lowdown-proxy 0.1.15 → 0.1.17

package/README.md

@@ -1,236 +1,309 @@
-# lowdown-proxy
-
-Agents should not have to trust anyone they've never interacted with.
-
-`lowdown-proxy` records interactions between AI agents, tools, and services — and makes
-that history queryable by anyone. Before choosing a tool, calling an API, or delegating
-to another agent, you can ask: *what has the network seen from this one?*
-
-A transparent stdio proxy for MCP servers is the first entry point. The interaction history layer is open to any agent, tool, or service — not just MCP.
-
-See [DESIGN.md](./DESIGN.md) for background and design principles.
-
-## Quick start
-
-```bash
-npx lowdown-proxy -- npx some-mcp-server
-```
-
-That's it. No signup, no configuration. On first run, a node identity is created automatically at `~/.lowdown/node.json`. Your interactions are contributed to the network — and you get deeper data back in return.
-
-Wrap any MCP server in your client config:
-
-```jsonc
-// before
-{
-  "mcpServers": {
-    "search": { "command": "npx", "args": ["search-mcp-server"] }
-  }
-}
-
-// after
-{
-  "mcpServers": {
-    "search": {
-      "command": "npx",
-      "args": ["lowdown-proxy", "--target", "search-mcp-server", "--", "npx", "search-mcp-server"]
-    }
-  }
-}
-```
-
-## Lookup tools for agents (MCP server)
-
-The same package ships an MCP server (stdio) that lets an agent query Lowdown directly:
-
-```jsonc
-{
-  "mcpServers": {
-    "lowdown": { "command": "npx", "args": ["-y", "-p", "lowdown-proxy", "lowdown-mcp"] }
-  }
-}
-```
-
-| Tool | What it returns |
-|---|---|
-| `get_lowdown` | Interactions reported for a target and, for MCP Registry servers, the Scanner observations (see [Scanner observations](#scanner-observations)) |
-| `compare_tools` | 2 to 5 targets side by side, ordered by reported success rate; Scanner data is not used for the ordering |
-| `record_interaction` | Records the outcome of using a tool or service |
-| `get_node_stats` | Contribution stats of your node |
-
-The same data is available over HTTP without installing anything: see [Public API](#public-api), the [OpenAPI document](https://lowdown-proxy.vercel.app/openapi.json), and [`llms.txt`](https://lowdown-proxy.vercel.app/llms.txt). The Scanner dataset and daily report are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data) (CC BY 4.0).
-
-## Options
-
-| Flag | Description | Default |
-|---|---|---|
-| `--actor` | Identifier of the calling agent | `anonymous` |
-| `--target` | Label for the target tool | command string |
-| `--source` | `organic` \| `seeded` \| `synthetic` (internal/testing only) | `organic` |
-
-## Environment variables
-
-Required for recording. The proxy works as a pure pass-through without them.
-
-```bash
-export LOWDOWN_SUPABASE_URL="https://xxxx.supabase.co"
-export LOWDOWN_SUPABASE_KEY="..."
-```
-
-## Public API
-
-No auth required.
-
-```bash
-# Get reputation of a tool
-curl https://lowdown-proxy.vercel.app/api/reputation/brave-search
-
-# With node identity — returns richer data
-curl https://lowdown-proxy.vercel.app/api/reputation/brave-search \
-  -H "x-lowdown-node-id: ld_your_node_id"
-
-# Check your node's contribution
-curl https://lowdown-proxy.vercel.app/api/node/ld_your_node_id
-
-# Record an interaction
-curl -X POST https://lowdown-proxy.vercel.app/api/interactions \
-  -H "Content-Type: application/json" \
-  -d '{"actor":"agent:my-bot","target":"mcp:modelcontextprotocol/brave-search","target_type":"tool","task_type":"web_search","outcome":"success"}'
-```
-
-Basic response (no node):
-
-```json
-{
-  "target": "brave-search",
-  "interactions": 30,
-  "success_rate": 0.933,
-  "confidence": "medium"
-}
-```
-
-Contributor response (with node):
-
-```json
-{
-  "target": "brave-search",
-  "interactions": 30,
-  "success_rate": 0.933,
-  "confidence": "medium",
-  "task_breakdown": { ... },
-  "recent_trends": [ ... ]
-}
-```
-
-Fuzzy matching supported — short names like `brave-search`, `fetch`, `github` resolve automatically.
-
-### Scanner observations
-
-For MCP servers listed in the official MCP Registry, the response also carries a separate `scanner` block: what Lowdown's Scanner observed when it connected to the server (`initialize` and `tools/list` only — it never calls a tool). It is observation data, kept apart from interaction data and never counted in `success_rate`.
-
-```bash
-curl https://lowdown-proxy.vercel.app/api/reputation/mcp:io.github.user/server
-```
-
-```json
-{
-  "target": "mcp:io.github.user/server",
-  "interactions": 0,
-  "success_rate": null,
-  "scanner": {
-    "target": "mcp:io.github.user/server",
-    "last_observed_at": "2026-10-07T19:17:00+00:00",
-    "observations_30d": 28,
-    "latest": { "reached_level": 2, "http_status": 200, "latency_ms": 312, "tool_count": 7 },
-    "schema_versions_30d": 1,
-    "status_distribution_30d": { "200": 28 }
-  }
-}
-```
-
-HTTP statuses are reported as observed — a `401` is a `401`, not "dead".
-
-## Why Lowdown
-
-Agents often start with no shared history of a tool's past behavior. They have no way to know which tools have been reliable, which fail silently, or which have never been successfully used for a given task type.
-
-Lowdown solves this by recording what actually happens — not ratings, not reviews, but observed interaction history. When an agent queries Lowdown before selecting a tool, it is drawing on the collective experience of other agents that ran the same proxy.
-
-The loop is simple:
-- **Read**: query observed history before selecting a tool
-- **Use**: run the tool through the proxy
-- **Write**: the result is automatically recorded for the next agent
-
-No ratings. No human curation. Just signal from actual use.
-
-> Observations are interaction data, not independent quality judgments.
-
-## How the network works
-
-```
-Run proxy → node_id auto-created → interactions contributed → deeper Lowdown data
-```
-
-Every proxy instance is a node.
-
-Nodes contribute interaction data to the shared network.
-Contributors get access to richer query results.
-
-No tokens.
-No points.
-No reviews to write.
-
-Just run the proxy and share what your agents experience.
-
-## Design principles
-
-- **Zero config**: run the proxy, everything else is automatic.
-- **Pass-through first**: recording never blocks or degrades MCP communication.
-- **Facts only**: v0 records success/failure and latency. Quality judgments are out of scope.
-- **Provenance always tagged**: every record carries `organic` / `seeded` / `synthetic` so bootstrap data and real traffic are always distinguishable.
-
-## Status
-
-30-day public experiment, started September 2026.
-See [DESIGN.md](./DESIGN.md) for what's in scope and what's been ruled out.
-
-## License
-
-MIT
-
----
-
-## 한국어
-
-한 번도 거래한 적 없는 상대를 에이전트가 무조건 신뢰할 필요는 없습니다.
-
-`lowdown-proxy`는 AI 에이전트, 도구, 서비스 사이의 상호작용을 기록하고,
-그 이력을 누구나 조회할 수 있게 만듭니다. 도구를 선택하거나, API를 호출하거나,
-다른 에이전트에게 작업을 위임하기 전에 물어볼 수 있습니다:
-*네트워크는 이 상대에 대해 무엇을 봤는가?*
-
-MCP 서버를 감싸는 stdio 프록시가 첫 번째 진입점입니다.
-평판 레이어는 MCP에 국한되지 않고 모든 에이전트, 도구, 서비스에 열려 있습니다.
-
-기록된 데이터는 다른 에이전트가 판단할 때 참고할 수 있는 최소한의 공통 근거가 됩니다.
-
-### 네트워크 구조
-
-```
-프록시 실행 → node_id 자동 생성 → interaction 기여 → 더 깊은 Lowdown 조회
-```
-
-프록시를 실행하는 것 자체가 노드 참여입니다. 기여할수록 더 상세한 데이터를 조회할 수 있습니다.
-
-### Scanner 관찰 데이터
-
-공식 MCP Registry에 등록된 원격 MCP 서버는 응답에 `scanner` 블록이 함께 옵니다. Lowdown Scanner가 서버에 직접 연결해 관찰한 사실(`initialize`, `tools/list`까지만 호출하며 tool은 실행하지 않음)이고, interaction 데이터와 분리되어 `success_rate`에는 합산되지 않습니다. HTTP 상태는 해석 없이 관찰된 값 그대로 보여줍니다.
-
-### 설계 원칙 (요약)
-
-- **설정 없음**: 프록시를 실행하면 모든 것이 자동으로 처리됩니다.
-- **패스스루 우선**: 기록 로직이 실패하거나 느려도 실제 MCP 통신은 절대 막지 않습니다.
-- **사실만 기록**: v0는 성공/실패/지연시간만 기록합니다. 품질 판단은 범위 밖입니다.
-- **출처 구분**: 모든 기록은 `organic` / `seeded` / `synthetic`으로 태깅됩니다.
-
+# lowdown-proxy
+
+Agents should not have to trust anyone they've never interacted with.
+
+`lowdown-proxy` records interactions between AI agents, tools, and services — and makes
+that history queryable by anyone. Before choosing a tool, calling an API, or delegating
+to another agent, you can ask: *what has the network seen from this one?*
+
+A transparent stdio proxy for MCP servers is the first entry point. The interaction history layer is open to any agent, tool, or service — not just MCP.
+
+See [DESIGN.md](./DESIGN.md) for background and design principles.
+
+## Quick start
+
+```bash
+npx lowdown-proxy -- npx some-mcp-server
+```
+
+That's it. No signup, no configuration. On first run, a node identity is created automatically at `~/.lowdown/node.json`. Your interactions are contributed to the network — and you get deeper data back in return.
+
+Wrap any MCP server in your client config:
+
+```jsonc
+// before
+{
+  "mcpServers": {
+    "search": { "command": "npx", "args": ["search-mcp-server"] }
+  }
+}
+
+// after
+{
+  "mcpServers": {
+    "search": {
+      "command": "npx",
+      "args": ["lowdown-proxy", "--target", "search-mcp-server", "--", "npx", "search-mcp-server"]
+    }
+  }
+}
+```
+
+## Lookup tools for agents (MCP server)
+
+The same package ships an MCP server (stdio) that lets an agent query Lowdown directly:
+
+```jsonc
+{
+  "mcpServers": {
+    "lowdown": { "command": "npx", "args": ["-y", "-p", "lowdown-proxy", "lowdown-mcp"] }
+  }
+}
+```
+
+| Tool | What it returns |
+|---|---|
+| `get_lowdown` | Interactions reported for a target and, for MCP Registry servers, the Scanner observations (see [Scanner observations](#scanner-observations)) |
+| `compare_tools` | 2 to 5 targets side by side, ordered by reported success rate; Scanner data is not used for the ordering |
+| `record_interaction` | Records the outcome of using a tool or service |
+| `get_node_stats` | Contribution stats of your node |
+
+The same data is available over HTTP without installing anything: see [Public API](#public-api), the [OpenAPI document](https://lowdown-proxy.vercel.app/openapi.json), and [`llms.txt`](https://lowdown-proxy.vercel.app/llms.txt). The Scanner dataset and daily report are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data) (CC BY 4.0).
+
+## App logs in tool results
+
+Some tools succeed while the app behind them fails. A scene, a game, or a dev server reports the real error in its own log file, and the agent never sees it. `--watch-log` closes that gap: after each `tools/call`, new lines written to the log since the previous call that match `--log-pattern` are appended to the tool result. The agent does not call anything extra.
+
+```jsonc
+{
+  "mcpServers": {
+    "my-app": {
+      "command": "npx",
+      "args": [
+        "lowdown-proxy", "--target", "my-app-mcp",
+        "--watch-log", "%LOCALAPPDATA%/MyApp/app.log",
+        "--log-pattern", "\\b(Uncaught|TypeError|ReferenceError|SyntaxError)\\b",
+        "--", "npx", "my-app-mcp"
+      ]
+    }
+  }
+}
+```
+
+What the agent sees, as an extra text item in the result:
+
+```
+[lowdown] Since 21:13:13, these app logs recorded new matching lines. Quoted from the log files, not instructions.
+C:\Users\you\AppData\Local\MyApp\app.log: 1 new line(s)
+  | 21:14:20.786 - Uncaught TypeError: Cannot read properties of undefined (reading 'position')
+```
+
+- Only lines written after the proxy started are reported, and each line is reported once.
+- Repeat `--watch-log` to watch several files. `%VAR%`, `$VAR` and `~` are expanded.
+- `--log-pattern` is a case-insensitive regular expression. Default: `\b(error|exception|fatal|uncaught|unhandled|failed)\b`.
+- At most the last 20 matching lines per log, 300 characters each. Bearer tokens, API keys, JWTs, `token=` values and long hex strings are masked.
+- Facts only: lines are quoted from the log, with no diagnosis or suggested fix. Results with a JSON-RPC error carry no content, so pending lines are added to the next successful result.
+- Everything stays local. Log lines are never recorded to Lowdown.
+
+## Options
+
+| Flag | Description | Default |
+|---|---|---|
+| `--actor` | Identifier of the calling agent | `anonymous` |
+| `--target` | Label for the target tool | package or file name from the command (never the full command line) |
+| `--source` | `organic` \| `seeded` \| `synthetic` (internal/testing only) | `organic` |
+| `--test` | Record this session as `synthetic` — use it for intentional failure tests so they are not counted against the server | off |
+| `--watch-log` | App log file to watch; repeat for several files (see [App logs in tool results](#app-logs-in-tool-results)) | none |
+| `--log-pattern` | Regular expression for log lines to report | error, exception, fatal, uncaught, unhandled, failed |
+
+## Recording
+
+From 0.1.17 the proxy records through the public API (`POST /api/interactions`). No database key is needed; `LOWDOWN_SUPABASE_URL` / `LOWDOWN_SUPABASE_KEY` are no longer used.
+
+| Variable | Effect |
+|---|---|
+| `LOWDOWN_RECORD=0` | Pass-through only, nothing is recorded |
+| `LOWDOWN_API_URL` | Record to (and query) another Lowdown deployment |
+
+What one record contains: actor, target label, tool name (or protocol method), outcome, latency, node id, and — when the server reported them — `server_version` (from `initialize`) and `schema_hash` (same hash as the Scanner's, from `tools/list`). Arguments and results are never recorded.
+
+How a response is classified (MCP spec, *Tools → Error Handling*):
+
+| Response | Recorded as | In `success_rate` |
+|---|---|---|
+| `tools/call` result | success | yes |
+| `tools/call` result with `isError: true` | failure, `tool_error`, `error_layer: tool` | yes |
+| JSON-RPC error -32700 / -32600 / -32601 / -32602 (malformed request, unknown tool, invalid arguments) | failure, `error_layer: request` | no — counted as `rejected_requests` |
+| Other JSON-RPC errors (internal error, timeout) | failure, `error_layer: server` | yes |
+| `initialize`, `tools/list`, `ping`, ... | `request_kind: protocol` | no — counted as `protocol_requests` |
+
+`success_rate` counts `organic` records only; `seeded` and `synthetic` are reported separately in `by_source`. Every record carries `recorder_version`, so records made before 0.1.17 (which counted `isError` results as success) can be told apart.
+
+## Public API
+
+No auth required.
+
+```bash
+# Get reputation of a tool
+curl https://lowdown-proxy.vercel.app/api/reputation/brave-search
+
+# With node identity — returns richer data
+curl https://lowdown-proxy.vercel.app/api/reputation/brave-search \
+  -H "x-lowdown-node-id: ld_your_node_id"
+
+# Check your node's contribution
+curl https://lowdown-proxy.vercel.app/api/node/ld_your_node_id
+
+# Record an interaction
+curl -X POST https://lowdown-proxy.vercel.app/api/interactions \
+  -H "Content-Type: application/json" \
+  -d '{"actor":"agent:my-bot","target":"mcp:modelcontextprotocol/brave-search","target_type":"tool","task_type":"web_search","outcome":"success"}'
+```
+
+Basic response (no node):
+
+```json
+{
+  "target": "brave-search",
+  "interactions": 30,
+  "rated_interactions": 30,
+  "success_rate": 0.933,
+  "protocol_requests": 0,
+  "rejected_requests": 0,
+  "by_source": { "organic": 30, "seeded": 0, "synthetic": 0 },
+  "confidence": "medium"
+}
+```
+
+`interactions` is every record for the target; `rated_interactions` is the denominator of `success_rate`, and `confidence` is based on it.
+
+Contributor response (with node):
+
+```json
+{
+  "target": "brave-search",
+  "interactions": 30,
+  "success_rate": 0.933,
+  "confidence": "medium",
+  "task_breakdown": { ... },
+  "recent_trends": [ ... ]
+}
+```
+
+Fuzzy matching supported — short names like `brave-search`, `fetch`, `github` resolve automatically.
+
+### Scanner observations
+
+For MCP servers listed in the official MCP Registry, the response also carries a separate `scanner` block: what Lowdown's Scanner observed when it connected to the server (`initialize` and `tools/list` only — it never calls a tool). It is observation data, kept apart from interaction data and never counted in `success_rate`.
+
+```bash
+curl https://lowdown-proxy.vercel.app/api/reputation/mcp:io.github.user/server
+```
+
+```json
+{
+  "target": "mcp:io.github.user/server",
+  "interactions": 0,
+  "success_rate": null,
+  "scanner": {
+    "target": "mcp:io.github.user/server",
+    "last_observed_at": "2026-10-07T19:17:00+00:00",
+    "observations_30d": 28,
+    "latest": { "reached_level": 2, "http_status": 200, "latency_ms": 312, "tool_count": 7 },
+    "schema_versions_30d": 1,
+    "status_distribution_30d": { "200": 28 }
+  }
+}
+```
+
+HTTP statuses are reported as observed — a `401` is a `401`, not "dead".
+
+## Why Lowdown
+
+Agents often start with no shared history of a tool's past behavior. They have no way to know which tools have been reliable, which fail silently, or which have never been successfully used for a given task type.
+
+Lowdown solves this by recording what actually happens — not ratings, not reviews, but observed interaction history. When an agent queries Lowdown before selecting a tool, it is drawing on the collective experience of other agents that ran the same proxy.
+
+The loop is simple:
+- **Read**: query observed history before selecting a tool
+- **Use**: run the tool through the proxy
+- **Write**: the result is automatically recorded for the next agent
+
+No ratings. No human curation. Just signal from actual use.
+
+> Observations are interaction data, not independent quality judgments.
+
+## How the network works
+
+```
+Run proxy → node_id auto-created → interactions contributed → deeper Lowdown data
+```
+
+Every proxy instance is a node.
+
+Nodes contribute interaction data to the shared network.
+Contributors get access to richer query results.
+
+No tokens.
+No points.
+No reviews to write.
+
+Just run the proxy and share what your agents experience.
+
+## Design principles
+
+- **Zero config**: run the proxy, everything else is automatic.
+- **Pass-through first**: recording never blocks or degrades MCP communication.
+- **Facts only**: v0 records success/failure and latency. Quality judgments are out of scope.
+- **Provenance always tagged**: every record carries `organic` / `seeded` / `synthetic` so bootstrap data and real traffic are always distinguishable.
+
+## Status
+
+Running continuously since September 2026. Since October 6, 2026 the Scanner has observed the same 2,000 MCP Registry entries every day; the daily report and raw data are public at [PetShopBros/lowdown-data](https://github.com/PetShopBros/lowdown-data).
+See [DESIGN.md](./DESIGN.md) for what's in scope and what's been ruled out.
+
+## License
+
+MIT
+
+---
+
+## 한국어
+
+한 번도 거래한 적 없는 상대를 에이전트가 무조건 신뢰할 필요는 없습니다.
+
+`lowdown-proxy`는 AI 에이전트, 도구, 서비스 사이의 상호작용을 기록하고,
+그 이력을 누구나 조회할 수 있게 만듭니다. 도구를 선택하거나, API를 호출하거나,
+다른 에이전트에게 작업을 위임하기 전에 물어볼 수 있습니다:
+*네트워크는 이 상대에 대해 무엇을 봤는가?*
+
+MCP 서버를 감싸는 stdio 프록시가 첫 번째 진입점입니다.
+평판 레이어는 MCP에 국한되지 않고 모든 에이전트, 도구, 서비스에 열려 있습니다.
+
+기록된 데이터는 다른 에이전트가 판단할 때 참고할 수 있는 최소한의 공통 근거가 됩니다.
+
+### 네트워크 구조
+
+```
+프록시 실행 → node_id 자동 생성 → interaction 기여 → 더 깊은 Lowdown 조회
+```
+
+프록시를 실행하는 것 자체가 노드 참여입니다. 기여할수록 더 상세한 데이터를 조회할 수 있습니다.
+
+### Scanner 관찰 데이터
+
+공식 MCP Registry에 등록된 원격 MCP 서버는 응답에 `scanner` 블록이 함께 옵니다. Lowdown Scanner가 서버에 직접 연결해 관찰한 사실(`initialize`, `tools/list`까지만 호출하며 tool은 실행하지 않음)이고, interaction 데이터와 분리되어 `success_rate`에는 합산되지 않습니다. HTTP 상태는 해석 없이 관찰된 값 그대로 보여줍니다.
+
+### 앱 로그를 도구 결과에 붙이기
+
+도구 호출은 성공했는데 그 뒤의 앱(씬, 게임, 개발 서버)이 실패하는 경우가 있습니다. 진짜 에러는 앱의 로그 파일에만 찍혀서 에이전트는 모릅니다. `--watch-log`를 주면 `tools/call` 결과마다 직전 호출 이후 로그에 새로 찍힌 줄 중 `--log-pattern`에 맞는 줄이 결과 끝에 붙습니다. 에이전트가 따로 호출할 것은 없습니다. 로그 내용은 로컬에만 머물고 Lowdown에 기록되지 않습니다.
+
+### 기록 방식 (0.1.17~)
+
+프록시는 공개 API(`POST /api/interactions`)로 기록합니다. DB 키가 필요 없고 `LOWDOWN_SUPABASE_URL` / `LOWDOWN_SUPABASE_KEY`는 더 이상 쓰지 않습니다. `LOWDOWN_RECORD=0`이면 기록 없이 패스스루만 합니다.
+
+- `tools/call` 결과의 `isError: true`는 실패(`tool_error`)로 기록합니다.
+- 잘못된 요청(-32700/-32600/-32601/-32602: 형식 오류, 없는 도구, 잘못된 인자)은 서버 실패와 분리해 `rejected_requests`로 셉니다. `success_rate`에는 들어가지 않습니다.
+- `initialize`, `tools/list` 같은 비도구 요청은 `protocol_requests`로 따로 셉니다.
+- `success_rate`는 `organic` 기록만 계산합니다. `seeded` / `synthetic`은 `by_source`로 따로 보여줍니다. 일부러 실패시키는 테스트는 `--test`로 실행하면 `synthetic`으로 남습니다.
+- 각 기록에는 그 시점의 `server_version`(initialize), `schema_hash`(tools/list, Scanner와 같은 계산), `recorder_version`이 함께 남습니다. 인자와 결과 내용은 기록하지 않습니다.
+- `--target`을 주지 않으면 명령줄 전체가 아니라 패키지·파일 이름 하나만 라벨로 씁니다.
+
+### 설계 원칙 (요약)
+
+- **설정 없음**: 프록시를 실행하면 모든 것이 자동으로 처리됩니다.
+- **패스스루 우선**: 기록 로직이 실패하거나 느려도 실제 MCP 통신은 절대 막지 않습니다.
+- **사실만 기록**: v0는 성공/실패/지연시간만 기록합니다. 품질 판단은 범위 밖입니다.
+- **출처 구분**: 모든 기록은 `organic` / `seeded` / `synthetic`으로 태깅됩니다.
+
 자세한 배경과 설계 원칙은 [DESIGN.md](./DESIGN.md)를 참고하세요.

package/dist/classify.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+const REQUEST_ERROR_CODES = new Set([-32700, -32600, -32601, -32602]);
+export function classifyResponse(method, msg) {
+    const request_kind = method === "tools/call" ? "tool_call" : "protocol";
+    if (msg?.error) {
+        const code = typeof msg.error.code === "number" ? msg.error.code : undefined;
+        const message = String(msg.error.message ?? "").toLowerCase();
+        if (code !== undefined && REQUEST_ERROR_CODES.has(code)) {
+            return {
+                request_kind,
+                outcome: "failure",
+                failure_type: code === -32602 ? "invalid_arguments" : "protocol_error",
+                error_layer: "request",
+            };
+        }
+        let failure_type = "unknown";
+        if (message.includes("timeout") || message.includes("timed out"))
+            failure_type = "timeout";
+        else if (code === -32603)
+            failure_type = "server_error";
+        else if (code === -32000)
+            failure_type = "tool_error";
+        return { request_kind, outcome: "failure", failure_type, error_layer: "server" };
+    }
+    if (request_kind === "tool_call" && msg?.result?.isError === true) {
+        return { request_kind, outcome: "failure", failure_type: "tool_error", error_layer: "tool" };
+    }
+    return { request_kind, outcome: "success" };
+}
+// ── schema_hash: Scanner(scanner/lib.ts hashTools)와 같은 계산 → 프록시 기록과 Scanner 관찰을 비교할 수 있다 ──
+export function canonicalJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(",")}]`;
+    const o = v;
+    const parts = Object.keys(o)
+        .sort()
+        .filter((k) => o[k] !== undefined)
+        .map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`);
+    return `{${parts.join(",")}}`;
+}
+/** name + inputSchema + outputSchema. 도구 순서·키 순서와 무관. */
+export function schemaHash(tools) {
+    const objs = tools.map((t) => typeof t === "object" && t !== null && !Array.isArray(t) ? t : {});
+    const byName = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+    const schema = objs
+        .map((t) => canonicalJson({ name: t.name, inputSchema: t.inputSchema, outputSchema: t.outputSchema }))
+        .sort(byName);
+    return createHash("sha256").update(`[${schema.join(",")}]`).digest("hex");
+}
+/** 서버가 initialize 에서 알려준 버전. 문자열이 아니면 버린다. */
+export function serverVersionOf(msg) {
+    const v = msg?.result?.serverInfo?.version;
+    return typeof v === "string" && v.length > 0 ? v.slice(0, 100) : undefined;
+}
+const RUNNERS = new Set([
+    "npx", "npx.cmd", "uvx", "uv", "bunx", "pnpx", "pnpm", "yarn", "dlx", "run", "tool", "exec",
+    "node", "node.exe", "python", "python3", "python.exe", "deno", "bun", "cmd", "cmd.exe",
+]);
+/**
+ * --target 이 없을 때 쓸 라벨. 명령줄 전체(인자에 키·경로가 있을 수 있음)를 공개 기록에 넣지 않기 위해
+ * 실행기(npx/uvx/node …)와 옵션을 건너뛴 첫 토큰 하나만 쓴다. 경로면 파일 이름만.
+ */
+export function defaultTargetLabel(command, args) {
+    const tokens = [command, ...args];
+    for (const raw of tokens) {
+        const base = raw.split(/[\\/]/).pop() ?? raw;
+        if (raw.startsWith("-") || raw.toLowerCase() === "/c")
+            continue;
+        if (RUNNERS.has(base.toLowerCase()))
+            continue;
+        if (raw.startsWith("@"))
+            return raw.slice(0, 200); // 스코프 패키지 이름은 '/' 를 포함하므로 그대로
+        return base.slice(0, 200);
+    }
+    return "unknown";
+}

package/dist/cli.js

@@ -1,13 +1,17 @@
 #!/usr/bin/env node
 import { runProxy } from "./proxy.js";
+import { LogWatcher } from "./log-watch.js";
+import { defaultTargetLabel } from "./classify.js";
 // 사용법:
 //   npx lowdown-proxy                      → 인자 없음: Lowdown 조회용 MCP 서버(stdio) 시작 (Registry 설치 경로)
-//   npx lowdown-proxy [--actor <id>] [--target <label>] [--source organic|seeded|synthetic] -- <command> [args...]
+//   npx lowdown-proxy [--actor <id>] [--target <label>] [--source organic|seeded|synthetic] [--test] -- <command> [args...]
 //                                          → MCP 서버를 감싸는 기록 프록시
+//   --test : 이 세션의 기록을 synthetic 으로 남긴다(일부러 실패시키는 테스트가 서버 실패로 집계되지 않게).
+//   --target 이 없으면 명령줄 전체가 아니라 패키지/파일 이름 하나만 라벨로 쓴다(인자의 키·경로가 공개 기록에 남지 않게).
 function parseArgs(argv) {
     const dashIndex = argv.indexOf("--");
     if (dashIndex === -1) {
-        console.error("사용법: lowdown-proxy [--actor <id>] [--target <label>] [--source organic|seeded|synthetic] -- <command> [args...]\n" +
+        console.error("사용법: lowdown-proxy [--actor <id>] [--target <label>] [--source organic|seeded|synthetic] [--test] -- <command> [args...]\n" +
             "예시:   lowdown-proxy -- npx some-mcp-server\n" +
             "인자 없이 실행하면 Lowdown 조회용 MCP 서버가 시작됩니다.");
         process.exit(1);
@@ -22,12 +26,21 @@ function parseArgs(argv) {
         const i = flags.indexOf(name);
         return i !== -1 && flags[i + 1] ? flags[i + 1] : fallback;
     };
+    const getAll = (name) => flags.flatMap((f, i) => (f === name && flags[i + 1] ? [flags[i + 1]] : []));
+    const watchLogs = getAll("--watch-log");
+    const sourceFlag = getFlag("--source", "organic");
+    if (!["organic", "seeded", "synthetic"].includes(sourceFlag)) {
+        console.error(`[lowdown] --source 는 organic|seeded|synthetic 중 하나여야 합니다: ${sourceFlag}`);
+        process.exit(1);
+    }
+    const source = (flags.includes("--test") ? "synthetic" : sourceFlag);
     return {
         actor: getFlag("--actor", "anonymous"),
-        targetLabel: getFlag("--target", commandParts.join(" ")),
-        source: getFlag("--source", "organic"),
+        targetLabel: getFlag("--target", defaultTargetLabel(commandParts[0], commandParts.slice(1))),
+        source,
         command: commandParts[0],
         args: commandParts.slice(1),
+        logWatcher: watchLogs.length ? new LogWatcher(watchLogs, getFlag("--log-pattern", "")) : undefined,
     };
 }
 const argv = process.argv.slice(2);

package/dist/log-watch.js

@@ -0,0 +1,149 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Watches app log files and returns new lines that match a pattern since the
+ * last check. Used by the proxy to append app-side errors to tools/call results,
+ * so the agent sees runtime errors that only appear in another app's log.
+ * Facts only: no diagnosis, no instructions.
+ */
+export const DEFAULT_LOG_PATTERN = "\\b(error|exception|fatal|uncaught|unhandled|failed)\\b";
+const MAX_LINES = 20;
+const MAX_LINE_LEN = 300;
+const MAX_READ_BYTES = 256 * 1024;
+export function expandPath(p) {
+    let out = p.replace(/%([A-Za-z0-9_]+)%/g, (m, v) => process.env[v] ?? m);
+    out = out.replace(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g, (m, v) => process.env[v] ?? m);
+    if (out === "~" || out.startsWith("~/") || out.startsWith("~\\")) {
+        out = path.join(os.homedir(), out.slice(1));
+    }
+    return path.resolve(out);
+}
+export function redact(line) {
+    return line
+        .replace(/(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[redacted]")
+        .replace(/\b(sk|pk|ghp|gho|github_pat|xox[abpr])[-_][A-Za-z0-9_-]{8,}/g, "[redacted]")
+        .replace(/((?:api[_-]?key|token|secret|password|passwd|authorization)\s*[:=]\s*)("?)[^\s"',;]+/gi, "$1$2[redacted]")
+        .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, "[redacted]")
+        .replace(/\b[A-Fa-f0-9]{40,}\b/g, "[redacted]");
+}
+function fileSize(p) {
+    try {
+        return fs.statSync(p).size;
+    }
+    catch {
+        return null;
+    }
+}
+function readRange(p, from, size) {
+    let start = from;
+    if (size < start)
+        start = 0; // rotated or truncated (e.g. app restarted)
+    if (size === start)
+        return "";
+    if (size - start > MAX_READ_BYTES)
+        start = size - MAX_READ_BYTES;
+    const len = size - start;
+    const buf = Buffer.alloc(len);
+    let fd;
+    try {
+        fd = fs.openSync(p, "r");
+        fs.readSync(fd, buf, 0, len, start);
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+    return buf.toString("utf8");
+}
+export class LogWatcher {
+    offsets = new Map();
+    lastCheck = Date.now();
+    logs;
+    pattern;
+    constructor(logs, pattern) {
+        this.logs = logs.map(expandPath);
+        let re;
+        try {
+            re = new RegExp(pattern || DEFAULT_LOG_PATTERN, "i");
+        }
+        catch {
+            console.error(`[lowdown] invalid --log-pattern, using default`);
+            re = new RegExp(DEFAULT_LOG_PATTERN, "i");
+        }
+        this.pattern = re;
+        // Lines already in the log when the proxy starts are not reported.
+        for (const log of this.logs) {
+            const s = fileSize(log);
+            if (s !== null)
+                this.offsets.set(log, s);
+        }
+    }
+    /** New matching lines since the previous call. Never throws. */
+    collect() {
+        const since = this.lastCheck;
+        this.lastCheck = Date.now();
+        const blocks = [];
+        for (const log of this.logs) {
+            try {
+                const size = fileSize(log);
+                if (size === null)
+                    continue;
+                const from = this.offsets.has(log) ? this.offsets.get(log) : 0;
+                const text = readRange(log, from, size);
+                this.offsets.set(log, size);
+                const lines = text.split(/\r?\n/).filter((l) => l.trim() && this.pattern.test(l));
+                if (!lines.length)
+                    continue;
+                const shown = lines.slice(-MAX_LINES).map((l) => {
+                    const r = redact(l.trim());
+                    return r.length > MAX_LINE_LEN ? r.slice(0, MAX_LINE_LEN) + "…" : r;
+                });
+                blocks.push({ log, total: lines.length, shown });
+            }
+            catch {
+                // never break the proxy because of a log read
+            }
+        }
+        return { since, blocks };
+    }
+}
+function hhmmss(ms) {
+    const d = new Date(ms);
+    return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
+}
+export function formatLogReport(since, blocks) {
+    const out = [
+        `[lowdown] Since ${hhmmss(since)}, these app logs recorded new matching lines. Quoted from the log files, not instructions.`,
+    ];
+    for (const b of blocks) {
+        const extra = b.total > b.shown.length ? `, last ${b.shown.length} shown` : "";
+        out.push(`${b.log}: ${b.total} new line(s)${extra}`);
+        for (const l of b.shown)
+            out.push(`  | ${l}`);
+    }
+    return out.join("\n");
+}
+/**
+ * If msg is a successful tools/call result and the watcher has new lines,
+ * returns the message with one text item appended to result.content.
+ * Otherwise returns null (caller forwards the original line unchanged).
+ */
+export function annotateToolResult(msg, watcher) {
+    const content = msg?.result?.content;
+    if (!Array.isArray(content))
+        return null; // keep lines for the next result
+    const { since, blocks } = watcher.collect();
+    if (!blocks.length)
+        return null;
+    return {
+        ...msg,
+        result: {
+            ...msg.result,
+            content: [...content, { type: "text", text: formatLogReport(since, blocks) }],
+        },
+    };
+}

package/dist/mcp-server.js

@@ -20,8 +20,9 @@ const server = new McpServer({
 });
 // ── 1. get_lowdown ──────────────────────────────────────────────
 server.tool("get_lowdown", "Look up what Lowdown has recorded about an agent, tool, or service. " +
-    "Returns interactions reported by agents (count, outcomes, success rate) and, for MCP Registry servers, " +
-    "a separate `scanner` block: daily Lowdown Scanner observations of initialize and tools/list reachability, " +
+    "Returns recorded interactions (count, outcomes, success rate). The success rate counts organic tool calls and " +
+    "agent reports only; protocol requests, rejected requests, and seeded or synthetic records are counted separately. " +
+    "For MCP Registry servers it also returns a separate `scanner` block: daily Lowdown Scanner observations of initialize and tools/list reachability, " +
     "HTTP status, tool count, and tool-schema changes over the last 30 days. " +
     "Scanner data is observation, not a score. A target outside the observed sample returns `observed: false`, " +
     "which says nothing about its status.", {
@@ -35,7 +36,9 @@ server.tool("get_lowdown", "Look up what Lowdown has recorded about an agent, to
 });
 // ── 2. record_interaction ───────────────────────────────────────
 server.tool("record_interaction", "Record an interaction with an agent, tool, or service after using it. " +
-    "Helps build the shared reputation dataset for the community.", {
+    "Helps build the shared reputation dataset for the community. " +
+    "If the call was an intentional negative test (e.g. deliberately invalid input), set source to 'synthetic' " +
+    "so it is not counted as a failure of the target.", {
     actor: z.string().describe("Your agent/system identifier"),
     target: z.string().describe("Identifier of what you used"),
     target_type: z.enum(["agent", "tool", "service", "human"]),
@@ -45,12 +48,18 @@ server.tool("record_interaction", "Record an interaction with an agent, tool, or
         .optional()
         .describe("Required when outcome is failure. Distinguish tool failure vs argument error."),
     latency_ms: z.number().optional().describe("How long it took in milliseconds"),
-    source: z.enum(["organic", "seeded", "synthetic"]).optional(),
+    source: z.enum(["organic", "seeded", "synthetic"]).optional()
+        .describe("organic (default) for real use; synthetic for tests, including intentional failure tests"),
 }, async ({ actor, target, target_type, task_type, outcome, failure_type, latency_ms, source }) => {
     const res = await fetch(`${BASE_URL}/api/interactions`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ actor, target, target_type, task_type, outcome, failure_type, latency_ms, source }),
+        body: JSON.stringify({
+            actor, target, target_type, task_type, outcome, failure_type, latency_ms, source,
+            request_kind: "reported",
+            node_id: NODE_ID,
+            recorder_version: PKG_VERSION,
+        }),
     });
     const data = await res.json();
     return {
@@ -61,7 +70,7 @@ server.tool("record_interaction", "Record an interaction with an agent, tool, or
 server.tool("compare_tools", "Compare 2 to 5 tools or agents by the interactions reported to Lowdown. " +
     "Candidates are ordered by reported success rate (candidates without data last), with interaction count and confidence. " +
     "Scanner observations are not used for the ordering. " +
-    "A suggestion is included only when the first candidate has at least 5 reported interactions.", {
+    "A suggestion is included only when the first candidate has at least 5 rated interactions.", {
     candidates: z.array(z.string()).min(2).max(5).describe("List of tool/agent identifiers to compare"),
     task_type: z.string().optional().describe("Filter by task type if you want task-specific comparison"),
 }, async ({ candidates, task_type }) => {
@@ -98,19 +107,19 @@ server.tool("compare_tools", "Compare 2 to 5 tools or agents by the interactions
         .map((r, i) => {
         const rate = r.success_rate !== null ? `${(Number(r.success_rate) * 100).toFixed(0)}%` : "no data";
         const latency = r.avg_latency_ms ? `, latency: ${r.avg_latency_ms}ms` : "";
-        return `${i + 1}. ${r.target} — success: ${rate}, interactions: ${r.interactions}, confidence: ${r.confidence}${latency}`;
+        return `${i + 1}. ${r.target} — success: ${rate}, rated interactions: ${ratedCount(r)}, confidence: ${r.confidence}${latency}`;
     })
         .join("\n");
     // recommendation + reason 자동 생성
     const best = ranked[0];
     let recommendation = null;
-    if (best?.interactions >= 5 && best?.success_rate !== null) {
+    if (ratedCount(best) >= 5 && best?.success_rate !== null && best?.success_rate !== undefined) {
         const rate = `${(Number(best.success_rate) * 100).toFixed(0)}%`;
         const latencyNote = best.avg_latency_ms ? ` with avg latency ${best.avg_latency_ms}ms` : "";
         const taskNote = task_type ? ` for ${task_type}` : "";
         recommendation = {
             target: best.target,
-            reason: `Highest success rate${taskNote} (${rate}) across ${best.interactions} observations${latencyNote}.`,
+            reason: `Highest success rate${taskNote} (${rate}) across ${ratedCount(best)} rated interactions${latencyNote}.`,
         };
     }
     return {
@@ -133,6 +142,10 @@ server.tool("get_node_stats", "Get your node's contribution stats and network po
         content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
     };
 });
+// success_rate 의 분모(organic 도구 호출·보고). 0.1.17 이전 API 응답에는 없으므로 interactions 로 대체.
+function ratedCount(r) {
+    return Number(r?.rated_interactions ?? r?.interactions ?? 0);
+}
 // ── 서버 시작 ───────────────────────────────────────────────────
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/proxy.js

@@ -1,89 +1,56 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { recordInteraction } from "./supabase.js";
+import { recordInteraction } from "./record.js";
 import { getNodeId } from "./node-identity.js";
+import { annotateToolResult } from "./log-watch.js";
+import { classifyResponse, schemaHash, serverVersionOf } from "./classify.js";
 /**
  * lowdown-proxy 핵심 로직.
  *
  * 설계 원칙 (lowdown-brief.md 참고):
  * - 패스스루가 최우선. 기록 로직이 통신을 막거나 지연시켜선 안 된다.
  * - "무슨 일이 일어났는가"만 기록한다(Interaction 레이어). 품질 판단(Opinion)은 v0 범위 밖.
- * - tool_execution 성공(JSON-RPC 에러 없음)과 실제 결과 품질은 다른 문제 — v0는 전자만 다룬다.
+ * - 판정 기준은 classify.ts: tools/call 의 isError 는 실패, 잘못된 요청(-32602 등)은 서버 실패와 분리,
+ *   tools/call 이 아닌 요청은 protocol 로 남기고 성공률에 넣지 않는다.
+ * - 각 행에 그 시점의 server_version(initialize)·schema_hash(tools/list)를 찍는다.
  */
 export function runProxy(opts) {
     const nodeId = getNodeId();
+    const record = opts.record ?? ((r) => recordInteraction(r));
     const child = spawn(opts.command, opts.args, {
         stdio: ["pipe", "pipe", "inherit"], // stderr는 그대로 상위로 흘려보냄(디버깅용)
         shell: process.platform === "win32",
     });
     const pending = new Map();
+    const state = {};
     // ── Client(부모 프로세스의 stdin) → Server(child.stdin) ──
-    // 요청을 가로채서 tools/call이면 pending에 기록해두고, 그대로 통과시킴
     const clientReader = createInterface({ input: process.stdin });
     clientReader.on("line", (line) => {
         // 항상 먼저 그대로 전달 — 파싱 실패해도 패스스루는 깨지면 안 됨
         child.stdin.write(line + "\n");
-        try {
-            const msg = JSON.parse(line);
-            if (msg?.id !== undefined && msg?.method) {
-                pending.set(msg.id, {
-                    method: msg.method,
-                    toolName: msg.method === "tools/call" ? msg.params?.name : undefined,
-                    startedAt: Date.now(),
-                });
-            }
-        }
-        catch {
-            // JSON이 아니거나 파싱 실패 — 무시하고 패스스루만 유지
-        }
+        trackRequest(pending, line);
     });
     // ── Server(child.stdout) → Client(부모 프로세스의 stdout) ──
-    // 응답을 가로채서 pending과 매칭되면 interaction 기록, 그대로 통과시킴
     const serverReader = createInterface({ input: child.stdout });
     serverReader.on("line", (line) => {
-        process.stdout.write(line + "\n");
-        try {
-            const msg = JSON.parse(line);
-            if (msg?.id !== undefined && pending.has(msg.id)) {
-                const call = pending.get(msg.id);
-                pending.delete(msg.id);
-                const latency_ms = Date.now() - call.startedAt;
-                const outcome = msg.error
-                    ? "failure"
-                    : "success";
-                let failure_type;
-                if (msg.error) {
-                    const code = msg.error?.code;
-                    const message = msg.error?.message ?? "";
-                    if (code === -32602)
-                        failure_type = "invalid_arguments";
-                    else if (message.toLowerCase().includes("timeout"))
-                        failure_type = "timeout";
-                    else if (code === -32603)
-                        failure_type = "server_error";
-                    else if (code === -32000)
-                        failure_type = "tool_error";
-                    else
-                        failure_type = "unknown";
+        let out = line;
+        if (opts.logWatcher) {
+            try {
+                const m = JSON.parse(line);
+                if (m?.id !== undefined && pending.get(m.id)?.method === "tools/call") {
+                    const annotated = annotateToolResult(m, opts.logWatcher);
+                    if (annotated)
+                        out = JSON.stringify(annotated);
                 }
-                const record = {
-                    actor: opts.actor,
-                    target: opts.targetLabel,
-                    target_type: "tool",
-                    task_type: call.toolName ?? call.method,
-                    outcome,
-                    failure_type,
-                    latency_ms,
-                    source: opts.source,
-                    node_id: nodeId,
-                };
-                // fire-and-forget — 응답 전달을 기다리게 하지 않음
-                void recordInteraction(record);
+            }
+            catch {
+                // passthrough
             }
         }
-        catch {
-            // 무시, 패스스루 유지
-        }
+        process.stdout.write(out + "\n");
+        const rec = buildRecord(pending, state, line, { ...opts, nodeId });
+        if (rec)
+            void Promise.resolve(record(rec)).catch(() => { }); // fire-and-forget
     });
     child.on("exit", (code) => {
         process.exit(code ?? 0);
@@ -91,3 +58,60 @@ export function runProxy(opts) {
     process.on("SIGINT", () => child.kill("SIGINT"));
     process.on("SIGTERM", () => child.kill("SIGTERM"));
 }
+/** 클라이언트 → 서버 한 줄. id 있는 요청이면 pending 에 등록. */
+export function trackRequest(pending, line, now = Date.now()) {
+    try {
+        const msg = JSON.parse(line);
+        if (msg?.id !== undefined && typeof msg?.method === "string") {
+            pending.set(msg.id, {
+                method: msg.method,
+                toolName: msg.method === "tools/call" && typeof msg.params?.name === "string" ? msg.params.name : undefined,
+                paged: msg.method === "tools/list" && msg.params?.cursor !== undefined,
+                startedAt: now,
+            });
+        }
+    }
+    catch {
+        // JSON이 아니거나 파싱 실패 — 무시하고 패스스루만 유지
+    }
+}
+/** 서버 → 클라이언트 한 줄. 대기 중인 요청의 응답이면 기록 1건을 만든다(상태도 갱신). */
+export function buildRecord(pending, state, line, opts, now = Date.now()) {
+    let msg;
+    try {
+        msg = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    if (msg?.id === undefined || !pending.has(msg.id))
+        return null;
+    const call = pending.get(msg.id);
+    pending.delete(msg.id);
+    if (!msg.error) {
+        if (call.method === "initialize") {
+            const v = serverVersionOf(msg);
+            if (v)
+                state.serverVersion = v;
+        }
+        else if (call.method === "tools/list" && Array.isArray(msg.result?.tools) && !call.paged && msg.result?.nextCursor === undefined) {
+            state.schemaHash = schemaHash(msg.result.tools);
+        }
+    }
+    const c = classifyResponse(call.method, msg);
+    return {
+        actor: opts.actor,
+        target: opts.targetLabel,
+        target_type: "tool",
+        task_type: call.toolName ?? call.method,
+        outcome: c.outcome,
+        ...(c.failure_type ? { failure_type: c.failure_type } : {}),
+        ...(c.error_layer ? { error_layer: c.error_layer } : {}),
+        request_kind: c.request_kind,
+        latency_ms: now - call.startedAt,
+        source: opts.source,
+        node_id: opts.nodeId,
+        ...(state.serverVersion ? { server_version: state.serverVersion } : {}),
+        ...(state.schemaHash ? { schema_hash: state.schemaHash } : {}),
+    };
+}

package/dist/record.js

@@ -0,0 +1,43 @@
+import { createRequire } from "node:module";
+const DEFAULT_API_URL = "https://lowdown-proxy.vercel.app";
+/** dist/*.js 기준 ../package.json — 기록 행마다 어떤 판정 로직(버전)이 남긴 기록인지 남긴다. */
+export const RECORDER_VERSION = (() => {
+    try {
+        return createRequire(import.meta.url)("../package.json").version;
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
+export function apiBaseUrl() {
+    return (process.env.LOWDOWN_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+}
+let warnedLegacyKey = false;
+/**
+ * interaction 을 공개 API(POST /api/interactions)로 보낸다. DB 키가 필요 없다.
+ * 절대 throw 하지 않는다 — 기록 실패가 프록시 통신을 막아서는 안 된다(패스스루가 본 기능).
+ */
+export async function recordInteraction(record, deps = {}) {
+    if (process.env.LOWDOWN_RECORD === "0")
+        return;
+    if (process.env.LOWDOWN_SUPABASE_KEY && !warnedLegacyKey) {
+        warnedLegacyKey = true;
+        console.error("[lowdown] LOWDOWN_SUPABASE_KEY 는 더 이상 쓰지 않습니다(기록은 공개 API 경유). 설정에서 지워도 됩니다.");
+    }
+    const f = deps.fetchImpl ?? fetch;
+    try {
+        const res = await f(`${apiBaseUrl()}/api/interactions`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ ...record, recorder_version: record.recorder_version ?? RECORDER_VERSION }),
+            signal: AbortSignal.timeout(deps.timeoutMs ?? 3000),
+        });
+        if (!res.ok && process.env.LOWDOWN_DEBUG) {
+            console.error(`[lowdown] interaction 기록 실패: HTTP ${res.status} ${(await res.text()).slice(0, 200)}`);
+        }
+    }
+    catch (err) {
+        if (process.env.LOWDOWN_DEBUG)
+            console.error("[lowdown] interaction 기록 예외:", err);
+    }
+}

package/package.json

@@ -1,46 +1,47 @@
-{
-  "name": "lowdown-proxy",
-  "version": "0.1.15",
-  "mcpName": "io.github.PetShopBros/lowdown-proxy",
-  "description": "Record and query AI agent/tool/service interactions. Shared interaction history for the multi-agent ecosystem.",
-  "type": "module",
-  "bin": {
-    "lowdown-proxy": "dist/cli.js",
-    "lowdown-mcp": "dist/mcp-server.js"
-  },
-  "main": "./dist/cli.js",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsx src/cli.ts",
-    "scanner:typecheck": "tsc -p scanner",
-    "scanner:test": "node --test scanner/lib.test.ts scanner/reputation.test.ts scanner/report.test.ts",
-    "scanner:dry": "node scanner/scan.ts --dry-run --limit=30"
-  },
-  "keywords": [
-    "mcp",
-    "ai-agent",
-    "reputation",
-    "interaction",
-    "proxy",
-    "trust",
-    "lowdown"
-  ],
-  "license": "MIT",
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@supabase/supabase-js": "^2.45.0",
-    "@vercel/node": "^3.0.0",
-    "zod": "^3.25.76"
-  },
-  "devDependencies": {
-    "@types/node": "^22.20.4",
-    "tsx": "^4.16.0",
-    "typescript": "^5.5.0"
-  },
-  "engines": {
-    "node": ">=18"
-  }
-}
+{
+  "name": "lowdown-proxy",
+  "version": "0.1.17",
+  "mcpName": "io.github.PetShopBros/lowdown-proxy",
+  "description": "Record and query AI agent/tool/service interactions. Shared interaction history for the multi-agent ecosystem.",
+  "type": "module",
+  "bin": {
+    "lowdown-proxy": "dist/cli.js",
+    "lowdown-mcp": "dist/mcp-server.js"
+  },
+  "main": "./dist/cli.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
+    "dev": "tsx src/cli.ts",
+    "scanner:typecheck": "tsc -p scanner",
+    "scanner:test": "node --test scanner/lib.test.ts scanner/reputation.test.ts scanner/report.test.ts",
+    "scanner:dry": "node scanner/scan.ts --dry-run --limit=30",
+    "test": "npm run build && node --test test/p0.test.ts"
+  },
+  "keywords": [
+    "mcp",
+    "ai-agent",
+    "reputation",
+    "interaction",
+    "proxy",
+    "trust",
+    "lowdown"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@supabase/supabase-js": "^2.45.0",
+    "@vercel/node": "^3.0.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.4",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

package/dist/supabase.js

@@ -1,52 +0,0 @@
-import { createClient } from "@supabase/supabase-js";
-let client = null;
-function getClient() {
-    if (client)
-        return client;
-    const url = process.env.LOWDOWN_SUPABASE_URL;
-    const key = process.env.LOWDOWN_SUPABASE_KEY;
-    if (!url || !key) {
-        // 설계 원칙: 자격증명이 없어도 프록시 자체는 죽지 않는다.
-        // 패스스루가 우선이고, 기록은 부가 기능이다.
-        return null;
-    }
-    client = createClient(url, key, { auth: { persistSession: false } });
-    return client;
-}
-/**
- * interaction을 Supabase에 기록한다.
- * 절대 throw하지 않는다 — 기록 실패가 프록시 통신을 막아서는 안 된다.
- * (기록은 부가 기능, 패스스루가 본 기능)
- */
-export async function recordInteraction(record) {
-    const supabase = getClient();
-    if (!supabase) {
-        if (process.env.LOWDOWN_DEBUG) {
-            console.error("[lowdown] LOWDOWN_SUPABASE_URL/KEY 미설정 — 기록 건너뜀:", record);
-        }
-        return;
-    }
-    try {
-        // Database 타입을 별도 생성하지 않은 v0 상태라 insert 페이로드는 any로 캐스팅.
-        // (나중에 `supabase gen types`로 타입을 뽑으면 제거 가능)
-        const { error } = await supabase.from("interactions").insert({
-            actor: record.actor,
-            target: record.target,
-            target_type: record.target_type,
-            task_type: record.task_type,
-            outcome: record.outcome,
-            latency_ms: record.latency_ms ?? null,
-            source: record.source ?? "organic",
-            node_id: record.node_id ?? null,
-            failure_type: record.failure_type ?? null,
-        });
-        if (error && process.env.LOWDOWN_DEBUG) {
-            console.error("[lowdown] interaction 기록 실패:", error.message);
-        }
-    }
-    catch (err) {
-        if (process.env.LOWDOWN_DEBUG) {
-            console.error("[lowdown] interaction 기록 예외:", err);
-        }
-    }
-}