vantage-peers-mcp 2.11.0 → 2.12.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [2.12.0] — 2026-06-14
+
+### Changed
+- `check_messages` now calls `messages:checkNewMessagesEnvelope` (Convex PR #759 mergeCommit `c03023fc85463fe16fc53948d3002420bc1c4547`) for bounded tool-response size. New optional `limit` arg (1-50, default 20). When the call is truncated, the text payload appends `— truncated. Resume with check_messages since=<nextSince>` so the orchestrator can page the backlog cleanly without busting Claude Code's tool-response cap.
+- `since` arg description amended with a "pair with `nextSince` from a previous truncated reply" hint.
+
+### Notes
+- Closes Pi BLOCKER VP task `k1702xaahb` (Day 102 — sigma-vps cron crash on a 36-message / 53 KB backlog).
+- Legacy `messages:checkNewMessages` Convex query left intact for vp-mcp <2.12.0 callers (no break).
+
 ## [2.11.0] — 2026-06-14 — Day 102 CRUD baseline PR-C-bis option B: 3-entity Convex searchIndex (mission k575kc1ryps0n8br95jw3q7d0x88m2v9)
 
 Mission `mcp-crud-baseline-standard` PR-C-bis under T2. Pi-sequenced follow-up after PR-C (rename-only safe subset) — implements **option B SCOPED** per Pi arbitrage msg `jn7abynmghy5qdr9ga0b914wmh88n99w` ("GO option B SCOPED — démarre PR-C avec 3 entités prioritaires"): tasks + messages + briefingNotes get native Convex BM25 search via `.searchIndex()` schema additions + per-entity Convex queries + MCP tool wrappers.

package/LICENSE

@@ -0,0 +1,110 @@
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+Abbreviation
+
+FSL-1.1-Apache-2.0
+
+Notice
+
+Copyright 2026 VantageOS (ElPi Corp)
+
+Terms and Conditions
+
+Licensor:             VantageOS (ElPi Corp)
+
+Licensed Work:        VantagePeers
+                      The Licensed Work is (c) 2026 VantageOS (ElPi Corp)
+
+Additional Use Grant: You may make production use of the Licensed Work,
+                      provided Your use does not include offering the Licensed
+                      Work to third parties as a hosted or managed service
+                      where the service provides users with access to any
+                      substantial set of the features or functionality of the
+                      Licensed Work.
+
+Change Date:          2028-04-03 (two years from publication)
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: contact@vantageos.com
+
+License text below is provided for informational purposes only.
+
+---
+
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+1. Purpose
+
+This license gives you broad permission to use, modify, and share this
+software, with one important condition: you may not use it to compete with us.
+
+2. Acceptance
+
+To use the software, you must agree to these terms. If you do not agree, you
+may not use the software.
+
+3. Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-
+sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+4. Limitations
+
+You may not make the functionality of the software available to third parties
+as a service, or otherwise use the software to provide a service to third
+parties that competes with the licensor.
+
+5. Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license or becomes able to license, to make, have made, use, sell, offer for
+sale, import, and have imported the software, in each case subject to the
+limitations and conditions in this license.
+
+6. Fair Use
+
+This license is not intended to limit any rights you may have under applicable
+fair use or other laws.
+
+7. No Other Rights
+
+These terms do not grant any other rights. The licensor reserves all rights not
+expressly granted.
+
+8. Termination
+
+Your license is automatically terminated if you violate the terms. However, if
+you cure the violation within 30 days of discovering it, your license is
+reinstated retroactively.
+
+9. Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED.
+
+10. Limitation of Liability
+
+TO THE EXTENT PERMITTED BY LAW, THE LICENSOR IS NOT LIABLE FOR ANY DAMAGES
+ARISING FROM THE USE OF THE SOFTWARE.
+
+11. Change Date and License
+
+After the Change Date, the licensor grants you the rights under the Change
+License.
+
+12. Definitions
+
+"Compete" means providing a product or service that is substantially similar
+to, or a replacement for, all or a significant portion of the Licensed Work.
+
+---
+
+Apache License, Version 2.0
+
+After the Change Date (2028-04-03), this software will be available under the
+Apache License, Version 2.0. See https://www.apache.org/licenses/LICENSE-2.0
+for full text.

package/README.md

@@ -91,7 +91,7 @@ The server also reads `CONVEX_URL` from `.env.local` in the parent directory if
 ## Tools (97)
 
 ### Memory (6)
-`store_memory`, `recall`, `list_memories`, `soft_delete_memory`, `get_memory`, `store_episode`
+`store_memory`, `search_memories_by_semantic` (alias `recall`), `list_memories`, `soft_delete_memory`, `get_memory`, `store_episode`
 
 ### Profiles (3)
 `get_profile`, `update_profile`, `list_peers`
@@ -115,7 +115,7 @@ The server also reads `CONVEX_URL` from `.env.local` in the parent directory if
 `create_briefing_note`, `list_briefing_notes`
 
 ### Search / RAG (3)
-`search_fix_patterns`, `text_search`, `hybrid_search`
+`search_fix_patterns_by_semantic` (alias `search_fix_patterns`), `search_memories_by_keyword` (alias `text_search`), `hybrid_search`
 
 ### Issues (6)
 `get_issue`, `list_issues`, `update_issue_status`, `verify_issue`, `issue_stats`, `link_commit_to_issue`
@@ -231,7 +231,7 @@ Example:
 `create_bu`, `list_bus`, `get_bu`, `update_bu`, `delete_bu`
 
 ### Components (6)
-`register_component`, `list_components`, `get_component`, `update_component`, `delete_component`, `search_components`
+`register_component`, `list_components`, `get_component`, `update_component`, `delete_component`, `search_components_by_keyword` (alias `search_components`)
 
 ### Mandates (6)
 `create_mandate`, `list_mandates`, `accept_mandate`, `update_mandate`, `validate_mandate_spending`, `settle_mandate`
@@ -242,7 +242,7 @@ Example:
 ### Session (1)
 `set_summary`
 
-## Compact payloads and status aliases (v2.11.0 — feature since v2.3.0)
+## Compact payloads and status aliases (v2.12.0 — feature since v2.3.0)
 
 ### `fields=lite` — reduced token payloads
 
@@ -312,13 +312,13 @@ A fix pattern is a validated learning extracted from a resolved bug — symptom,
 
 The cycle runs as follows:
 
-1. **Agent encounters a bug.** Before touching any code, call `search_fix_patterns` with a plain-language description of the symptom. The KB returns ranked matches using semantic vector search.
+1. **Agent encounters a bug.** Before touching any code, call `search_fix_patterns_by_semantic` (alias `search_fix_patterns`) with a plain-language description of the symptom. The KB returns ranked matches using semantic vector search.
 2. **KB hit.** If a validated pattern is returned, apply the known fix directly. Log the reuse via `add_fix_attempt` (`worked: true`) so confidence scores stay current.
 3. **KB miss.** If no pattern matches, the agent fixes the bug manually using standard debugging. Once resolved, the learning is captured immediately via `create_fix_pattern` — symptom, root cause, severity, stack, and the working fix.
 4. **Validation.** After the fix holds in production (or after a second independent confirmation), call `validate_fix` to promote the pattern to validated status. This is the signal that downstream agents can trust the pattern without verification.
 5. **Issue linkage.** Call `link_issue_to_pattern` to attach the VantagePeers issue ID to the pattern. This creates a bidirectional reference: the issue record points to the pattern, and the pattern's `linkedIssueIds` list points back.
 
-The four tools that power this cycle are: `create_fix_pattern`, `add_fix_attempt`, `validate_fix`, and `link_issue_to_pattern`. The fifth tool, `search_fix_patterns`, is in the Search / RAG category and is the entry point agents should call first.
+The four tools that power this cycle are: `create_fix_pattern`, `add_fix_attempt`, `validate_fix`, and `link_issue_to_pattern`. The fifth tool, `search_fix_patterns_by_semantic` (alias `search_fix_patterns`), is in the Search / RAG category and is the entry point agents should call first.
 
 On the agent side, the `/capitalize-fix` skill and the `inject-fix-patterns` hook automate steps 3-5: the hook fires on task completion events and prompts the orchestrator to capture the learning before closing the task. The cycle is designed to be low-friction — one tool call per step, all via MCP, no `npx convex run` required.
 

package/dist/server-http.js

@@ -46,8 +46,13 @@ catch {
 // ─────────────────────────────────────────────────────────────────────────────
 // Constants
 // ─────────────────────────────────────────────────────────────────────────────
-const PUBLIC_BASE_URL_FALLBACK = process.env.PUBLIC_BASE_URL ??
-    "https://vantage-peers-production.up.railway.app";
+// Day 107 Cédric BLOCKER root cause: previously hardcoded a fallback to the
+// VantagePeers Cloud production URL, which meant Self-host deploys forgetting
+// PUBLIC_BASE_URL silently advertised Sigma's URL in OAuth metadata and broke
+// every Self-host customer's DCR chain with `invalid_client`. Fix: env-only
+// fallback, no implicit cross-tenant default. `resolveIssuer` throws clear
+// error if both Host header AND env are absent.
+const PUBLIC_BASE_URL_FALLBACK = process.env.PUBLIC_BASE_URL ?? null;
 const ACCESS_TOKEN_TTL_SECONDS = 3600; // 1 hour
 const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 3600; // 30 days
 const AUTH_CODE_TTL_SECONDS = 600; // 10 minutes
@@ -77,7 +82,10 @@ function resolveIssuer(req) {
                 : "https");
         return `${proto}://${host}`;
     }
-    return PUBLIC_BASE_URL_FALLBACK;
+    if (PUBLIC_BASE_URL_FALLBACK) {
+        return PUBLIC_BASE_URL_FALLBACK;
+    }
+    throw new Error("Server misconfigured: cannot determine public base URL (no Host header and PUBLIC_BASE_URL env var unset). Self-host deploys MUST set PUBLIC_BASE_URL.");
 }
 function randomOpaqueToken() {
     // 256-bit entropy via getRandomValues (32 bytes → 64 hex chars).

package/dist/server.d.ts

@@ -1,12 +1,19 @@
 #!/usr/bin/env node
 /**
- * VantagePeers MCP Server
- * Exposes 82 Convex-backed tools to Claude Code agents via stdio transport.
+ * VantagePeers MCP Server — stdio transport (Self-host / local Claude Code path).
  *
- * Tool categories: Memory, Profiles, Messages, Tasks, Missions, Diary,
- * Briefing Notes, Components, Recurring Tasks, Mandates, Business Units,
- * Issues, Fix Patterns, Search/RAG, Mission Templates, Error Monitoring,
- * Deployments, Repo Mappings.
+ * Thin bootstrap: resolves CONVEX_URL, instantiates McpServer + ConvexHttpClient,
+ * delegates ALL tool registration to the shared `registerTools(server, convex)`
+ * surface in src/tools.ts. This guarantees stdio and HTTP transports expose the
+ * same tool set (parity locked by src/__tests__/stdio-http-parity.test.ts).
+ *
+ * Day 102 refactor (fix-pattern m974adhs7wtwb6pt4h0sdxn1k988mnxk):
+ * Removed ~3.6k LOC of inline `server.tool(...)` registrations that had drifted
+ * out of sync with src/tools.ts, hiding 12 new CRUD-baseline tools from fleet
+ * stdio consumers (Claude Code, Codex via npx vantage-peers-mcp).
+ *
+ * VP_EMIT_UI_MARKERS env gate is honored inside src/tools.ts and therefore
+ * works transparently on stdio as well as HTTP.
  *
  * See README.md for the full tool reference.
  */