mcp-pacemaker 1.3.1

package/bin/top.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+/**
+ * mcp-pacemaker top — live terminal dashboard (Ink). Same data as the web /ui.
+ * Reads the bridge port from ~/.mcp-pacemaker/state.json (or --port) and the admin
+ * nonce from ~/.mcp-pacemaker/admin.nonce for the Recycle keybind. No JSX (uses createElement).
+ */
+import { createElement as h, useState, useEffect } from 'react';
+import { render, Box, Text, useApp, useInput } from 'ink';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = resolve(homedir(), '.mcp-pacemaker');
+
+export function fetchSnapshot(port) {
+  return new Promise((res) => {
+    const r = http.get({ host: '127.0.0.1', port, path: '/api/status', timeout: 2000 }, (resp) => {
+      let d = ''; resp.on('data', (c) => (d += c)); resp.on('end', () => { try { res(JSON.parse(d)); } catch { res(null); } });
+    });
+    r.on('error', () => res(null));
+    r.on('timeout', () => { r.destroy(); res(null); });
+  });
+}
+
+export function recycleServer(port, name, nonce) {
+  return new Promise((res) => {
+    const r = http.request({ host: '127.0.0.1', port, path: `/admin/recycle/${encodeURIComponent(name)}`, method: 'POST', headers: { 'x-mcp-nonce': nonce }, timeout: 3000 }, (resp) => {
+      let d = ''; resp.on('data', (c) => (d += c)); resp.on('end', () => { let body = null; try { body = JSON.parse(d || 'null'); } catch { /* noop */ } res({ status: resp.statusCode, body }); });
+    });
+    r.on('error', () => res(null));
+    r.on('timeout', () => { r.destroy(); res(null); });
+    r.end();
+  });
+}
+
+const readNonce = () => { try { return readFileSync(resolve(HOME, 'admin.nonce'), 'utf8').trim(); } catch { return ''; } };
+// Pure: pick the bridge port from a parsed state object (list shape wins, legacy {port} fallback).
+export function portFromState(state) {
+  if (state && Array.isArray(state.hosts)) return state.hosts[0]?.port || 8791;
+  return (state && state.port) || 8791;
+}
+function resolvePort(port) {
+  if (port) return port;
+  try { return portFromState(JSON.parse(readFileSync(resolve(HOME, 'state.json'), 'utf8'))); } catch { return 8791; }
+}
+
+const pad = (s, n) => { s = String(s ?? ''); return s.length >= n ? s.slice(0, n - 1) + ' ' : s.padEnd(n); };
+const fmtTok = (sec) => (sec == null ? '-' : sec <= 0 ? 'exp' : `${Math.round(sec / 60)}m`);
+// 'unknown' has to be visibly distinct from 'ok': the point of the health column is that a
+// server nobody has called is not claimed to be working.
+const HEALTH = { ok: { text: 'ok', color: 'green' }, failing: { text: 'FAIL', color: 'red' }, unknown: { text: '?', color: 'gray' } };
+const healthCell = (s) => {
+  const st = s.health?.state ?? 'unknown';
+  const h = HEALTH[st] ?? HEALTH.unknown;
+  return { text: st === 'failing' && s.health.consecutiveFailures > 1 ? `FAIL×${s.health.consecutiveFailures}` : h.text, color: h.color };
+};
+
+function App({ port }) {
+  const { exit } = useApp();
+  const [snap, setSnap] = useState(null);
+  const [sel, setSel] = useState(0);
+  const [msg, setMsg] = useState('');
+
+  useEffect(() => {
+    let alive = true;
+    const tick = async () => { const s = await fetchSnapshot(port); if (alive) setSnap(s); };
+    tick();
+    const t = setInterval(tick, 1500);
+    return () => { alive = false; clearInterval(t); };
+  }, [port]);
+
+  const servers = snap?.servers ?? [];
+
+  useInput((input, key) => {
+    if (input === 'q' || (key.ctrl && input === 'c')) return exit();
+    if (key.upArrow) setSel((i) => Math.max(0, i - 1));
+    else if (key.downArrow) setSel((i) => Math.min(Math.max(0, servers.length - 1), i + 1));
+    else if (input === 'r') {
+      const s = servers[sel];
+      if (!s) return;
+      if (s.type === 'http') { setMsg('http servers have no child to recycle'); return; }
+      setMsg(`recycling ${s.name}…`);
+      recycleServer(port, s.name, readNonce()).then((r) =>
+        setMsg(r && r.status === 200 ? `recycled ${s.name} (${r.body?.recycled ?? 0})` : `recycle failed (${r?.status ?? 'no nonce/bridge'})`),
+      );
+    }
+  });
+
+  return h(
+    Box,
+    { flexDirection: 'column', padding: 1 },
+    h(
+      Box,
+      { justifyContent: 'space-between' },
+      h(Text, { bold: true, color: 'cyan' }, '🫀 mcp-pacemaker top'),
+      h(Text, { color: snap ? 'green' : 'red' }, snap ? `● :${snap.port} · up ${snap.uptimeSec}s · v${snap.version}` : '● connecting…'),
+    ),
+    h(Text, { dimColor: true }, pad('SERVER', 18) + pad('TYPE', 7) + pad('HEALTH', 8) + pad('SESS', 6) + pad('WARM', 6) + pad('REQ', 7) + pad('PID', 10) + pad('TOKEN', 8) + 'ERROR / CLIENTS'),
+    servers.length === 0
+      ? h(Text, { dimColor: true }, snap ? 'no servers configured' : 'connecting…')
+      : servers.map((s, i) =>
+          h(
+            Text,
+            { key: s.name, inverse: i === sel, color: s.health?.state === 'failing' ? 'red' : undefined },
+            pad(s.name, 18) + pad(s.type, 7) + pad(healthCell(s).text, 8) + pad(s.sessions, 6) + pad(s.sharing === 'pool' ? `${s.warm}/${s.minWarm ?? 1}` : '-', 6) + pad(s.requests, 7) + pad(s.pids.join(',') || '-', 10) + pad(fmtTok(s.tokenExpiresIn), 8) + (s.lastError ? String(s.lastError).slice(0, 24) : (s.clients && s.clients.length ? '\u21c4 ' + s.clients.join(',') : '')),
+          ),
+        ),
+    h(Text, { dimColor: true }, `↑↓ select · r recycle · q quit   ${msg}`),
+  );
+}
+
+export function runTop(port) {
+  render(h(App, { port: resolvePort(port) }));
+}

package/bin/update-check.mjs

@@ -0,0 +1,153 @@
+import { execFile } from 'node:child_process';
+import { existsSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
+import { dirname, join, resolve, delimiter } from 'node:path';
+import { tmpdir } from 'node:os';
+import { promisify } from 'node:util';
+import semver from 'semver';
+
+const runFile = promisify(execFile);
+
+export function updateChannel(pkg) {
+  if (typeof pkg.name !== 'string' ||
+      !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(pkg.name)) {
+    throw new Error('Invalid installed package name.');
+  }
+  if (typeof pkg.version !== 'string' ||
+      !semver.valid(pkg.version) ||
+      semver.prerelease(pkg.version)) {
+    throw new Error('The installed CLI must have a stable SemVer version.');
+  }
+  const major = semver.major(pkg.version);
+  if (major !== 1 &&
+      major !== 2) {
+    throw new Error(`No update channel is defined for major ${major}.`);
+  }
+  return major === 1 ? 'legacy' : 'latest';
+}
+
+export function channelTarget(pkg, tags) {
+  const channel = updateChannel(pkg);
+  const target = tags?.[channel];
+  if (typeof target !== 'string' ||
+      semver.valid(target) !== target ||
+      semver.prerelease(target) ||
+      semver.major(target) !== semver.major(pkg.version)) {
+    throw new Error(`Channel "${channel}" has no valid stable same-major target. No fallback selected.`);
+  }
+  return target;
+}
+
+export function selectUpdate(pkg, tags, release) {
+  const channel = updateChannel(pkg);
+  const target = channelTarget(pkg, tags);
+  if (!release ||
+      Array.isArray(release) ||
+      release.name !== pkg.name ||
+      release.version !== target) {
+    throw new Error(`The exact "${channel}" target could not be verified.`);
+  }
+  if (release.deprecated !== undefined &&
+      release.deprecated !== '') {
+    throw new Error(`The "${channel}" target is deprecated. No fallback selected.`);
+  }
+  const order = semver.compare(target, pkg.version);
+  return {
+    name: pkg.name,
+    current: pkg.version,
+    channel,
+    target,
+    status: order > 0 ? 'update-available' : order < 0 ? 'installed-ahead' : 'current',
+    updateAvailable: order > 0,
+    rollbackRequired: order < 0,
+  };
+}
+
+export function validateRegistry(registry) {
+  if (registry === undefined) return undefined;
+  const url = new URL(registry);
+  if (!['https:', 'http:'].includes(url.protocol) ||
+      url.username ||
+      url.password ||
+      url.search ||
+      url.hash) {
+    throw new Error('Registry must be an HTTP(S) URL without credentials, query, or fragment. Use npm configuration for authentication.');
+  }
+  return url.href;
+}
+
+function npmCliPath() {
+  const candidates = [];
+  if (process.env.npm_execpath) candidates.push(process.env.npm_execpath);
+  candidates.push(join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+  for (const directory of (process.env.PATH || '').split(delimiter)) {
+    if (!directory) continue;
+    candidates.push(join(directory, 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+    const launcher = join(directory, 'npm');
+    if (existsSync(launcher)) candidates.push(realpathSync(launcher));
+  }
+  const path = candidates.find((candidate) => candidate.endsWith('npm-cli.js') && existsSync(candidate));
+  if (!path) throw new Error('npm CLI not found. Install npm with Node.js or run through npm; no registry fallback was attempted.');
+  return resolve(path);
+}
+
+export async function readNpmMetadata(spec, field, { registry, cache, run = runFile } = {}) {
+  const args = [npmCliPath(), 'view', spec];
+  if (field) args.push(field);
+  args.push('--json', '--prefer-online', '--ignore-scripts', '--fetch-retries=0', '--fetch-timeout=8000', '--cache', cache);
+  if (registry !== undefined) args.push('--registry', validateRegistry(registry));
+  let stdout;
+  try {
+    ({ stdout } = await run(process.execPath, args, {
+      encoding: 'utf8', timeout: 12000, maxBuffer: 4 * 1024 * 1024, windowsHide: true,
+    }));
+  } catch {
+    // npm's diagnostics can contain private registry URLs and authentication details.
+    throw new Error('Registry metadata unavailable (offline, denied, missing, or npm failed). Check your approved npm configuration; no fallback selected.');
+  }
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    throw new Error('npm returned invalid metadata. No fallback selected.');
+  }
+}
+
+export async function checkForUpdate(pkg, { registry, read = readNpmMetadata } = {}) {
+  updateChannel(pkg);
+  registry = validateRegistry(registry);
+  // An empty cache prevents an offline/stale response from certifying channel state.
+  const cache = mkdtempSync(join(tmpdir(), 'mcp-update-'));
+  try {
+    const options = { registry, cache };
+    const tags = await read(pkg.name, 'dist-tags', options);
+    const target = channelTarget(pkg, tags);
+    const release = await read(`${pkg.name}@${target}`, undefined, options);
+    return selectUpdate(pkg, tags, release);
+  } finally {
+    rmSync(cache, { recursive: true, force: true });
+  }
+}
+
+export function updateGuidance(result, { registry, platform = process.platform } = {}) {
+  const quote = (value) => platform === 'win32'
+    ? `'${value.replaceAll("'", "''")}'`
+    : `'${value.replaceAll("'", "'\\''")}'`;
+  const registryOption = registry === undefined ? '' : ` --registry ${quote(validateRegistry(registry))}`;
+  const action = result.rollbackRequired
+    ? 'Installed CLI is ahead of its channel. This is a deliberate rollback, NOT a normal update.'
+    : result.updateAvailable ? 'A same-major CLI update is available.' : 'Installed CLI matches its channel.';
+  return [
+    `${result.name}: installed CLI ${result.current}; ${result.channel} -> ${result.target}. ${action}`,
+    'Guidance only: no package, service, autostart, or host configuration was changed.',
+    'Before replacement: identify every service using the installation root, its supervisor, autostart, port and config directory.',
+    'For a 2.x downgrade, settle/cancel batches and recover interrupted transactions with 2.x first. Keep protected backups; never delete transaction files.',
+    'Use the matching installation CLI to stop the selected managed service: mcp-pacemaker stop --port <port>.',
+    'A successful managed stop holds its supervisor/autostart until an explicit start. Older/unmanaged supervisors require separately verified OS-service shutdown and disabled autostart.',
+    'Do not overwrite ANY root still used by a bridge or supervisor: workers, helpers and UI load files later.',
+    'Only after shutdown is verified, and after a deliberate rollback decision if installed-ahead:',
+    `  npm install --global ${result.name}@${result.target}${registryOption}`,
+    'Use the same approved npm registry configuration. Prefer a separate durable version root; one global prefix replaces the shared CLI bins.',
+    'Re-register the intended durable autostart path if it changed, start deliberately, and verify backend version and a new instance ID. Refresh dashboard tabs and check active config, permissions and tool calls.',
+    'Moving to another major is a separate migration; no cross-major target was selected.',
+    'Side-by-side services need separate durable roots, config directories, HOME/host state and ports. import/init --config is an input host config, not a runtime profile.',
+  ].join('\n');
+}

package/bin/windows/PoolingSecurityHelper.build.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 1,
+  "binary": "PoolingSecurityHelper.exe",
+  "binarySha256": "effdc8deb06beab195523f714b8d1a396ec53f00b6b4a437e251a25d94234c9e",
+  "inputs": {
+    "targetFramework": ".NETFramework,Version=v4.6.2",
+    "platform": "AnyCPU",
+    "compilerVersion": "5.9.0-1.26357.3 (35d9211b841e7613c1d2f8f5af6d628ace696c4c)",
+    "compilerSha256": "3aafb7b9c54fa31a7092af35148971ee616965e7f9a0b80fb7fdc4bdd1d1a555",
+    "compilerArguments": [
+      "/nologo",
+      "/noconfig",
+      "/nostdlib+",
+      "/target:exe",
+      "/platform:anycpu",
+      "/langversion:7.3",
+      "/optimize+",
+      "/debug-",
+      "/deterministic+",
+      "/checked-",
+      "/unsafe-",
+      "/warn:4",
+      "/warnaserror+",
+      "/utf8output"
+    ],
+    "pathMap": "/_/mcp-pacemaker/windows-security-helper",
+    "sourceEncoding": "UTF-8 without BOM, LF line endings",
+    "sourceSha256": {
+      "AssemblyInfo.cs": "e81e107352fbcb82818d8265dfcdf392eac8d25df37e6d65ca7f02d1e63a6c9a",
+      "PoolingSecurityReader.cs": "91620ba5e0b3c6fcc673319f59c96466115a6be74fd8b93808f08f07087b7038",
+      "PoolingSecurityHelper.cs": "aff0222cf28258f1004908b0ad6e471d00012d5ea7dd90af163d83eb743df6f0"
+    },
+    "buildScriptSha256": "29dcb4641182bfe5552e9e913f90d4a37e99ddc7677b65b7dcb22cae16d98c60",
+    "referenceSha256": {
+      "mscorlib.dll": "7118fe658567606fa0538f7b5a2071e4606756c07e9062e1e5b24fa49e97d1f6",
+      "System.dll": "b76822f9c08aff597120e3167b3e0fbda836d6bc6f14bc4bc2eeffab5b2c6125"
+    }
+  }
+}

package/bin/windows/src/AssemblyInfo.cs

@@ -0,0 +1,11 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+
+[assembly: AssemblyTitle("mcp-pacemaker Windows security helper")]
+[assembly: AssemblyDescription("Inspects and preserves configuration file security.")]
+[assembly: AssemblyProduct("mcp-pacemaker")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: ComVisible(false)]
+[assembly: TargetFramework(".NETFramework,Version=v4.6.2")]

package/bin/windows/src/PoolingSecurityHelper.cs

@@ -0,0 +1,165 @@
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Security.AccessControl;
+using System.Security.Cryptography;
+
+public sealed class PoolingSecurityHelper
+{
+    private readonly PoolingSecurityReader nativeReader = new PoolingSecurityReader();
+    private readonly AccessControlSections sections =
+        AccessControlSections.Access | AccessControlSections.Owner | AccessControlSections.Group;
+
+    /// <summary>Inspects or preserves Windows file security.</summary>
+    /// <param name="args">One action: inspect or copy. File paths come from MCP_POOL environment variables.</param>
+    /// <returns>Zero on success, three on a source security conflict, or one on failure.</returns>
+    public static int Main(string[] args)
+    {
+        return new PoolingSecurityHelper().Run(args);
+    }
+
+    /// <summary>Runs a security operation without changing file contents.</summary>
+    /// <param name="args">One action: inspect or copy.</param>
+    /// <returns>Zero on success, three on a source security conflict, or one on failure.</returns>
+    public int Run(string[] args)
+    {
+        try
+        {
+            if (args.Length != 1)
+            {
+                throw new ArgumentException();
+            }
+
+            var sourcePath = this.RequiredEnvironment("MCP_POOL_SOURCE");
+            if (args[0] == "inspect")
+            {
+                Console.WriteLine(this.ReadSecurity(sourcePath).Fingerprint);
+                return 0;
+            }
+
+            if (args[0] == "copy")
+            {
+                return this.CopySecurity(sourcePath);
+            }
+
+            throw new ArgumentException();
+        }
+        catch (Exception error)
+        {
+            Console.Error.WriteLine("MCPERR type=" + error.GetType().Name);
+            var nativeError = error as Win32Exception;
+            if (nativeError != null)
+            {
+                Console.Error.WriteLine("MCPERR nativeError=" + nativeError.NativeErrorCode);
+            }
+
+            return 1;
+        }
+    }
+
+    private string RequiredEnvironment(string name)
+    {
+        var value = Environment.GetEnvironmentVariable(name);
+        if (string.IsNullOrEmpty(value))
+        {
+            throw new ArgumentException();
+        }
+
+        return value;
+    }
+
+    private SecurityState ReadSecurity(string path)
+    {
+        var acl = File.GetAccessControl(path);
+        var descriptor = acl.GetSecurityDescriptorSddlForm(this.sections);
+        var native = this.nativeReader.ReadControlDescriptor(path);
+        bool complete = true;
+        var audit = new byte[0];
+        try
+        {
+            audit = this.ReadAudit(path);
+        }
+        catch (PrivilegeNotHeldException)
+        {
+            complete = false;
+        }
+        catch (UnauthorizedAccessException)
+        {
+            complete = false;
+        }
+
+        int attributes = (int)File.GetAttributes(path);
+        using (var hash = SHA256.Create())
+        using (var buffer = new MemoryStream())
+        using (var writer = new BinaryWriter(buffer))
+        {
+            writer.Write(native.Length);
+            writer.Write(native);
+            writer.Write(audit.Length);
+            writer.Write(audit);
+            writer.Write(attributes);
+            writer.Flush();
+            var scope = complete ? "F:" : "P:";
+            return new SecurityState
+            {
+                Descriptor = descriptor,
+                Fingerprint = scope + Convert.ToBase64String(hash.ComputeHash(buffer.ToArray())),
+            };
+        }
+    }
+
+    private byte[] ReadAudit(string path)
+    {
+        return File.GetAccessControl(path, AccessControlSections.Audit).GetSecurityDescriptorBinaryForm();
+    }
+
+    private int CopySecurity(string sourcePath)
+    {
+        var expectedFingerprint = this.RequiredEnvironment("MCP_POOL_SECURITY");
+        var source = this.ReadSecurity(sourcePath);
+        if (!string.Equals(source.Fingerprint, expectedFingerprint, StringComparison.Ordinal))
+        {
+            return 3;
+        }
+
+        var paths = new[]
+        {
+            this.RequiredEnvironment("MCP_POOL_TEMP"),
+            this.RequiredEnvironment("MCP_POOL_BACKUP"),
+        };
+        foreach (var path in paths)
+        {
+            var actual = File.GetAccessControl(path);
+            if (!string.Equals(actual.GetSecurityDescriptorSddlForm(this.sections),
+                source.Descriptor, StringComparison.Ordinal))
+            {
+                var copy = new FileSecurity();
+                copy.SetSecurityDescriptorSddlForm(source.Descriptor, this.sections);
+                File.SetAccessControl(path, copy);
+                actual = File.GetAccessControl(path);
+            }
+
+            if (!string.Equals(actual.GetSecurityDescriptorSddlForm(this.sections),
+                source.Descriptor, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException();
+            }
+
+            if (!string.Equals(this.ReadSecurity(path).Fingerprint,
+                expectedFingerprint, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException();
+            }
+        }
+
+        return string.Equals(this.ReadSecurity(sourcePath).Fingerprint,
+            expectedFingerprint, StringComparison.Ordinal) ? 0 : 3;
+    }
+
+    private sealed class SecurityState
+    {
+        public string Descriptor { get; set; }
+
+        public string Fingerprint { get; set; }
+    }
+}

package/bin/windows/src/PoolingSecurityReader.cs

@@ -0,0 +1,50 @@
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+
+public sealed class PoolingSecurityReader
+{
+    private const uint ReadControlSections = 0x1f7;
+
+    /// <summary>Reads native owner, DACL and non-audit security sections.</summary>
+    /// <param name="path">File whose descriptor is queried.</param>
+    /// <returns>The unfiltered sections in canonical binary form.</returns>
+    public byte[] ReadControlDescriptor(string path)
+    {
+        var descriptor = IntPtr.Zero;
+        try
+        {
+            uint status = GetNamedSecurityInfo(path, 1, ReadControlSections,
+                IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out descriptor);
+            if (status != 0)
+            {
+                throw new Win32Exception((int)status);
+            }
+
+            var native = new byte[GetSecurityDescriptorLength(descriptor)];
+            Marshal.Copy(descriptor, native, 0, native.Length);
+            var raw = new RawSecurityDescriptor(native, 0);
+            var canonical = new byte[raw.BinaryLength];
+            raw.GetBinaryForm(canonical, 0);
+            return canonical;
+        }
+        finally
+        {
+            if (descriptor != IntPtr.Zero)
+            {
+                LocalFree(descriptor);
+            }
+        }
+    }
+
+    [DllImport("advapi32.dll", EntryPoint = "GetNamedSecurityInfoW", CharSet = CharSet.Unicode)]
+    private static extern uint GetNamedSecurityInfo(string path, uint objectType, uint sections,
+        IntPtr owner, IntPtr group, IntPtr dacl, IntPtr sacl, out IntPtr descriptor);
+
+    [DllImport("advapi32.dll")]
+    private static extern uint GetSecurityDescriptorLength(IntPtr descriptor);
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr LocalFree(IntPtr memory);
+}