jefrichat-mcp 0.48.10 → 0.48.12

package/dist/http.js

@@ -32012,7 +32012,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash2 } = __require("crypto");
+    var { randomBytes, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -32680,7 +32680,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -33049,7 +33049,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension3 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -33356,7 +33356,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -60785,8 +60785,12 @@ var JefriHttpClient = class {
   /** DECLARE a status — a user-level choice that hits every connection the
    *  identity holds. The returned status is the SETTLED one, which may differ
    *  from the request if another lease outvoted it. */
-  presence(status) {
-    return this.call("POST", "/api/presence", { status });
+  /** `declId` (optional) makes the declaration retry-safe: a re-POST of the
+   *  same id replays — answering the CURRENT settled state — instead of
+   *  reapplying, so a stale retry can never overwrite a status another device
+   *  chose in between. Reusing an id with a DIFFERENT status is a 409. */
+  presence(status, declId) {
+    return this.call("POST", "/api/presence", declId ? { status, declId } : { status });
   }
   /** KEEPALIVE — "still here", declaring nothing. This is the call for a timer.
    *  Heartbeating through presence("online") instead is a declaration on a
@@ -61519,8 +61523,10 @@ async function statelessPresenceBringUp(acp) {
   try {
     const hb = await acp.heartbeat();
     if (hb.state === "signedOff") await acp.presence("online");
+    return true;
   } catch (e) {
-    log("stateless presence bring-up failed (will retry on sweep):", e?.message ?? e);
+    log("stateless presence bring-up failed (the sweep retries it):", e?.message ?? e);
+    return false;
   }
 }
 async function statelessSweepBeat(acp, pool, onAuthRevoked) {
@@ -61536,6 +61542,71 @@ async function statelessSweepBeat(acp, pool, onAuthRevoked) {
   }
 }
 
+// src/stateless-mcp.ts
+var rpcError = (res, status, code3, message) => res.status(status).json({ jsonrpc: "2.0", error: { code: code3, message }, id: null });
+function statelessMcpHandler(deps) {
+  return async (req, res) => {
+    if (deps.isDraining()) {
+      res.setHeader("retry-after", "1");
+      return rpcError(res, 503, -32e3, "server is shutting down \u2014 retry; another instance will answer");
+    }
+    const token = deps.bearer(req);
+    if (!token)
+      return rpcError(res, 401, -32001, "Missing Jefri Chat token \u2014 every request must include Authorization: Bearer <token> (or ?token=).");
+    if (!deps.tryAcquireInflight(token))
+      return rpcError(res, 429, -32003, "too many concurrent requests \u2014 slow down.");
+    try {
+      let acp;
+      try {
+        ({ acp } = await deps.acquire(token));
+      } catch (e) {
+        if (deps.classifyError(e) === "auth")
+          return rpcError(
+            res,
+            401,
+            -32001,
+            "Invalid or expired Jefri Chat token. Rotate it in the Jefri Chat web app (the agent's owner \u2192 \u{1F511} connect) and reconnect with the fresh command."
+          );
+        return rpcError(res, 502, -32002, `Hub unreachable: ${e?.message ?? e}`);
+      }
+      const mcp = new McpServer({ name: "jefrichat", version: "0.1.0" });
+      const deferred = [];
+      deps.registerTools(mcp, acp, { deferUntilDelivered: (fn) => deferred.push(fn) });
+      const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+      res.on("finish", () => {
+        for (const fn of deferred) {
+          try {
+            void Promise.resolve(fn()).catch((e) => deps.log?.("deferred post-delivery work failed:", e?.message ?? e));
+          } catch (e) {
+            deps.log?.("deferred post-delivery work failed:", e?.message ?? e);
+          }
+        }
+        deferred.length = 0;
+      });
+      res.on("close", () => {
+        try {
+          transport.close();
+        } catch {
+        }
+        try {
+          void mcp.close();
+        } catch {
+        }
+      });
+      await mcp.connect(transport);
+      await transport.handleRequest(req, res, req.body);
+    } catch (e) {
+      deps.log?.("stateless request failed:", e?.message ?? e);
+      if (!res.headersSent) rpcError(res, 500, -32603, "internal error handling the request");
+    } finally {
+      deps.releaseInflight(token);
+    }
+  };
+}
+function statelessMethodNotAllowed(_req, res) {
+  res.status(405).json({ jsonrpc: "2.0", error: { code: -32e3, message: "stateless server: POST only (no SSE stream, no session to terminate)" }, id: null });
+}
+
 // src/conn-pool.ts
 function attachRef(c, id) {
   if (c.closed) return false;
@@ -61574,7 +61645,8 @@ function createKeyedPool() {
       return v;
     },
     has: (key) => ready.has(key),
-    size: () => ready.size
+    size: () => ready.size,
+    keys: () => [...ready.keys()]
   };
 }
 
@@ -61602,6 +61674,7 @@ import cp3 from "node:child_process";
 import os4 from "node:os";
 import nnet from "node:net";
 import ndns from "node:dns/promises";
+import { createHash as createHash2 } from "node:crypto";
 import nhttp from "node:http";
 import nhttps from "node:https";
 
@@ -62024,6 +62097,22 @@ async function confirmWrite(c, fire) {
   const e = await err;
   return e ? { error: e.message } : {};
 }
+function retryKey(extra, parts) {
+  const rid = extra?.requestId;
+  if (rid === void 0 || rid === null) return void 0;
+  const h = extra?.requestInfo?.headers;
+  const ua = String((typeof h?.get === "function" ? h.get("user-agent") : h?.["user-agent"]) ?? "");
+  if (!ua) return void 0;
+  const bucket = Math.floor(Date.now() / 75e3);
+  return "mcp-" + createHash2("sha256").update(JSON.stringify([bucket, ua, rid, ...parts])).digest("hex").slice(0, 40);
+}
+function declKey(extra, parts) {
+  const rid = extra?.requestId;
+  if (rid === void 0 || rid === null) return void 0;
+  const h = extra?.requestInfo?.headers;
+  const ua = String((typeof h?.get === "function" ? h.get("user-agent") : h?.["user-agent"]) ?? "");
+  return "d-" + createHash2("sha256").update(JSON.stringify([ua, rid, ...parts])).digest("hex").slice(0, 40);
+}
 async function fetchHistory(c, convId) {
   if (isStateless(c)) return c.history(convId);
   const p = waitFor(c, "history", (e) => e.conversationId === convId, 4e3);
@@ -62482,7 +62571,17 @@ Use jefri_agent_apps with agent=<name> to see its live app + active state.`);
         text: external_exports.string().describe("the message body")
       }
     },
-    async ({ to, text: text5 }) => withClient(async (c) => {
+    async ({ to, text: text5 }, extra) => withClient(async (c) => {
+      if (isStateless(c)) {
+        try {
+          const res = await c.message(to, text5, retryKey(extra, ["message", to, text5]));
+          if (res?.deduplicated)
+            return ok3(`Already delivered to @${to} \u2014 this request matched a recent identical send and was suppressed as a retry. If you meant it as a NEW message, send it again (it will not be suppressed twice).`);
+          return ok3(`Sent to @${to}: "${text5}"`);
+        } catch (e) {
+          return fail(`Message rejected: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c, () => c.message(to, text5));
       if (r.error) return fail(`Message rejected: ${r.error}`);
       return ok3(`Sent to @${to}: "${text5}"`);
@@ -62640,7 +62739,7 @@ ${fp}`);
         fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ to, path: path3, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
+    async ({ to, path: path3, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c) => {
       let name, mime, url;
       if (path3) {
         if (!ctx.local) {
@@ -62694,7 +62793,23 @@ ${psCmd}
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
         return fail(`${name} is ${MB(rawBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c) || rawBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c)) {
+        try {
+          const res = await c.sendFile(
+            { to, caption },
+            name,
+            mime,
+            rawBytes,
+            retryKey(extra, ["file", to, name, createHash2("sha256").update(rawBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${name} matched a recent identical upload and was suppressed as a retry (round 28 #2: suppression is SAID, never a false "Sent"). If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4CE} ${name} (${MB(rawBytes.length)} MB) to @${to}${caption ? ` \u2014 "${caption}"` : ""}`);
+      }
+      if (rawBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c, ctx.serverUrl, { to }, name, mime, rawBytes, caption);
         } catch (e2) {
@@ -62722,13 +62837,29 @@ ${psCmd}
         caption: external_exports.string().optional()
       }
     },
-    async ({ to, fileName, content: content3, caption }) => withClient(async (c) => {
+    async ({ to, fileName, content: content3, caption }, extra) => withClient(async (c) => {
       const known = mimeOf(fileName);
       const mime = known === "application/octet-stream" ? "text/plain" : known;
       const contentBytes = Buffer.from(content3, "utf8");
       if (contentBytes.length > MAX_UPLOAD_BYTES)
         return fail(`That content is ${MB(contentBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c) || contentBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c)) {
+        try {
+          const res = await c.sendFile(
+            { to, caption },
+            fileName,
+            mime,
+            contentBytes,
+            retryKey(extra, ["file", to, fileName, createHash2("sha256").update(contentBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${fileName} matched a recent identical upload and was suppressed as a retry. If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4C4} ${fileName} (${MB(contentBytes.length)} MB) to @${to}${caption ? ` \u2014 "${caption}"` : ""}`);
+      }
+      if (contentBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c, ctx.serverUrl, { to }, fileName, mime, contentBytes, caption);
         } catch (e2) {
@@ -63119,7 +63250,7 @@ Or just upload ${fname} from the agent's page in the web app.`
     },
     async () => withClient(async (c) => {
       const me = c.identity.username;
-      const since = inboxWatermark.get(me);
+      const since = ctx.stateless ? "stored" : inboxWatermark.get(me);
       const url = `${ctx.serverUrl.replace(/\/$/, "")}/api/inbox` + (since ? `?since=${encodeURIComponent(since)}` : "");
       let msgs = [];
       try {
@@ -63132,9 +63263,7 @@ Or just upload ${fname} from the agent's page in the web app.`
         ctx.inbox.length = 0;
       }
       if (!msgs.length) return ok3("\u{1F4ED} No new messages.");
-      msgs.sort((a, b) => a.createdAt < b.createdAt ? -1 : 1);
-      inboxWatermark.set(me, msgs[msgs.length - 1].createdAt);
-      saveWatermark();
+      msgs.sort((a, b) => a.createdAt < b.createdAt ? -1 : a.createdAt > b.createdAt ? 1 : a.id < b.id ? -1 : 1);
       const groupNames = /* @__PURE__ */ new Map();
       if (msgs.some((m) => m.groupId)) {
         try {
@@ -63162,8 +63291,27 @@ Or just upload ${fname} from the agent's page in the web app.`
         const body = m.kind === "file" ? `\u{1F4CE} sent a file: ${m.fileName} \u2014 to save it call jefri_download_file(from: "${m.senderUsername}"${m.fileName ? `, fileName: "${m.fileName}"` : ""})` : m.content;
         return `${at}@${m.senderUsername}${where(m)}: ${body}`;
       }));
-      return ok3(`\u{1F4E8} ${lines.length} message(s):
-` + lines.join("\n"));
+      const rendered = `\u{1F4E8} ${lines.length} message(s):
+` + lines.join("\n");
+      if (ctx.stateless) {
+        const renderedIds = msgs.map((m) => m.id);
+        const ack = async () => {
+          try {
+            await fetch(`${ctx.serverUrl.replace(/\/$/, "")}/api/inbox/seen`, {
+              method: "POST",
+              headers: { authorization: `Bearer ${c.token}`, "content-type": "application/json" },
+              body: JSON.stringify({ messageIds: renderedIds })
+            });
+          } catch {
+          }
+        };
+        if (ctx.deferUntilDelivered) ctx.deferUntilDelivered(ack);
+        else await ack();
+      } else {
+        inboxWatermark.set(me, msgs[msgs.length - 1].createdAt);
+        saveWatermark();
+      }
+      return ok3(rendered);
     })
   );
   server2.registerTool(
@@ -63192,7 +63340,17 @@ Or just upload ${fname} from the agent's page in the web app.`
         text: external_exports.string().describe("the message to post to the group")
       }
     },
-    async ({ groupId, text: text5 }) => withClient(async (c) => {
+    async ({ groupId, text: text5 }, extra) => withClient(async (c) => {
+      if (isStateless(c)) {
+        try {
+          const res = await c.groupMessage(groupId, text5, retryKey(extra, ["group_message", groupId, text5]));
+          if (res?.deduplicated)
+            return ok3(`Already posted \u2014 this request matched a recent identical post and was suppressed as a retry. If you meant it as a NEW message, send it again.`);
+          return ok3(`Posted to the group.`);
+        } catch (e) {
+          return fail(`Couldn't post to the group: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c, () => c.groupMessage(groupId, text5));
       if (r.error) return fail(`Couldn't post to the group: ${r.error}`);
       return ok3(`Posted to the group.`);
@@ -63212,7 +63370,7 @@ Or just upload ${fname} from the agent's page in the web app.`
         fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ groupId, path: path3, caption, dataUrl, fileUrl, fileName }) => withClient(async (c) => {
+    async ({ groupId, path: path3, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c) => {
       let name, mime, url;
       if (path3) {
         if (!ctx.local) {
@@ -63256,7 +63414,23 @@ Or just upload ${fname} from the agent's page in the web app.`
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
         return fail(`${name} is ${MB(rawBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c) || rawBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c)) {
+        try {
+          const res = await c.sendFile(
+            { groupId, caption },
+            name,
+            mime,
+            rawBytes,
+            retryKey(extra, ["file", groupId, name, createHash2("sha256").update(rawBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${name} matched a recent identical upload and was suppressed as a retry. If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4CE} ${name} (${MB(rawBytes.length)} MB) to the group.`);
+      }
+      if (rawBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c, ctx.serverUrl, { groupId }, name, mime, rawBytes, caption);
         } catch (e2) {
@@ -63341,7 +63515,19 @@ Or just upload ${fname} from the agent's page in the web app.`
         status: external_exports.enum(["online", "away", "busy", "coding", "reviewing", "planning", "offline"])
       }
     },
-    async ({ status }) => withClient(async (c) => {
+    async ({ status }, extra) => withClient(async (c) => {
+      if (isStateless(c)) {
+        const declId = declKey(extra, ["presence", status]);
+        try {
+          const res = await c.presence(status, declId);
+          ctx.onPresenceDeclared?.(res.status);
+          if (res.replayed && res.status !== status)
+            return ok3(`That request was an old retry \u2014 your status is "${res.status}" (a newer declaration stands).`);
+          return ok3(`Status set to ${res.status}.`);
+        } catch (e) {
+          return fail(`Couldn't set status: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c, () => c.presence(status));
       if (r.error) return fail(`Couldn't set status: ${r.error}`);
       return ok3(`Status set to ${status}.`);
@@ -63541,6 +63727,7 @@ var sessions = /* @__PURE__ */ new Map();
 var HOST_FRESH_MS = Number(process.env.MCP_HOST_FRESH_MS ?? 10 * 60 * 1e3);
 var hubPool = createKeyedPool();
 var SESSION_TTL_MS = Number(process.env.MCP_SESSION_TTL_MS ?? 4 * 60 * 60 * 1e3);
+var STATELESS_POOL_IDLE_MS = Number(process.env.MCP_STATELESS_POOL_IDLE_MS ?? 10 * 60 * 1e3);
 var MAX_SESSIONS = Number(process.env.MCP_MAX_SESSIONS ?? 1500);
 var MAX_SESSIONS_PER_IDENTITY = Number(process.env.MCP_MAX_SESSIONS_PER_IDENTITY ?? 20);
 var INIT_WINDOW_MS = 6e4;
@@ -63601,8 +63788,8 @@ async function acquirePooledConn(token, poolKey) {
     if (STATELESS) {
       const acp2 = new JefriHttpClient({ server: HUB, token });
       await acp2.whoami();
-      await statelessPresenceBringUp(acp2);
-      return { acp: acp2, inbox: [], refs: /* @__PURE__ */ new Set(), closed: false };
+      const broughtUp = await statelessPresenceBringUp(acp2);
+      return { acp: acp2, inbox: [], refs: /* @__PURE__ */ new Set(), closed: false, lastSeen: Date.now(), needsBringUp: !broughtUp };
     }
     const acp = await JefriClient.connect({ server: HUB, token, status: "online" });
     const inbox = [];
@@ -63625,15 +63812,30 @@ setInterval(() => {
   for (const [sid, s] of sessions) {
     if (now - s.lastActive > SESSION_TTL_MS) closeSession(sid, "idle");
   }
-  const seenPools = /* @__PURE__ */ new Set();
-  for (const s of sessions.values()) {
-    if (seenPools.has(s.poolKey)) continue;
-    seenPools.add(s.poolKey);
-    const pooled = hubPool.get(s.poolKey);
-    if (!pooled) continue;
-    announcePoolHosts(s.poolKey, pooled);
-    if (STATELESS)
-      void statelessSweepBeat(pooled.acp, pooled, () => closePool(s.poolKey, "auth revoked"));
+  if (STATELESS) {
+    for (const key of hubPool.keys()) {
+      const pooled = hubPool.get(key);
+      if (!pooled) continue;
+      if (now - (pooled.lastSeen ?? 0) > STATELESS_POOL_IDLE_MS) {
+        hubPool.drop(key);
+        continue;
+      }
+      if (pooled.needsBringUp) {
+        void statelessPresenceBringUp(pooled.acp).then((ok4) => {
+          if (ok4) pooled.needsBringUp = false;
+        });
+      } else {
+        void statelessSweepBeat(pooled.acp, pooled, () => closePool(key, "auth revoked"));
+      }
+    }
+  } else {
+    const seenPools = /* @__PURE__ */ new Set();
+    for (const s of sessions.values()) {
+      if (seenPools.has(s.poolKey)) continue;
+      seenPools.add(s.poolKey);
+      const pooled = hubPool.get(s.poolKey);
+      if (pooled) announcePoolHosts(s.poolKey, pooled);
+    }
   }
   for (const [ip, e] of initHits) {
     if (now > e.resetAt) initHits.delete(ip);
@@ -63697,7 +63899,7 @@ var health = (_req, res) => res.status(draining ? 503 : 200).json({
 });
 app.get("/health", health);
 app.get("/mcp/health", health);
-app.post("/mcp", async (req, res) => {
+var statefulPost = async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   if (sessionId && sessions.has(sessionId)) {
     const s = sessions.get(sessionId);
@@ -63777,10 +63979,6 @@ app.post("/mcp", async (req, res) => {
       res.status(502).json({ jsonrpc: "2.0", error: { code: -32002, message: `Hub unreachable: ${e?.message ?? e}` }, id: null });
       return;
     }
-    if (STATELESS && pooled.hbSignedOff) {
-      pooled.hbSignedOff = false;
-      void statelessPresenceBringUp(pooled.acp);
-    }
     const acp = pooled.acp;
     if (!acp.identity) {
       closePool(poolKey, "no identity");
@@ -63864,7 +64062,7 @@ app.post("/mcp", async (req, res) => {
     error: { code: -32001, message: "Session expired \u2014 reinitialize (your token is still valid)" },
     id: null
   });
-});
+};
 var bySession = async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   const s = sessionId ? sessions.get(sessionId) : void 0;
@@ -63882,8 +64080,58 @@ var bySession = async (req, res) => {
   touch(sessionId);
   await s.transport.handleRequest(req, res);
 };
-app.get("/mcp", bySession);
-app.delete("/mcp", bySession);
+if (STATELESS) {
+  app.post(
+    "/mcp",
+    statelessMcpHandler({
+      bearer,
+      acquire: async (token) => {
+        const poolKey = sha256(token).toString("hex");
+        const pooled = await acquirePooledConn(token, poolKey);
+        pooled.lastSeen = Date.now();
+        return pooled;
+      },
+      // registerTools below closes over the POOLED entry via acp — the presence
+      // resume/stop signal needs the pool, so it is looked up by identity of
+      // the shared client (one pool owns exactly one client instance).
+      classifyError: (e) => e instanceof JefriAuthError || e?.code === "ACP_AUTH_FAILED" || e instanceof JefriHttpError && (e.status === 401 || e.status === 403) ? "auth" : "hub",
+      registerTools: (mcp, acp, hooks) => registerAcpTools(mcp, {
+        ensureClient: async () => acp,
+        inbox: [],
+        serverUrl: HUB,
+        local: false,
+        stateless: true,
+        deferUntilDelivered: hooks.deferUntilDelivered,
+        // Round 26 #4a: a successful declaration RESUMES heartbeats (the
+        // user came back — the hub cleared its sign-off marker, the pool
+        // must clear its own), and a sign-off STOPS them proactively.
+        onPresenceDeclared: (status) => {
+          for (const key of hubPool.keys()) {
+            const pooled = hubPool.get(key);
+            if (pooled && pooled.acp === acp) {
+              if (status === "offline") pooled.hbSignedOff = true;
+              else {
+                pooled.hbSignedOff = false;
+                pooled.needsBringUp = false;
+              }
+              break;
+            }
+          }
+        }
+      }),
+      isDraining: () => draining,
+      tryAcquireInflight: (token) => tryAcquire(tokenInflight, sha256(token).toString("hex"), MAX_INFLIGHT_PER_TOKEN),
+      releaseInflight: (token) => release(tokenInflight, sha256(token).toString("hex")),
+      log: log2
+    })
+  );
+  app.get("/mcp", statelessMethodNotAllowed);
+  app.delete("/mcp", statelessMethodNotAllowed);
+} else {
+  app.post("/mcp", statefulPost);
+  app.get("/mcp", bySession);
+  app.delete("/mcp", bySession);
+}
 var server = http.createServer(app).listen(PORT, () => {
   console.error(`
   \u{1F310} Jefri Chat remote MCP (HTTP) on http://localhost:${PORT}/mcp`);

package/dist/index.js

@@ -9152,7 +9152,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net4 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash3 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -9820,7 +9820,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -10189,7 +10189,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash3 } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension3 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -10496,7 +10496,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -10891,7 +10891,7 @@ import fs6 from "node:fs";
 import net from "node:net";
 import os5 from "node:os";
 import np5 from "node:path";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 function parseInstanceName(name) {
   if (name.startsWith(".")) return null;
   const lastDot = name.lastIndexOf(".");
@@ -10922,7 +10922,7 @@ function safeUserParts(u) {
   const raw = u || "unknown";
   return {
     base: raw.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 40) || "agent",
-    hash: createHash("sha1").update(raw).digest("hex").slice(0, 8)
+    hash: createHash2("sha1").update(raw).digest("hex").slice(0, 8)
   };
 }
 function safeUser2(u) {
@@ -10935,7 +10935,7 @@ function socketPathFor(username, home = os5.homedir(), platform = process.platfo
   const preferred = np5.join(home, ".jefri", "sock", `${safe}.sock`);
   if (Buffer.byteLength(preferred) <= 100) return preferred;
   const uid = typeof process.getuid === "function" ? String(process.getuid()) : process.env.USERNAME ?? "";
-  const scope = createHash("sha1").update(`${home}\0${uid}`).digest("hex").slice(0, 8);
+  const scope = createHash2("sha1").update(`${home}\0${uid}`).digest("hex").slice(0, 8);
   const { base, hash } = safeUserParts(username);
   return np5.join(tmp, `jefri-${base.slice(0, 16)}-${hash}-${scope}.sock`);
 }
@@ -12118,7 +12118,7 @@ __export(run_exports, {
   tmuxRunArgv: () => tmuxRunArgv
 });
 import cp9 from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import readline2 from "node:readline";
 function tmuxRunArgv(agentCmd, sessionName, cwd, envPairs = []) {
   const env = envPairs.flatMap((e) => ["-e", e]);
@@ -12127,7 +12127,7 @@ function tmuxRunArgv(agentCmd, sessionName, cwd, envPairs = []) {
 function sessionNameFor(agentCmd, cwd = process.cwd(), experimental = false) {
   const exe = (agentCmd[0] || "agent").replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 32);
   const key = agentCmd.join("\0") + "\0" + cwd;
-  const h = createHash2("sha1").update(key + (experimental ? " x" : "")).digest("hex").slice(0, 8);
+  const h = createHash3("sha1").update(key + (experimental ? " x" : "")).digest("hex").slice(0, 8);
   return `jefri-${exe}-${h}`;
 }
 function isShellExe(cmd) {
@@ -39391,6 +39391,7 @@ import cp3 from "node:child_process";
 import os4 from "node:os";
 import nnet from "node:net";
 import ndns from "node:dns/promises";
+import { createHash } from "node:crypto";
 import nhttp from "node:http";
 import nhttps from "node:https";
 
@@ -40556,6 +40557,22 @@ async function confirmWrite(c2, fire) {
   const e = await err;
   return e ? { error: e.message } : {};
 }
+function retryKey(extra, parts) {
+  const rid = extra?.requestId;
+  if (rid === void 0 || rid === null) return void 0;
+  const h = extra?.requestInfo?.headers;
+  const ua = String((typeof h?.get === "function" ? h.get("user-agent") : h?.["user-agent"]) ?? "");
+  if (!ua) return void 0;
+  const bucket = Math.floor(Date.now() / 75e3);
+  return "mcp-" + createHash("sha256").update(JSON.stringify([bucket, ua, rid, ...parts])).digest("hex").slice(0, 40);
+}
+function declKey(extra, parts) {
+  const rid = extra?.requestId;
+  if (rid === void 0 || rid === null) return void 0;
+  const h = extra?.requestInfo?.headers;
+  const ua = String((typeof h?.get === "function" ? h.get("user-agent") : h?.["user-agent"]) ?? "");
+  return "d-" + createHash("sha256").update(JSON.stringify([ua, rid, ...parts])).digest("hex").slice(0, 40);
+}
 async function fetchHistory2(c2, convId) {
   if (isStateless(c2)) return c2.history(convId);
   const p = waitFor(c2, "history", (e) => e.conversationId === convId, 4e3);
@@ -41017,7 +41034,17 @@ Use jefri_agent_apps with agent=<name> to see its live app + active state.`);
         text: external_exports.string().describe("the message body")
       }
     },
-    async ({ to, text: text5 }) => withClient(async (c2) => {
+    async ({ to, text: text5 }, extra) => withClient(async (c2) => {
+      if (isStateless(c2)) {
+        try {
+          const res = await c2.message(to, text5, retryKey(extra, ["message", to, text5]));
+          if (res?.deduplicated)
+            return ok3(`Already delivered to @${to} \u2014 this request matched a recent identical send and was suppressed as a retry. If you meant it as a NEW message, send it again (it will not be suppressed twice).`);
+          return ok3(`Sent to @${to}: "${text5}"`);
+        } catch (e) {
+          return fail(`Message rejected: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c2, () => c2.message(to, text5));
       if (r.error) return fail(`Message rejected: ${r.error}`);
       return ok3(`Sent to @${to}: "${text5}"`);
@@ -41175,7 +41202,7 @@ ${fp}`);
         fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ to, path: path4, caption, dataUrl, fileUrl, fileName }) => withClient(async (c2) => {
+    async ({ to, path: path4, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c2) => {
       let name, mime, url;
       if (path4) {
         if (!ctx.local) {
@@ -41229,7 +41256,23 @@ ${psCmd}
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
         return fail(`${name} is ${MB(rawBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c2) || rawBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c2)) {
+        try {
+          const res = await c2.sendFile(
+            { to, caption },
+            name,
+            mime,
+            rawBytes,
+            retryKey(extra, ["file", to, name, createHash("sha256").update(rawBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${name} matched a recent identical upload and was suppressed as a retry (round 28 #2: suppression is SAID, never a false "Sent"). If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4CE} ${name} (${MB(rawBytes.length)} MB) to @${to}${caption ? ` \u2014 "${caption}"` : ""}`);
+      }
+      if (rawBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c2, ctx.serverUrl, { to }, name, mime, rawBytes, caption);
         } catch (e2) {
@@ -41257,13 +41300,29 @@ ${psCmd}
         caption: external_exports.string().optional()
       }
     },
-    async ({ to, fileName, content: content3, caption }) => withClient(async (c2) => {
+    async ({ to, fileName, content: content3, caption }, extra) => withClient(async (c2) => {
       const known = mimeOf(fileName);
       const mime = known === "application/octet-stream" ? "text/plain" : known;
       const contentBytes = Buffer.from(content3, "utf8");
       if (contentBytes.length > MAX_UPLOAD_BYTES)
         return fail(`That content is ${MB(contentBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c2) || contentBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c2)) {
+        try {
+          const res = await c2.sendFile(
+            { to, caption },
+            fileName,
+            mime,
+            contentBytes,
+            retryKey(extra, ["file", to, fileName, createHash("sha256").update(contentBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${fileName} matched a recent identical upload and was suppressed as a retry. If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4C4} ${fileName} (${MB(contentBytes.length)} MB) to @${to}${caption ? ` \u2014 "${caption}"` : ""}`);
+      }
+      if (contentBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c2, ctx.serverUrl, { to }, fileName, mime, contentBytes, caption);
         } catch (e2) {
@@ -41654,7 +41713,7 @@ Or just upload ${fname} from the agent's page in the web app.`
     },
     async () => withClient(async (c2) => {
       const me = c2.identity.username;
-      const since = inboxWatermark.get(me);
+      const since = ctx.stateless ? "stored" : inboxWatermark.get(me);
       const url = `${ctx.serverUrl.replace(/\/$/, "")}/api/inbox` + (since ? `?since=${encodeURIComponent(since)}` : "");
       let msgs = [];
       try {
@@ -41667,9 +41726,7 @@ Or just upload ${fname} from the agent's page in the web app.`
         ctx.inbox.length = 0;
       }
       if (!msgs.length) return ok3("\u{1F4ED} No new messages.");
-      msgs.sort((a, b) => a.createdAt < b.createdAt ? -1 : 1);
-      inboxWatermark.set(me, msgs[msgs.length - 1].createdAt);
-      saveWatermark();
+      msgs.sort((a, b) => a.createdAt < b.createdAt ? -1 : a.createdAt > b.createdAt ? 1 : a.id < b.id ? -1 : 1);
       const groupNames = /* @__PURE__ */ new Map();
       if (msgs.some((m) => m.groupId)) {
         try {
@@ -41697,8 +41754,27 @@ Or just upload ${fname} from the agent's page in the web app.`
         const body = m.kind === "file" ? `\u{1F4CE} sent a file: ${m.fileName} \u2014 to save it call jefri_download_file(from: "${m.senderUsername}"${m.fileName ? `, fileName: "${m.fileName}"` : ""})` : m.content;
         return `${at}@${m.senderUsername}${where(m)}: ${body}`;
       }));
-      return ok3(`\u{1F4E8} ${lines.length} message(s):
-` + lines.join("\n"));
+      const rendered = `\u{1F4E8} ${lines.length} message(s):
+` + lines.join("\n");
+      if (ctx.stateless) {
+        const renderedIds = msgs.map((m) => m.id);
+        const ack = async () => {
+          try {
+            await fetch(`${ctx.serverUrl.replace(/\/$/, "")}/api/inbox/seen`, {
+              method: "POST",
+              headers: { authorization: `Bearer ${c2.token}`, "content-type": "application/json" },
+              body: JSON.stringify({ messageIds: renderedIds })
+            });
+          } catch {
+          }
+        };
+        if (ctx.deferUntilDelivered) ctx.deferUntilDelivered(ack);
+        else await ack();
+      } else {
+        inboxWatermark.set(me, msgs[msgs.length - 1].createdAt);
+        saveWatermark();
+      }
+      return ok3(rendered);
     })
   );
   server2.registerTool(
@@ -41727,7 +41803,17 @@ Or just upload ${fname} from the agent's page in the web app.`
         text: external_exports.string().describe("the message to post to the group")
       }
     },
-    async ({ groupId, text: text5 }) => withClient(async (c2) => {
+    async ({ groupId, text: text5 }, extra) => withClient(async (c2) => {
+      if (isStateless(c2)) {
+        try {
+          const res = await c2.groupMessage(groupId, text5, retryKey(extra, ["group_message", groupId, text5]));
+          if (res?.deduplicated)
+            return ok3(`Already posted \u2014 this request matched a recent identical post and was suppressed as a retry. If you meant it as a NEW message, send it again.`);
+          return ok3(`Posted to the group.`);
+        } catch (e) {
+          return fail(`Couldn't post to the group: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c2, () => c2.groupMessage(groupId, text5));
       if (r.error) return fail(`Couldn't post to the group: ${r.error}`);
       return ok3(`Posted to the group.`);
@@ -41747,7 +41833,7 @@ Or just upload ${fname} from the agent's page in the web app.`
         fileName: external_exports.string().optional().describe("file name (used with dataUrl, or to name a fileUrl download)")
       }
     },
-    async ({ groupId, path: path4, caption, dataUrl, fileUrl, fileName }) => withClient(async (c2) => {
+    async ({ groupId, path: path4, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c2) => {
       let name, mime, url;
       if (path4) {
         if (!ctx.local) {
@@ -41791,7 +41877,23 @@ Or just upload ${fname} from the agent's page in the web app.`
       const rawBytes = Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
         return fail(`${name} is ${MB(rawBytes.length)} MB, over the ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)} MB limit.`);
-      if (isStateless(c2) || rawBytes.length > WS_SAFE_FILE_BYTES) {
+      if (isStateless(c2)) {
+        try {
+          const res = await c2.sendFile(
+            { groupId, caption },
+            name,
+            mime,
+            rawBytes,
+            retryKey(extra, ["file", groupId, name, createHash("sha256").update(rawBytes).digest("hex")])
+          );
+          if (res?.deduplicated)
+            return ok3(`Already delivered \u2014 ${name} matched a recent identical upload and was suppressed as a retry. If you meant a new copy, send it again.`);
+        } catch (e2) {
+          return fail(`Rejected: ${e2?.message ?? e2}`);
+        }
+        return ok3(`Sent \u{1F4CE} ${name} (${MB(rawBytes.length)} MB) to the group.`);
+      }
+      if (rawBytes.length > WS_SAFE_FILE_BYTES) {
         try {
           await uploadFileHttp(c2, ctx.serverUrl, { groupId }, name, mime, rawBytes, caption);
         } catch (e2) {
@@ -41876,7 +41978,19 @@ Or just upload ${fname} from the agent's page in the web app.`
         status: external_exports.enum(["online", "away", "busy", "coding", "reviewing", "planning", "offline"])
       }
     },
-    async ({ status }) => withClient(async (c2) => {
+    async ({ status }, extra) => withClient(async (c2) => {
+      if (isStateless(c2)) {
+        const declId = declKey(extra, ["presence", status]);
+        try {
+          const res = await c2.presence(status, declId);
+          ctx.onPresenceDeclared?.(res.status);
+          if (res.replayed && res.status !== status)
+            return ok3(`That request was an old retry \u2014 your status is "${res.status}" (a newer declaration stands).`);
+          return ok3(`Status set to ${res.status}.`);
+        } catch (e) {
+          return fail(`Couldn't set status: ${e?.message ?? e}`);
+        }
+      }
       const r = await confirmWrite(c2, () => c2.presence(status));
       if (r.error) return fail(`Couldn't set status: ${r.error}`);
       return ok3(`Status set to ${status}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jefrichat-mcp",
-  "version": "0.48.10",
+  "version": "0.48.12",
   "description": "Jefri Chat connector — join the Jefri Chat network (WhatsApp for AI agents) from any MCP client (Claude, Codex, Cursor, …).",
   "type": "module",
   "bin": {