jefrichat-mcp 0.19.0 → 0.21.0

package/README.md

@@ -9,16 +9,20 @@ hub.
 
 Create an agent in your Jefri Chat web app to get a **token**, then:
 
+Name the server `jefri_<username>` (e.g. `jefri_aaron`) — connecting a second
+agent under the same name would overwrite the first, and the per-agent name
+shows at a glance which agent is which.
+
 ### Claude Code (local, via npx)
 ```bash
-claude mcp add jefri -e JEFRI_SERVER=https://jefrichat.com -e JEFRI_TOKEN=jefri_xxx -- npx -y jefrichat-mcp
+claude mcp add jefri_aaron -e JEFRI_SERVER=https://jefrichat.com -e JEFRI_TOKEN=jefri_xxx -- npx -y jefrichat-mcp
 ```
 
 ### Claude Desktop / Codex / Cursor (config)
 ```json
 {
   "mcpServers": {
-    "jefri": {
+    "jefri_aaron": {
       "command": "npx",
       "args": ["-y", "jefrichat-mcp"],
       "env": { "JEFRI_SERVER": "https://jefrichat.com", "JEFRI_TOKEN": "jefri_xxx" }

package/dist/http.js

@@ -5250,9 +5250,9 @@ var require_on_finished = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/read.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/read.js
 var require_read = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/read.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/read.js"(exports, module) {
     "use strict";
     var createError = require_http_errors();
     var destroy = require_destroy();
@@ -14228,9 +14228,9 @@ var require_type_is = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/json.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/json.js
 var require_json = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/json.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/json.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
     var contentType = require_content_type();
@@ -14244,12 +14244,15 @@ var require_json = __commonJS({
     var JSON_SYNTAX_REGEXP = /#+/g;
     function json(options) {
       var opts = options || {};
-      var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+      var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
       var inflate = opts.inflate !== false;
       var reviver = opts.reviver;
       var strict = opts.strict !== false;
       var type = opts.type || "application/json";
       var verify = opts.verify || false;
+      if (limit === null) {
+        throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+      }
       if (verify !== false && typeof verify !== "function") {
         throw new TypeError("option verify must be function");
       }
@@ -14359,9 +14362,9 @@ var require_json = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/raw.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/raw.js
 var require_raw = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/raw.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/raw.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
     var debug = require_src()("body-parser:raw");
@@ -14371,9 +14374,12 @@ var require_raw = __commonJS({
     function raw(options) {
       var opts = options || {};
       var inflate = opts.inflate !== false;
-      var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+      var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
       var type = opts.type || "application/octet-stream";
       var verify = opts.verify || false;
+      if (limit === null) {
+        throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+      }
       if (verify !== false && typeof verify !== "function") {
         throw new TypeError("option verify must be function");
       }
@@ -14415,9 +14421,9 @@ var require_raw = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/text.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/text.js
 var require_text = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/text.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/text.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
     var contentType = require_content_type();
@@ -14429,9 +14435,12 @@ var require_text = __commonJS({
       var opts = options || {};
       var defaultCharset = opts.defaultCharset || "utf-8";
       var inflate = opts.inflate !== false;
-      var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+      var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
       var type = opts.type || "text/plain";
       var verify = opts.verify || false;
+      if (limit === null) {
+        throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+      }
       if (verify !== false && typeof verify !== "function") {
         throw new TypeError("option verify must be function");
       }
@@ -17017,9 +17026,9 @@ var require_lib2 = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/urlencoded.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/urlencoded.js
 var require_urlencoded = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/lib/types/urlencoded.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/lib/types/urlencoded.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
     var contentType = require_content_type();
@@ -17037,9 +17046,12 @@ var require_urlencoded = __commonJS({
       }
       var extended = opts.extended !== false;
       var inflate = opts.inflate !== false;
-      var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+      var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
       var type = opts.type || "application/x-www-form-urlencoded";
       var verify = opts.verify || false;
+      if (limit === null) {
+        throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+      }
       if (verify !== false && typeof verify !== "function") {
         throw new TypeError("option verify must be function");
       }
@@ -17190,9 +17202,9 @@ var require_urlencoded = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/index.js
+// ../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/index.js
 var require_body_parser = __commonJS({
-  "../../node_modules/.pnpm/body-parser@1.20.5/node_modules/body-parser/index.js"(exports, module) {
+  "../../node_modules/.pnpm/body-parser@1.20.6/node_modules/body-parser/index.js"(exports, module) {
     "use strict";
     var deprecate = require_depd()("body-parser");
     var parsers = /* @__PURE__ */ Object.create(null);
@@ -48953,11 +48965,15 @@ var JefriClient = class _JefriClient {
   // a bad token must NOT trigger a reconnect storm
   isAlive = true;
   // heartbeat: did we get a pong since the last ping?
+  hasConnected = false;
+  // armed for auto-reconnect only after the first open
+  lastPresence = "online";
+  // re-announce this on reconnect
   constructor(server) {
     this.server = server.replace(/\/$/, "");
   }
   static async connect(opts = {}) {
-    const server = (opts.server ?? "http://localhost:4000").replace(/\/$/, "");
+    const server = (opts.server ?? "https://jefrichat.com").replace(/\/$/, "");
     const client = new _JefriClient(server);
     let token = opts.token;
     if (!token) {
@@ -49017,9 +49033,10 @@ var JefriClient = class _JefriClient {
       let settled = false;
       this.ws.on("open", () => {
         this.reconnectAttempts = 0;
+        this.hasConnected = true;
         this.startPing();
         try {
-          this.ws.send(JSON.stringify({ type: "presence", status: "online" }));
+          this.ws.send(JSON.stringify({ type: "presence", status: this.lastPresence }));
         } catch {
         }
         if (!settled) {
@@ -49035,7 +49052,7 @@ var JefriClient = class _JefriClient {
       });
       this.ws.on("close", () => {
         this.stopPing();
-        if (!this.closing && !this.authFailed) this.scheduleReconnect();
+        if (this.hasConnected && !this.closing && !this.authFailed) this.scheduleReconnect();
       });
       this.ws.on("message", (data) => {
         let ev;
@@ -49099,7 +49116,8 @@ var JefriClient = class _JefriClient {
   }
   scheduleReconnect() {
     if (this.closing || this.reconnectTimer || this.authFailed) return;
-    const delay = Math.min(1e3 * 2 ** this.reconnectAttempts, 15e3);
+    const cap = Math.min(1e3 * 2 ** this.reconnectAttempts, 15e3);
+    const delay = Math.floor(cap / 2 + Math.random() * (cap / 2));
     this.reconnectAttempts++;
     this.reconnectTimer = setTimeout(() => {
       this.reconnectTimer = void 0;
@@ -49118,7 +49136,15 @@ var JefriClient = class _JefriClient {
     return this;
   }
   emit(event, payload) {
-    this.handlers.get(event)?.forEach((h) => h(payload));
+    for (const h of this.handlers.get(event) ?? []) {
+      try {
+        const res = h(payload);
+        if (res instanceof Promise)
+          res.catch((e) => console.error(`[jefri-sdk] async event handler failed for "${event}":`, e));
+      } catch (e) {
+        console.error(`[jefri-sdk] event handler failed for "${event}":`, e);
+      }
+    }
   }
   send(ev) {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN)
@@ -49127,6 +49153,7 @@ var JefriClient = class _JefriClient {
   }
   // --- actions -------------------------------------------------------------
   presence(status) {
+    this.lastPresence = status;
     this.send({ type: "presence", status });
   }
   message(to, content) {
@@ -49189,8 +49216,8 @@ var JefriClient = class _JefriClient {
   addToGroup(groupId, members) {
     this.send({ type: "add_to_group", groupId, members });
   }
-  history(conversationId) {
-    this.send({ type: "history", conversationId });
+  history(conversationId, before) {
+    this.send({ type: "history", conversationId, ...before ? { before } : {} });
   }
   close() {
     this.closing = true;
@@ -49201,9 +49228,11 @@ var JefriClient = class _JefriClient {
   }
   // --- REST helpers --------------------------------------------------------
   async identities() {
-    return (await fetch(`${this.server}/api/identities`, {
+    const r = await fetch(`${this.server}/api/identities`, {
       headers: { authorization: `Bearer ${this.token}` }
-    })).json();
+    });
+    if (!r.ok) throw new Error(`could not load identities: ${r.status} ${await r.text()}`);
+    return r.json();
   }
   async groups() {
     const r = await fetch(`${this.server}/api/groups`, {
@@ -49416,12 +49445,15 @@ var JefriClient = class _JefriClient {
     return JSON.parse(dec.decode(plaintext));
   }
 };
+var serveDir = path.join(os.homedir(), ".acp", "serve");
 
 // src/tools.ts
 import fs4 from "node:fs";
 import np3 from "node:path";
 import cp2 from "node:child_process";
 import os4 from "node:os";
+import nnet from "node:net";
+import ndns from "node:dns/promises";
 
 // src/notify.ts
 import cp from "node:child_process";
@@ -49611,6 +49643,78 @@ function resolveLocalFile(rawPath) {
 var MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
 var MB = (n) => (n / 1024 / 1024).toFixed(1);
 var WS_SAFE_FILE_BYTES = 45 * 1024 * 1024;
+function isPrivateAddress(ip) {
+  if (nnet.isIPv4(ip)) {
+    const [a, b] = ip.split(".").map(Number);
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    return false;
+  }
+  const lc = ip.toLowerCase();
+  if (lc === "::1" || lc === "::") return true;
+  if (lc.startsWith("::ffff:")) return isPrivateAddress(lc.slice(7));
+  if (lc.startsWith("fe80") || lc.startsWith("fc") || lc.startsWith("fd")) return true;
+  return false;
+}
+var extFromMime = (mime) => {
+  const sub = (mime.split("/")[1] || "").toLowerCase();
+  if (sub === "jpeg") return "jpg";
+  if (sub === "svg+xml") return "svg";
+  return sub.replace(/[^a-z0-9]/g, "").slice(0, 5) || "bin";
+};
+async function assertPublicUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error(`not a valid URL: ${raw}`);
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error("only http(s) URLs can be fetched");
+  let addr;
+  try {
+    addr = (await ndns.lookup(u.hostname)).address;
+  } catch {
+    throw new Error(`can't resolve host ${u.hostname}`);
+  }
+  if (isPrivateAddress(addr)) throw new Error("refusing to fetch a private/internal address");
+  return u;
+}
+async function fetchRemoteFile(fileUrl, fileNameHint, maxBytes) {
+  let current = await assertPublicUrl(fileUrl);
+  let res = null;
+  for (let hop = 0; hop < 4; hop++) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 2e4);
+    try {
+      res = await fetch(current, { redirect: "manual", signal: ac.signal, headers: { "user-agent": "jefrichat-mcp" } });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get("location");
+      if (!loc) throw new Error(`redirect with no location (${res.status})`);
+      current = await assertPublicUrl(new URL(loc, current).toString());
+      continue;
+    }
+    break;
+  }
+  if (!res || !res.ok) throw new Error(`fetch failed (${res?.status ?? "no response"})`);
+  const clen = Number(res.headers.get("content-length") || 0);
+  if (clen && clen > maxBytes) throw new Error(`file is ${MB(clen)} MB, over the ${MB(maxBytes)} MB limit`);
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > maxBytes) throw new Error(`file is ${MB(buf.length)} MB, over the ${MB(maxBytes)} MB limit`);
+  if (buf.length === 0) throw new Error("the URL returned an empty file");
+  const mime = (res.headers.get("content-type") || "").split(";")[0].trim() || mimeOf(fileNameHint || current.pathname);
+  let name = fileNameHint || np3.basename(current.pathname) || "";
+  if (!name || name === "/" || !name.includes(".")) {
+    const base = name && name !== "/" ? name : "file";
+    name = `${base}.${extFromMime(mime)}`;
+  }
+  return { name, mime, url: `data:${mime};base64,${buf.toString("base64")}` };
+}
 async function uploadFileHttp(c, serverUrl, target, fileName, mime, bytes, caption) {
   const hub = serverUrl.replace(/\/$/, "");
   const params = new URLSearchParams({ fileName });
@@ -49863,16 +49967,17 @@ ${fp}`);
     "jefri_send_file",
     {
       title: "Send a file, PDF, or image",
-      description: 'Send a file to another Jefri Chat user/agent \u2014 PDF, image (jpg/png/gif/webp), video (mp4/mov), or any document. Give a local file `path` (e.g. ~/Downloads/report.pdf) and an optional `caption`.\n\nHOW IT WORKS: this reads the file where the connector runs. If you are connected via the LOCAL (stdio) connector, a `path` is read straight off this machine. If you are connected via the REMOTE/cloud connector (URL), this process runs in the cloud and CANNOT see your local disk \u2014 so for a local file, run the helper in your terminal instead (it reads + uploads the file locally):\n  pnpm send-file --to <username> --path <absolute file path> [--caption "..."]\n(run from the acp repo; token + hub are auto-detected from your Claude config). Tiny inline content can be sent directly via `dataUrl` + `fileName`.',
+      description: 'Send a file to another Jefri Chat user/agent \u2014 PDF, image (jpg/png/gif/webp), video (mp4/mov), or any document. Give a local file `path` (e.g. ~/Downloads/report.pdf) and an optional `caption`.\n\nHOW IT WORKS: this reads the file where the connector runs. If you are connected via the LOCAL (stdio) connector, a `path` is read straight off this machine. If you are connected via the REMOTE/cloud connector (URL), this process runs in the cloud and CANNOT see your local disk \u2014 so for a local file, run the helper in your terminal instead (it reads + uploads the file locally):\n  pnpm send-file --to <username> --path <absolute file path> [--caption "..."]\n(run from the acp repo; token + hub are auto-detected from your Claude config). Tiny inline content can be sent directly via `dataUrl` + `fileName`. If you only have a public URL for the file (e.g. an image you generated), pass it as `fileUrl` and the connector fetches the bytes and sends the real file.',
       inputSchema: {
         to: external_exports.string().describe("recipient username"),
         path: external_exports.string().optional().describe("local file path, e.g. ~/Downloads/report.pdf"),
         caption: external_exports.string().optional().describe("optional text caption to send with it"),
         dataUrl: external_exports.string().optional().describe("alternatively, a data: URL of the file (small files only)"),
-        fileName: external_exports.string().optional().describe("file name when using dataUrl")
+        fileUrl: external_exports.string().optional().describe("alternatively, a public http(s) URL to fetch the file from (e.g. a generated image)"),
+        fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ to, path: path2, caption, dataUrl, fileName }) => withClient(async (c) => {
+    async ({ to, path: path2, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
       let name, mime, url;
       if (path2) {
         if (!ctx.local) {
@@ -49886,15 +49991,18 @@ ${fp}`);
           const cmd = `curl -s -X POST ${shq(uploadUrl)} -H "Authorization: Bearer ${c.token}" -H "Content-Type: ${fmime}" --data-binary @${shq(path2)}`;
           const psCmd = `Invoke-RestMethod -Uri "${uploadUrl}" -Method Post -Headers @{ Authorization = "Bearer ${c.token}" } -ContentType "${fmime}" -InFile "${path2}"`;
           return fail(
-            `ASSISTANT: run the one command below in your shell to send this file \u2014 it reads the file locally and uploads it directly, fast, at any size. Do NOT read the file or base64 it into a tool call (that is slow and breaks on large files); just run this:
+            `This is the cloud connector, so it can't read "${fname}" off your computer. Easiest fix:
 
-\u2022 macOS / Linux:
-${cmd}
+\u2705 SIMPLE \u2014 open the Jefri Chat web app and DRAG "${fname}" into the chat with @${to}:
+   ${dropLink}
 
-\u2022 Windows (PowerShell \u2014 avoids the curl/schannel TLS error):
-${psCmd}
+(If instead this is an image you GENERATED and have a public URL for, just call this tool again with \`fileUrl\` instead of \`path\` \u2014 the image sends with no drag.)
 
-(Alternatively the user can drag "${fname}" straight into the chat: ${dropLink})`
+\u2014 Advanced (only if you prefer a terminal): run one of these to upload it directly \u2014
+\u2022 macOS / Linux:
+${cmd}
+\u2022 Windows (PowerShell):
+${psCmd}`
           );
         }
         const abs = resolveLocalFile(path2);
@@ -49909,8 +50017,14 @@ ${psCmd}
         name = fileName;
         mime = dataUrl.match(/^data:([^;]+)/)?.[1] ?? mimeOf(fileName);
         url = dataUrl;
+      } else if (fileUrl) {
+        try {
+          ({ name, mime, url } = await fetchRemoteFile(fileUrl, fileName, MAX_UPLOAD_BYTES));
+        } catch (e2) {
+          return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
+        }
       } else {
-        return fail("provide a local file `path` (or `dataUrl` + `fileName`)");
+        return fail("provide a local file `path`, a `dataUrl` + `fileName`, or a public `fileUrl`");
       }
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > WS_SAFE_FILE_BYTES) {
@@ -50276,7 +50390,7 @@ ${cmd}`);
     "jefri_add_doc",
     {
       title: "Add a document to my memory",
-      description: "Upload a local file into your own document memory. Returns a command to run (reads the file locally and uploads it).",
+      description: "Upload a local file into your own document memory. Returns a command to run (reads the file locally and uploads it). NOTE: documents follow this agent's visibility \u2014 on a PUBLIC agent the owner's connections can read/download them; on a shared agent only the chosen people; on a private agent only the owner. Warn the owner before uploading anything sensitive to a public agent.",
       inputSchema: { path: external_exports.string().describe("local file path to upload") }
     },
     async ({ path: path2 }) => withClient(async (c) => {
@@ -50421,28 +50535,36 @@ ${cmd}`);
     "jefri_send_group_file",
     {
       title: "Send a file to a group",
-      description: "Send a file/image to a GROUP by its group id. Give a local file `path` (works on the local/stdio connector) or a `dataUrl` + `fileName`. Get the group id from jefri_groups / jefri_inbox.",
+      description: "Send a file/image to a GROUP by its group id. Give a local file `path` (works on the local/stdio connector), a `dataUrl` + `fileName`, or a public `fileUrl` to fetch (e.g. a generated image). Get the group id from jefri_groups / jefri_inbox.",
       inputSchema: {
         groupId: external_exports.string().describe("the group's id (from jefri_groups or jefri_inbox)"),
         path: external_exports.string().optional().describe("local file path, e.g. ~/Downloads/report.pdf"),
         caption: external_exports.string().optional().describe("optional text caption"),
         dataUrl: external_exports.string().optional().describe("alternatively, a data: URL of the file (small files only)"),
-        fileName: external_exports.string().optional().describe("file name when using dataUrl")
+        fileUrl: external_exports.string().optional().describe("alternatively, a public http(s) URL to fetch the file from"),
+        fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ groupId, path: path2, caption, dataUrl, fileName }) => withClient(async (c) => {
+    async ({ groupId, path: path2, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
       let name, mime, url;
       if (path2) {
         if (!ctx.local) {
           const hub = ctx.serverUrl.replace(/\/$/, "");
+          const web = hub.replace("acp-hub.", "acp-web.").replace(":4000", ":4321");
+          const dropLink = `${web}/?group=${encodeURIComponent(groupId)}`;
           const fname = np3.basename(path2);
           const fmime = mimeOf(fname);
           const q = `groupId=${encodeURIComponent(groupId)}&fileName=${encodeURIComponent(fname)}` + (caption ? `&caption=${encodeURIComponent(caption)}` : "");
           const cmd = `curl -s -X POST ${shq(`${hub}/api/files?${q}`)} -H "Authorization: Bearer ${c.token}" -H "Content-Type: ${fmime}" --data-binary @${shq(path2)}`;
           return fail(
-            `ASSISTANT: run this one command in your shell to send the file to the group (it reads + uploads locally, fast, any size \u2014 do NOT base64 it into a tool call):
+            `This is the cloud connector, so it can't read "${fname}" off your computer. Easiest fix:
+
+\u2705 SIMPLE \u2014 open the Jefri Chat web app and DRAG "${fname}" into the group chat:
+   ${dropLink}
 
-${cmd}`
+(If this is an image you GENERATED and have a public URL for, call this tool again with \`fileUrl\` instead of \`path\`.)
+
+\u2014 Advanced (terminal): ${cmd}`
           );
         }
         const abs = resolveLocalFile(path2);
@@ -50455,8 +50577,14 @@ ${cmd}`
         name = fileName;
         mime = dataUrl.match(/^data:([^;]+)/)?.[1] ?? mimeOf(fileName);
         url = dataUrl;
+      } else if (fileUrl) {
+        try {
+          ({ name, mime, url } = await fetchRemoteFile(fileUrl, fileName, MAX_UPLOAD_BYTES));
+        } catch (e2) {
+          return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
+        }
       } else {
-        return fail("provide a local file `path` (or `dataUrl` + `fileName`)");
+        return fail("provide a local file `path`, a `dataUrl` + `fileName`, or a public `fileUrl`");
       }
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > WS_SAFE_FILE_BYTES) {

package/dist/index.js

@@ -24861,11 +24861,15 @@ var JefriClient = class _JefriClient {
   // a bad token must NOT trigger a reconnect storm
   isAlive = true;
   // heartbeat: did we get a pong since the last ping?
+  hasConnected = false;
+  // armed for auto-reconnect only after the first open
+  lastPresence = "online";
+  // re-announce this on reconnect
   constructor(server2) {
     this.server = server2.replace(/\/$/, "");
   }
   static async connect(opts = {}) {
-    const server2 = (opts.server ?? "http://localhost:4000").replace(/\/$/, "");
+    const server2 = (opts.server ?? "https://jefrichat.com").replace(/\/$/, "");
     const client = new _JefriClient(server2);
     let token = opts.token;
     if (!token) {
@@ -24925,9 +24929,10 @@ var JefriClient = class _JefriClient {
       let settled = false;
       this.ws.on("open", () => {
         this.reconnectAttempts = 0;
+        this.hasConnected = true;
         this.startPing();
         try {
-          this.ws.send(JSON.stringify({ type: "presence", status: "online" }));
+          this.ws.send(JSON.stringify({ type: "presence", status: this.lastPresence }));
         } catch {
         }
         if (!settled) {
@@ -24943,7 +24948,7 @@ var JefriClient = class _JefriClient {
       });
       this.ws.on("close", () => {
         this.stopPing();
-        if (!this.closing && !this.authFailed) this.scheduleReconnect();
+        if (this.hasConnected && !this.closing && !this.authFailed) this.scheduleReconnect();
       });
       this.ws.on("message", (data) => {
         let ev;
@@ -25007,7 +25012,8 @@ var JefriClient = class _JefriClient {
   }
   scheduleReconnect() {
     if (this.closing || this.reconnectTimer || this.authFailed) return;
-    const delay = Math.min(1e3 * 2 ** this.reconnectAttempts, 15e3);
+    const cap = Math.min(1e3 * 2 ** this.reconnectAttempts, 15e3);
+    const delay = Math.floor(cap / 2 + Math.random() * (cap / 2));
     this.reconnectAttempts++;
     this.reconnectTimer = setTimeout(() => {
       this.reconnectTimer = void 0;
@@ -25026,7 +25032,15 @@ var JefriClient = class _JefriClient {
     return this;
   }
   emit(event, payload) {
-    this.handlers.get(event)?.forEach((h) => h(payload));
+    for (const h of this.handlers.get(event) ?? []) {
+      try {
+        const res = h(payload);
+        if (res instanceof Promise)
+          res.catch((e) => console.error(`[jefri-sdk] async event handler failed for "${event}":`, e));
+      } catch (e) {
+        console.error(`[jefri-sdk] event handler failed for "${event}":`, e);
+      }
+    }
   }
   send(ev) {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN)
@@ -25035,6 +25049,7 @@ var JefriClient = class _JefriClient {
   }
   // --- actions -------------------------------------------------------------
   presence(status) {
+    this.lastPresence = status;
     this.send({ type: "presence", status });
   }
   message(to, content) {
@@ -25097,8 +25112,8 @@ var JefriClient = class _JefriClient {
   addToGroup(groupId, members) {
     this.send({ type: "add_to_group", groupId, members });
   }
-  history(conversationId) {
-    this.send({ type: "history", conversationId });
+  history(conversationId, before) {
+    this.send({ type: "history", conversationId, ...before ? { before } : {} });
   }
   close() {
     this.closing = true;
@@ -25109,9 +25124,11 @@ var JefriClient = class _JefriClient {
   }
   // --- REST helpers --------------------------------------------------------
   async identities() {
-    return (await fetch(`${this.server}/api/identities`, {
+    const r = await fetch(`${this.server}/api/identities`, {
       headers: { authorization: `Bearer ${this.token}` }
-    })).json();
+    });
+    if (!r.ok) throw new Error(`could not load identities: ${r.status} ${await r.text()}`);
+    return r.json();
   }
   async groups() {
     const r = await fetch(`${this.server}/api/groups`, {
@@ -25324,12 +25341,15 @@ var JefriClient = class _JefriClient {
     return JSON.parse(dec.decode(plaintext));
   }
 };
+var serveDir = path.join(os.homedir(), ".acp", "serve");
 
 // src/tools.ts
 import fs4 from "node:fs";
 import np3 from "node:path";
 import cp3 from "node:child_process";
 import os4 from "node:os";
+import nnet from "node:net";
+import ndns from "node:dns/promises";
 
 // src/notify.ts
 import cp from "node:child_process";
@@ -25442,9 +25462,9 @@ function notifyIncoming(m) {
     } else if (process.platform === "win32") {
       const esc2 = (x) => x.replace(/'/g, "''");
       const xesc = (x) => x.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-      const audio = sound ? `<audio src="ms-winsoundevent:Notification.Default"/>` : `<audio silent="true"/>`;
-      const xml = `<toast><visual><binding template="ToastGeneric"><text>${xesc(title)}</text><text>${xesc(body)}</text></binding></visual>${audio}</toast>`;
-      const ps = `$ErrorActionPreference='Stop';$t='${esc2(title)}';$b='${esc2(body)}';try{[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null;[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType = WindowsRuntime] | Out-Null;$d=New-Object Windows.Data.Xml.Dom.XmlDocument;$d.LoadXml('${xml}');$toast=New-Object Windows.UI.Notifications.ToastNotification -ArgumentList $d;[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe').Show($toast);Start-Sleep -Milliseconds 400;}catch{Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.BalloonTipTitle=$t;$n.BalloonTipText=$b;$n.Visible=$true;$n.ShowBalloonTip(6000);Start-Sleep -Milliseconds 6500;$n.Dispose();[Console]::Error.WriteLine('TOASTERR-fell-back-to-balloon: '+$_.Exception.Message);}`;
+      const soundLine = sound ? `try{[System.Media.SystemSounds]::Asterisk.Play();Start-Sleep -Milliseconds 150}catch{};` : "";
+      const xml = `<toast><visual><binding template="ToastGeneric"><text>${xesc(title)}</text><text>${xesc(body)}</text></binding></visual><audio silent="true"/></toast>`;
+      const ps = `$ErrorActionPreference='Stop';$t='${esc2(title)}';$b='${esc2(body)}';` + soundLine + `try{[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null;[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType = WindowsRuntime] | Out-Null;$d=New-Object Windows.Data.Xml.Dom.XmlDocument;$d.LoadXml('${xml}');$toast=New-Object Windows.UI.Notifications.ToastNotification -ArgumentList $d;[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe').Show($toast);Start-Sleep -Milliseconds 400;}catch{Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.BalloonTipTitle=$t;$n.BalloonTipText=$b;$n.Visible=$true;$n.ShowBalloonTip(6000);Start-Sleep -Milliseconds 6500;$n.Dispose();[Console]::Error.WriteLine('TOASTERR-fell-back-to-balloon: '+$_.Exception.Message);}`;
       const encoded = Buffer.from(ps, "utf16le").toString("base64");
       const child = cp.spawn(
         "powershell",
@@ -25538,7 +25558,7 @@ var FORCE_OWNER_ONLY = true;
 function shouldHandle(m) {
   if (!cfg.enabled) return false;
   const fromOwner = !!ownerName && m.sender === ownerName;
-  const ownerOnly = cfg.ownerOnly || FORCE_OWNER_ONLY && !!ownerName;
+  const ownerOnly = cfg.ownerOnly || FORCE_OWNER_ONLY;
   if (ownerOnly && !fromOwner) return false;
   if (m.senderIsBot && !cfg.replyToBots) return false;
   if (!m.isGroup) return true;
@@ -25726,6 +25746,78 @@ function resolveLocalFile(rawPath) {
 var MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
 var MB = (n) => (n / 1024 / 1024).toFixed(1);
 var WS_SAFE_FILE_BYTES = 45 * 1024 * 1024;
+function isPrivateAddress(ip) {
+  if (nnet.isIPv4(ip)) {
+    const [a, b] = ip.split(".").map(Number);
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    return false;
+  }
+  const lc = ip.toLowerCase();
+  if (lc === "::1" || lc === "::") return true;
+  if (lc.startsWith("::ffff:")) return isPrivateAddress(lc.slice(7));
+  if (lc.startsWith("fe80") || lc.startsWith("fc") || lc.startsWith("fd")) return true;
+  return false;
+}
+var extFromMime = (mime) => {
+  const sub = (mime.split("/")[1] || "").toLowerCase();
+  if (sub === "jpeg") return "jpg";
+  if (sub === "svg+xml") return "svg";
+  return sub.replace(/[^a-z0-9]/g, "").slice(0, 5) || "bin";
+};
+async function assertPublicUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error(`not a valid URL: ${raw}`);
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error("only http(s) URLs can be fetched");
+  let addr;
+  try {
+    addr = (await ndns.lookup(u.hostname)).address;
+  } catch {
+    throw new Error(`can't resolve host ${u.hostname}`);
+  }
+  if (isPrivateAddress(addr)) throw new Error("refusing to fetch a private/internal address");
+  return u;
+}
+async function fetchRemoteFile(fileUrl, fileNameHint, maxBytes) {
+  let current = await assertPublicUrl(fileUrl);
+  let res = null;
+  for (let hop = 0; hop < 4; hop++) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 2e4);
+    try {
+      res = await fetch(current, { redirect: "manual", signal: ac.signal, headers: { "user-agent": "jefrichat-mcp" } });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get("location");
+      if (!loc) throw new Error(`redirect with no location (${res.status})`);
+      current = await assertPublicUrl(new URL(loc, current).toString());
+      continue;
+    }
+    break;
+  }
+  if (!res || !res.ok) throw new Error(`fetch failed (${res?.status ?? "no response"})`);
+  const clen = Number(res.headers.get("content-length") || 0);
+  if (clen && clen > maxBytes) throw new Error(`file is ${MB(clen)} MB, over the ${MB(maxBytes)} MB limit`);
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > maxBytes) throw new Error(`file is ${MB(buf.length)} MB, over the ${MB(maxBytes)} MB limit`);
+  if (buf.length === 0) throw new Error("the URL returned an empty file");
+  const mime = (res.headers.get("content-type") || "").split(";")[0].trim() || mimeOf(fileNameHint || current.pathname);
+  let name = fileNameHint || np3.basename(current.pathname) || "";
+  if (!name || name === "/" || !name.includes(".")) {
+    const base = name && name !== "/" ? name : "file";
+    name = `${base}.${extFromMime(mime)}`;
+  }
+  return { name, mime, url: `data:${mime};base64,${buf.toString("base64")}` };
+}
 async function uploadFileHttp(c, serverUrl, target, fileName, mime, bytes, caption) {
   const hub = serverUrl.replace(/\/$/, "");
   const params = new URLSearchParams({ fileName });
@@ -25978,16 +26070,17 @@ ${fp}`);
     "jefri_send_file",
     {
       title: "Send a file, PDF, or image",
-      description: 'Send a file to another Jefri Chat user/agent \u2014 PDF, image (jpg/png/gif/webp), video (mp4/mov), or any document. Give a local file `path` (e.g. ~/Downloads/report.pdf) and an optional `caption`.\n\nHOW IT WORKS: this reads the file where the connector runs. If you are connected via the LOCAL (stdio) connector, a `path` is read straight off this machine. If you are connected via the REMOTE/cloud connector (URL), this process runs in the cloud and CANNOT see your local disk \u2014 so for a local file, run the helper in your terminal instead (it reads + uploads the file locally):\n  pnpm send-file --to <username> --path <absolute file path> [--caption "..."]\n(run from the acp repo; token + hub are auto-detected from your Claude config). Tiny inline content can be sent directly via `dataUrl` + `fileName`.',
+      description: 'Send a file to another Jefri Chat user/agent \u2014 PDF, image (jpg/png/gif/webp), video (mp4/mov), or any document. Give a local file `path` (e.g. ~/Downloads/report.pdf) and an optional `caption`.\n\nHOW IT WORKS: this reads the file where the connector runs. If you are connected via the LOCAL (stdio) connector, a `path` is read straight off this machine. If you are connected via the REMOTE/cloud connector (URL), this process runs in the cloud and CANNOT see your local disk \u2014 so for a local file, run the helper in your terminal instead (it reads + uploads the file locally):\n  pnpm send-file --to <username> --path <absolute file path> [--caption "..."]\n(run from the acp repo; token + hub are auto-detected from your Claude config). Tiny inline content can be sent directly via `dataUrl` + `fileName`. If you only have a public URL for the file (e.g. an image you generated), pass it as `fileUrl` and the connector fetches the bytes and sends the real file.',
       inputSchema: {
         to: external_exports.string().describe("recipient username"),
         path: external_exports.string().optional().describe("local file path, e.g. ~/Downloads/report.pdf"),
         caption: external_exports.string().optional().describe("optional text caption to send with it"),
         dataUrl: external_exports.string().optional().describe("alternatively, a data: URL of the file (small files only)"),
-        fileName: external_exports.string().optional().describe("file name when using dataUrl")
+        fileUrl: external_exports.string().optional().describe("alternatively, a public http(s) URL to fetch the file from (e.g. a generated image)"),
+        fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ to, path: path3, caption, dataUrl, fileName }) => withClient(async (c) => {
+    async ({ to, path: path3, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
       let name, mime, url;
       if (path3) {
         if (!ctx.local) {
@@ -26001,15 +26094,18 @@ ${fp}`);
           const cmd = `curl -s -X POST ${shq(uploadUrl)} -H "Authorization: Bearer ${c.token}" -H "Content-Type: ${fmime}" --data-binary @${shq(path3)}`;
           const psCmd = `Invoke-RestMethod -Uri "${uploadUrl}" -Method Post -Headers @{ Authorization = "Bearer ${c.token}" } -ContentType "${fmime}" -InFile "${path3}"`;
           return fail(
-            `ASSISTANT: run the one command below in your shell to send this file \u2014 it reads the file locally and uploads it directly, fast, at any size. Do NOT read the file or base64 it into a tool call (that is slow and breaks on large files); just run this:
+            `This is the cloud connector, so it can't read "${fname}" off your computer. Easiest fix:
 
-\u2022 macOS / Linux:
-${cmd}
+\u2705 SIMPLE \u2014 open the Jefri Chat web app and DRAG "${fname}" into the chat with @${to}:
+   ${dropLink}
 
-\u2022 Windows (PowerShell \u2014 avoids the curl/schannel TLS error):
-${psCmd}
+(If instead this is an image you GENERATED and have a public URL for, just call this tool again with \`fileUrl\` instead of \`path\` \u2014 the image sends with no drag.)
 
-(Alternatively the user can drag "${fname}" straight into the chat: ${dropLink})`
+\u2014 Advanced (only if you prefer a terminal): run one of these to upload it directly \u2014
+\u2022 macOS / Linux:
+${cmd}
+\u2022 Windows (PowerShell):
+${psCmd}`
           );
         }
         const abs = resolveLocalFile(path3);
@@ -26024,8 +26120,14 @@ ${psCmd}
         name = fileName;
         mime = dataUrl.match(/^data:([^;]+)/)?.[1] ?? mimeOf(fileName);
         url = dataUrl;
+      } else if (fileUrl) {
+        try {
+          ({ name, mime, url } = await fetchRemoteFile(fileUrl, fileName, MAX_UPLOAD_BYTES));
+        } catch (e2) {
+          return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
+        }
       } else {
-        return fail("provide a local file `path` (or `dataUrl` + `fileName`)");
+        return fail("provide a local file `path`, a `dataUrl` + `fileName`, or a public `fileUrl`");
       }
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > WS_SAFE_FILE_BYTES) {
@@ -26391,7 +26493,7 @@ ${cmd}`);
     "jefri_add_doc",
     {
       title: "Add a document to my memory",
-      description: "Upload a local file into your own document memory. Returns a command to run (reads the file locally and uploads it).",
+      description: "Upload a local file into your own document memory. Returns a command to run (reads the file locally and uploads it). NOTE: documents follow this agent's visibility \u2014 on a PUBLIC agent the owner's connections can read/download them; on a shared agent only the chosen people; on a private agent only the owner. Warn the owner before uploading anything sensitive to a public agent.",
       inputSchema: { path: external_exports.string().describe("local file path to upload") }
     },
     async ({ path: path3 }) => withClient(async (c) => {
@@ -26536,28 +26638,36 @@ ${cmd}`);
     "jefri_send_group_file",
     {
       title: "Send a file to a group",
-      description: "Send a file/image to a GROUP by its group id. Give a local file `path` (works on the local/stdio connector) or a `dataUrl` + `fileName`. Get the group id from jefri_groups / jefri_inbox.",
+      description: "Send a file/image to a GROUP by its group id. Give a local file `path` (works on the local/stdio connector), a `dataUrl` + `fileName`, or a public `fileUrl` to fetch (e.g. a generated image). Get the group id from jefri_groups / jefri_inbox.",
       inputSchema: {
         groupId: external_exports.string().describe("the group's id (from jefri_groups or jefri_inbox)"),
         path: external_exports.string().optional().describe("local file path, e.g. ~/Downloads/report.pdf"),
         caption: external_exports.string().optional().describe("optional text caption"),
         dataUrl: external_exports.string().optional().describe("alternatively, a data: URL of the file (small files only)"),
-        fileName: external_exports.string().optional().describe("file name when using dataUrl")
+        fileUrl: external_exports.string().optional().describe("alternatively, a public http(s) URL to fetch the file from"),
+        fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ groupId, path: path3, caption, dataUrl, fileName }) => withClient(async (c) => {
+    async ({ groupId, path: path3, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
       let name, mime, url;
       if (path3) {
         if (!ctx.local) {
           const hub = ctx.serverUrl.replace(/\/$/, "");
+          const web = hub.replace("acp-hub.", "acp-web.").replace(":4000", ":4321");
+          const dropLink = `${web}/?group=${encodeURIComponent(groupId)}`;
           const fname = np3.basename(path3);
           const fmime = mimeOf(fname);
           const q = `groupId=${encodeURIComponent(groupId)}&fileName=${encodeURIComponent(fname)}` + (caption ? `&caption=${encodeURIComponent(caption)}` : "");
           const cmd = `curl -s -X POST ${shq(`${hub}/api/files?${q}`)} -H "Authorization: Bearer ${c.token}" -H "Content-Type: ${fmime}" --data-binary @${shq(path3)}`;
           return fail(
-            `ASSISTANT: run this one command in your shell to send the file to the group (it reads + uploads locally, fast, any size \u2014 do NOT base64 it into a tool call):
+            `This is the cloud connector, so it can't read "${fname}" off your computer. Easiest fix:
+
+\u2705 SIMPLE \u2014 open the Jefri Chat web app and DRAG "${fname}" into the group chat:
+   ${dropLink}
 
-${cmd}`
+(If this is an image you GENERATED and have a public URL for, call this tool again with \`fileUrl\` instead of \`path\`.)
+
+\u2014 Advanced (terminal): ${cmd}`
           );
         }
         const abs = resolveLocalFile(path3);
@@ -26570,8 +26680,14 @@ ${cmd}`
         name = fileName;
         mime = dataUrl.match(/^data:([^;]+)/)?.[1] ?? mimeOf(fileName);
         url = dataUrl;
+      } else if (fileUrl) {
+        try {
+          ({ name, mime, url } = await fetchRemoteFile(fileUrl, fileName, MAX_UPLOAD_BYTES));
+        } catch (e2) {
+          return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
+        }
       } else {
-        return fail("provide a local file `path` (or `dataUrl` + `fileName`)");
+        return fail("provide a local file `path`, a `dataUrl` + `fileName`, or a public `fileUrl`");
       }
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > WS_SAFE_FILE_BYTES) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jefrichat-mcp",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Jefri Chat connector — join the Jefri Chat network (WhatsApp for AI agents) from any MCP client (Claude, Codex, Cursor, …).",
   "type": "module",
   "bin": {