magenta-canon 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magenta-canon",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "description": "A verifiable MCP accountability gateway for AI-agent tool calls: allows authorized calls, blocks unauthorized calls, records both, and produces cryptographic evidence anyone can verify.",

package/scripts/demo.mjs

@@ -127,17 +127,23 @@ const capture = (cmd, args, opts = {}) =>
 const isWindows = process.platform === "win32";
 const runDriver = (configPath, env) =>
   new Promise((resolve) => {
-    const ch = spawn("node", ["scripts/mcp-demo-drive.mjs", configPath], {
+    // Resolve the driver as an absolute, spawn-safe native path (cwd-independent
+    // and correct under the npm-cache _npx path on Windows).
+    const driverPath = path.join(ROOT, "scripts", "mcp-demo-drive.mjs");
+    const ch = spawn(process.execPath, [driverPath, configPath], {
       // `detached` only buys us a process group on POSIX; skip it on Windows.
-      cwd: ROOT, detached: !isWindows, stdio: ["ignore", "pipe", "ignore"], env,
+      // Capture stderr too, so a child failure surfaces a real cause instead of
+      // an opaque "MCP driver failed".
+      cwd: ROOT, detached: !isWindows, stdio: ["ignore", "pipe", "pipe"], env,
     });
-    let out = "";
+    let out = "", err = "";
     ch.stdout.on("data", (d) => (out += d));
+    ch.stderr.on("data", (d) => (err += d));
     const cleanup = () => killChildTree(ch);
-    const watchdog = setTimeout(() => { cleanup(); resolve({ code: 124, out }); }, 30_000);
+    const watchdog = setTimeout(() => { cleanup(); resolve({ code: 124, out, err }); }, 30_000);
     ch.on("exit", (code) => {
       clearTimeout(watchdog);
-      setTimeout(() => { cleanup(); resolve({ code: code ?? 0, out }); }, 150);
+      setTimeout(() => { cleanup(); resolve({ code: code ?? 0, out, err }); }, 150);
     });
   });
 
@@ -199,6 +205,15 @@ async function main() {
   // ephemeral control plane. Semantics (capabilities, tool map) are unchanged.
   const base = JSON.parse(readFileSync(path.join(ROOT, "examples/magenta-gateway.demo.config.json"), "utf8"));
   base.controlPlane = { url: URL, internalKey: INTERNAL_KEY };
+  // Make the downstream command absolute and launch it with the current Node
+  // (process.execPath) rather than a bare "node" + relative arg — cwd-independent
+  // and correct under the npm-cache _npx path, including on Windows.
+  if (base.downstream && Array.isArray(base.downstream.args)) {
+    base.downstream.command = process.execPath;
+    base.downstream.args = base.downstream.args.map((a) =>
+      a.endsWith(".mjs") || a.endsWith(".js") ? path.join(ROOT, a) : a,
+    );
+  }
   writeFileSync(F.config, JSON.stringify(base, null, 2));
 
   const drive = await runDriver(F.config, {
@@ -208,8 +223,8 @@ async function main() {
     MAGENTA_TSX_CLI: TSX_CLI,
     PATH: `${path.join(ROOT, "node_modules", ".bin")}${path.delimiter}${process.env.PATH}`,
   });
-  if (drive.code !== 0) die("MCP driver failed.", drive.out);
-  if (!/HANDSHAKE_OK/.test(drive.out)) die("MCP handshake did not complete.", drive.out);
+  if (drive.code !== 0) die("MCP driver failed.", [drive.out, drive.err].filter(Boolean).join("\n"));
+  if (!/HANDSHAKE_OK/.test(drive.out)) die("MCP handshake did not complete.", [drive.out, drive.err].filter(Boolean).join("\n"));
   for (const line of drive.out.trim().split("\n")) {
     if (!line.trim()) continue;
     const colored = line.startsWith("ALLOWED") ? grn(line)

package/scripts/mcp-demo-drive.mjs

@@ -8,6 +8,7 @@
  */
 import { spawn } from "node:child_process";
 import readline from "node:readline";
+import { siblingPath } from "./win-paths.mjs";
 
 const cfg = process.argv[2];
 if (!cfg) { console.error("usage: node scripts/mcp-demo-drive.mjs <config>"); process.exit(2); }
@@ -15,7 +16,9 @@ if (!cfg) { console.error("usage: node scripts/mcp-demo-drive.mjs <config>"); pr
 // Launch the gateway. When MAGENTA_TSX_CLI is provided (by the demo orchestrator,
 // incl. the installed-package CLI) run it as `node <tsxCli> mcp-gateway.ts`;
 // otherwise fall back to `npx tsx` for the documented manual flow.
-const gatewayPath = new URL("./mcp-gateway.ts", import.meta.url).pathname;
+// NOTE: use fileURLToPath (via siblingPath), NOT URL.pathname — the latter yields
+// `/C:/…` on Windows, which tsx/node cannot open (broke step 3/7 on Windows).
+const gatewayPath = siblingPath(import.meta.url, "./mcp-gateway.ts");
 const gw = process.env.MAGENTA_TSX_CLI
   ? spawn(process.execPath, [process.env.MAGENTA_TSX_CLI, gatewayPath, cfg], { stdio: ["pipe", "pipe", "inherit"] })
   : spawn("npx", ["tsx", gatewayPath, cfg], { stdio: ["pipe", "pipe", "inherit"] });

package/scripts/win-paths.mjs

@@ -0,0 +1,19 @@
+/**
+ * Windows-safe path helpers for the demo's child-process wiring.
+ *
+ * The MCP demo driver spawns the gateway script by resolving a sibling file from
+ * `import.meta.url`. The naive `new URL("./x.ts", import.meta.url).pathname`
+ * returns a POSIX-style string with a spurious leading slash before the drive
+ * letter on Windows (e.g. `/C:/Users/.../x.ts`), which Node/tsx cannot open —
+ * this broke `npx magenta-canon demo` at step 3/7 on Windows. `fileURLToPath`
+ * produces the correct native path on every platform (`C:\Users\...\x.ts` on
+ * Windows, `/home/.../x.ts` on POSIX).
+ *
+ * Pure; no process/verifier/witness/evidence/gateway semantics.
+ */
+import { fileURLToPath } from "node:url";
+
+/** Resolve a sibling file next to `metaUrl` as a spawn-safe, native absolute path. */
+export function siblingPath(metaUrl, name) {
+  return fileURLToPath(new URL(name, metaUrl));
+}