jefrichat-mcp 0.48.13 → 0.49.0

package/dist/http.js

@@ -60904,6 +60904,22 @@ var JefriAuthError = class extends Error {
 var JefriClient = class _JefriClient {
   ws;
   handlers = /* @__PURE__ */ new Map();
+  // Round 2 of the sessions audit (finding #1): a message can arrive in the
+  // milliseconds between `registered` and the caller attaching its handlers —
+  // connect() itself awaits E2E setup after registration, and the connector
+  // wires its inbox after connect() resolves. Events nobody is listening for
+  // yet are BUFFERED (delivery-critical types only) and replayed, in order,
+  // to the first subscriber. Live listeners bypass the buffer entirely.
+  static REPLAYABLE = /* @__PURE__ */ new Set([
+    "message_received",
+    "file_received",
+    "debate_turn",
+    "debate_summary_request",
+    "debate_cancel"
+  ]);
+  static REPLAY_MAX = 500;
+  replayBuffer = [];
+  replayScheduled = false;
   server;
   token;
   identity;
@@ -61160,14 +61176,33 @@ var JefriClient = class _JefriClient {
     const set = this.handlers.get(event) ?? /* @__PURE__ */ new Set();
     set.add(handler);
     this.handlers.set(event, set);
+    if (this.replayBuffer.length && _JefriClient.REPLAYABLE.has(event)) this.scheduleReplayDrain();
     return this;
   }
   off(event, handler) {
     this.handlers.get(event)?.delete(handler);
     return this;
   }
-  emit(event, payload) {
-    for (const h of this.handlers.get(event) ?? []) {
+  scheduleReplayDrain() {
+    if (this.replayScheduled) return;
+    this.replayScheduled = true;
+    queueMicrotask(() => {
+      this.replayScheduled = false;
+      const drain3 = this.replayBuffer;
+      this.replayBuffer = [];
+      const keep = [];
+      for (const b of drain3) {
+        const hs = this.handlers.get(b.event);
+        if (hs?.size) this.dispatch(b.event, b.payload, hs);
+        else keep.push(b);
+      }
+      this.replayBuffer = keep.concat(this.replayBuffer);
+    });
+  }
+  /** emit()'s containment, shared with replay: a throwing handler must NEVER
+   *  propagate or starve the others; async rejections are contained too. */
+  dispatch(event, payload, handlers) {
+    for (const h of handlers) {
       try {
         const res = h(payload);
         if (res instanceof Promise)
@@ -61177,6 +61212,16 @@ var JefriClient = class _JefriClient {
       }
     }
   }
+  emit(event, payload) {
+    if (_JefriClient.REPLAYABLE.has(event) && !this.handlers.get(event)?.size) {
+      if (this.replayBuffer.length >= _JefriClient.REPLAY_MAX) {
+        this.replayBuffer.shift();
+        console.error(`[jefri-sdk] replay buffer overflow for pre-subscription events \u2014 oldest dropped`);
+      }
+      this.replayBuffer.push({ event, payload });
+    }
+    this.dispatch(event, payload, this.handlers.get(event) ?? []);
+  }
   send(ev) {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN)
       throw new Error("not connected to the Jefri Chat hub (reconnecting) \u2014 try again in a moment");
@@ -62114,9 +62159,25 @@ function declKey(extra, parts) {
   return "d-" + createHash2("sha256").update(JSON.stringify([ua, rid, ...parts])).digest("hex").slice(0, 40);
 }
 var crossBasename = (p) => String(p).split(/[\\/]/).pop() || "file";
+var DOWNLOAD_DIR_SH = "~/Downloads/jefri";
+var downloadDirAbs = () => process.env.JEFRI_DOWNLOAD_DIR || np3.join(os4.homedir(), "Downloads", "jefri");
+var ensureDownloadDir = () => {
+  const dir = downloadDirAbs();
+  fs4.mkdirSync(dir, { recursive: true });
+  const st = fs4.lstatSync(dir);
+  if (st.isSymbolicLink() || !st.isDirectory())
+    throw new Error(`refusing to save: ${dir} is a symlink (or not a directory) \u2014 a planted link could redirect downloads anywhere. Remove it and retry.`);
+  return dir;
+};
+var safeSaveName = (p) => {
+  const base = String(p ?? "").split(/[\\/]/).pop() ?? "";
+  const clean = base.replace(/[\x00-\x1f\x7f]/g, "").trim();
+  return !clean || clean === "." || clean === ".." ? "" : clean;
+};
 var shPathArg = (p) => p.startsWith("~/") ? `"$HOME"${shq(p.slice(1))}` : shq(p);
 var psq = (s) => `'${String(s).replace(/'/g, "''")}'`;
 var psPathArg = (p) => p.startsWith("~/") || p.startsWith("~\\") ? `($HOME + ${psq(p.slice(1))})` : psq(p);
+var isTextyFile = (mime, name) => /^text\/|json|xml|javascript|typescript|markdown|csv|ya?ml|x-sh|toml/i.test(mime) || /\.(md|txt|json|csv|ya?ml|log|ts|tsx|js|jsx|py|rb|go|rs|java|c|h|cpp|sh|sql|toml|env|cfg|ini)$/i.test(name);
 var DATAURL_INLINE_MAX = 256 * 1024;
 var dataUrlTooBig = (dataUrl) => dataUrl.length > DATAURL_INLINE_MAX * 1.4 ? `That dataUrl is ~${MB(dataUrl.length * 0.75)} MB decoded \u2014 far past the ${Math.round(DATAURL_INLINE_MAX / 1024)}KB inline limit. NEVER read a local file and base64 it through the model. Call this tool again with the file's PATH \u2014 you'll get a single-use upload command that sends it in seconds.` : null;
 async function remoteUploadCommand(c, ctx, target, path3, caption, where) {
@@ -62519,9 +62580,13 @@ ${e?.message ?? e}`);
       description: "Show this session's Jefri Chat identity (username, display name) and connection status.",
       inputSchema: {}
     },
-    async () => withClient(
-      async (c) => ok3(`You are "${c.identity.displayName}" (@${c.identity.username}) on Jefri Chat at ${ctx.serverUrl}, status: online.`)
-    )
+    async () => {
+      const unbound = await ctx.identityStatus?.();
+      if (unbound) return ok3(unbound);
+      return withClient(
+        async (c) => ok3(`You are "${c.identity.displayName}" (@${c.identity.username}) on Jefri Chat at ${ctx.serverUrl}, status: online.`)
+      );
+    }
   );
   server2.registerTool(
     "jefri_agents",
@@ -63004,13 +63069,13 @@ ${fp}`);
   server2.registerTool(
     "jefri_download_file",
     {
-      title: "Download / save a file someone sent you",
-      description: "Save a file (PDF, image, video, any document) that another agent/user sent you, onto this machine. For a DM give the sender's username `from`; for a file sent in a GROUP give `groupId` instead (from jefri_groups / jefri_inbox). Add `fileName` if there are several. Returns a ready-to-run command that downloads the file locally \u2014 run it in the terminal. Use this when the user says things like 'download that file', 'save the pdf antonio sent', etc.",
+      title: "Read or save a file someone sent you",
+      description: "Get a file another agent/user sent you. For a DM give the sender's username `from`; for a GROUP file give `groupId` (from jefri_groups / jefri_inbox). Add `fileName` if there are several. TEXT files (code, markdown, JSON, CSV, logs \u2014 up to 256KB) come back with their FULL CONTENT inline, and PDFs come back as EXTRACTED TEXT \u2014 so you can read and discuss both directly, no terminal needed. Only images, video and other binaries return a save command (or view them in the web app). On the local connector, files are saved straight to disk. Use this when the user says 'read the file sara sent', 'download that file', 'what does the doc say', etc.",
       inputSchema: {
         from: external_exports.string().optional().describe("who sent you the file (their username) \u2014 for a DM"),
         groupId: external_exports.string().optional().describe("the group's id \u2014 for a file sent in a group"),
         fileName: external_exports.string().optional().describe("which file, if there are several"),
-        savePath: external_exports.string().optional().describe("where to save it (default: the file's own name in the current folder)")
+        savePath: external_exports.string().optional().describe("the file NAME to save as (a bare name \u2014 every download lands in ~/Downloads/jefri/, never elsewhere); a taken name gets a -1/-2 suffix")
       }
     },
     async ({ from, groupId, fileName, savePath }) => withClient(async (c) => {
@@ -63023,26 +63088,92 @@ ${fp}`);
       const match = fileName ? [...files].reverse().find((m) => m.fileName === fileName || m.fileName?.includes(fileName)) : files[files.length - 1];
       if (!match) return fail(`No file named "${fileName}" in ${where}.`);
       const hub = ctx.serverUrl.replace(/\/$/, "");
-      const out = savePath || match.fileName || "downloaded.file";
+      const safeName2 = safeSaveName(match.fileName) || "downloaded.file";
+      const out = safeSaveName(savePath) || safeName2;
       if (ctx.local) {
-        const outPath = out.startsWith("~") ? np3.join(os4.homedir(), out.slice(1)) : out;
         try {
+          const dlDir = ensureDownloadDir();
+          const outPath = np3.join(dlDir, out);
           const r = await fetch(`${hub}/api/files/${match.id}`, { headers: { authorization: `Bearer ${c.token}` } });
           if (!r.ok) throw new Error(`download failed (${r.status})`);
           const buf = Buffer.from(await r.arrayBuffer());
-          fs4.writeFileSync(outPath, buf);
-          return ok3(`\u2705 Saved \u{1F4CE} ${match.fileName} from ${where} to ${outPath} (${MB(buf.length)} MB).`);
+          let finalPath = outPath;
+          const ext = np3.extname(finalPath);
+          const stem = finalPath.slice(0, finalPath.length - ext.length);
+          let written = false;
+          for (let i = 0; i < 100 && !written; i++) {
+            finalPath = i === 0 ? outPath : `${stem}-${i}${ext}`;
+            try {
+              fs4.writeFileSync(finalPath, buf, { flag: "wx" });
+              written = true;
+            } catch (e) {
+              if (e?.code !== "EEXIST") throw e;
+            }
+          }
+          if (!written) return fail(`Couldn't save: 100 files named like ${outPath} already exist here.`);
+          return ok3(`\u2705 Saved \u{1F4CE} ${match.fileName} from ${where} to ${finalPath} (${MB(buf.length)} MB).`);
         } catch (e) {
           return fail(`Couldn't save the file: ${e?.message ?? e}`);
         }
       }
-      const cmd = `curl -s -o ${shq(out)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hub}/api/files/${match.id}`)}`;
+      const fname2 = safeName2;
+      const fmime2 = match.fileMime || mimeOf(fname2);
+      const sizeKnownTooBig = typeof match.fileSize === "number" && match.fileSize > DATAURL_INLINE_MAX;
+      if (isTextyFile(fmime2, fname2) && !sizeKnownTooBig) {
+        try {
+          const ac = new AbortController();
+          const killer = setTimeout(() => ac.abort(), 15e3);
+          try {
+            const r = await fetch(`${hub}/api/files/${match.id}`, { headers: { authorization: `Bearer ${c.token}` }, signal: ac.signal });
+            if (r.ok && r.body) {
+              const declared = Number(r.headers.get("content-length") ?? 0);
+              if (!declared || declared <= DATAURL_INLINE_MAX) {
+                const bytes = await readCapped(r.body, DATAURL_INLINE_MAX, Date.now() + 15e3);
+                return ok3(
+                  `\u{1F4CE} ${fname2} from ${where} (${(bytes.length / 1024).toFixed(1)} KB) \u2014 full content:
+
+` + bytes.toString("utf8")
+                );
+              }
+            }
+          } finally {
+            clearTimeout(killer);
+          }
+        } catch {
+        }
+      }
+      if (/pdf$/i.test(fmime2) || /\.pdf$/i.test(fname2)) {
+        const pdfTooBig = typeof match.fileSize === "number" && match.fileSize > 15 * 1024 * 1024;
+        if (!pdfTooBig) {
+          try {
+            const ac = new AbortController();
+            const killer = setTimeout(() => ac.abort(), 3e4);
+            try {
+              const r = await fetch(`${hub}/api/files/${match.id}/text`, { headers: { authorization: `Bearer ${c.token}` }, signal: ac.signal });
+              if (r.ok) {
+                const body = await r.json();
+                if (body?.text)
+                  return ok3(
+                    `\u{1F4CE} ${fname2} from ${where} \u2014 extracted text (${body.chars ?? body.text.length} chars):
+
+` + body.text
+                  );
+              }
+            } finally {
+              clearTimeout(killer);
+            }
+          } catch {
+          }
+        }
+      }
+      const cmd = `curl -s --no-clobber --create-dirs -o ${shPathArg(`${DOWNLOAD_DIR_SH}/${out}`)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hub}/api/files/${match.id}`)}`;
+      const web2 = hub.replace("acp-hub.", "acp-web.").replace(":4000", ":4321");
       return ok3(
-        `To save \u{1F4CE} ${match.fileName} from ${where}, run this in the terminal:
-
-${cmd}
+        `\u{1F4CE} ${match.fileName} (${fmime2}) is a binary/large file \u2014 I can't show it inline.
 
-It downloads the file to your machine (current folder unless you set a path). First set your token: export JEFRI_TOKEN=\u2026 (from the app's Connect dialog) \u2014 it isn't printed here on purpose.`
+\u2022 Easiest: open the chat in the web app, the file renders there: ${web2}
+\u2022 Terminal: ${cmd}
+  (set your token first: export JEFRI_TOKEN=\u2026 from the app's Connect dialog \u2014 it isn't printed here on purpose.)`
       );
     })
   );
@@ -63097,21 +63228,21 @@ It downloads the file to your machine (current folder unless you set a path). Fi
       inputSchema: {
         departmentId: external_exports.string(),
         fileId: external_exports.string(),
-        savePath: external_exports.string().optional().describe("where to save (default: the file's name in the current folder)")
+        savePath: external_exports.string().optional().describe("the file NAME to save as (a bare name \u2014 the command saves into ~/Downloads/jefri/)")
       }
     },
     async ({ departmentId, fileId, savePath }) => withClient(async (c) => {
-      let name = savePath || "department-file";
+      let name = safeSaveName(savePath) || "department-file";
       try {
         const r = await fetch(`${hubBase()}/api/departments/${departmentId}/drive`, { headers: { authorization: `Bearer ${c.token}` } });
         if (r.ok) {
           const { files } = await r.json();
           const f = files.find((x) => x.id === fileId);
-          if (f && !savePath) name = f.name;
+          if (f && !safeSaveName(savePath)) name = safeSaveName(f.name) || name;
         }
       } catch {
       }
-      const cmd = `curl -s -o ${shq(name)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hubBase()}/api/departments/${departmentId}/files/${fileId}`)}`;
+      const cmd = `curl -s --no-clobber --create-dirs -o ${shPathArg(`${DOWNLOAD_DIR_SH}/${name}`)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hubBase()}/api/departments/${departmentId}/files/${fileId}`)}`;
       return ok3(`To save this department file, run in the terminal:
 
 ${cmd}
@@ -63201,7 +63332,7 @@ ${h.text}`).join("\n\n---\n\n")
       if (d.text) return ok3(`Contents of "${d.name}":
 
 ${d.text}`);
-      const cmd = `curl -s -o ${shq(d.name)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hubBase()}/api/agents/${encodeURIComponent(c.identity.username)}/docs/${encodeURIComponent(docId)}`)}`;
+      const cmd = `curl -s --no-clobber --create-dirs -o ${shPathArg(`${DOWNLOAD_DIR_SH}/${safeSaveName(d.name) || "document"}`)} -H "Authorization: Bearer $JEFRI_TOKEN" ${shq(`${hubBase()}/api/agents/${encodeURIComponent(c.identity.username)}/docs/${encodeURIComponent(docId)}`)}`;
       return ok3(`"${d.name}" is a ${d.mime} file. To download it and work with it locally, run in the terminal:
 
 ${cmd}