nexarch 0.12.22 → 0.12.25

package/dist/lib/mcp.js

@@ -33,7 +33,13 @@ async function requestOnce(method, params, options) {
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${creds.token}`,
-                "x-company-id": companyId,
+                // Scoped tokens carry their company_id server-side (see
+                // auth.ts's resolveCompanyId) and never populate creds.companyId
+                // locally, so an empty header here is the expected normal case —
+                // sending it as a literal empty string, rather than omitting it,
+                // used to matter for legacy static tokens where the header is the
+                // only source of truth. Omit rather than send "".
+                ...(companyId ? { "x-company-id": companyId } : {}),
                 "Content-Length": Buffer.byteLength(body),
             },
             timeout: REQUEST_TIMEOUT_MS,
@@ -93,7 +99,16 @@ async function callMcpRpc(method, params = {}, options = {}) {
     throw lastError instanceof Error ? lastError : new Error(String(lastError ?? "MCP call failed"));
 }
 export async function callMcpTool(toolName, toolArgs = {}, options = {}) {
-    return callMcpRpc("tools/call", { name: toolName, arguments: toolArgs }, options);
+    // Every gateway tool schema declares companyId as z.string().uuid().optional() —
+    // "optional" means absent, not empty. Call sites pass creds.companyId
+    // unconditionally, which is "" for a scoped token (see credentials.ts);
+    // sent as a literal "", that fails .uuid() and the tool call is refused
+    // outright instead of falling back to the header/token-derived company.
+    // Single choke point: every call site funnels through here.
+    const toolArguments = { ...toolArgs };
+    if (toolArguments.companyId === "")
+        delete toolArguments.companyId;
+    return callMcpRpc("tools/call", { name: toolName, arguments: toolArguments }, options);
 }
 export async function mcpInitialize(options = {}) {
     return callMcpRpc("initialize", {

package/dist/lib/trust.js

@@ -1,11 +1,18 @@
 import https from "https";
 import { requireCredentials } from "./credentials.js";
 const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
-export async function requestTrustAttestation(agentId) {
+/**
+ * `contentHash` (sha256 hex of the exact managed-section text being written)
+ * binds the signature to the instructions themselves, not just to the claim
+ * that Nexarch minted *a* token for this agent — see ADR-0112. Omit it only
+ * when there is no section body yet to hash.
+ */
+export async function requestTrustAttestation(agentId, contentHash) {
     const creds = requireCredentials();
     const body = JSON.stringify({
         agentId,
-        scope: "instruction_injection",
+        scope: "agent_config_write",
+        ...(contentHash ? { contentHash } : {}),
     });
     return new Promise((resolve) => {
         const url = new URL("/trust/attest", MCP_GATEWAY_URL);

package/dist/lib/update-check.js

@@ -0,0 +1,109 @@
+import { homedir } from "os";
+import { join } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { cliVersion } from "./version.js";
+/**
+ * Best-effort "a newer version exists" advisory (feature request #1).
+ *
+ * Checked once per day per machine, not on every invocation — a network call
+ * on every single command would make the CLI feel like it always has a
+ * network dependency, when almost nothing else about a status check does.
+ * The result is cached in the same ~/.nexarch directory as credentials.json,
+ * so most invocations skip the network entirely and this costs nothing.
+ *
+ * Kicked off at the very start of the process and only awaited (with a short
+ * cap) right before the CLI would otherwise exit, so it rides alongside
+ * whatever network calls the command itself is already making rather than
+ * adding its own visible delay.
+ */
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1500;
+/** How long we're willing to wait for an in-flight check before giving up on printing it this run. */
+const PRINT_GRACE_MS = 200;
+function cacheDir() {
+    return join(homedir(), ".nexarch");
+}
+function cachePath() {
+    return join(cacheDir(), "update-check.json");
+}
+function readCache() {
+    try {
+        if (!existsSync(cachePath()))
+            return null;
+        const parsed = JSON.parse(readFileSync(cachePath(), "utf8"));
+        if (typeof parsed.lastCheckedAt !== "string" || typeof parsed.latestVersion !== "string")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(cache) {
+    try {
+        mkdirSync(cacheDir(), { recursive: true });
+        writeFileSync(cachePath(), JSON.stringify(cache), "utf8");
+    }
+    catch {
+        // Best effort — a cache write failure should never surface to the user.
+    }
+}
+async function fetchLatestVersion() {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch("https://registry.npmjs.org/nexarch/latest", { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return typeof body.version === "string" ? body.version : null;
+    }
+    catch {
+        // Offline, registry down, DNS failure, timeout — all the same outcome: say nothing.
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Plain numeric semver compare — good enough for release versions, no pre-release handling needed. */
+function isNewer(latest, current) {
+    const a = latest.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    const b = current.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+        const x = a[i] ?? 0;
+        const y = b[i] ?? 0;
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}
+/**
+ * Starts the check immediately; resolves to update info only when the
+ * installed copy is actually behind. Never rejects.
+ */
+export async function checkForUpdate() {
+    const current = cliVersion();
+    const cache = readCache();
+    const cacheIsFresh = cache && Date.now() - new Date(cache.lastCheckedAt).getTime() < CHECK_INTERVAL_MS;
+    const latest = cacheIsFresh ? cache.latestVersion : await fetchLatestVersion();
+    if (!cacheIsFresh && latest) {
+        writeCache({ lastCheckedAt: new Date().toISOString(), latestVersion: latest });
+    }
+    if (!latest || !isNewer(latest, current))
+        return null;
+    return { current, latest };
+}
+/**
+ * Awaits an in-flight check with a short grace period and prints the
+ * advisory to stderr if it's ready and outdated — stderr so it never
+ * contaminates a command's --json stdout for an agent caller parsing it.
+ */
+export async function printUpdateNoticeIfReady(pending) {
+    const timeout = new Promise((resolve) => setTimeout(() => resolve(null), PRINT_GRACE_MS));
+    const info = await Promise.race([pending, timeout]);
+    if (!info)
+        return;
+    process.stderr.write(`\nA newer version of nexarch is available: ${info.current} -> ${info.latest}\n` +
+        `Run with npx nexarch@latest to use it — npx always fetches latest, nothing to install.\n`);
+}

package/package.json

@@ -1,35 +1,36 @@
-{
-  "name": "nexarch",
-  "version": "0.12.22",
-  "description": "Your architecture workspace for AI delivery.",
-  "keywords": [
-    "nexarch",
-    "mcp",
-    "architecture",
-    "ai"
-  ],
-  "license": "MIT",
-  "author": "Nexarch <hello@nexarch.ai>",
-  "homepage": "https://nexarch.ai",
-  "engines": {
-    "node": ">=18"
-  },
-  "type": "module",
-  "bin": {
-    "nexarch": "dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit"
-  },
-  "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4",
-    "typescript": "^5"
-  }
-}
+{
+  "name": "nexarch",
+  "version": "0.12.25",
+  "description": "Your architecture workspace for AI delivery.",
+  "keywords": [
+    "nexarch",
+    "mcp",
+    "architecture",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "Nexarch <hello@nexarch.ai>",
+  "homepage": "https://nexarch.ai",
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "bin": {
+    "nexarch": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "tsc",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx scripts/test-mcp-proxy-response.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "tsx": "^4",
+    "typescript": "^5"
+  }
+}