kojee-mcp 0.2.1 → 0.4.0

package/dist/{chunk-RNKJONY3.js → chunk-ZGVUM4AG.js}

@@ -1,4 +1,10 @@
+import {
+  deriveDiscoveryKey,
+  findClaudeAncestorPid
+} from "./chunk-36DMIXH7.js";
+
 // src/index.ts
+import fs2 from "fs";
 import path2 from "path";
 
 // src/auth/auth-module.ts
@@ -277,9 +283,41 @@ function translateHttpError(status, errorCode, _trigger) {
   }
   return null;
 }
+var TANDEM_ERROR_MESSAGES = {
+  [-32003]: () => "This Tandem is hardened to owner-only membership; you can't join.",
+  [-32004]: () => "You aren't a member of that Tandem. Use tandem_join(join_link) first.",
+  [-32006]: (data) => {
+    const retry = data?.["retry_after_seconds"] ?? "a moment";
+    return `Rate limit hit on this Tandem. Retry after ${retry} seconds.`;
+  },
+  [-32007]: (data) => {
+    const rule = data?.["rule"] ?? "policy";
+    return `Message rejected by Tandem policy (${rule}).`;
+  },
+  [-32011]: (data) => {
+    const id = data?.["tandem_id"] ?? "unknown";
+    return `Tandem ${id} doesn't exist or isn't visible to you.`;
+  },
+  [-32015]: (data) => {
+    const candidates = data?.["candidates"] ?? [];
+    return `An @-mention matched multiple members and is ambiguous. Retry with explicit mentions[]. Candidates: ${candidates.join(", ")}.`;
+  }
+};
 function translateJsonRpcError(error) {
   const msg = error.message ?? "";
   const msgLower = msg.toLowerCase();
+  const tandemMessage = TANDEM_ERROR_MESSAGES[error.code];
+  if (tandemMessage) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: tandemMessage(error.data)
+        }
+      ],
+      isError: true
+    };
+  }
   switch (error.code) {
     case -32601:
       return makeError(
@@ -346,6 +384,10 @@ function makeError(text) {
   };
 }
 
+// src/tandem/session-id.ts
+import { ulid } from "ulidx";
+var MCP_SESSION_ID = ulid();
+
 // src/gateway-client.ts
 var STEP_UP_POLL_INTERVAL_MS = 5e3;
 var STEP_UP_MAX_TIMEOUT_MS = 3e5;
@@ -364,6 +406,21 @@ var GatewayClient = class {
   currentNonce;
   requestCounter = 0;
   endpoint;
+  /**
+   * Expose the DPoP signing key so peer modules sharing auth state
+   * (e.g. tandem/event-stream.ts) can sign their own requests.
+   */
+  getPrivateKey() {
+    return this.privateKey;
+  }
+  /**
+   * Expose the bot_key_id (kid) for DPoP proof headers. Paired with
+   * getPrivateKey() so peer modules can construct proofs without
+   * threading the key material through their own constructors.
+   */
+  getKid() {
+    return this.kid;
+  }
   /**
    * Derive a deterministic session ID from the gateway token.
    * session_id = sha256(token + "proxy").slice(0, 16)
@@ -446,7 +503,8 @@ var GatewayClient = class {
       headers: {
         "Content-Type": "application/json",
         Authorization: `DPoP ${this.token}`,
-        DPoP: proof
+        DPoP: proof,
+        "Mcp-Session-Id": MCP_SESSION_ID
       },
       body: JSON.stringify(rpcRequest)
     });
@@ -590,16 +648,28 @@ import {
   ListToolsRequestSchema,
   CallToolRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-function createMcpServer(registry) {
+function buildChannelInstructions(tandemMembershipCount, eventLogPath) {
+  const intro = 'Tandem events are delivered to you in three ways depending on which is active in your Claude Code session:\n\n(1) If channel notifications are available, you\'ll see them as `<channel source="kojee-mcp" ...>` tags in your context. Each tag carries tandem_id, message_id, from_principal, kind, severity. Reply with tandem_send(tandem_id, text, reply_to=<message_id>); read more context with tandem_messages(tandem_id, since=cursor).\n\n';
+  const monitorSection = `(2) For sustained wake-from-idle WITHOUT channel notifications, the proxy writes one event line per Tandem message to ${eventLogPath}. At the start of every session, spawn ONE Monitor task: Monitor(command="tail -n +1 -F ${eventLogPath}", persistent=true, description="kojee Tandem events"). Each appended line will arrive as a separate wake notification. Use the cursor in the line to call tandem_messages(tandem_id, since=cursor-1) for the full message body.
+
+`;
+  const listenSection = "(3) If you want to BLOCK until any single reply lands (rather than receive a stream of events), call tandem_listen(tandem_id, since=cursor, timeout_ms=N) instead.";
+  const advice = "\n\nPrefer (2) at session start \u2014 it's the default no-allowlist wake mechanism. (1) supplements it when channels are enabled; (3) is for one-shot blocking waits.";
+  if (tandemMembershipCount === 0) {
+    return intro + listenSection;
+  }
+  return intro + monitorSection + listenSection + advice;
+}
+function createMcpServer(registry, adapter, tandemMembershipCount = -1, eventLogPath) {
+  const capabilities = { tools: {} };
+  if (adapter.supportsChannels) {
+    capabilities.experimental = { "claude/channel": {} };
+  }
   const server = new Server(
+    { name: "kojee-mcp", version: "0.3.0" },
     {
-      name: "kojee-mcp",
-      version: "0.2.0"
-    },
-    {
-      capabilities: {
-        tools: {}
-      }
+      capabilities,
+      ...adapter.supportsChannels ? { instructions: buildChannelInstructions(tandemMembershipCount, eventLogPath ?? "") } : {}
     }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => {
@@ -614,10 +684,7 @@ function createMcpServer(registry) {
     const { name, arguments: args } = request.params;
     const rawResult = await registry.callTool(name, args ?? {});
     const result = translateToolCallResult(rawResult);
-    return {
-      content: result.content,
-      isError: result.isError
-    };
+    return { content: result.content, isError: result.isError };
   });
   return server;
 }
@@ -627,15 +694,353 @@ async function startMcpServer(server) {
   console.error("[mcp] Server started on stdio transport");
 }
 
+// src/runtime/detect.ts
+import childProcess from "child_process";
+function detectRuntime(env = process.env) {
+  if (env["KOJEE_RUNTIME"] === "claude-code") return "claude-code";
+  if (env["CLAUDE_CODE_SESSION_ID"]) return "claude-code";
+  if (parentProcessLooksLikeClaude()) return "claude-code";
+  return "unknown";
+}
+function parentProcessLooksLikeClaude() {
+  if (process.platform === "win32") return false;
+  try {
+    let pid = process.ppid;
+    for (let depth = 0; depth < 5 && pid && pid > 1; depth++) {
+      const cmd = childProcess.execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      if (/(^|\/)claude(\.app)?(\/|$|\s|\\)/i.test(cmd) || /Claude Helper/i.test(cmd)) {
+        return true;
+      }
+      const ppidOut = childProcess.execFileSync("ps", ["-o", "ppid=", "-p", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      pid = Number.parseInt(ppidOut, 10);
+      if (!Number.isFinite(pid)) return false;
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/adapters/claude-code.ts
+function computeSeverity(event) {
+  if (event.type === "state_change") return "high";
+  if (event.mentions && event.mentions.length > 0) {
+    return "high";
+  }
+  return "normal";
+}
+function formatBody(event) {
+  if (event.type === "state_change") {
+    return `[Tandem: ${event.tandem_id}] ${event.from.displayname}: ${event.content.body}`;
+  }
+  return [
+    `[Tandem: ${event.tandem_id}] ${event.from.displayname} (${event.from.principal}) \u2014 ${event.kind}:`,
+    event.content.body,
+    "",
+    `> reply with tandem_send(tandem_id="${event.tandem_id}", text="...", reply_to="${event.id}")`
+  ].join("\n");
+}
+var claudeCodeAdapter = {
+  runtime: "claude-code",
+  supportsChannels: true,
+  formatTandemEvent(event) {
+    const meta = {
+      tandem_id: event.tandem_id,
+      message_id: event.id,
+      cursor: String(event.cursor),
+      kind: event.kind,
+      from_principal: event.from.principal,
+      from_display: event.from.displayname,
+      severity: computeSeverity(event)
+    };
+    return { content: formatBody(event), meta };
+  }
+};
+
+// src/adapters/unknown.ts
+var unknownAdapter = {
+  runtime: "unknown",
+  supportsChannels: false,
+  formatTandemEvent() {
+    throw new Error(
+      "unknownAdapter.formatTandemEvent() is unreachable \u2014 caller should gate on supportsChannels"
+    );
+  }
+};
+
+// src/tandem/event-stream.ts
+async function startEventStream(opts) {
+  let stopped = false;
+  let lastCursor = null;
+  const controller = new AbortController();
+  void (async function loop() {
+    let backoffMs = 1e3;
+    while (!stopped) {
+      try {
+        await connectAndConsume(opts, lastCursor, controller, (cursor) => {
+          lastCursor = cursor;
+          backoffMs = 1e3;
+        });
+      } catch (err) {
+        if (stopped) return;
+        console.error("[event-stream] disconnect:", err.message);
+      }
+      if (stopped) return;
+      const jitter = Math.random() * backoffMs;
+      await sleep2(jitter);
+      backoffMs = Math.min(backoffMs * 2, 3e4);
+    }
+  })();
+  return () => {
+    stopped = true;
+    controller.abort();
+  };
+}
+async function connectAndConsume(opts, sinceCursor, controller, onCursor) {
+  const params = new URLSearchParams();
+  if (sinceCursor !== null) params.set("since", String(sinceCursor));
+  const url = `${opts.brokerUrl}/api/v2/tandems/stream${params.toString() ? "?" + params.toString() : ""}`;
+  const proof = await createDPoPProof(
+    opts.gateway.getPrivateKey(),
+    opts.gateway.getKid(),
+    "GET",
+    url,
+    void 0,
+    opts.token
+  );
+  const res = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `DPoP ${opts.token}`,
+      DPoP: proof,
+      "Mcp-Session-Id": MCP_SESSION_ID,
+      Accept: "text/event-stream"
+    },
+    signal: controller.signal
+  });
+  if (!res.ok) throw new Error(`SSE connect failed: ${res.status}`);
+  if (!res.body) throw new Error("SSE response has no body");
+  await consumeSse(res.body, opts, onCursor);
+}
+async function consumeSse(body, opts, onCursor) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) return;
+    buffer += decoder.decode(value, { stream: true });
+    const events = drainSseEvents(buffer);
+    buffer = events.remaining;
+    for (const evt of events.events) {
+      if (evt.event === "stream_revoked") {
+        throw new Error("stream_revoked \u2014 reconnect needed");
+      }
+      if (evt.event === "heartbeat") continue;
+      if (evt.event === "message" || evt.event === "state_change") {
+        try {
+          const raw = JSON.parse(evt.data);
+          const parsed = normalizeBackendEvent(raw, evt.event);
+          onCursor(parsed.cursor);
+          opts.queue?.push(parsed);
+          const channel = opts.adapter.formatTandemEvent(parsed);
+          await opts.server.notification({
+            method: "notifications/claude/channel",
+            params: channel
+          });
+          opts.queue?.markChannelDelivered(parsed.id);
+          if (opts.eventLog) {
+            try {
+              await opts.eventLog.append(parsed);
+              opts.queue?.markMonitorDelivered(parsed.id);
+            } catch (err) {
+              console.error("[event-stream] event-log append failed:", err);
+            }
+          }
+        } catch (err) {
+          console.error("[event-stream] failed to handle event:", err);
+        }
+      }
+    }
+  }
+}
+function drainSseEvents(input) {
+  const events = [];
+  const parts = input.split("\n\n");
+  const remaining = parts.pop() ?? "";
+  for (const block of parts) {
+    let id;
+    let event = "message";
+    const dataLines = [];
+    for (const line of block.split("\n")) {
+      if (line.startsWith("id: ")) id = line.slice(4);
+      else if (line.startsWith("event: ")) event = line.slice(7);
+      else if (line.startsWith("data: ")) dataLines.push(line.slice(6));
+    }
+    if (dataLines.length > 0) events.push({ id, event, data: dataLines.join("\n") });
+  }
+  return { events, remaining };
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function normalizeBackendEvent(raw, sseEventType) {
+  const obj = raw ?? {};
+  const maybeFrom = obj["from"];
+  if (maybeFrom && typeof maybeFrom["principal"] === "string") {
+    return raw;
+  }
+  const sender = obj["sender"] ?? {};
+  const principal = sender["principal_id"] ?? "";
+  const agentId = sender["agent_id"];
+  const displayname = principal ? `principal:${principal.slice(0, 8)}` : "unknown";
+  const type = sseEventType === "state_change" ? "state_change" : "message";
+  const kind = obj["kind"] ?? "message";
+  return {
+    type,
+    id: obj["message_id"] ?? obj["id"] ?? "",
+    tandem_id: obj["tandem_id"] ?? "",
+    cursor: obj["cursor"] ?? 0,
+    time: obj["time"] ?? (/* @__PURE__ */ new Date()).toISOString(),
+    from: {
+      member_id: "",
+      principal,
+      ...agentId ? { agent_id: agentId } : {},
+      displayname
+    },
+    kind,
+    content: {
+      body: obj["body"] ?? "",
+      ...typeof obj["format"] === "string" ? { format: obj["format"] } : {}
+    },
+    ...Array.isArray(obj["mentions"]) ? { mentions: obj["mentions"] } : {},
+    ...obj["reply_to"] !== void 0 ? { reply_to: obj["reply_to"] } : {}
+  };
+}
+
 // src/index.ts
 var DEFAULT_KEYSTORE_PATH = path2.join(
   process.env["HOME"] ?? "~",
   ".kojee",
   "keypair.json"
 );
+function isDPoPEnrollmentError(err) {
+  const msg = String(err?.message ?? err ?? "").toLowerCase();
+  if (msg.includes("invalid or expired") && msg.includes("token")) return false;
+  if (msg.includes("generate a new")) return false;
+  return msg.includes("401") || msg.includes("authentication failed") || msg.includes("dpop") || msg.includes("key enrollment") || msg.includes("kid");
+}
+function selectAdapter() {
+  const runtime = detectRuntime();
+  if (runtime === "claude-code") return claudeCodeAdapter;
+  return unknownAdapter;
+}
 async function startProxy(config) {
   const keystorePath = config.keystorePath || DEFAULT_KEYSTORE_PATH;
-  console.error(`[kojee-mcp] Starting proxy for ${config.url}`);
+  const adapter = selectAdapter();
+  console.error(`[kojee-mcp] Starting proxy for ${config.url} (runtime=${adapter.runtime})`);
+  const { registry, gateway } = await enrollAndDiscover(config, keystorePath);
+  console.error(
+    `[kojee-mcp] Ready \u2014 ${registry.toolCount} tools available from ${config.url}`
+  );
+  let tandemMembershipCount = -1;
+  try {
+    const result = await gateway.sendRpc("tools/call", { name: "tandem_list", arguments: {} });
+    const maybeErr = result;
+    if (!maybeErr.isError) {
+      const text = maybeErr.content?.[0]?.text;
+      try {
+        const parsed = text ? JSON.parse(text) : {};
+        if (Array.isArray(parsed.tandems)) {
+          tandemMembershipCount = parsed.tandems.length;
+        } else if (Array.isArray(parsed)) {
+          tandemMembershipCount = parsed.length;
+        } else {
+          tandemMembershipCount = 0;
+        }
+      } catch {
+      }
+    }
+  } catch (err) {
+    console.error("[kojee-mcp] tandem_list probe failed:", err.message);
+  }
+  console.error(`[kojee-mcp] Tandem memberships: ${tandemMembershipCount === -1 ? "unknown" : tandemMembershipCount}`);
+  let server;
+  if (adapter.supportsChannels) {
+    const { EventQueue } = await import("./event-queue-5YVJFR3E.js");
+    const { startHookServer } = await import("./hook-server-43QS7L7P.js");
+    const {
+      writeDiscoveryByKey,
+      cleanupDiscoveryByKey,
+      sweepStaleDiscovery
+    } = await import("./session-discovery-WSHLR4OV.js");
+    const { startEventLog, sweepStaleEventLogs } = await import("./event-log-ETWR6PPY.js");
+    sweepStaleDiscovery();
+    sweepStaleEventLogs();
+    const ccPid = findClaudeAncestorPid();
+    const projectDir = process.env["CLAUDE_PROJECT_DIR"];
+    const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
+    const eventLog = startEventLog({ key: discoveryKey });
+    server = createMcpServer(registry, adapter, tandemMembershipCount, eventLog.path);
+    const queue = new EventQueue();
+    const hookServer = await startHookServer({ port: 0, queue, adapter });
+    writeDiscoveryByKey(discoveryKey, {
+      schema: 2,
+      discoveryKey,
+      ccPid,
+      projectDir: projectDir ?? null,
+      proxyPid: process.pid,
+      // Legacy `pid` mirrors `proxyPid` so the existing event-log sweep
+      // (which reads `data.pid`) still considers this entry live.
+      pid: process.pid,
+      port: hookServer.port,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      brokerUrl: config.url
+    });
+    const cleanupDiscoveryFile = () => cleanupDiscoveryByKey(discoveryKey);
+    process.on("exit", () => cleanupDiscoveryFile());
+    process.on("SIGINT", () => {
+      cleanupDiscoveryFile();
+      process.exit(0);
+    });
+    process.on("SIGTERM", () => {
+      cleanupDiscoveryFile();
+      process.exit(0);
+    });
+    process.on("exit", () => eventLog.cleanup());
+    const cancelStream = await startEventStream({
+      brokerUrl: config.url,
+      token: config.token,
+      gateway,
+      adapter,
+      server,
+      queue,
+      eventLog
+    });
+    process.stdin.on("end", () => {
+      cancelStream();
+      cleanupDiscoveryFile();
+      eventLog.cleanup();
+      hookServer.stop().finally(() => {
+        console.error("[kojee-mcp] stdin closed, exiting");
+        process.exit(0);
+      });
+    });
+  } else {
+    server = createMcpServer(registry, adapter, tandemMembershipCount);
+    process.stdin.on("end", () => {
+      console.error("[kojee-mcp] stdin closed, exiting");
+      process.exit(0);
+    });
+  }
+  await startMcpServer(server);
+}
+async function enrollAndDiscover(config, keystorePath, isRetry = false) {
   const auth = new AuthModule(config.token, config.url, keystorePath);
   const keyPair = await auth.ensureEnrolled();
   const sessionId = GatewayClient.deriveSessionId(config.token);
@@ -648,18 +1053,26 @@ async function startProxy(config) {
     sessionId
   );
   const registry = new ToolRegistry(gateway);
-  await registry.discoverTools();
-  console.error(
-    `[kojee-mcp] Ready \u2014 ${registry.toolCount} tools available from ${config.url}`
-  );
-  const server = createMcpServer(registry);
-  process.stdin.on("end", () => {
-    console.error("[kojee-mcp] stdin closed, exiting");
-    process.exit(0);
-  });
-  await startMcpServer(server);
+  try {
+    await registry.discoverTools();
+    return { registry, gateway };
+  } catch (err) {
+    if (isRetry || !isDPoPEnrollmentError(err)) {
+      throw err;
+    }
+    console.error(
+      "[kojee-mcp] Auth failed, attempting recovery with fresh enrollment..."
+    );
+    try {
+      if (fs2.existsSync(keystorePath)) fs2.unlinkSync(keystorePath);
+    } catch (unlinkErr) {
+      console.error("[kojee-mcp] Could not remove stale keystore:", unlinkErr);
+    }
+    return enrollAndDiscover(config, keystorePath, true);
+  }
 }
 
 export {
+  AuthModule,
   startProxy
 };