kiku-agent 1.0.0 → 1.0.3

package/server/mcp/security.js

@@ -1,138 +1,140 @@
-import { timingSafeEqual } from 'node:crypto';
-
-const SECURITY_CONFIG = {
-  apiKeyRequired: !!process.env.MCP_API_KEY,
-
-  rateLimitWindowMs: 60_000,
-  rateLimitMaxRequests: 30,
-
-  maxConcurrentSessions: 100,
-  sessionTtlMs: 30 * 60_000,
-  maxMessagesPerSession: 500,
-
-  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '*').split(',').map(s => s.trim()),
-  maxRequestBodyBytes: 1_048_576,
-};
-
-export const MAX_REQUEST_BODY_SIZE = SECURITY_CONFIG.maxRequestBodyBytes;
-
-export function validateApiKey(req) {
-  if (!SECURITY_CONFIG.apiKeyRequired) return { valid: true };
-
-  let key = req.headers['x-api-key'];
-  if (!key) {
-    try {
-      const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-      key = url.searchParams.get('key') || url.searchParams.get('apiKey');
-    } catch {
-    }
-  }
-  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or ?key= query parameter.' };
-  const expected = Buffer.from(process.env.MCP_API_KEY || '');
-  const received = Buffer.from(String(key));
-  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
-    return { valid: false, error: 'Invalid API key.' };
-  }
-  return { valid: true };
-}
-
-const rateLimitStore = new Map();
-
-export function checkRateLimit(sessionId) {
-  const now = Date.now();
-  const entry = rateLimitStore.get(sessionId);
-
-  if (!entry || now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs) {
-    rateLimitStore.set(sessionId, { count: 1, windowStart: now });
-    return { allowed: true, remaining: SECURITY_CONFIG.rateLimitMaxRequests - 1 };
-  }
-
-  entry.count++;
-  const remaining = SECURITY_CONFIG.rateLimitMaxRequests - entry.count;
-  if (remaining < 0) {
-    return { allowed: false, error: `Rate limit exceeded. Max ${SECURITY_CONFIG.rateLimitMaxRequests} requests per minute.` };
-  }
-  return { allowed: true, remaining };
-}
-
-const rateLimitCleanupTimer = setInterval(() => {
-  const now = Date.now();
-  for (const [id, entry] of rateLimitStore) {
-    if (now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs * 2) {
-      rateLimitStore.delete(id);
-    }
-  }
-}, 60_000);
-rateLimitCleanupTimer.unref?.();
-
-export function sanitizeInput(input) {
-  if (typeof input === 'string') {
-    return input
-      .replace(/[<>]/g, '')
-      .replace(/\x00/g, '')
-      .slice(0, 1000);
-  }
-  if (typeof input === 'object' && input !== null) {
-    const sanitized = {};
-    for (const [key, value] of Object.entries(input)) {
-      if (typeof key === 'string' && key.length <= 100) {
-        sanitized[key] = sanitizeInput(value);
-      }
-    }
-    return sanitized;
-  }
-  return input;
-}
-
-export function validateSessionId(sessionId) {
-  if (!sessionId || typeof sessionId !== 'string') return false;
-  return /^[a-zA-Z0-9_-]{1,100}$/.test(sessionId);
-}
-
-export function setCorsHeaders(res, origin) {
-  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
-  const isAllowed = allowed.includes('*') || allowed.includes(origin);
-
-  if (isAllowed) {
-    res.setHeader('Access-Control-Allow-Origin', origin || '*');
-  } else {
-    res.setHeader('Access-Control-Allow-Origin', '');
-  }
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-API-Key');
-  res.setHeader('Access-Control-Max-Age', '86400');
-
-  return isAllowed;
-}
-
-export function securityMiddleware(req, res) {
-  const origin = req.headers.origin || '';
-  const corsOk = setCorsHeaders(res, origin);
-
-  if (req.method === 'OPTIONS') {
-    res.statusCode = 204;
-    res.end();
-    return { blocked: true };
-  }
-
-  if (!corsOk) {
-    res.statusCode = 403;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.end(JSON.stringify({ error: 'Origin not allowed by CORS policy.' }));
-    return { blocked: true };
-  }
-
-  const auth = validateApiKey(req);
-  if (!auth.valid) {
-    res.statusCode = 401;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.end(JSON.stringify({ error: auth.error }));
-    return { blocked: true };
-  }
-
-  return { blocked: false };
-}
-
-export function getSecurityConfig() {
-  return { ...SECURITY_CONFIG, apiKeyRequired: SECURITY_CONFIG.apiKeyRequired };
-}
+import { timingSafeEqual } from 'node:crypto';
+
+const SECURITY_CONFIG = {
+  apiKeyRequired: !!process.env.MCP_API_KEY,
+
+  rateLimitWindowMs: 60_000,
+  rateLimitMaxRequests: 30,
+
+  maxConcurrentSessions: 100,
+  sessionTtlMs: 30 * 60_000,
+  maxMessagesPerSession: 500,
+
+  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '*').split(',').map(s => s.trim()),
+  maxRequestBodyBytes: 1_048_576,
+};
+
+export const MAX_REQUEST_BODY_SIZE = SECURITY_CONFIG.maxRequestBodyBytes;
+
+export function validateApiKey(req) {
+  if (!SECURITY_CONFIG.apiKeyRequired) return { valid: true };
+
+  let key = req.headers['x-api-key'];
+  if (!key) {
+    try {
+      const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+      key = url.searchParams.get('key') || url.searchParams.get('apiKey');
+    } catch {
+    }
+  }
+  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or ?key= query parameter.' };
+  const expected = Buffer.from(process.env.MCP_API_KEY || '');
+  const received = Buffer.from(String(key));
+  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
+    return { valid: false, error: 'Invalid API key.' };
+  }
+  return { valid: true };
+}
+
+const rateLimitStore = new Map();
+
+export function checkRateLimit(sessionId) {
+  const now = Date.now();
+  const entry = rateLimitStore.get(sessionId);
+
+  if (!entry || now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs) {
+    rateLimitStore.set(sessionId, { count: 1, windowStart: now });
+    return { allowed: true, remaining: SECURITY_CONFIG.rateLimitMaxRequests - 1 };
+  }
+
+  entry.count++;
+  const remaining = SECURITY_CONFIG.rateLimitMaxRequests - entry.count;
+  if (remaining < 0) {
+    return { allowed: false, error: `Rate limit exceeded. Max ${SECURITY_CONFIG.rateLimitMaxRequests} requests per minute.` };
+  }
+  return { allowed: true, remaining };
+}
+
+const rateLimitCleanupTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [id, entry] of rateLimitStore) {
+    if (now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs * 2) {
+      rateLimitStore.delete(id);
+    }
+  }
+}, 60_000);
+rateLimitCleanupTimer.unref?.();
+
+export function sanitizeInput(input) {
+  if (typeof input === 'string') {
+    return input
+      .replace(/[<>]/g, '')
+      .replace(/\x00/g, '')
+      .slice(0, 1000);
+  }
+  if (typeof input === 'object' && input !== null) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(input)) {
+      if (typeof key === 'string' && key.length <= 100) {
+        sanitized[key] = sanitizeInput(value);
+      }
+    }
+    return sanitized;
+  }
+  return input;
+}
+
+export function validateSessionId(sessionId) {
+  if (!sessionId || typeof sessionId !== 'string') return false;
+  return /^[a-zA-Z0-9_-]{1,100}$/.test(sessionId);
+}
+
+export function setCorsHeaders(res, origin) {
+  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
+  const isAllowed = allowed.includes('*') || allowed.includes(origin);
+
+  if (isAllowed) {
+    res.setHeader('Access-Control-Allow-Origin', origin || '*');
+  } else {
+    res.setHeader('Access-Control-Allow-Origin', '');
+  }
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
+  res.setHeader('Access-Control-Max-Age', '86400');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  return isAllowed;
+}
+
+export function securityMiddleware(req, res) {
+  const origin = req.headers.origin || '';
+  const corsOk = setCorsHeaders(res, origin);
+
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    res.end();
+    return { blocked: true };
+  }
+
+  if (!corsOk) {
+    res.statusCode = 403;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(JSON.stringify({ error: 'Origin not allowed by CORS policy.' }));
+    return { blocked: true };
+  }
+
+  const auth = validateApiKey(req);
+  if (!auth.valid) {
+    res.statusCode = 401;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(JSON.stringify({ error: auth.error }));
+    return { blocked: true };
+  }
+
+  return { blocked: false };
+}
+
+export function getSecurityConfig() {
+  return { ...SECURITY_CONFIG, apiKeyRequired: SECURITY_CONFIG.apiKeyRequired };
+}

package/server/mcp/server.js

@@ -1,100 +1,129 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { z } from 'zod';
-import { toolDefinitions, handleToolCall } from './tools.js';
-import { resourceDefinitions, readResource } from './resources.js';
-import { getPrompt } from './prompts.js';
-
-export function createMcpServer() {
-  const server = new McpServer({
-    name: 'kiku-mcp-server',
-    version: '1.1.0',
-  }, {
-    capabilities: {
-      tools: {},
-      resources: {},
-      prompts: {},
-    },
-  });
-
-  for (const tool of toolDefinitions) {
-    server.registerTool(
-      tool.name,
-      {
-        description: tool.description,
-        inputSchema: tool.inputSchema,
-        annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
-      },
-      async (args) => {
-        try {
-          const result = await handleToolCall(tool.name, args);
-          return {
-            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
-            structuredContent: result,
-            isError: result?.status === 'error',
-          };
-        } catch (err) {
-          return {
-            content: [{ type: 'text', text: JSON.stringify({ status: 'error', message: err.message }) }],
-            isError: true,
-          };
-        }
-      }
-    );
-  }
-
-  const resourceMap = {
-    'kiku://bio': 'kiku-bio',
-    'kiku://awards': 'kiku-awards',
-    'kiku://catalog': 'kiku-catalog',
-    'kiku://timeline': 'kiku-timeline',
-    'kiku://discography': 'kiku-discography',
-    'kiku://brands': 'kiku-brands',
-    'kiku://social': 'kiku-social',
-  };
-
-  for (const def of resourceDefinitions) {
-    server.registerResource(
-      resourceMap[def.uri],
-      def.uri,
-      { description: def.description, mimeType: def.mimeType },
-      async (uri) => readResource(uri.href)
-    );
-  }
-
-  server.registerPrompt(
-    'recommend_series',
-    {
-      description: 'Recommend Ju Jingyi dramas based on mood or genre preference.',
-      argsSchema: {
-        mood: z.string().optional().describe('Current mood: romantic, action-packed, mysterious, emotional, or lighthearted'),
-        genre: z.string().optional().describe('Preferred genre: historical, fantasy, xianxia, romance, or suspense'),
-      },
-    },
-    async (args) => getPrompt('recommend_series', args)
-  );
-
-  server.registerPrompt(
-    'brand_portfolio',
-    { description: 'Summarize Ju Jingyi brand endorsements and commercial influence.' },
-    async (args) => getPrompt('brand_portfolio', args)
-  );
-
-  server.registerPrompt(
-    'character_summary',
-    {
-      description: 'Get a detailed summary of a specific character role by Ju Jingyi.',
-      argsSchema: {
-        character_name: z.string().min(1).describe('Character name, such as Yang Caiwei, Bai Suzhen, Lu Wuyi, or Han Yunxi'),
-      },
-    },
-    async (args) => getPrompt('character_summary', args)
-  );
-
-  server.registerPrompt(
-    'career_overview',
-    { description: 'Get a comprehensive career overview organized by era.' },
-    async (args) => getPrompt('career_overview', args)
-  );
-
-  return server;
-}
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { toolDefinitions, handleToolCall } from './tools.js';
+import { resourceDefinitions, readResource } from './resources.js';
+import { getPrompt } from './prompts.js';
+
+export function createMcpServer() {
+  const server = new McpServer({
+    name: 'kiku',
+    title: 'kiku',
+    version: '1.1.0',
+    description: 'MCP server exposing the Ju Jingyi catalog as tools, resources, and prompts.',
+    websiteUrl: 'https://jujingyi-kikuuu.vercel.app/',
+    icons: [
+      {
+        src: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCI+DQogIDxkZWZzPg0KICAgIDxsaW5lYXJHcmFkaWVudCBpZD0icGV0YWwiIHgxPSIwIiB5MT0iMCIgeDI9IjEiIHkyPSIxIj4NCiAgICAgIDxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iI2Y5YThkNCIvPg0KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjZWM0ODk5Ii8+DQogICAgPC9saW5lYXJHcmFkaWVudD4NCiAgPC9kZWZzPg0KICA8cmVjdCB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIHJ4PSIxNCIgZmlsbD0iIzIwMTIyYiIvPg0KICA8ZyBmaWxsPSJ1cmwoI3BldGFsKSI+DQogICAgPGVsbGlwc2UgY3g9IjMyIiBjeT0iMTkiIHJ4PSI3LjUiIHJ5PSIxMSIvPg0KICAgIDxlbGxpcHNlIGN4PSIzMiIgY3k9IjQ1IiByeD0iNy41IiByeT0iMTEiLz4NCiAgICA8ZWxsaXBzZSBjeD0iMTkiIGN5PSIzMiIgcng9IjExIiByeT0iNy41Ii8+DQogICAgPGVsbGlwc2UgY3g9IjQ1IiBjeT0iMzIiIHJ4PSIxMSIgcnk9IjcuNSIvPg0KICA8L2c+DQogIDxjaXJjbGUgY3g9IjMyIiBjeT0iMzIiIHI9IjUuNSIgZmlsbD0iI2ZkZTY4YSIvPg0KPC9zdmc+DQo=',
+        mimeType: 'image/svg+xml',
+        sizes: ['any', '64x64', '128x128'],
+        theme: 'dark',
+      },
+      {
+        src: 'https://jujingyi-kikuuu.vercel.app/mcp-logo-128.png',
+        mimeType: 'image/png',
+        sizes: ['128x128'],
+        theme: 'dark',
+      },
+      {
+        src: 'https://jujingyi-kikuuu.vercel.app/mcp-logo-64.png',
+        mimeType: 'image/png',
+        sizes: ['64x64'],
+        theme: 'dark',
+      },
+      {
+        src: 'https://jujingyi-kikuuu.vercel.app/mcp-logo.svg',
+        mimeType: 'image/svg+xml',
+        sizes: ['any'],
+        theme: 'dark',
+      },
+    ],
+  }, {
+    capabilities: {
+      tools: {},
+      resources: {},
+      prompts: {},
+    },
+  });
+
+  for (const tool of toolDefinitions) {
+    server.registerTool(
+      tool.name,
+      {
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+      },
+      async (args) => {
+        try {
+          const result = await handleToolCall(tool.name, args);
+          return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+            structuredContent: result,
+            isError: result?.status === 'error',
+          };
+        } catch (err) {
+          return {
+            content: [{ type: 'text', text: JSON.stringify({ status: 'error', message: err.message }) }],
+            isError: true,
+          };
+        }
+      }
+    );
+  }
+
+  const resourceMap = {
+    'kiku://bio': 'kiku-bio',
+    'kiku://awards': 'kiku-awards',
+    'kiku://catalog': 'kiku-catalog',
+    'kiku://timeline': 'kiku-timeline',
+    'kiku://discography': 'kiku-discography',
+    'kiku://brands': 'kiku-brands',
+    'kiku://social': 'kiku-social',
+  };
+
+  for (const def of resourceDefinitions) {
+    server.registerResource(
+      resourceMap[def.uri],
+      def.uri,
+      { description: def.description, mimeType: def.mimeType },
+      async (uri) => readResource(uri.href)
+    );
+  }
+
+  server.registerPrompt(
+    'recommend_series',
+    {
+      description: 'Recommend Ju Jingyi dramas based on mood or genre preference.',
+      argsSchema: {
+        mood: z.string().optional().describe('Current mood: romantic, action-packed, mysterious, emotional, or lighthearted'),
+        genre: z.string().optional().describe('Preferred genre: historical, fantasy, xianxia, romance, or suspense'),
+      },
+    },
+    async (args) => getPrompt('recommend_series', args)
+  );
+
+  server.registerPrompt(
+    'brand_portfolio',
+    { description: 'Summarize Ju Jingyi brand endorsements and commercial influence.' },
+    async (args) => getPrompt('brand_portfolio', args)
+  );
+
+  server.registerPrompt(
+    'character_summary',
+    {
+      description: 'Get a detailed summary of a specific character role by Ju Jingyi.',
+      argsSchema: {
+        character_name: z.string().min(1).describe('Character name, such as Yang Caiwei, Bai Suzhen, Lu Wuyi, or Han Yunxi'),
+      },
+    },
+    async (args) => getPrompt('character_summary', args)
+  );
+
+  server.registerPrompt(
+    'career_overview',
+    { description: 'Get a comprehensive career overview organized by era.' },
+    async (args) => getPrompt('career_overview', args)
+  );
+
+  return server;
+}

package/server/mcp/stdio.js

@@ -10,10 +10,12 @@ let closing = false;
 async function shutdown(exitCode = 0) {
   if (closing) return;
   closing = true;
-  await Promise.allSettled([transport.close(), server.close()]);
-  process.exitCode = exitCode;
+  await Promise.allSettled([transport.close().catch(() => {}), server.close().catch(() => {})]);
+  process.exit(exitCode);
 }
 
+process.stdin.once('end', () => { void shutdown(0); });
+process.stdin.once('close', () => { void shutdown(0); });
 process.once('SIGINT', () => { void shutdown(130); });
 process.once('SIGTERM', () => { void shutdown(143); });
 process.once('uncaughtException', error => {