jaitus 0.3.24 → 0.3.26

package/src/index.js

@@ -23,17 +23,18 @@ import { DEFAULT_DENY } from './agent/rules.js';
 import { forgetIgnoreCache, imageBlock, IMAGE_MIME } from './agent/tools.js';
 import { shrinkImageFile, clipboardBytes } from './tui/clipboard.js';
 import { THEME_NAMES } from './tui/theme.js';
-import { loadContext, CONTEXT_FILE } from './project.js';
+import { loadContext, loadUserContext, userContextFile, appendNote, USER_CONTEXT_HEADER, PROJECT_CONTEXT_HEADER, CONTEXT_FILE } from './project.js';
 import { discoverSkills, skillCatalog } from './skills.js';
 import { runHook, configuredHookEvents } from './hooks.js';
 import { newSession, saveSession, loadSession, latestSession, listSessions, sessionSummary, replaySession, sameDir } from './sessions.js';
 import { createJournal, displayPath } from './rewind.js';
 import { createLedger } from './ledger.js';
-import { listMcpServers, addMcpServer, removeMcpServer, untrustedServers, trustServer, discoverMcpTools, mcpProblems, allServers } from './mcp.js';
+import { listMcpServers, addMcpServer, removeMcpServer, untrustedServers, trustServer, discoverMcpTools, mcpProblems, allServers, isRemote, expandEnv } from './mcp.js';
 import { banner, wordmark, renderHomeLogo, startupTip } from './brand.js';
+import { adSourceFor } from './adSlots.js';
 import {
   c, out, err, ok, fail, info, warn, table, present,
-  promptLine, useHistoryFile, watchEsc, setTuiSink, askKey, colorLevel,
+  promptLine, useHistoryFile, watchEsc, setTuiSink, askKey, ask, colorLevel,
   unicode, glyph, columns,
 } from './ui.js';
 import { createTui as createClassicTui } from './tui.js';
@@ -583,7 +584,7 @@ const SLASH = {
   '/diff': { summary: 'uncommitted changes, staged or not, and new files' },
   '/tasks': { summary: 'review tool activity from this session' },
   '/image <path>': { summary: 'attach an image (png/jpg/gif/webp) the model will see with your next message' },
-  '/memory [text]': { summary: 'show or append to JAITUS.md (# does this inline)' },
+  '/memory [text]': { summary: 'show your notes for the agent, or add one (# does this inline)' },
   '/permissions [mode|rules|default]': { summary: 'permission mode, the mode new sessions start in, and the allow/deny rules for this project' },
   '/skills': { summary: 'list project workflows' },
   '/sessions': { summary: 'list saved sessions in this directory' },
@@ -843,6 +844,8 @@ async function session({ flags }) {
     ],
     fileProvider: (frag) => completeFiles(frag),
     settings: loadSettings(),
+    // Sponsored lines (adSlots.js). The server decides who sees them; Max never does.
+    ads: adSourceFor(client),
     meta: {
       version: VERSION, cwd: flags.cwd, model, mode: permissions.mode, intent: 'build',
       session: sessionState.id, branch: gitBranch(flags.cwd),
@@ -1244,8 +1247,7 @@ async function session({ flags }) {
     if (input.startsWith('#')) {
       const note = input.slice(1).trim();
       if (note) {
-        appendMemory(flags.cwd, note);
-        ok(`Remembered in ${CONTEXT_FILE}: ${c.bold(note.slice(0, 60))}${note.length > 60 ? '…' : ''}`);
+        await rememberNote(flags.cwd, note, tui);
       } else {
         const existing = loadContext(flags.cwd);
         out(existing ? existing : c.dim(`(no ${CONTEXT_FILE} yet — type "# note text" to add one)`));
@@ -1407,6 +1409,11 @@ async function session({ flags }) {
       const picked = list[Number(key) - 1];
       return picked === undefined ? null : (picked && typeof picked === 'object' ? picked : { value: picked });
     };
+    tui.askText = async (question) => {
+      if (!process.stdin.isTTY) return null;
+      const typed = await ask(`  ${c.bold(String(question).replace(/\x1b\[[0-9;]*m/g, ''))}\n  ${c.dim('›')} `);
+      return typed || null;
+    };
     tui.showPanel = async (title, lines) => {
       out(`  ${c.bold(String(title))}`);
       for (const line of (Array.isArray(lines) ? lines : String(lines).split('\n'))) out(`  ${line}`);
@@ -1436,11 +1443,16 @@ async function session({ flags }) {
     // exact command is approved here — asked once, remembered per project and command.
     void (async () => {
       for (const server of untrustedServers(flags.cwd)) {
-        const line = [server.config.command, ...(server.config.args || [])].join(' ');
+        const remote = isRemote(server.config);
+        const line = remote ? server.config.url : [server.config.command, ...(server.config.args || [])].join(' ');
         const answer = dialogValue(await tui.askDialog(
-          `This project's .mcp.json wants to start an MCP server "${server.name}". It runs on your computer, with your files.`,
+          remote
+            ? `This project's .mcp.json wants to connect to a remote MCP server "${server.name}". What the agent sends its tools goes to that address.`
+            : `This project's .mcp.json wants to start an MCP server "${server.name}". It runs on your computer, with your files.`,
           [{ label: 'Allow and remember for this project', value: 'trust' }, { label: 'Not now', value: 'no' }],
-          [`command: ${line.slice(0, 300)}`, ...(server.config.env ? [`env: ${Object.keys(server.config.env).join(', ')}`] : [])],
+          remote
+            ? [`address: ${String(line).slice(0, 300)}`, ...(server.config.headers ? [`headers: ${Object.keys(server.config.headers).join(', ')}`] : [])]
+            : [`command: ${line.slice(0, 300)}`, ...(server.config.env ? [`env: ${Object.keys(server.config.env).join(', ')}`] : [])],
           { title: 'MCP SERVER', hideComment: true },
         ));
         if (answer === 'trust') { trustServer(flags.cwd, server); tui.notice(`MCP server ${server.name} approved for this project.`, 'info'); }
@@ -1684,15 +1696,32 @@ function appendHistoryLine(line) {
   } catch { /* history is a convenience, never a reason to fail */ }
 }
 
-/** Append one line to the project memory file, creating it with a header if needed. */
-function appendMemory(cwd, note) {
-  const file = path.join(cwd, CONTEXT_FILE);
+/**
+ * Save a note for the agent: this project's JAITUS.md, or the personal notes sent with
+ * every project. Asked when a dialog can be shown; a script or a plain terminal keeps the
+ * old behaviour (the project file). Resolves 'project' | 'user' | null (not saved).
+ */
+async function rememberNote(cwd, note, tui) {
+  let where = 'project';
+  if (tui?.askDialog) {
+    const shown = note.length > 80 ? `${note.slice(0, 79)}…` : note;
+    const answer = await tui.askDialog(`Remember "${shown}" for…`, [
+      { label: `This project — ${CONTEXT_FILE}`, value: 'project' },
+      { label: 'All my projects — ~/.jaitus/JAITUS.md', value: 'user' },
+    ], [], { title: 'Save a note', hideComment: true });
+    const picked = dialogValue(answer);
+    if (picked !== 'project' && picked !== 'user') { out(c.dim('  Not saved.')); return null; }
+    where = picked;
+  }
+  const file = where === 'user' ? userContextFile() : path.join(cwd, CONTEXT_FILE);
   try {
-    if (!fs.existsSync(file)) fs.writeFileSync(file, `# ${CONTEXT_FILE}\n\nNotes for the Jaitus agent working in this directory.\n\n`, 'utf8');
-    fs.appendFileSync(file, `- ${note}\n`, 'utf8');
+    appendNote(file, note, where === 'user' ? USER_CONTEXT_HEADER : PROJECT_CONTEXT_HEADER);
   } catch (e) {
-    fail(`Could not write ${CONTEXT_FILE}: ${e.message}`);
+    fail(`Could not write ${file}: ${e.message}`);
+    return null;
   }
+  ok(`Remembered ${where === 'user' ? 'for every project (~/.jaitus/JAITUS.md)' : `in ${CONTEXT_FILE}`}: ${c.bold(note.slice(0, 60))}${note.length > 60 ? '…' : ''}`);
+  return where;
 }
 
 /** Run a shell command with output streaming to the terminal. Returns the exit code. */
@@ -1832,6 +1861,7 @@ async function slashCommand(verb, args, ctx) {
           { label: 'Messages', value: String(ctx.messages.length) },
           { label: 'Tool results', value: String(count((b) => b.type === 'tool_result')) },
           { label: 'Images', value: String(count((b) => b.type === 'image')) },
+          ...(loadUserContext() ? [{ label: 'Personal notes', value: '~/.jaitus/JAITUS.md (loaded)' }] : []),
           ...(loadContext(ctx.flags.cwd) ? [{ label: 'Project notes', value: `${CONTEXT_FILE} (loaded)` }] : []),
           { gap: true },
           { label: '', value: '/compact summarises it now' },
@@ -1844,6 +1874,7 @@ async function slashCommand(verb, args, ctx) {
         [`  ${c.dim('assistant turns')}`, String(ctx.messages.filter((m) => m.role === 'assistant').length)],
         [`  ${c.dim('tool results')}`, String(ctx.messages.reduce((n, m) => n + (Array.isArray(m.content) ? m.content.filter((b) => b.type === 'tool_result').length : 0), 0))],
         [`  ${c.dim('estimated tokens')}`, tokens.toLocaleString()],
+        ...(loadUserContext() ? [[`  ${c.dim('personal notes')}`, '~/.jaitus/JAITUS.md (loaded)']] : []),
         ...(loadContext(ctx.flags.cwd) ? [[`  ${c.dim('project notes')}`, `${CONTEXT_FILE} (loaded)`]] : []),
       ]);
       info(`${c.dim('Run')} ${c.bold('/compact')} ${c.dim('to summarise and free context when this grows.')}`);
@@ -1989,9 +2020,21 @@ async function slashCommand(verb, args, ctx) {
 
     case '/memory': {
       const note = args.join(' ').trim();
-      if (note) { appendMemory(ctx.flags.cwd, note); ok(`Remembered in ${CONTEXT_FILE}.`); return null; }
-      const existing = loadContext(ctx.flags.cwd);
-      out(existing ? existing : c.dim(`(no ${CONTEXT_FILE} yet — /memory <text> creates one)`));
+      if (note) { await rememberNote(ctx.flags.cwd, note, ctx.tui); return null; }
+      // Both halves of what the agent is told, each with where it lives.
+      const personal = loadUserContext();
+      const project = loadContext(ctx.flags.cwd);
+      const lines = [
+        c.bold(`Every project — ${userContextFile()}`),
+        ...(personal ? personal.split('\n').map((l) => `  ${l}`) : [c.dim('  (nothing yet)')]),
+        '',
+        c.bold(`This project — ${path.join(ctx.flags.cwd, CONTEXT_FILE)}`),
+        ...(project ? project.split('\n').map((l) => `  ${l}`) : [c.dim('  (nothing yet)')]),
+        '',
+        c.dim('Type "# a note" (or /memory a note) to add one; you choose where it goes. Edit the files for anything longer.'),
+      ];
+      if (ctx.tui?.showPanel) await ctx.tui.showPanel('Memory', lines);
+      else out(lines.join('\n'));
       return null;
     }
 
@@ -2815,7 +2858,7 @@ const commands = {
       // In the app view: a popup over the conversation that Esc closes, not rows that
       // stay in the transcript for good.
       if (tui?.showMeters && !json) {
-        void tui.showMeters('Usage', sections);
+        void tui.showMeters('Usage', sections, { ad: 'usage' });
         return 0;
       }
       present(json, withoutCredits({ ...d, planStatus: u?.planStatus || null }), () => table(sectionsAsTable(sections)));
@@ -2859,18 +2902,50 @@ const commands = {
     usage: [
       'jaitus mcp list',
       'jaitus mcp add [--global] <name> -- <command> [args...]',
+      'jaitus mcp add [--global] --transport http|sse <name> <url> [--header "Name: value"]...',
       'jaitus mcp trust <name>',
       'jaitus mcp remove <name>',
     ],
     detail: [
-      'Local stdio servers from your own ~/.jaitus/mcp.json (--global) and the project\'s .mcp.json, merged,',
-      'exposed to the agent as permission-gated tools. A project\'s servers start only once you approve them.',
-      'Put the command after -- so its own flags (-y, --port) are not read as Jaitus flags.',
+      'Servers from your own ~/.jaitus/mcp.json (--global) and the project\'s .mcp.json, merged, exposed to',
+      'the agent as permission-gated tools. A project\'s servers start only once you approve them.',
+      'Local: put the command after -- so its own flags (-y, --port) are not read as Jaitus flags.',
+      'Remote: an https address (Streamable HTTP, or sse for older servers). Write a token as ${VAR} to',
+      'read it from the environment rather than saving it, e.g. --header "Authorization: Bearer ${API_TOKEN}".',
     ],
     run: (argv, { json, flags }) => {
       const global = argv.includes('--global');
-      const rest = argv.filter((a) => a !== '--global');
+      // --transport http|sse and repeated --header/-H "Name: value" (remote servers).
+      let transport = null;
+      const headers = {};
+      const rest = [];
+      for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i];
+        if (a === '--global') continue;
+        if (a === '--transport' || a === '-t') { transport = String(argv[i + 1] || '').toLowerCase(); i += 1; continue; }
+        if (a === '--header' || a === '-H') {
+          const h = String(argv[i + 1] || ''); i += 1;
+          const at = h.indexOf(':');
+          if (at <= 0) { fail(`A header is "Name: value" — got ${JSON.stringify(h)}.`); return 1; }
+          headers[h.slice(0, at).trim()] = h.slice(at + 1).trim();
+          continue;
+        }
+        rest.push(a);
+      }
       const [action = 'list', name, command, ...args] = rest;
+      if (action === 'add' && transport && transport !== 'stdio') {
+        if (!['http', 'sse'].includes(transport)) { fail('--transport is http, sse or stdio.'); return 1; }
+        if (!name || !command) { fail('Usage: jaitus mcp add --transport http|sse <name> <url> [--header "Name: value"]'); return 1; }
+        const config = { type: transport, url: command, ...(Object.keys(headers).length ? { headers } : {}) };
+        if (!isRemote(config)) { fail('Give the server address, e.g. https://example.com/mcp'); return 1; }
+        try { new URL(expandEnv(command)); } catch { fail(`Not a valid address: ${command}`); return 1; }
+        addMcpServer(flags.cwd, name, config, { global });
+        ok(`Added remote MCP server ${c.bold(name)} (${transport})${global ? ' for every project' : ''}.`);
+        if (Object.values(headers).some((v) => /[A-Za-z0-9_-]{24,}/.test(v) && !/\$\{/.test(v))) {
+          warn(`The header holds what looks like a token, saved as text in ${global ? '~/.jaitus/mcp.json' : '.mcp.json'}. Prefer \${VAR} so it is read from the environment${global ? '' : ' — and never commit it'}.`);
+        }
+        return 0;
+      }
       if (action === 'list') {
         const servers = listMcpServers(flags.cwd);
         present(json, { servers }, () => {
@@ -2888,7 +2963,7 @@ const commands = {
         const server = allServers(flags.cwd).find((s) => s.name === name);
         if (!server) { warn(`No MCP server named ${name}.`); return 1; }
         trustServer(flags.cwd, server);
-        ok(`Approved ${c.bold(name)} for this project: ${[server.config.command, ...(server.config.args || [])].join(' ')}`);
+        ok(`Approved ${c.bold(name)} for this project: ${isRemote(server.config) ? server.config.url : [server.config.command, ...(server.config.args || [])].join(' ')}`);
         return 0;
       }
       if (action === 'remove' && name) {
@@ -2896,7 +2971,7 @@ const commands = {
         ok(`Removed MCP server ${c.bold(name)}.`);
         return 0;
       }
-      fail('Usage: jaitus mcp list | add [--global] <name> -- <command> [args...] | trust <name> | remove <name>');
+      fail('Usage: jaitus mcp list | add [--global] <name> -- <command> [args...] | add --transport http|sse <name> <url> | trust <name> | remove <name>');
       return 1;
     },
   },

package/src/mcp.js

@@ -1,7 +1,8 @@
-// ─── Model Context Protocol over stdio ─────────────────────────────────────────
+// ─── Model Context Protocol: local (stdio) and remote (HTTP) servers ────────────
 //
-// Jaitus supports the portable part of MCP that is most useful in a terminal: local
-// stdio servers exposing tools.
+// Jaitus supports the portable part of MCP that is most useful in a terminal: servers
+// exposing tools — local ones over stdio, and remote ones over Streamable HTTP or the
+// older HTTP+SSE transport.
 //
 // Servers come from two places, merged: your own (~/.jaitus/mcp.json, added with
 // `jaitus mcp add --global`) and the project's (.mcp.json). A project's file comes with
@@ -16,6 +17,8 @@
 
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { SESSIONS, loadSettings, saveSettings } from './config.js';
@@ -45,10 +48,40 @@ export function readMcpConfig(cwd) {
   return { file: projectFile(cwd), servers };
 }
 
+// ── Remote servers ──
+// The two HTTP transports other agents read from the same .mcp.json shape:
+//   { "type": "http", "url": "https://…/mcp", "headers": { "Authorization": "Bearer ${TOKEN}" } }
+//   { "type": "sse",  "url": "https://…/sse", … }   (the older HTTP+SSE transport)
+// ${VAR} and ${VAR:-fallback} in the url and headers are read from the environment, so
+// a token never has to be written into a file that is committed.
+const REMOTE_TYPES = new Set(['http', 'streamable-http', 'sse']);
+export const isRemote = (config) => Boolean(config?.url) && REMOTE_TYPES.has(String(config?.type || 'http').toLowerCase()) && !config?.command;
+export function expandEnv(value, env = process.env) {
+  return String(value ?? '').replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (_, name, fallback) => (env[name] !== undefined && env[name] !== '' ? env[name] : (fallback ?? '')));
+}
+function remoteTarget(config) {
+  const url = expandEnv(config.url);
+  let u;
+  try { u = new URL(url); } catch { throw new Error(`MCP server url is not a valid address: ${url}`); }
+  // A token in a header must not cross the internet in plain text: http only to this
+  // computer, https everywhere else.
+  const local = ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname);
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) throw new Error(`MCP server url must be https:// (http:// only for this computer): ${url}`);
+  const headers = {};
+  for (const [k, v] of Object.entries(config.headers || {})) headers[String(k)] = expandEnv(v);
+  return { url: u, headers };
+}
+
 // ── Trust ──
-/** What is approved: the command line itself. Change the command and it asks again. */
+/**
+ * What is approved: the command line itself, or for a remote server its address and
+ * headers. Change it and it asks again. (A stdio server's fingerprint is unchanged from
+ * before remote servers existed, so nothing already approved has to be approved again.)
+ */
 export function fingerprint(config) {
-  const body = JSON.stringify({ command: config?.command || '', args: config?.args || [], env: config?.env || {} });
+  const body = isRemote(config)
+    ? JSON.stringify({ type: String(config.type || 'http').toLowerCase(), url: config.url, headers: config.headers || {} })
+    : JSON.stringify({ command: config?.command || '', args: config?.args || [], env: config?.env || {} });
   return crypto.createHash('sha256').update(body).digest('hex').slice(0, 24);
 }
 const trustKey = (cwd) => path.resolve(cwd).toLowerCase();
@@ -65,7 +98,7 @@ export function trustServer(cwd, server) {
   discovery.clear();
 }
 export function untrustedServers(cwd) {
-  return allServers(cwd).filter((s) => s.config?.command && !isTrusted(cwd, s));
+  return allServers(cwd).filter((s) => (s.config?.command || isRemote(s.config)) && !isTrusted(cwd, s));
 }
 
 export function listMcpServers(cwd) {
@@ -73,7 +106,7 @@ export function listMcpServers(cwd) {
     name: s.name,
     scope: s.scope,
     trusted: isTrusted(cwd, s),
-    transport: s.config?.type || (s.config?.command ? 'stdio' : 'unknown'),
+    transport: s.config?.command ? 'stdio' : isRemote(s.config) ? String(s.config.type || 'http').toLowerCase() : 'unknown',
     command: [s.config?.command || s.config?.url || '', ...(s.config?.args || [])].join(' ').trim(),
   }));
 }
@@ -218,6 +251,214 @@ class StdioClient {
   }
 }
 
+/**
+ * Server-sent events from a stream of text chunks: yields { event, data } per event.
+ * Lines are `field: value`; an event ends at a blank line; `data` lines are joined.
+ */
+function sseParser(onEvent) {
+  let buffer = '';
+  let event = 'message';
+  let data = [];
+  return (chunk) => {
+    buffer += chunk;
+    let at;
+    while ((at = buffer.search(/\r?\n/)) >= 0) {
+      const line = buffer.slice(0, at);
+      buffer = buffer.slice(at + (buffer[at] === '\r' ? 2 : 1));
+      if (line === '') {
+        if (data.length) onEvent({ event, data: data.join('\n') });
+        event = 'message'; data = [];
+      } else if (!line.startsWith(':')) {
+        const colon = line.indexOf(':');
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const value = colon < 0 ? '' : line.slice(colon + 1).replace(/^ /, '');
+        if (field === 'event') event = value;
+        else if (field === 'data') data.push(value);
+      }
+    }
+  };
+}
+
+const remoteError = (status, text) => {
+  if (status === 401 || status === 403) return new Error(`MCP server refused the request (${status}) — check the token in its "headers" (an unset \${VAR} becomes empty).`);
+  return new Error(`MCP server answered ${status}${text ? `: ${String(text).replace(/\s+/g, ' ').slice(0, 200)}` : ''}`);
+};
+
+/**
+ * Streamable HTTP (MCP 2025-03-26 and later): every message is a POST; the answer is JSON,
+ * or an event stream carrying it. The server may hand out a session id on initialize,
+ * which then goes with every request.
+ */
+class HttpClient {
+  constructor(config) {
+    this.config = config;
+    this.nextId = 1;
+    this.sessionId = null;
+    this.protocol = '2025-06-18';
+    this.initialized = false;
+    this.alive = false;
+  }
+
+  async start() {
+    this.target = remoteTarget(this.config);
+    const result = await this.request('initialize', { protocolVersion: this.protocol, capabilities: {}, clientInfo: { name: 'jaitus', version: '0.3' } }, 20_000);
+    if (result?.protocolVersion) this.protocol = result.protocolVersion;
+    this.initialized = true;
+    this.alive = true;
+    await this.notify('notifications/initialized', {});
+    return this;
+  }
+
+  async post(message, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    const headers = { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...this.target.headers };
+    if (this.sessionId) headers['mcp-session-id'] = this.sessionId;
+    if (this.initialized) headers['mcp-protocol-version'] = this.protocol;
+    try {
+      const res = await fetch(this.target.url, { method: 'POST', headers, body: JSON.stringify(message), signal: ctl.signal });
+      const sid = res.headers.get('mcp-session-id');
+      if (sid) this.sessionId = sid;
+      if (message.id === undefined) { try { await res.body?.cancel(); } catch { /* done */ } return null; }
+      if (res.status === 404 && this.sessionId) { this.alive = false; throw new Error('MCP session ended on the server; it is started again on the next call'); }
+      if (!res.ok) throw remoteError(res.status, await res.text().catch(() => ''));
+      const type = String(res.headers.get('content-type') || '');
+      if (type.includes('text/event-stream')) {
+        // The answer is one event among possibly several (progress, server requests).
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let found = null;
+        const feed = sseParser(({ data }) => {
+          try { const m = JSON.parse(data); for (const one of Array.isArray(m) ? m : [m]) if (one?.id === message.id && ('result' in one || 'error' in one)) found = one; } catch { /* not JSON */ }
+        });
+        while (!found) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          feed(decoder.decode(value, { stream: true }));
+        }
+        try { await reader.cancel(); } catch { /* done */ }
+        if (!found) throw new Error(`MCP server closed the stream without answering ${message.method}`);
+        return found;
+      }
+      const body = await res.json();
+      const list = Array.isArray(body) ? body : [body];
+      const found = list.find((m) => m?.id === message.id);
+      if (!found) throw new Error(`MCP server did not answer ${message.method}`);
+      return found;
+    } catch (e) {
+      if (e?.name === 'AbortError') throw new Error(`MCP request timed out after ${Math.round(timeoutMs / 1000)}s: ${message.method}`);
+      if (e?.cause?.code === 'ECONNREFUSED' || /fetch failed/.test(e?.message || '')) throw new Error(`Could not reach MCP server at ${this.target.url.origin}`);
+      throw e;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  async request(method, params, timeoutMs = 120_000) {
+    const id = this.nextId++;
+    const m = await this.post({ jsonrpc: '2.0', id, method, params }, timeoutMs);
+    if (m.error) throw new Error(m.error.message || 'MCP request failed');
+    return m.result;
+  }
+
+  notify(method, params) {
+    return this.post({ jsonrpc: '2.0', method, params }, 10_000).catch(() => null);
+  }
+
+  close() {
+    this.alive = false;
+    // Tell the server the session is over (it may keep state for it). Best effort.
+    if (this.sessionId && this.target) {
+      fetch(this.target.url, { method: 'DELETE', headers: { ...this.target.headers, 'mcp-session-id': this.sessionId }, signal: AbortSignal.timeout(2000) }).catch(() => {});
+    }
+  }
+}
+
+/**
+ * The older HTTP+SSE transport (MCP 2024-11-05): a GET opens an event stream whose first
+ * event names where to POST; answers arrive on the stream. The stream's socket does not
+ * hold the process open (a finished one-shot run still exits).
+ */
+class SseClient {
+  constructor(config) {
+    this.config = config;
+    this.nextId = 1;
+    this.pending = new Map();
+    this.alive = false;
+  }
+
+  start() {
+    this.target = remoteTarget(this.config);
+    return new Promise((resolve, reject) => {
+      const u = this.target.url;
+      const lib = u.protocol === 'https:' ? https : http;
+      const giveUp = setTimeout(() => { reject(new Error('MCP server did not send its message address within 20s')); this.close(); }, 20_000);
+      this.req = lib.request(u, { method: 'GET', headers: { accept: 'text/event-stream', ...this.target.headers } }, (res) => {
+        if (res.statusCode !== 200) {
+          clearTimeout(giveUp);
+          let text = '';
+          res.setEncoding('utf8');
+          res.on('data', (d) => { text += d; });
+          res.on('end', () => reject(remoteError(res.statusCode, text)));
+          return;
+        }
+        res.socket?.unref?.();
+        res.setEncoding('utf8');
+        const feed = sseParser(({ event, data }) => {
+          if (event === 'endpoint') {
+            clearTimeout(giveUp);
+            try { this.postUrl = new URL(data.trim(), u); } catch { reject(new Error(`MCP server sent a bad message address: ${data}`)); return; }
+            this.alive = true;
+            this.initialize().then(() => resolve(this), (e) => { this.close(); reject(e); });
+            return;
+          }
+          try {
+            const m = JSON.parse(data);
+            if (m?.id !== undefined && this.pending.has(m.id)) {
+              const p = this.pending.get(m.id);
+              this.pending.delete(m.id);
+              if (m.error) p.reject(new Error(m.error.message || 'MCP request failed')); else p.resolve(m.result);
+            }
+          } catch { /* not JSON */ }
+        });
+        res.on('data', feed);
+        res.on('close', () => { this.alive = false; this.rejectAll(new Error('MCP server closed its event stream')); });
+      });
+      this.req.on('error', (e) => { clearTimeout(giveUp); this.alive = false; reject(new Error(`Could not reach MCP server at ${u.origin}: ${e.message}`)); this.rejectAll(e); });
+      this.req.end();
+    });
+  }
+
+  async initialize() {
+    await this.request('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'jaitus', version: '0.3' } }, 20_000);
+    await this.notify('notifications/initialized', {});
+  }
+
+  async send(message) {
+    const res = await fetch(this.postUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...this.target.headers }, body: JSON.stringify(message), signal: AbortSignal.timeout(20_000) });
+    if (!res.ok) throw remoteError(res.status, await res.text().catch(() => ''));
+    try { await res.body?.cancel(); } catch { /* done */ }
+  }
+
+  request(method, params, timeoutMs = 120_000) {
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`MCP request timed out after ${Math.round(timeoutMs / 1000)}s: ${method}`)); }, timeoutMs);
+      this.pending.set(id, { resolve: (v) => { clearTimeout(timer); resolve(v); }, reject: (e) => { clearTimeout(timer); reject(e); } });
+      this.send({ jsonrpc: '2.0', id, method, params }).catch((e) => { const p = this.pending.get(id); if (p) { this.pending.delete(id); p.reject(e); } });
+    });
+  }
+
+  notify(method, params) { return this.send({ jsonrpc: '2.0', method, params }).catch(() => null); }
+
+  rejectAll(error) { for (const p of this.pending.values()) p.reject(error); this.pending.clear(); }
+
+  close() {
+    this.alive = false;
+    try { this.req?.destroy(); } catch { /* gone */ }
+  }
+}
+
 // One live client per server for the session.
 const clients = new Map();
 function closeAll() { for (const client of clients.values()) client.close(); clients.clear(); }
@@ -226,7 +467,8 @@ process.once('exit', closeAll);
 async function clientFor(key, config, cwd) {
   const have = clients.get(key);
   if (have?.alive) return have;
-  const fresh = new StdioClient(config, cwd);
+  const fresh = !isRemote(config) ? new StdioClient(config, cwd)
+    : String(config.type || 'http').toLowerCase() === 'sse' ? new SseClient(config) : new HttpClient(config);
   await fresh.start();
   clients.set(key, fresh);
   return fresh;
@@ -258,7 +500,7 @@ export function discoverMcpTools(cwd) {
   const key = `${path.resolve(cwd)}|${stamp(cwd)}|${JSON.stringify(loadSettings().trustedMcp?.[trustKey(cwd)] || {})}`;
   if (!discovery.has(key)) {
     discovery.set(key, (async () => {
-      const servers = allServers(cwd).filter((s) => s.config?.command && isTrusted(cwd, s));
+      const servers = allServers(cwd).filter((s) => (s.config?.command || isRemote(s.config)) && isTrusted(cwd, s));
       const lists = await Promise.all(servers.map(async (server) => {
         const ckey = `${path.resolve(cwd)}|${server.scope}|${server.name}|${fingerprint(server.config)}`;
         try {

package/src/project.js

@@ -11,6 +11,7 @@
 // starts from the code, which is what it did before these existed.
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 export const CONTEXT_FILE = 'JAITUS.md';
@@ -46,6 +47,38 @@ npm test
 `;
 
 /** The project briefing, or null. Truncated rather than refused if someone writes an essay. */
+/**
+ * Personal notes: ~/.jaitus/JAITUS.md, sent with EVERY project — how you like to work,
+ * wherever you work ("answer briefly", "I use pnpm", "never push without asking"). The
+ * project's own JAITUS.md is the other half; the two are labelled apart in the prompt.
+ */
+export function userContextFile() {
+  return path.join(os.homedir(), '.jaitus', CONTEXT_FILE);       // the same folder as config.HOME
+}
+
+export function loadUserContext() {
+  return readNotes(userContextFile(), '~/.jaitus/JAITUS.md');
+}
+
+/** Append one line to a notes file, creating it (and its folder) with a header. */
+export function appendNote(file, note, header) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (!fs.existsSync(file)) fs.writeFileSync(file, header, 'utf8');
+  const text = fs.readFileSync(file, 'utf8');
+  fs.appendFileSync(file, `${text.endsWith('\n') || !text ? '' : '\n'}- ${String(note).replace(/[\r\n]+/g, ' ').trim()}\n`, 'utf8');
+}
+
+export const USER_CONTEXT_HEADER = `# My notes for Jaitus\n\nSent with every project. Keep it short and true — how you like to work, wherever you work.\n\n`;
+export const PROJECT_CONTEXT_HEADER = `# ${CONTEXT_FILE}\n\nNotes for the Jaitus agent working in this directory.\n\n`;
+
+function readNotes(file, name) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8').trim(); } catch { return null; }
+  if (!text) return null;
+  if (text.length > MAX_CONTEXT) text = `${text.slice(0, MAX_CONTEXT)}\n\n[${name} truncated here — it is longer than the agent will read]`;
+  return text;
+}
+
 export function loadContext(cwd) {
   const file = path.join(cwd, CONTEXT_FILE);
   let text;