metheus-governance-mcp-cli 0.2.35 → 0.2.36

package/cli.mjs

@@ -4048,6 +4048,28 @@ async function runProxy(flags) {
   // Proxy-initiated requests (e.g., roots/list) pending client responses.
   const pendingProxyRequests = new Map(); // id → callback(responseObj)
   let proxyRequestIdCounter = 0;
+  let stdoutEnvelopeMode = "line"; // "line" | "framed"
+
+  function writeProxyMessage(messageText) {
+    const normalized = String(messageText || "").trim();
+    if (!normalized) return;
+    if (stdoutEnvelopeMode === "framed") {
+      const contentLength = Buffer.byteLength(normalized, "utf8");
+      process.stdout.write(`Content-Length: ${contentLength}\r\n\r\n${normalized}`);
+      return;
+    }
+    process.stdout.write(`${normalized}\n`);
+  }
+
+  function writeProxyJson(payload) {
+    writeProxyMessage(JSON.stringify(payload));
+  }
+
+  function clientSupportsRootsList(initParamsRaw) {
+    const initParams = safeObject(initParamsRaw);
+    const capabilities = safeObject(initParams.capabilities);
+    return Object.prototype.hasOwnProperty.call(capabilities, "roots");
+  }
 
   /**
    * Probe the MCP client for workspace roots via the standard roots/list request.
@@ -4093,7 +4115,7 @@ async function runProxy(flags) {
         } catch { /* best-effort */ }
       }
     }, 10000);
-    process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id, method: "roots/list" })}\n`);
+    writeProxyJson({ jsonrpc: "2.0", id, method: "roots/list" });
   }
 
   const handleIncomingMessage = async (lineRaw) => {
@@ -4102,7 +4124,7 @@ async function runProxy(flags) {
 
     const requestObj = tryJsonParse(line);
     if (requestObj == null) {
-      process.stdout.write(`${JSON.stringify(jsonRpcError(null, -32700, "parse error"))}\n`);
+      writeProxyJson(jsonRpcError(null, -32700, "parse error"));
       return;
     }
 
@@ -4141,16 +4163,14 @@ async function runProxy(flags) {
           ? `; expired token ignored: ${resolved.expired.source}${resolved.expired.expires ? ` (${resolved.expired.expires})` : ""}`
           : "";
       const refreshHint = lastRefreshError ? `; refresh failed: ${lastRefreshError}` : "";
-      process.stdout.write(
-        `${JSON.stringify(
-          jsonRpcError(
-            requestObj,
-            -32001,
-            `missing auth token (set METHEUS_TOKEN or run 'metheus-governance-mcp auth login --base-url ${normalizeSiteBaseURL(
-              args.baseURL,
-            )}'; login: ${helpURL}${expiredHint}${refreshHint})`,
-          ),
-        )}\n`,
+      writeProxyJson(
+        jsonRpcError(
+          requestObj,
+          -32001,
+          `missing auth token (set METHEUS_TOKEN or run 'metheus-governance-mcp auth login --base-url ${normalizeSiteBaseURL(
+            args.baseURL,
+          )}'; login: ${helpURL}${expiredHint}${refreshHint})`,
+        ),
       );
       return;
     }
@@ -4239,15 +4259,11 @@ async function runProxy(flags) {
         }),
       ).trim();
       if (!projectID) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, "project_id is required (or set --project-id during setup)"))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, "project_id is required (or set --project-id during setup)"));
         return;
       }
       if (!isUUID(projectID)) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, "project_id must be a valid UUID"))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, "project_id must be a valid UUID"));
         return;
       }
       try {
@@ -4274,23 +4290,19 @@ async function runProxy(flags) {
           workspaceSignalTrusted,
         });
         const text = buildProjectSummaryText(summary);
-        process.stdout.write(
-          `${JSON.stringify(
-            jsonRpcResult(requestObj, {
-              content: [
-                {
-                  type: "text",
-                  text,
-                },
-              ],
-              structuredContent: summary,
-            }),
-          )}\n`,
+        writeProxyJson(
+          jsonRpcResult(requestObj, {
+            content: [
+              {
+                type: "text",
+                text,
+              },
+            ],
+            structuredContent: summary,
+          }),
         );
       } catch (err) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, String(err?.message || err)))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, String(err?.message || err)));
       }
       return;
     }
@@ -4303,15 +4315,11 @@ async function runProxy(flags) {
         }),
       ).trim();
       if (!projectID) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, "project_id is required (or set --project-id during setup)"))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, "project_id is required (or set --project-id during setup)"));
         return;
       }
       if (!isUUID(projectID)) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, "project_id must be a valid UUID"))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, "project_id must be a valid UUID"));
         return;
       }
 
@@ -4320,14 +4328,12 @@ async function runProxy(flags) {
           const statusRaw = String(toolArgs.status || "").trim().toLowerCase();
           const statusFilter = normalizeMergeStatusFilter(statusRaw);
           if (statusRaw && !statusFilter) {
-            process.stdout.write(
-              `${JSON.stringify(
-                jsonRpcError(
-                  requestObj,
-                  -32001,
-                  "status must be one of: open, review, approved, rejected, merged, closed, all",
-                ),
-              )}\n`,
+            writeProxyJson(
+              jsonRpcError(
+                requestObj,
+                -32001,
+                "status must be one of: open, review, approved, rejected, merged, closed, all",
+              ),
             );
             return;
           }
@@ -4342,13 +4348,11 @@ async function runProxy(flags) {
             workspaceDir: requestWorkspaceDir,
           });
           const text = buildCtxpackMergeBriefText(brief);
-          process.stdout.write(
-            `${JSON.stringify(
-              jsonRpcResult(requestObj, {
-                content: [{ type: "text", text }],
-                structuredContent: brief,
-              }),
-            )}\n`,
+          writeProxyJson(
+            jsonRpcResult(requestObj, {
+              content: [{ type: "text", text }],
+              structuredContent: brief,
+            }),
           );
           return;
         }
@@ -4360,16 +4364,12 @@ async function runProxy(flags) {
             toolArgs.owner_confirmation || toolArgs.ownerConfirmation || "",
           ).trim();
           if (!mergeRequestID || !isUUID(mergeRequestID)) {
-            process.stdout.write(
-              `${JSON.stringify(jsonRpcError(requestObj, -32001, "merge_request_id must be a valid UUID"))}\n`,
-            );
+            writeProxyJson(jsonRpcError(requestObj, -32001, "merge_request_id must be a valid UUID"));
             return;
           }
           if (!action) {
-            process.stdout.write(
-              `${JSON.stringify(
-                jsonRpcError(requestObj, -32001, "action must be one of: review, approve, reject, close, merge"),
-              )}\n`,
+            writeProxyJson(
+              jsonRpcError(requestObj, -32001, "action must be one of: review, approve, reject, close, merge"),
             );
             return;
           }
@@ -4384,20 +4384,16 @@ async function runProxy(flags) {
             workspaceDir: requestWorkspaceDir,
           });
           const text = buildCtxpackMergeExecuteText(result);
-          process.stdout.write(
-            `${JSON.stringify(
-              jsonRpcResult(requestObj, {
-                content: [{ type: "text", text }],
-                structuredContent: result,
-              }),
-            )}\n`,
+          writeProxyJson(
+            jsonRpcResult(requestObj, {
+              content: [{ type: "text", text }],
+              structuredContent: result,
+            }),
           );
           return;
         }
       } catch (err) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, String(err?.message || err)))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, String(err?.message || err)));
         return;
       }
     }
@@ -4429,7 +4425,7 @@ async function runProxy(flags) {
               requestWorkspaceDir,
               workspaceSignalTrusted,
             );
-            process.stdout.write(`${JSON.stringify(patched)}\n`);
+            writeProxyJson(patched);
             return;
           }
           if (isJsonRpcMethod(requestObj, "tools/list")) {
@@ -4445,10 +4441,12 @@ async function runProxy(flags) {
                 `[${new Date().toISOString()}] initialize: clientInfo=${JSON.stringify(initParams.clientInfo || {})} capabilities=${JSON.stringify(initParams.capabilities || {})} rootUri=${initParams.rootUri || "(none)"} workspaceFolders=${JSON.stringify(initParams.workspaceFolders || []).substring(0, 300)}\n`,
               );
             } catch { /* best-effort */ }
-            // Probe client workspace roots via MCP roots/list protocol.
-            // Use setImmediate so the initialize response is flushed to stdout first;
-            // the client must see the response before it can handle server-initiated requests.
-            setImmediate(() => sendRootsListProbe());
+            // Probe roots/list only when client advertised roots capability.
+            // Some MCP clients reject unsolicited server requests and then hide tools.
+            if (clientSupportsRootsList(requestObj?.params)) {
+              // Use setImmediate so the initialize response is flushed first.
+              setImmediate(() => sendRootsListProbe());
+            }
           } else if (isJsonRpcMethod(requestObj, "tools/call") && toolName === "workitem.list") {
             patched = await appendWorkitemListHints(patched, args, toolArgs, token, workspaceSignalTrusted);
           } else if (isJsonRpcMethod(requestObj, "tools/call") && toolName === "ctxpack.ensure") {
@@ -4463,21 +4461,17 @@ async function runProxy(flags) {
           if (autoSyncSummary) {
             patched = appendAutoCtxpackSyncHint(patched, autoSyncSummary);
           }
-          process.stdout.write(`${JSON.stringify(patched)}\n`);
+          writeProxyJson(patched);
           return;
         }
-        process.stdout.write(`${responseText}\n`);
+        writeProxyMessage(responseText);
         return;
       }
       if (Object.prototype.hasOwnProperty.call(requestObj, "id")) {
-        process.stdout.write(
-          `${JSON.stringify(jsonRpcError(requestObj, -32001, "empty gateway response"))}\n`,
-        );
+        writeProxyJson(jsonRpcError(requestObj, -32001, "empty gateway response"));
       }
     } catch (err) {
-      process.stdout.write(
-        `${JSON.stringify(jsonRpcError(requestObj, -32001, String(err?.message || err)))}\n`,
-      );
+      writeProxyJson(jsonRpcError(requestObj, -32001, String(err?.message || err)));
     }
   };
 
@@ -4576,6 +4570,7 @@ async function runProxy(flags) {
       if (pendingInputBuffer.length === 0) break;
 
       if (startsWithContentLengthHeader(pendingInputBuffer)) {
+        stdoutEnvelopeMode = "framed";
         const framed = extractFramedMessage(pendingInputBuffer);
         if (!framed) break;
         pendingInputBuffer = framed.remaining;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.35",
+  "version": "0.2.36",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [