klyro 1.0.5 → 1.0.6

package/dist/mcp/registry.js

@@ -30,6 +30,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { McpClient, McpError } from './client.js';
+import { RemoteMcpClient } from './remote.js';
 import { loadMcpServers } from './config.js';
 import { evaluateMcpPolicy } from './policy.js';
 import { jsonSchemaToZod } from './schema.js';
@@ -141,9 +142,20 @@ async function executeMcpTool(server, spec, toolDef, client, input, ctx) {
         return { ok: false, error: { code: 'TOOL_ERROR', message: redact(errMessage(err)) } };
     }
 }
+/**
+ * Construct the right client for a spec: remote HTTP when `url` is set,
+ * else stdio. Used by registration, probe, and prompt runs.
+ */
+export function makeMcpClient(name, spec) {
+    if (spec.url)
+        return new RemoteMcpClient(name, spec);
+    if (!spec.command)
+        throw new McpError(`mcp server "${name}" has neither command nor url`, 'INVALID_SPEC');
+    return new McpClient(name, spec);
+}
 export async function registerMcpServers(cfg, opts) {
     const { registry, policy } = opts;
-    const factory = opts.clientFactory ?? ((name, spec) => new McpClient(name, spec));
+    const factory = opts.clientFactory ?? makeMcpClient;
     const registered = [];
     const errors = [];
     const skipped = [];
@@ -291,3 +303,31 @@ export async function loadAndRegisterMcp(opts) {
         };
     }
 }
+/**
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh stdio
+ * connection per invocation (no client lifecycle to manage), redacted
+ * output. Typing the prompt name is explicit consent, so project servers
+ * connect without the registration-time approval gate. Throws McpError /
+ * Error on unknown server, disabled server, or prompt failure.
+ */
+export async function runMcpPrompt(cwd, server, prompt, args) {
+    const cfg = loadMcpServers(cwd);
+    const spec = cfg.servers[server];
+    if (!spec)
+        throw new Error(`mcp server not found: ${server}`);
+    if (spec.disabled)
+        throw new Error(`mcp server disabled: ${server}`);
+    const client = makeMcpClient(server, spec);
+    if (!client.promptsGet)
+        throw new Error(`mcp server "${server}" does not support prompts`);
+    try {
+        const withConnect = client;
+        if (typeof withConnect.connect === 'function')
+            await withConnect.connect();
+        const text = await client.promptsGet(prompt, args);
+        return redact(text).slice(0, 8000);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}

package/dist/mcp/remote.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Remote MCP transport — JSON-RPC 2.0 over HTTP POST (Streamable HTTP).
+ *
+ * Covers servers that speak plain request/response JSON-RPC at an HTTPS
+ * endpoint (the common self-hosted shape). Pure SSE-stream servers that
+ * require a persistent GET event stream are NOT supported — `probe` reports
+ * that explicitly. Custom headers (e.g. Authorization) come from the spec
+ * with `${env:VAR}` expansion applied at load time.
+ */
+import type { McpServerSpec } from './config.js';
+import { type McpClientLike, type McpToolDef, type McpCallResult, type McpResource, type McpPromptDef } from './client.js';
+/** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
+export declare function parseSseBody(text: string): unknown[];
+export declare class RemoteMcpClient implements McpClientLike {
+    readonly name: string;
+    private readonly spec;
+    private nextId;
+    private readonly headers;
+    private readonly timeoutMs;
+    constructor(name: string, spec: McpServerSpec);
+    connect(): Promise<void>;
+    listTools(signal?: AbortSignal): Promise<McpToolDef[]>;
+    callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;
+    listResources(signal?: AbortSignal): Promise<McpResource[]>;
+    promptsList(signal?: AbortSignal): Promise<McpPromptDef[]>;
+    promptsGet(name: string, args?: Record<string, string>, signal?: AbortSignal): Promise<string>;
+    close(): Promise<void>;
+    private request;
+}

package/dist/mcp/remote.js

@@ -0,0 +1,153 @@
+import { McpError } from './client.js';
+const PROTOCOL_VERSION = '2024-11-05';
+const DEFAULT_TIMEOUT_MS = 30_000;
+/** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
+export function parseSseBody(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const t = line.trim();
+        if (!t.startsWith('data:'))
+            continue;
+        const payload = t.slice(5).trim();
+        if (payload === '[DONE]')
+            continue;
+        try {
+            out.push(JSON.parse(payload));
+        }
+        catch { /* ignore malformed lines */ }
+    }
+    return out;
+}
+export class RemoteMcpClient {
+    name;
+    spec;
+    nextId = 1;
+    headers;
+    timeoutMs;
+    constructor(name, spec) {
+        this.name = name;
+        this.spec = spec;
+        if (!spec.url)
+            throw new McpError(`mcp server "${name}" has no url`, 'INVALID_SPEC');
+        this.headers = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream', ...(spec.headers ?? {}) };
+        this.timeoutMs = spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async connect() {
+        // Handshake doubles as reachability probe; failures surface typed errors.
+        await this.request('initialize', {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'klyro', version: 'remote' },
+        });
+        // Best-effort initialized notification (no id → no response expected).
+        try {
+            await fetch(this.spec.url, {
+                method: 'POST',
+                headers: this.headers,
+                body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }),
+                signal: AbortSignal.timeout(5000),
+            });
+        }
+        catch { /* notification is best-effort */ }
+    }
+    async listTools(signal) {
+        const res = (await this.request('tools/list', {}, this.timeoutMs, signal));
+        return Array.isArray(res.tools) ? res.tools : [];
+    }
+    async callTool(name, args, signal) {
+        const res = (await this.request('tools/call', { name, arguments: args ?? {} }, this.timeoutMs, signal));
+        const blocks = Array.isArray(res.content) ? res.content : [];
+        const text = blocks.map((b) => (typeof b.text === 'string' ? b.text : JSON.stringify(b))).join('\n');
+        return { text, isError: res.isError === true, raw: res };
+    }
+    async listResources(signal) {
+        const res = (await this.request('resources/list', {}, this.timeoutMs, signal));
+        return Array.isArray(res.resources) ? res.resources : [];
+    }
+    async promptsList(signal) {
+        try {
+            const res = (await this.request('prompts/list', {}, this.timeoutMs, signal));
+            return Array.isArray(res.prompts) ? res.prompts : [];
+        }
+        catch (err) {
+            if (err instanceof McpError && err.code === 'SERVER_ERROR' && err.details?.code === -32601)
+                return [];
+            throw err;
+        }
+    }
+    async promptsGet(name, args, signal) {
+        const res = (await this.request('prompts/get', { name, arguments: args ?? {} }, this.timeoutMs, signal));
+        const parts = [];
+        if (typeof res.description === 'string' && res.description)
+            parts.push(res.description);
+        for (const m of Array.isArray(res.messages) ? res.messages : []) {
+            const c = m.content;
+            if (c && typeof c.text === 'string')
+                parts.push(c.text);
+            else if (c !== undefined)
+                parts.push(JSON.stringify(c));
+        }
+        return parts.join('\n\n');
+    }
+    async close() {
+        // Stateless HTTP — nothing to tear down.
+    }
+    async request(method, params, timeoutMs = this.timeoutMs, signal) {
+        if (signal?.aborted)
+            throw new McpError(`mcp call "${method}" aborted`, 'ABORTED');
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        const onAbort = () => ctrl.abort();
+        signal?.addEventListener('abort', onAbort, { once: true });
+        const id = this.nextId++;
+        try {
+            const res = await fetch(this.spec.url, {
+                method: 'POST',
+                headers: this.headers,
+                body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+                signal: ctrl.signal,
+            });
+            const ctype = res.headers.get('content-type') ?? '';
+            const text = await res.text();
+            if (!res.ok)
+                throw new McpError(`mcp server "${this.name}" HTTP ${res.status}: ${text.slice(0, 300)}`, 'HTTP_ERROR', { status: res.status });
+            let body;
+            if (ctype.includes('text/event-stream')) {
+                const events = parseSseBody(text);
+                const last = [...events].reverse().find((e) => typeof e === 'object' && e !== null && 'result' in e);
+                const errs = [...events].reverse().find((e) => typeof e === 'object' && e !== null && 'error' in e);
+                if (!last && errs?.error)
+                    throw new McpError(`mcp server "${this.name}" error: ${errs.error.message ?? 'unknown'}`, 'SERVER_ERROR', errs.error);
+                if (!last)
+                    throw new McpError(`mcp server "${this.name}" empty SSE stream`, 'PROTOCOL_ERROR');
+                body = last.result;
+            }
+            else {
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    throw new McpError(`mcp server "${this.name}" returned non-JSON`, 'PROTOCOL_ERROR');
+                }
+                const env = body;
+                if (env && typeof env === 'object' && 'error' in env && env.error) {
+                    throw new McpError(`mcp server "${this.name}" error: ${env.error.message ?? 'unknown'}`, 'SERVER_ERROR', env.error);
+                }
+                body = env && typeof env === 'object' && 'result' in env ? env.result : body;
+            }
+            return body;
+        }
+        catch (err) {
+            if (err instanceof McpError)
+                throw err;
+            if (err instanceof Error && err.name === 'AbortError') {
+                throw new McpError(`mcp call "${method}" timed out after ${timeoutMs}ms`, 'TIMEOUT');
+            }
+            throw new McpError(`mcp call "${method}" failed: ${err instanceof Error ? err.message : String(err)}`, 'IO_ERROR');
+        }
+        finally {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        }
+    }
+}

package/dist/policy/approval.d.ts

@@ -11,7 +11,17 @@ export type ApprovalChoice =
 /** Yes, and auto-allow this pattern for the rest of the session. */
  | 'always'
 /** Yes, session-allow AND persist the pattern to settings (survives restarts). */
- | 'always-persist';
+ | 'always-persist'
+/**
+ * Yes, but with edited input. Produced by the TUI modal (`e`): the
+ * runtime re-validates + re-evaluates policy on `editedInput` (bounded
+ * re-prompt loop) instead of running the original call. The stdin prompt
+ * has no editor — `e` there stays `deny`.
+ */
+ | {
+    kind: 'edit';
+    editedInput: Record<string, unknown>;
+};
 export interface ApprovalRequest {
     toolName: string;
     reason: string;
@@ -37,6 +47,10 @@ export declare function sanitizeForPrompt(s: string): string;
  * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
  * persist to settings. Case MUST be checked before lowercasing — the old TUI
  * code lowercased first, so `A` silently became session-only `always`.
+ *
+ * NOTE: `e` maps to `deny` here, but the TUI modal intercepts `e` BEFORE
+ * this mapper to open inline edit mode (edit-and-retry). Only callers
+ * without an editor (stdin prompt) should rely on the `e`→`deny` mapping.
  */
 export declare function approvalChoiceForKey(inputStr: string): ApprovalChoice | 'expand' | 'explain' | null;
 /** Default prompt backed by readline on stdin/stdout. */

package/dist/policy/approval.js

@@ -30,6 +30,10 @@ export function sanitizeForPrompt(s) {
  * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
  * persist to settings. Case MUST be checked before lowercasing — the old TUI
  * code lowercased first, so `A` silently became session-only `always`.
+ *
+ * NOTE: `e` maps to `deny` here, but the TUI modal intercepts `e` BEFORE
+ * this mapper to open inline edit mode (edit-and-retry). Only callers
+ * without an editor (stdin prompt) should rely on the `e`→`deny` mapping.
  */
 export function approvalChoiceForKey(inputStr) {
     if (inputStr === 'A')
@@ -101,6 +105,10 @@ export class PatternApprovalCache {
         if (key && this.session.has(key))
             return 'allow';
         const choice = await this.inner.ask(req);
+        // Edited input is a new call, not an approval of the pattern — pass
+        // through without caching so the re-evaluated call prompts on its own.
+        if (typeof choice === 'object')
+            return choice;
         if ((choice === 'always' || choice === 'always-persist') && key) {
             this.session.add(key);
         }

package/dist/providers/endpoints.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Single provider registration point.
+ *
+ * Everything a new provider needs lives in ONE entry here:
+ *   - default base URL + model (hosted) or probe URL (local)
+ *   - wire protocol kind (OpenAI-compatible vs Anthropic)
+ *   - key env vars for resolution
+ *
+ * Consumers:
+ *   - `src/providers.ts` local-probe list + hosted defaults derive from this
+ *   - `src/providers/model-info.ts` pricing stays model-keyed (unchanged)
+ *   - `registerEndpoint()` allows programmatic/enterprise providers
+ */
+export type ProviderKind = 'openai-compatible' | 'anthropic';
+export interface ProviderEndpoint {
+    /** Stable id, e.g. 'openai', 'ollama'. Lowercase + dashes. */
+    id: string;
+    /** Human label for doctor/help output. */
+    label: string;
+    /** Wire protocol for adapter selection. */
+    kind: ProviderKind;
+    /** Default base URL (hosted) or probe URL (local). */
+    baseURL: string;
+    /** Model used when nothing else specifies one. */
+    defaultModel: string;
+    /** Local servers only: probed in order with `GET <base><probePath>`. */
+    probePath?: string;
+    /** Env vars tried (in order) for this provider's key. */
+    apiKeyEnv?: string[];
+}
+/** Register (or override) a provider endpoint programmatically. */
+export declare function registerEndpoint(def: ProviderEndpoint): void;
+/** All endpoints: builtins with custom overrides applied. */
+export declare function listEndpoints(): ProviderEndpoint[];
+/** Find one endpoint by id (custom wins). */
+export declare function getEndpoint(id: string): ProviderEndpoint | undefined;
+/** Local-probe candidates in order (entries with probePath). */
+export declare function localProbeEndpoints(): ProviderEndpoint[];
+/**
+ * Guess the provider id from a base URL (host matching). Returns undefined
+ * for unknown hosts — callers treat that as generic OpenAI-compatible.
+ */
+export declare function inferProviderId(baseURL: string): string | undefined;

package/dist/providers/endpoints.js

@@ -0,0 +1,104 @@
+const BUILTINS = [
+    {
+        id: 'openai',
+        label: 'OpenAI',
+        kind: 'openai-compatible',
+        baseURL: 'https://api.openai.com/v1',
+        defaultModel: 'gpt-4o-mini',
+        apiKeyEnv: ['KLYRO_API_KEY', 'OPENAI_API_KEY'],
+    },
+    {
+        id: 'anthropic',
+        label: 'Anthropic',
+        kind: 'anthropic',
+        baseURL: 'https://api.anthropic.com/v1',
+        defaultModel: 'claude-3-5-sonnet-20240620',
+        apiKeyEnv: ['KLYRO_API_KEY', 'ANTHROPIC_API_KEY'],
+    },
+    {
+        id: 'ollama',
+        label: 'Ollama',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:11434/v1',
+        defaultModel: 'llama3.2',
+        probePath: '/models',
+    },
+    {
+        id: 'lmstudio',
+        label: 'LM Studio',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:1234/v1',
+        defaultModel: 'local-model',
+        probePath: '/models',
+    },
+    {
+        id: 'vllm',
+        label: 'vLLM',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:8000/v1',
+        defaultModel: 'meta-llama/Llama-3-8B-Instruct',
+        probePath: '/models',
+    },
+    {
+        id: 'llamacpp',
+        label: 'llama.cpp',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:8080/v1',
+        defaultModel: 'local-model',
+        probePath: '/models',
+    },
+];
+const custom = new Map();
+function validateEndpoint(def) {
+    if (!/^[a-z0-9-]{1,32}$/.test(def.id))
+        throw new Error(`invalid provider id "${def.id}"`);
+    if (!def.baseURL || !def.defaultModel)
+        throw new Error(`provider "${def.id}" needs baseURL + defaultModel`);
+}
+/** Register (or override) a provider endpoint programmatically. */
+export function registerEndpoint(def) {
+    validateEndpoint(def);
+    custom.set(def.id, def);
+}
+/** All endpoints: builtins with custom overrides applied. */
+export function listEndpoints() {
+    const byId = new Map();
+    for (const d of BUILTINS)
+        byId.set(d.id, d);
+    for (const [id, d] of custom)
+        byId.set(id, d);
+    return [...byId.values()];
+}
+/** Find one endpoint by id (custom wins). */
+export function getEndpoint(id) {
+    return custom.get(id) ?? BUILTINS.find((d) => d.id === id);
+}
+/** Local-probe candidates in order (entries with probePath). */
+export function localProbeEndpoints() {
+    return listEndpoints().filter((d) => d.probePath !== undefined);
+}
+/**
+ * Guess the provider id from a base URL (host matching). Returns undefined
+ * for unknown hosts — callers treat that as generic OpenAI-compatible.
+ */
+export function inferProviderId(baseURL) {
+    let host = '';
+    try {
+        host = new URL(baseURL).hostname.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+    if (host === 'api.openai.com')
+        return 'openai';
+    if (host === 'api.anthropic.com')
+        return 'anthropic';
+    for (const d of listEndpoints()) {
+        try {
+            if (new URL(d.baseURL).hostname.toLowerCase() === host && d.id !== 'openai' && d.id !== 'anthropic')
+                return d.id;
+        }
+        catch { /* ignore */ }
+    }
+    return undefined;
+}

package/dist/providers.js

@@ -12,12 +12,15 @@
  *   4. Fall back to api.openai.com with a clear error if no key
  */
 import { assertSafeBaseURL, normalizeBaseURL } from './chat.js';
-const LOCAL_ENDPOINTS = [
-    { name: 'Ollama', baseURL: 'http://localhost:11434/v1', defaultModel: 'llama3.2' },
-    { name: 'LM Studio', baseURL: 'http://localhost:1234/v1', defaultModel: 'local-model' },
-    { name: 'vLLM', baseURL: 'http://localhost:8000/v1', defaultModel: 'meta-llama/Llama-3-8B-Instruct' },
-    { name: 'llama.cpp', baseURL: 'http://localhost:8080/v1', defaultModel: 'local-model' },
-];
+import { localProbeEndpoints } from './providers/endpoints.js';
+/**
+ * Local probe candidates, derived from the single provider registry
+ * (`providers/endpoints.ts`) — adding a local server there automatically
+ * extends probing here.
+ */
+function localProbeList() {
+    return localProbeEndpoints().map((d) => ({ name: d.label, baseURL: d.baseURL, defaultModel: d.defaultModel, probePath: d.probePath ?? '/models' }));
+}
 /**
  * Resolve which provider to use. Does not throw; returns `null` if nothing
  * is reachable.
@@ -147,8 +150,8 @@ export async function resolveProvider() {
         };
     }
     // Probe local endpoints
-    for (const ep of LOCAL_ENDPOINTS) {
-        if (await probeLocal(ep.baseURL)) {
+    for (const ep of localProbeList()) {
+        if (await probeLocal(ep.baseURL, ep.probePath)) {
             return {
                 baseURL: ep.baseURL,
                 apiKey: '',
@@ -160,13 +163,13 @@ export async function resolveProvider() {
     return null;
 }
 /** Hit a cheap endpoint to check if a local server is up. */
-async function probeLocal(baseURL) {
+async function probeLocal(baseURL, probePath = '/models') {
     const ctrl = new AbortController();
     const t = setTimeout(() => ctrl.abort(), 600);
     try {
         // Try the OpenAI-style /models endpoint; some servers (Ollama before load)
         // answer /, others only /v1/models.
-        const res = await fetch(`${baseURL.replace(/\/+$/, '')}/models`, {
+        const res = await fetch(`${baseURL.replace(/\/+$/, '')}${probePath}`, {
             method: 'GET',
             signal: ctrl.signal,
         });