mishmar 0.2.0 → 0.3.0

package/README.md

@@ -1,13 +1,25 @@
 # mishmar (TypeScript)
 
-The TypeScript client for [Mishmar](https://mishmar.io): build a proposal,
-sign it with the agent's key, send it to the engine, read the decision. No
-runtime dependencies; Node 20 or later.
+[Mishmar](https://mishmar.io) is a risk management layer for trading bots
+and AI agents: every order is checked against your limits before it reaches
+the exchange, large orders wait for your approval, and no key can trade
+alone.
+
+This is the TypeScript client: build a proposal, sign it with the agent's
+key, send it to the engine, read the decision. No runtime dependencies; Node
+20 or later.
 
 ```sh
 npm install mishmar
 ```
 
+The package also puts `mishmar` on the path, so `npx -y mishmar mcp` runs
+the MCP server and `npx -y mishmar signer run` the signer without the CLI
+installed: the command runs the binary found through `MISHMAR_BIN`, the
+PATH or `~/.mishmar/bin`, and when there is none fetches the pinned release
+(v0.2.2) into `~/.mishmar/bin` first, checked against the release's
+checksums.
+
 ```ts
 import { AgentKey, Client } from "mishmar";
 

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// `mishmar` on npm: runs the real binary with these arguments (see wrapper.ts).
+import { main } from "./wrapper.js";
+process.exitCode = await main(import.meta.url);

package/dist/index.d.ts

@@ -5,5 +5,5 @@ export { Client, DEFAULT_RETRIES, EngineError, resolved, retryWait } from "./cli
 export type { ClientOptions, Decision, DecisionPage, Retries, SignRequest, SignerAnswer } from "./client.ts";
 export { fromWire, isDecimal, rfc3339, sign, signingBytes, toWire, validate } from "./proposal.ts";
 export type { Kind, OrderType, Proposal, Scheme, Side, VenueMessage, WireProposal } from "./proposal.ts";
-export { Signer, downloadBinary, findBinary, platformName, RELEASES } from "./signer.ts";
-export type { ConnectOptions, OrderIntent, SignerOptions } from "./signer.ts";
+export { Signer, downloadBinary, findBinary, platformName, RELEASE, RELEASES } from "./signer.ts";
+export type { ConnectOptions, FindBinaryOptions, OrderIntent, SignerOptions } from "./signer.ts";

package/dist/index.js

@@ -2,4 +2,4 @@ export { AgentKey, HEADER_KEY_ID, HEADER_NONCE, HEADER_SIGNATURE, HEADER_SIGNED_
 export { canonicalBytes, canonicalJson } from "./canon.js";
 export { Client, DEFAULT_RETRIES, EngineError, resolved, retryWait } from "./client.js";
 export { fromWire, isDecimal, rfc3339, sign, signingBytes, toWire, validate } from "./proposal.js";
-export { Signer, downloadBinary, findBinary, platformName, RELEASES } from "./signer.js";
+export { Signer, downloadBinary, findBinary, platformName, RELEASE, RELEASES } from "./signer.js";

package/dist/signer.d.ts

@@ -31,13 +31,22 @@
 import type { ChildProcess } from "node:child_process";
 import type { Decision, DecisionPage } from "./client.ts";
 export declare const RELEASES = "https://github.com/mishmar-io/mishmar/releases/download";
+/** The release the SDK fetches when it has to (the npm bin: `npx -y mishmar …`); bumped with each release. */
+export declare const RELEASE = "v0.2.2";
 /** The release asset's os_arch for this machine: linux_amd64, darwin_arm64, … */
 export declare function platformName(): string;
+/** What `findBinary` passes over on the PATH; the argument and `MISHMAR_BIN` are always taken as given. */
+export interface FindBinaryOptions {
+    /** Skip a `mishmar` that is a script (starts with `#!`): the binary is native, and a script by that name is a wrapper such as the npm or PyPI one. */
+    skipScripts?: boolean;
+    /** Real paths never to return: a wrapper's own, so it does not run itself. */
+    exclude?: string[];
+}
 /**
  * Where the mishmar binary is: the argument, `MISHMAR_BIN`, the PATH, or a
  * release `downloadBinary` fetched. Throws with what to do when there is none.
  */
-export declare function findBinary(explicit?: string): Promise<string>;
+export declare function findBinary(explicit?: string, options?: FindBinaryOptions): Promise<string>;
 /**
  * Fetch the release `version` (a tag, v0.1.0) for this machine into `destDir`
  * (default `~/.mishmar/bin/<version>`), after checking its SHA-256 against the

package/dist/signer.js

@@ -31,13 +31,15 @@
 import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { access, chmod, mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, mkdtemp, open, readdir, realpath, rm, writeFile } from "node:fs/promises";
 import * as http from "node:http";
 import * as net from "node:net";
 import { arch, homedir, platform, tmpdir } from "node:os";
 import * as path from "node:path";
 import { EngineError, resolved } from "./client.js";
 export const RELEASES = "https://github.com/mishmar-io/mishmar/releases/download";
+/** The release the SDK fetches when it has to (the npm bin: `npx -y mishmar …`); bumped with each release. */
+export const RELEASE = "v0.2.2";
 const ENV_BINARY = "MISHMAR_BIN";
 const ENV_LOCAL_TOKEN = "MISHMAR_LOCAL_TOKEN";
 /** The release asset's os_arch for this machine: linux_amd64, darwin_arm64, … */
@@ -62,27 +64,49 @@ async function executable(p) {
         return false;
     }
 }
+/** Whether the file starts with `#!`: a script, never the mishmar binary itself. */
+async function isScript(p) {
+    const f = await open(p, "r");
+    try {
+        const { bytesRead, buffer } = await f.read(Buffer.alloc(2), 0, 2, 0);
+        return bytesRead === 2 && buffer[0] === 0x23 && buffer[1] === 0x21;
+    }
+    finally {
+        await f.close();
+    }
+}
 /**
  * Where the mishmar binary is: the argument, `MISHMAR_BIN`, the PATH, or a
  * release `downloadBinary` fetched. Throws with what to do when there is none.
  */
-export async function findBinary(explicit) {
-    const candidates = [explicit, process.env[ENV_BINARY]];
+export async function findBinary(explicit, options = {}) {
+    for (const c of [explicit, process.env[ENV_BINARY]])
+        if (await executable(c))
+            return c;
     const name = exe("mishmar");
-    for (const dir of (process.env.PATH ?? "").split(path.delimiter))
-        if (dir)
-            candidates.push(path.join(dir, name));
+    for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const c = path.join(dir, name);
+        if (!(await executable(c)))
+            continue;
+        if (options.skipScripts && (await isScript(c)))
+            continue;
+        if (options.exclude?.length && options.exclude.includes(await realpath(c).catch(() => c)))
+            continue;
+        return c;
+    }
     const home = path.join(homedir(), ".mishmar", "bin");
     try {
-        for (const version of (await readdir(home)).sort().reverse())
-            candidates.push(path.join(home, version, name));
+        for (const version of (await readdir(home)).sort().reverse()) {
+            const c = path.join(home, version, name);
+            if (await executable(c))
+                return c;
+        }
     }
     catch {
         // no downloads yet
     }
-    for (const c of candidates)
-        if (await executable(c))
-            return c;
     throw new Error("no mishmar binary: install it from https://github.com/mishmar-io/mishmar/releases (or call downloadBinary(version)), put it on the PATH or in MISHMAR_BIN");
 }
 /**

package/dist/wrapper.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `mishmar` as an npm bin: `npx -y mishmar mcp`, or any other mishmar
+ * command, without installing the CLI first. It finds the real binary
+ * (`MISHMAR_BIN`, the PATH less any wrapper such as this one, then
+ * `~/.mishmar/bin`), fetches the pinned release when there is none, and runs
+ * it with the same arguments, stdin, stdout and stderr, so stdout stays the
+ * MCP channel; it writes nothing there itself. It forwards SIGINT and SIGTERM
+ * and exits with the binary's code.
+ */
+/**
+ * The binary for the wrapper at `self` (the running script's path) to run:
+ * found, or fetched into `~/.mishmar/bin/<release>`. `log` gets one line
+ * when a download starts.
+ */
+export declare function resolveBinary(self: string, log?: (line: string) => void): Promise<string>;
+/** Run the binary with `argv`; the exit code to end this process with. */
+export declare function main(selfUrl: string, argv?: string[]): Promise<number>;

package/dist/wrapper.js

@@ -0,0 +1,58 @@
+/**
+ * `mishmar` as an npm bin: `npx -y mishmar mcp`, or any other mishmar
+ * command, without installing the CLI first. It finds the real binary
+ * (`MISHMAR_BIN`, the PATH less any wrapper such as this one, then
+ * `~/.mishmar/bin`), fetches the pinned release when there is none, and runs
+ * it with the same arguments, stdin, stdout and stderr, so stdout stays the
+ * MCP channel; it writes nothing there itself. It forwards SIGINT and SIGTERM
+ * and exits with the binary's code.
+ */
+import { spawn } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { constants as osConstants } from "node:os";
+import { fileURLToPath } from "node:url";
+import { RELEASE, downloadBinary, findBinary, platformName } from "./signer.js";
+/** Set on the binary this wrapper starts; a wrapper that finds it set has been started by another wrapper, which means it resolved to itself. */
+const ENV_WRAPPED = "MISHMAR_WRAPPED";
+/**
+ * The binary for the wrapper at `self` (the running script's path) to run:
+ * found, or fetched into `~/.mishmar/bin/<release>`. `log` gets one line
+ * when a download starts.
+ */
+export async function resolveBinary(self, log = () => { }) {
+    const exclude = [await realpath(self).catch(() => self)];
+    try {
+        return await findBinary(undefined, { skipScripts: true, exclude });
+    }
+    catch {
+        log(`mishmar: fetching release ${RELEASE} for ${platformName()} into ~/.mishmar/bin/${RELEASE}`);
+        return await downloadBinary(RELEASE);
+    }
+}
+/** Run the binary with `argv`; the exit code to end this process with. */
+export async function main(selfUrl, argv = process.argv.slice(2)) {
+    const stderr = (line) => process.stderr.write(line + "\n");
+    if (process.env[ENV_WRAPPED]) {
+        stderr("mishmar: this wrapper was started by another wrapper, so the PATH holds no mishmar binary; set MISHMAR_BIN to it");
+        return 2;
+    }
+    let binary;
+    try {
+        binary = await resolveBinary(fileURLToPath(selfUrl), stderr);
+    }
+    catch (err) {
+        stderr(`mishmar: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    const child = spawn(binary, argv, { stdio: "inherit", env: { ...process.env, [ENV_WRAPPED]: "1" } });
+    const forward = (signal) => child.kill(signal);
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    return new Promise((resolve) => {
+        child.on("error", (err) => {
+            stderr(`mishmar: ${binary}: ${err.message}`);
+            resolve(1);
+        });
+        child.on("exit", (code, signal) => resolve(code ?? (signal ? 128 + (osConstants.signals[signal] ?? 0) : 1)));
+    });
+}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "mishmar",
-  "version": "0.2.0",
-  "description": "Mishmar client: sign and submit proposals to the engine that guards your trading agent",
+  "version": "0.3.0",
+  "mcpName": "io.github.mishmar-io/mishmar",
+  "description": "Mishmar is a risk management layer for trading bots and AI agents: every order is checked against your limits before it reaches the exchange, large orders wait for your approval, and no key can trade alone. The TypeScript SDK: run the agent's signer, propose orders, read decisions.",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -10,6 +11,9 @@
       "import": "./dist/index.js"
     }
   },
+  "bin": {
+    "mishmar": "./dist/bin.js"
+  },
   "files": [
     "dist"
   ],
@@ -17,7 +21,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && chmod +x dist/bin.js",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
     "test": "node --test \"tests/**/*.test.ts\""
@@ -34,10 +38,14 @@
   "homepage": "https://mishmar.io",
   "keywords": [
     "trading",
-    "agents",
-    "risk",
-    "guardrails",
+    "trading-bot",
+    "ai-agents",
+    "risk-management",
+    "pre-trade-risk",
     "hyperliquid",
-    "binance"
+    "binance",
+    "mpc",
+    "threshold-signatures",
+    "mcp"
   ]
 }