level-up-mcp-server-cn 0.4.0

package/dist/services/ownership.js

@@ -0,0 +1,79 @@
+// ============================================================
+// services/ownership.ts — Ownership verification for data access
+// ============================================================
+// Prevents users from viewing other users' private data (tasks,
+// XP history, evidence) by verifying the caller owns or is
+// associated with the requested entity.
+// ============================================================
+import { supabase } from "./supabase.js";
+import { fail } from "./errors.js";
+import { toMcpResponse } from "./register.js";
+/**
+ * Verify that a caller has access to the requested entity's data.
+ *
+ * Rules:
+ *   - If target user_id matches caller_user_id → allowed
+ *   - If target agent_id is owned by caller_user_id → allowed
+ *   - If target is a task, verify caller owns the task's user_id or agent
+ *   - Otherwise → denied
+ *
+ * @returns null if access is allowed, or an MCP error response if denied
+ */
+export async function verifyOwnership(params) {
+    const { caller_user_id, target_user_id, target_agent_id, target_task_id } = params;
+    // Direct user match
+    if (target_user_id && target_user_id === caller_user_id) {
+        return null; // allowed
+    }
+    // Check agent ownership
+    if (target_agent_id) {
+        const { data: agent } = await supabase
+            .from("agents")
+            .select("owner_user_id")
+            .eq("id", target_agent_id)
+            .maybeSingle();
+        if (agent?.owner_user_id === caller_user_id) {
+            return null; // allowed — caller owns this agent
+        }
+    }
+    // Check task ownership (task belongs to caller's user or agent)
+    if (target_task_id) {
+        const { data: task } = await supabase
+            .from("tasks")
+            .select("user_id, agent_id")
+            .eq("id", target_task_id)
+            .maybeSingle();
+        if (!task) {
+            return toMcpResponse(fail("未找到任务"));
+        }
+        // Task belongs to caller directly
+        if (task.user_id === caller_user_id) {
+            return null; // allowed
+        }
+        // Task belongs to caller's agent
+        if (task.agent_id) {
+            const { data: agent } = await supabase
+                .from("agents")
+                .select("owner_user_id")
+                .eq("id", task.agent_id)
+                .maybeSingle();
+            if (agent?.owner_user_id === caller_user_id) {
+                return null; // allowed
+            }
+        }
+    }
+    // If only user_id was provided and it didn't match, deny
+    if (target_user_id && target_user_id !== caller_user_id) {
+        return toMcpResponse(fail("拒绝访问：您只能查看自己的数据", "请传入您自己的 user_id 作为 caller_user_id 以证明所有权。"));
+    }
+    // If only agent_id was provided and ownership check failed
+    if (target_agent_id) {
+        return toMcpResponse(fail("拒绝访问：您不是此智能体的所有者", "请传入您自己的 user_id 作为 caller_user_id。只有智能体的所有者才能查看其数据。"));
+    }
+    // Task not owned by caller
+    if (target_task_id) {
+        return toMcpResponse(fail("拒绝访问：此任务不属于您", "您只能查看属于您或您的智能体的任务。"));
+    }
+    return toMcpResponse(fail("拒绝访问"));
+}
+//# sourceMappingURL=ownership.js.map

package/dist/services/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/services/ownership.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iEAAiE;AACjE,+DAA+D;AAC/D,gEAAgE;AAChE,2DAA2D;AAC3D,wCAAwC;AACxC,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAKrC;IACC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAEnF,oBAAoB;IACpB,IAAI,cAAc,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,wBAAwB;IACxB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;aACnC,IAAI,CAAC,QAAQ,CAAC;aACd,MAAM,CAAC,eAAe,CAAC;aACvB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;aACzB,WAAW,EAAE,CAAC;QAEjB,IAAI,KAAK,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClD,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ;aAClC,IAAI,CAAC,OAAO,CAAC;aACb,MAAM,CAAC,mBAAmB,CAAC;aAC3B,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC;aACxB,WAAW,EAAE,CAAC;QAEjB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,CAAC,UAAU;QACzB,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBACnC,IAAI,CAAC,QAAQ,CAAC;iBACd,MAAM,CAAC,eAAe,CAAC;iBACvB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;iBACvB,WAAW,EAAE,CAAC;YAEjB,IAAI,KAAK,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,CAAC,UAAU;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC,IAAI,CACvB,iBAAiB,EACjB,2CAA2C,CAC5C,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC,IAAI,CACvB,kBAAkB,EAClB,qDAAqD,CACtD,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC,IAAI,CACvB,cAAc,EACd,oBAAoB,CACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/services/quality-gate.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Award XP via SECURITY DEFINER RPC (shared helper).
+ * Used by skills, quests, and any code that needs to award non-task XP.
+ */
+export declare function awardXpViaRpc(entityType: string, entityId: string, xpAmount: number, sourceType: string, description: string, sourceId?: string): Promise<{
+    success: boolean;
+    running_total?: number;
+}>;
+/**
+ * Award class XP via SECURITY DEFINER RPC (shared helper).
+ * Updates user_class_progress and records in xp_ledger with class xp_type.
+ */
+export declare function awardClassXpViaRpc(userId: string, className: string, xpAmount: number, sourceType: string, description: string, sourceId?: string): Promise<{
+    success: boolean;
+    new_class_xp?: number;
+}>;
+/**
+ * Compute a system template quality score for a task (1-5 scale).
+ * Same logic as levelup_request_system_evaluation but runs inline.
+ *
+ * Timeliness is now tier-aware: tasks completed much faster than the
+ * expected pace for their tier score lower on timeliness (2-3/5),
+ * while tasks at or above the expected pace score 4-5/5.
+ */
+export declare function computeSystemScore(task: {
+    completion_pct: number;
+    output_type: string | null;
+    difficulty: number;
+    duration_seconds: number | null;
+    xp_tier?: string | null;
+}): {
+    score: number;
+    breakdown: Record<string, number>;
+};
+/**
+ * Get the integrity multiplier for an agent (0.1 to 1.0).
+ * Users always get multiplier 1.0.
+ */
+export declare function getIntegrityMultiplier(entityType: string, entityId: string): Promise<number>;
+/**
+ * Apply quality and integrity multipliers to an XP pool.
+ * Returns the adjusted XP amount (never less than 1 if original > 0).
+ */
+export declare function applyQualityMultiplier(xpPool: number, qualityScore: number, integrityMultiplier: number): number;
+//# sourceMappingURL=quality-gate.d.ts.map

package/dist/services/quality-gate.js

@@ -0,0 +1,131 @@
+// ============================================================
+// services/quality-gate.ts — Quality-gated XP & shared XP helpers
+// ============================================================
+// Auto-scores a completed task using template-based evaluation,
+// then applies quality and integrity multipliers to XP.
+// Also exports awardXpViaRpc for shared use across tool files.
+// ============================================================
+import { supabase } from "./supabase.js";
+/**
+ * Award XP via SECURITY DEFINER RPC (shared helper).
+ * Used by skills, quests, and any code that needs to award non-task XP.
+ */
+export async function awardXpViaRpc(entityType, entityId, xpAmount, sourceType, description, sourceId) {
+    const { data, error } = await supabase.rpc('award_xp_direct', {
+        p_entity_type: entityType,
+        p_entity_id: entityId,
+        p_amount: xpAmount,
+        p_source_type: sourceType,
+        p_description: description,
+        p_source_id: sourceId || null,
+    });
+    if (error) {
+        console.error("award_xp_direct RPC error:", error);
+        return { success: false };
+    }
+    return { success: data?.success ?? false, running_total: data?.running_total };
+}
+/**
+ * Award class XP via SECURITY DEFINER RPC (shared helper).
+ * Updates user_class_progress and records in xp_ledger with class xp_type.
+ */
+export async function awardClassXpViaRpc(userId, className, xpAmount, sourceType, description, sourceId) {
+    const { data, error } = await supabase.rpc('award_class_xp', {
+        p_user_id: userId,
+        p_class_name: className,
+        p_amount: xpAmount,
+        p_source_type: sourceType,
+        p_description: description,
+        p_source_id: sourceId || null,
+    });
+    if (error) {
+        console.error("award_class_xp RPC error:", error);
+        return { success: false };
+    }
+    return { success: data?.success ?? false, new_class_xp: data?.new_class_xp };
+}
+// "Good pace" thresholds per tier (seconds). Tasks completed faster than
+// the hard floor pass, but completing well under the expected pace lowers
+// the timeliness score in the quality gate — rewarding thoroughness without
+// hard-blocking fast agents.
+const EXPECTED_PACE_SECONDS = {
+    micro: 30, // 30s expected
+    light: 120, // 2 min expected
+    standard: 300, // 5 min expected
+    complex: 600, // 10 min expected
+    major: 1800, // 30 min expected
+};
+/**
+ * Compute a system template quality score for a task (1-5 scale).
+ * Same logic as levelup_request_system_evaluation but runs inline.
+ *
+ * Timeliness is now tier-aware: tasks completed much faster than the
+ * expected pace for their tier score lower on timeliness (2-3/5),
+ * while tasks at or above the expected pace score 4-5/5.
+ */
+export function computeSystemScore(task) {
+    const completionScore = task.completion_pct >= 100 ? 5
+        : task.completion_pct >= 75 ? 4
+            : task.completion_pct >= 50 ? 3 : 2;
+    const hasOutput = task.output_type === "deliverable" || task.output_type === "deployed";
+    const outputScore = hasOutput ? 4 : 3;
+    const difficultyScore = task.difficulty >= 3 ? 4 : 3;
+    // Tier-aware timeliness: compare actual duration against expected pace
+    const tier = task.xp_tier || "standard";
+    const expectedPace = EXPECTED_PACE_SECONDS[tier] || 300;
+    const durationSeconds = task.duration_seconds || 0;
+    const paceRatio = durationSeconds / Math.max(1, expectedPace); // 1.0 = on pace
+    let timelinessScore;
+    if (paceRatio >= 1.0) {
+        // At or above expected pace — good
+        timelinessScore = paceRatio < 3.0 ? 5 : 4; // very slow = still OK but 4
+    }
+    else if (paceRatio >= 0.5) {
+        // 50-99% of expected pace — slightly fast, decent score
+        timelinessScore = 4;
+    }
+    else if (paceRatio >= 0.3) {
+        // 30-49% of expected pace — suspiciously fast
+        timelinessScore = 3;
+    }
+    else {
+        // Under 30% of expected pace — rushing
+        timelinessScore = 2;
+    }
+    const breakdown = {
+        completeness: completionScore,
+        output_quality: outputScore,
+        difficulty_appropriate: difficultyScore,
+        timeliness: timelinessScore,
+    };
+    const scores = Object.values(breakdown);
+    const score = scores.reduce((s, n) => s + n, 0) / scores.length;
+    return { score, breakdown };
+}
+/**
+ * Get the integrity multiplier for an agent (0.1 to 1.0).
+ * Users always get multiplier 1.0.
+ */
+export async function getIntegrityMultiplier(entityType, entityId) {
+    if (entityType === "user")
+        return 1.0;
+    const { data: agent } = await supabase
+        .from("agents")
+        .select("integrity_score")
+        .eq("id", entityId)
+        .maybeSingle();
+    const integrity = agent?.integrity_score ?? 100;
+    return Math.max(0.1, Math.min(1.0, integrity / 100));
+}
+/**
+ * Apply quality and integrity multipliers to an XP pool.
+ * Returns the adjusted XP amount (never less than 1 if original > 0).
+ */
+export function applyQualityMultiplier(xpPool, qualityScore, integrityMultiplier) {
+    if (xpPool <= 0)
+        return 0;
+    const qualityMultiplier = qualityScore / 5.0;
+    const adjusted = Math.round(xpPool * qualityMultiplier * integrityMultiplier);
+    return Math.max(1, adjusted); // at least 1 XP if pool was > 0
+}
+//# sourceMappingURL=quality-gate.js.map

package/dist/services/quality-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-gate.js","sourceRoot":"","sources":["../../src/services/quality-gate.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,kEAAkE;AAClE,+DAA+D;AAC/D,gEAAgE;AAChE,wDAAwD;AACxD,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB,EAClB,WAAmB,EACnB,QAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE;QAC5D,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,UAAU;QACzB,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,QAAQ,IAAI,IAAI;KAC9B,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,UAAkB,EAClB,WAAmB,EACnB,QAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE;QAC3D,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,UAAU;QACzB,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,QAAQ,IAAI,IAAI;KAC9B,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC/E,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,6BAA6B;AAC7B,MAAM,qBAAqB,GAA2B;IACpD,KAAK,EAAE,EAAE,EAAQ,eAAe;IAChC,KAAK,EAAE,GAAG,EAAO,iBAAiB;IAClC,QAAQ,EAAE,GAAG,EAAI,iBAAiB;IAClC,OAAO,EAAE,GAAG,EAAK,kBAAkB;IACnC,KAAK,EAAE,IAAI,EAAM,kBAAkB;CACpC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAMlC;IACC,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC;IACxF,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC;IACxC,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB;IAE/E,IAAI,eAAuB,CAAC;IAC5B,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,mCAAmC;QACnC,eAAe,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;IAC1E,CAAC;SAAM,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QAC5B,wDAAwD;QACxD,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QAC5B,8CAA8C;QAC9C,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,uCAAuC;QACvC,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,eAAe;QAC7B,cAAc,EAAE,WAAW;QAC3B,sBAAsB,EAAE,eAAe;QACvC,UAAU,EAAE,eAAe;KAC5B,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAEhE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,QAAgB;IAEhB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAEtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;SACnC,IAAI,CAAC,QAAQ,CAAC;SACd,MAAM,CAAC,iBAAiB,CAAC;SACzB,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;SAClB,WAAW,EAAE,CAAC;IAEjB,MAAM,SAAS,GAAG,KAAK,EAAE,eAAe,IAAI,GAAG,CAAC;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,YAAoB,EACpB,mBAA2B;IAE3B,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,iBAAiB,GAAG,YAAY,GAAG,GAAG,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,iBAAiB,GAAG,mBAAmB,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,gCAAgC;AAChE,CAAC"}

package/dist/services/rate-limit.d.ts

@@ -0,0 +1,12 @@
+import { toMcpResponse } from "./register.js";
+/**
+ * Check if an action is within the rate limit.
+ *
+ * @param entityId - The user or agent ID performing the action
+ * @param action   - Action name (e.g. "start_task", "complete_task")
+ * @param maxCalls - Max calls allowed in the window
+ * @param windowMs - Time window in milliseconds
+ * @returns null if allowed, or an MCP error response if rate-limited
+ */
+export declare function checkRateLimit(entityId: string, action: string, maxCalls: number, windowMs: number): ReturnType<typeof toMcpResponse> | null;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/services/rate-limit.js

@@ -0,0 +1,49 @@
+// ============================================================
+// services/rate-limit.ts — In-memory rate limiting
+// ============================================================
+// Simple sliding-window rate limiter to prevent abuse of
+// XP-generating tools (start_task, complete_task, etc.).
+//
+// This is an in-memory solution — limits reset on server restart.
+// For production at scale, replace with Redis-based limiter.
+// ============================================================
+import { fail } from "./errors.js";
+import { toMcpResponse } from "./register.js";
+const buckets = new Map();
+// Clean up stale entries every 10 minutes
+setInterval(() => {
+    const cutoff = Date.now() - 3600_000; // 1 hour
+    for (const [key, entry] of buckets) {
+        entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+        if (entry.timestamps.length === 0)
+            buckets.delete(key);
+    }
+}, 600_000);
+/**
+ * Check if an action is within the rate limit.
+ *
+ * @param entityId - The user or agent ID performing the action
+ * @param action   - Action name (e.g. "start_task", "complete_task")
+ * @param maxCalls - Max calls allowed in the window
+ * @param windowMs - Time window in milliseconds
+ * @returns null if allowed, or an MCP error response if rate-limited
+ */
+export function checkRateLimit(entityId, action, maxCalls, windowMs) {
+    const key = `${action}:${entityId}`;
+    const now = Date.now();
+    const cutoff = now - windowMs;
+    let entry = buckets.get(key);
+    if (!entry) {
+        entry = { timestamps: [] };
+        buckets.set(key, entry);
+    }
+    // Remove timestamps outside the window
+    entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+    if (entry.timestamps.length >= maxCalls) {
+        const windowMinutes = Math.round(windowMs / 60_000);
+        return toMcpResponse(fail(`超出速率限制：每${windowMinutes}分钟最多${maxCalls}次${action}调用`, "请等待后重试。此限制用于防止滥用。"));
+    }
+    entry.timestamps.push(now);
+    return null;
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/services/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/services/rate-limit.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,mDAAmD;AACnD,+DAA+D;AAC/D,yDAAyD;AACzD,yDAAyD;AACzD,EAAE;AACF,kEAAkE;AAClE,6DAA6D;AAC7D,+DAA+D;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAM9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;AAElD,0CAA0C;AAC1C,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,SAAS;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,EAAE,OAAO,CAAC,CAAC;AAEZ;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;IAE9B,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAE9D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;QACpD,OAAO,aAAa,CAClB,IAAI,CACF,WAAW,aAAa,OAAO,QAAQ,IAAI,MAAM,IAAI,EACrD,mBAAmB,CACpB,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/register.d.ts

@@ -0,0 +1,49 @@
+import type { ToolResult } from "../types.js";
+/**
+ * MCP tool annotations — metadata about what a tool does.
+ * These help LLMs decide which tools to call (and which to avoid).
+ *
+ * readOnlyHint:    true = this tool only reads data, never changes anything
+ * destructiveHint: true = this tool deletes or irreversibly modifies data
+ * idempotentHint:  true = calling it twice with same params gives same result
+ * openWorldHint:   true = the tool talks to external systems (not just our DB)
+ */
+export interface ToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+/**
+ * Standard annotations for read-only tools (get_*, list_*).
+ * Most of our tools are reads, so this is the most common set.
+ */
+export declare const READ_ONLY: ToolAnnotations;
+/** For tools that create new records (register_*, start_*, create_*) */
+export declare const CREATES: ToolAnnotations;
+/** For tools that update existing records (update_*, complete_*) */
+export declare const UPDATES: ToolAnnotations;
+/** For tools that delete or irreversibly change data (merge_*, fail with cancel) */
+export declare const DESTRUCTIVE: ToolAnnotations;
+/**
+ * Convert a ToolResult into the MCP response format.
+ *
+ * The MCP protocol expects responses in a specific shape:
+ *   { content: [{ type: "text", text: "..." }] }
+ *
+ * If our tool returned an error (success: false), we also set
+ * isError: true so the MCP client knows something went wrong.
+ */
+export declare function toMcpResponse(result: ToolResult): {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+/**
+ * Helper to log tool registration at startup.
+ * This helps with debugging — you can see exactly which tools loaded.
+ */
+export declare function logRegistered(toolName: string): void;
+//# sourceMappingURL=register.d.ts.map

package/dist/services/register.js

@@ -0,0 +1,63 @@
+// ============================================================
+// services/register.ts — Tool registration helper
+// ============================================================
+// This file provides a convenience wrapper around the MCP SDK's
+// registerTool method. It standardizes how we register tools
+// and ensures every tool follows the same patterns.
+// ============================================================
+import { formatToolResponse } from "./format.js";
+/**
+ * Standard annotations for read-only tools (get_*, list_*).
+ * Most of our tools are reads, so this is the most common set.
+ */
+export const READ_ONLY = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+};
+/** For tools that create new records (register_*, start_*, create_*) */
+export const CREATES = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+/** For tools that update existing records (update_*, complete_*) */
+export const UPDATES = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+};
+/** For tools that delete or irreversibly change data (merge_*, fail with cancel) */
+export const DESTRUCTIVE = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false,
+};
+/**
+ * Convert a ToolResult into the MCP response format.
+ *
+ * The MCP protocol expects responses in a specific shape:
+ *   { content: [{ type: "text", text: "..." }] }
+ *
+ * If our tool returned an error (success: false), we also set
+ * isError: true so the MCP client knows something went wrong.
+ */
+export function toMcpResponse(result) {
+    const text = formatToolResponse(result);
+    return {
+        content: [{ type: "text", text }],
+        ...(result.success === false ? { isError: true } : {}),
+    };
+}
+/**
+ * Helper to log tool registration at startup.
+ * This helps with debugging — you can see exactly which tools loaded.
+ */
+export function logRegistered(toolName) {
+    console.error(`  ✓ Registered: ${toolName}`);
+}
+//# sourceMappingURL=register.js.map

package/dist/services/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/services/register.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,kDAAkD;AAClD,+DAA+D;AAC/D,gEAAgE;AAChE,6DAA6D;AAC7D,oDAAoD;AACpD,+DAA+D;AAG/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,KAAK;CACrB,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,OAAO,GAAoB;IACtC,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,OAAO,GAAoB;IACtC,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,KAAK;CACrB,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAI9C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/services/supabase.d.ts

@@ -0,0 +1,10 @@
+import { SupabaseClient } from "@supabase/supabase-js";
+/**
+ * Validate that required environment variables are set and
+ * initialize the Supabase client. Call this at server startup —
+ * if either variable is missing, we crash immediately with a
+ * helpful error message rather than failing mysteriously later.
+ */
+export declare function validateEnv(): void;
+export declare const supabase: SupabaseClient<any, "public", "public", any, any>;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/services/supabase.js

@@ -0,0 +1,79 @@
+// ============================================================
+// services/supabase.ts — Database client setup
+// ============================================================
+// This file creates the Supabase client that ALL tools use to
+// talk to your Postgres database. Think of it as the "phone
+// line" between your MCP server and Supabase.
+//
+// HOW IT WORKS:
+// - Zero-config: Falls back to the public anon key (RLS-protected)
+// - Optional: Set env vars to use your own project or service_role key
+//
+// KEY TYPES:
+//   anon key (default): Safe to expose. Respects Row Level Security.
+//     All operations go through RLS policies on the database.
+//   service_role key (optional): Bypasses RLS. Only set this if you
+//     need admin access or are running a private instance.
+// ============================================================
+import { createClient } from "@supabase/supabase-js";
+// Default public project credentials (anon key — safe to expose, RLS-protected)
+const DEFAULT_SUPABASE_URL = "https://pxanrmpwptinbtwigqdt.supabase.co";
+const DEFAULT_SUPABASE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InB4YW5ybXB3cHRpbmJ0d2lncWR0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMzMzE0MTUsImV4cCI6MjA4ODkwNzQxNX0.UES9REdFSED5Sl7VT_2tN_96rEgiFFZiXWR5-jflJL0";
+const supabaseUrl = process.env.SUPABASE_URL || DEFAULT_SUPABASE_URL;
+const supabaseKey = process.env.SUPABASE_SERVICE_KEY || DEFAULT_SUPABASE_KEY;
+/**
+ * Validate that required environment variables are set and
+ * initialize the Supabase client. Call this at server startup —
+ * if either variable is missing, we crash immediately with a
+ * helpful error message rather than failing mysteriously later.
+ */
+export function validateEnv() {
+    const usingDefaults = !process.env.SUPABASE_URL && !process.env.SUPABASE_SERVICE_KEY;
+    if (usingDefaults) {
+        console.error("  ℹ️  Using default public project (anon key, RLS-protected)");
+    }
+    else {
+        // If user set one but not both, warn
+        if (!process.env.SUPABASE_URL || !process.env.SUPABASE_SERVICE_KEY) {
+            console.error(`\n⚠️  Partial config: set BOTH SUPABASE_URL and SUPABASE_SERVICE_KEY, or neither (for defaults).\n` +
+                `  Falling back to defaults for missing values.\n`);
+        }
+    }
+    _supabase = createClient(supabaseUrl, supabaseKey, {
+        auth: {
+            autoRefreshToken: false,
+            persistSession: false,
+        },
+    });
+}
+/**
+ * The Supabase client instance.
+ *
+ * Usage in tool files:
+ *   import { supabase } from "../services/supabase.js";
+ *
+ *   const { data, error } = await supabase
+ *     .from("users")
+ *     .select("*")
+ *     .eq("id", userId);
+ *
+ * Common patterns:
+ *   .select("*")           → get all columns
+ *   .select("id, name")    → get specific columns
+ *   .eq("id", value)       → WHERE id = value
+ *   .ilike("name", "%pat") → case-insensitive LIKE
+ *   .order("created_at", { ascending: false }) → ORDER BY
+ *   .range(0, 19)          → LIMIT 20, OFFSET 0
+ *   .single()              → expect exactly one row
+ *   .maybeSingle()         → expect 0 or 1 rows
+ */
+let _supabase;
+export const supabase = new Proxy({}, {
+    get(_target, prop, receiver) {
+        if (!_supabase) {
+            throw new Error("Supabase client not initialized. Call validateEnv() first.");
+        }
+        return Reflect.get(_supabase, prop, receiver);
+    },
+});
+//# sourceMappingURL=supabase.js.map

package/dist/services/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/services/supabase.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+CAA+C;AAC/C,+DAA+D;AAC/D,8DAA8D;AAC9D,4DAA4D;AAC5D,8CAA8C;AAC9C,EAAE;AACF,gBAAgB;AAChB,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,aAAa;AACb,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AACpE,2DAA2D;AAC3D,+DAA+D;AAE/D,OAAO,EAAE,YAAY,EAAkB,MAAM,uBAAuB,CAAC;AAErE,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,oBAAoB,GAAG,kNAAkN,CAAC;AAEhP,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,oBAAoB,CAAC;AACrE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,oBAAoB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAErF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,CACX,oGAAoG;gBACpG,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE;QACjD,IAAI,EAAE;YACJ,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;SACtB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,IAAI,SAAyB,CAAC;AAE9B,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,EAAoB,EAAE;IACtD,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ;QACzB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/achievements.d.ts

@@ -0,0 +1,6 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ActionHandler } from "../services/dispatcher.js";
+export declare const getAchievementsHandler: ActionHandler;
+export declare const scanAchievementsHandler: ActionHandler;
+export declare function registerAchievementTools(server: McpServer): void;
+//# sourceMappingURL=achievements.d.ts.map