opindex-agent 0.2.0 → 0.2.1

package/mcp/server.mjs

@@ -33,6 +33,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import { PublicKey, VersionedTransaction } from '@solana/web3.js';
 import {
   createAssociatedTokenAccountIdempotentInstruction,
@@ -47,6 +48,16 @@ import { wallet } from '../src/wallet.mjs';
 import { connection, returnAddress, rpcSource } from '../src/returns.mjs';
 
 const USDC = new PublicKey('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v');
+
+/**
+ * The version that is actually running, read from the package that shipped it.
+ *
+ * Hosts install this with `npx` or with `npm install -g`, and the second never
+ * updates itself. A stale client looks exactly like a current one from inside
+ * a conversation -- fewer tools, older descriptions -- so `agent_wallet` says
+ * which one this is, and the person can compare it with npm's latest.
+ */
+const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 const PUBLIC_RPC = 'https://api.mainnet-beta.solana.com';
 
 const mint = z.string().regex(/^[1-9A-HJ-NP-Za-km-z]{32,44}$/, 'a base58 Solana mint address');
@@ -98,7 +109,7 @@ async function paid(tool, args, { method, body, query } = {}) {
   return { status: response.status, body: parsed, paid: response.headers.has('payment-response') };
 }
 
-const server = new McpServer({ name: 'opindex', version: '0.2.0' });
+const server = new McpServer({ name: 'opindex', version: VERSION });
 
 // ---------------------------------------------------------------- free tools
 
@@ -149,6 +160,10 @@ server.registerTool(
         ? `derived from the chain: the first USDC transfer in, ${ret.signature}`
         : ret.why,
       rpc: rpcSource(),
+      client_version: VERSION,
+      client_update:
+        'Compare client_version with `npm view opindex-agent version`. Installed globally (command `opindex-mcp`), ' +
+        'it never updates itself: `npm install -g opindex-agent@latest`, then restart the host.',
       note:
         'The agent needs no SOL to pay for answers — the service\'s facilitator pays that network fee. ' +
         'SOL is for the swaps the agent signs itself.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opindex-agent",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "An agent's Solana wallet, token risk answers paid for over x402, and swaps it signs itself. Library plus an MCP server.",
   "license": "MIT",
   "author": "MONOLITH LABS LTD <info@monolithlabs.uk>",

package/test/invariants.mjs

@@ -41,7 +41,7 @@ const call = (method, params) =>
 const checks = [];
 const check = (name, ok, saw) => checks.push({ name, ok, saw });
 
-await call('initialize', {
+const init = await call('initialize', {
   protocolVersion: '2024-11-05',
   capabilities: {},
   clientInfo: { name: 'invariants', version: '0' },
@@ -49,6 +49,16 @@ await call('initialize', {
 child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' })}\n`);
 
 const { result } = await call('tools/list', {});
+
+// The version a person reads to tell a stale client from a current one has to
+// be the one npm shipped. It is read from package.json at start, so this fails
+// only if someone writes a version into the server by hand again.
+const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+check(
+  'the server reports the package version',
+  init.result?.serverInfo?.version === pkg.version,
+  `${init.result?.serverInfo?.version} vs ${pkg.version}`,
+);
 const tools = result?.tools ?? [];
 const byName = new Map(tools.map((t) => [t.name, t]));
 const params = (name) => Object.keys(byName.get(name)?.inputSchema?.properties ?? {});
@@ -165,7 +175,6 @@ check(
 // starts with `./` — and says so in a warning that prints the normalised path,
 // which is the valid form, so the message points at a string that is fine.
 // That cost one failed publish; it costs nothing to pin.
-const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 const bins = Object.entries(pkg.bin ?? {});
 check('the package declares an executable', bins.length > 0, JSON.stringify(pkg.bin));
 for (const [name, target] of bins) {