this.req.on('error', (e) => { clearTimeout(giveUp); this.alive = false; reject(new Error(`Could not reach MCP server at ${u.origin}: ${e.message}`)); this.rejectAll(e); });
+      this.req.end();
+    });
+  }
+
+  async initialize() {
+    await this.request('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'jaitus', version: '0.3' } }, 20_000);
+    await this.notify('notifications/initialized', {});
+  }
+
+  async send(message) {
+    const res = await fetch(this.postUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...this.target.headers }, body: JSON.stringify(message), signal: AbortSignal.timeout(20_000) });
+    if (!res.ok) throw remoteError(res.status, await res.text().catch(() => ''));
+    try { await res.body?.cancel(); } catch { /* done */ }
+  }
+
+  request(method, params, timeoutMs = 120_000) {
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`MCP request timed out after ${Math.round(timeoutMs / 1000)}s: ${method}`)); }, timeoutMs);
+      this.pending.set(id, { resolve: (v) => { clearTimeout(timer); resolve(v); }, reject: (e) => { clearTimeout(timer); reject(e); } });
+      this.send({ jsonrpc: '2.0', id, method, params }).catch((e) => { const p = this.pending.get(id); if (p) { this.pending.delete(id); p.reject(e); } });
+    });
+  }
+
+  notify(method, params) { return this.send({ jsonrpc: '2.0', method, params }).catch(() => null); }
+
+  rejectAll(error) { for (const p of this.pending.values()) p.reject(error); this.pending.clear(); }
+
+  close() {
+    this.alive = false;
+    try { this.req?.destroy(); } catch { /* gone */ }
+  }
+}
+
 // One live client per server for the session.
 const clients = new Map();
 function closeAll() { for (const client of clients.values()) client.close(); clients.clear(); }
@@ -226,7 +467,8 @@ process.once('exit', closeAll);
 async function clientFor(key, config, cwd) {
   const have = clients.get(key);
   if (have?.alive) return have;
-  const fresh = new StdioClient(config, cwd);
+  const fresh = !isRemote(config) ? new StdioClient(config, cwd)
+    : String(config.type || 'http').toLowerCase() === 'sse' ? new SseClient(config) : new HttpClient(config);
   await fresh.start();
   clients.set(key, fresh);
   return fresh;
@@ -258,7 +500,7 @@ export function discoverMcpTools(cwd) {
   const key = `${path.resolve(cwd)}|${stamp(cwd)}|${JSON.stringify(loadSettings().trustedMcp?.[trustKey(cwd)] || {})}`;
   if (!discovery.has(key)) {
     discovery.set(key, (async () => {
-      const servers = allServers(cwd).filter((s) => s.config?.command && isTrusted(cwd, s));
+      const servers = allServers(cwd).filter((s) => (s.config?.command || isRemote(s.config)) && isTrusted(cwd, s));
       const lists = await Promise.all(servers.map(async (server) => {
         const ckey = `${path.resolve(cwd)}|${server.scope}|${server.name}|${fingerprint(server.config)}`;
         try {

package/src/project.js

@@ -11,6 +11,7 @@
 // starts from the code, which is what it did before these existed.
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 export const CONTEXT_FILE = 'JAITUS.md';
@@ -46,6 +47,38 @@ npm test
 `;
 
 /** The project briefing, or null. Truncated rather than refused if someone writes an essay. */
+/**
+ * Personal notes: ~/.jaitus/JAITUS.md, sent with EVERY project — how you like to work,
+ * wherever you work ("answer briefly", "I use pnpm", "never push without asking"). The
+ * project's own JAITUS.md is the other half; the two are labelled apart in the prompt.
+ */
+export function userContextFile() {
+  return path.join(os.homedir(), '.jaitus', CONTEXT_FILE);       // the same folder as config.HOME
+}
+
+export function loadUserContext() {
+  return readNotes(userContextFile(), '~/.jaitus/JAITUS.md');
+}
+
+/** Append one line to a notes file, creating it (and its folder) with a header. */
+export function appendNote(file, note, header) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (!fs.existsSync(file)) fs.writeFileSync(file, header, 'utf8');
+  const text = fs.readFileSync(file, 'utf8');
+  fs.appendFileSync(file, `${text.endsWith('\n') || !text ? '' : '\n'}- ${String(note).replace(/[\r\n]+/g, ' ').trim()}\n`, 'utf8');
+}
+
+export const USER_CONTEXT_HEADER = `# My notes for Jaitus\n\nSent with every project. Keep it short and true — how you like to work, wherever you work.\n\n`;
+export const PROJECT_CONTEXT_HEADER = `# ${CONTEXT_FILE}\n\nNotes for the Jaitus agent working in this directory.\n\n`;
+
+function readNotes(file, name) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8').trim(); } catch { return null; }
+  if (!text) return null;
+  if (text.length > MAX_CONTEXT) text = `${text.slice(0, MAX_CONTEXT)}\n\n[${name} truncated here — it is longer than the agent will read]`;
+  return text;
+}
+
 export function loadContext(cwd) {
   const file = path.join(cwd, CONTEXT_FILE);
   let text;