vantage-peers-mcp 2.12.0 → 2.12.1

package/LICENSE

@@ -0,0 +1,110 @@
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+Abbreviation
+
+FSL-1.1-Apache-2.0
+
+Notice
+
+Copyright 2026 VantageOS (ElPi Corp)
+
+Terms and Conditions
+
+Licensor:             VantageOS (ElPi Corp)
+
+Licensed Work:        VantagePeers
+                      The Licensed Work is (c) 2026 VantageOS (ElPi Corp)
+
+Additional Use Grant: You may make production use of the Licensed Work,
+                      provided Your use does not include offering the Licensed
+                      Work to third parties as a hosted or managed service
+                      where the service provides users with access to any
+                      substantial set of the features or functionality of the
+                      Licensed Work.
+
+Change Date:          2028-04-03 (two years from publication)
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: contact@vantageos.com
+
+License text below is provided for informational purposes only.
+
+---
+
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+1. Purpose
+
+This license gives you broad permission to use, modify, and share this
+software, with one important condition: you may not use it to compete with us.
+
+2. Acceptance
+
+To use the software, you must agree to these terms. If you do not agree, you
+may not use the software.
+
+3. Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-
+sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+4. Limitations
+
+You may not make the functionality of the software available to third parties
+as a service, or otherwise use the software to provide a service to third
+parties that competes with the licensor.
+
+5. Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license or becomes able to license, to make, have made, use, sell, offer for
+sale, import, and have imported the software, in each case subject to the
+limitations and conditions in this license.
+
+6. Fair Use
+
+This license is not intended to limit any rights you may have under applicable
+fair use or other laws.
+
+7. No Other Rights
+
+These terms do not grant any other rights. The licensor reserves all rights not
+expressly granted.
+
+8. Termination
+
+Your license is automatically terminated if you violate the terms. However, if
+you cure the violation within 30 days of discovering it, your license is
+reinstated retroactively.
+
+9. Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED.
+
+10. Limitation of Liability
+
+TO THE EXTENT PERMITTED BY LAW, THE LICENSOR IS NOT LIABLE FOR ANY DAMAGES
+ARISING FROM THE USE OF THE SOFTWARE.
+
+11. Change Date and License
+
+After the Change Date, the licensor grants you the rights under the Change
+License.
+
+12. Definitions
+
+"Compete" means providing a product or service that is substantially similar
+to, or a replacement for, all or a significant portion of the Licensed Work.
+
+---
+
+Apache License, Version 2.0
+
+After the Change Date (2028-04-03), this software will be available under the
+Apache License, Version 2.0. See https://www.apache.org/licenses/LICENSE-2.0
+for full text.

package/README.md

@@ -242,7 +242,7 @@ Example:
 ### Session (1)
 `set_summary`
 
-## Compact payloads and status aliases (v2.11.0 — feature since v2.3.0)
+## Compact payloads and status aliases (v2.12.0 — feature since v2.3.0)
 
 ### `fields=lite` — reduced token payloads
 

package/dist/server-http.js

@@ -46,8 +46,13 @@ catch {
 // ─────────────────────────────────────────────────────────────────────────────
 // Constants
 // ─────────────────────────────────────────────────────────────────────────────
-const PUBLIC_BASE_URL_FALLBACK = process.env.PUBLIC_BASE_URL ??
-    "https://vantage-peers-production.up.railway.app";
+// Day 107 Cédric BLOCKER root cause: previously hardcoded a fallback to the
+// VantagePeers Cloud production URL, which meant Self-host deploys forgetting
+// PUBLIC_BASE_URL silently advertised Sigma's URL in OAuth metadata and broke
+// every Self-host customer's DCR chain with `invalid_client`. Fix: env-only
+// fallback, no implicit cross-tenant default. `resolveIssuer` throws clear
+// error if both Host header AND env are absent.
+const PUBLIC_BASE_URL_FALLBACK = process.env.PUBLIC_BASE_URL ?? null;
 const ACCESS_TOKEN_TTL_SECONDS = 3600; // 1 hour
 const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 3600; // 30 days
 const AUTH_CODE_TTL_SECONDS = 600; // 10 minutes
@@ -77,7 +82,10 @@ function resolveIssuer(req) {
                 : "https");
         return `${proto}://${host}`;
     }
-    return PUBLIC_BASE_URL_FALLBACK;
+    if (PUBLIC_BASE_URL_FALLBACK) {
+        return PUBLIC_BASE_URL_FALLBACK;
+    }
+    throw new Error("Server misconfigured: cannot determine public base URL (no Host header and PUBLIC_BASE_URL env var unset). Self-host deploys MUST set PUBLIC_BASE_URL.");
 }
 function randomOpaqueToken() {
     // 256-bit entropy via getRandomValues (32 bytes → 64 hex chars).

package/dist/src/auth.js

@@ -163,8 +163,28 @@ export function bearerAuthMiddleware() {
         // the param MUST be `resource_metadata=` (not `resource=`). Claude.ai's OAuth
         // connector looks for `resource_metadata=` to bootstrap PRM discovery; with
         // `resource=` the entire DCR chain breaks before any token is issued.
-        const publicBaseUrl = process.env.PUBLIC_BASE_URL ??
-            "https://vantage-peers-production.up.railway.app";
+        //
+        // Day 107 Cédric BLOCKER root cause: a hardcoded fallback to the
+        // VantagePeers Cloud production URL ("vantage-peers-production.up.railway.app")
+        // meant Self-host deploys that forgot PUBLIC_BASE_URL silently advertised
+        // Sigma's PRM endpoint, breaking every Self-host customer's DCR chain with
+        // `invalid_client`. Fix: derive from the incoming request (RFC 8414 §2 —
+        // issuer MUST be the URL the client used). Fall back to PUBLIC_BASE_URL env
+        // only if Host header is absent (curl smoke). Fail closed if neither is set.
+        const host = c.req.header("host");
+        const xfProto = c.req.header("x-forwarded-proto");
+        const proto = xfProto ??
+            (host?.startsWith("localhost") || host?.startsWith("127.")
+                ? "http"
+                : "https");
+        const publicBaseUrl = host
+            ? `${proto}://${host}`
+            : (process.env.PUBLIC_BASE_URL ?? null);
+        if (!publicBaseUrl) {
+            return c.json({
+                error: "Server misconfigured: cannot determine public base URL (no Host header and PUBLIC_BASE_URL env var unset).",
+            }, 500);
+        }
         const wwwAuthHeader = `Bearer resource_metadata="${publicBaseUrl}/.well-known/oauth-protected-resource"`;
         const authHeader = c.req.header("Authorization");
         if (!authHeader?.startsWith("Bearer ")) {

package/dist/src/tools/exportOkfBundle.d.ts

@@ -0,0 +1,51 @@
+/**
+ * MCP tool: export_okf_bundle (Phase 1 — T3).
+ *
+ * Thin proxy around the Convex `okfBundle:exportOkfBundle` action. The MCP
+ * tool wrapper exposes the export to any MCP client (Claude.ai, ChatGPT,
+ * Claude Code, Codex, IDE…) via the public VantagePeers Cloud surface.
+ *
+ * **VantagePeers Cloud, multi-tenant**: this is the Cloud product (NOT
+ * Self-host). Phase 1 namespace is verrouillé to `project/elpi-corp`; the
+ * Convex action enforces the gate, the wrapper only forwards arguments.
+ *
+ * RFC parent: decisions/okf-bridge-phase-1-rfc-2026-06-18.md (commit 6613610).
+ * ADR:        decisions/adr-okf-exporter-arch.md (commit 2cd357e).
+ *
+ * Orchestrator: Sigma — VantagePeers | 2026-06-19
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ConvexHttpClient } from "convex/browser";
+import { z } from "zod";
+export interface ExportOkfBundleResult {
+    bundleUrl: string;
+    storageId: string;
+    size: number;
+    fileCount: number;
+    manifest: {
+        types: {
+            memoryCount: number;
+            briefingCount: number;
+            taskCount: number;
+        };
+        truncated: boolean;
+        urlExpiresAt: string;
+    };
+}
+export declare const exportOkfBundleArgsSchema: {
+    namespace: z.ZodString;
+    types: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    format: z.ZodEnum<{
+        tarball: "tarball";
+        tree: "tree";
+    }>;
+    since: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    urlTtl: z.ZodOptional<z.ZodNumber>;
+};
+/**
+ * Register the `export_okf_bundle` MCP tool against an McpServer instance.
+ *
+ * Call this from `tools.ts` (or directly from `server.ts`) alongside the other
+ * `server.tool(...)` registrations.
+ */
+export declare function registerExportOkfBundle(server: McpServer, convex: ConvexHttpClient): void;

package/dist/src/tools/exportOkfBundle.js

@@ -0,0 +1,100 @@
+/**
+ * MCP tool: export_okf_bundle (Phase 1 — T3).
+ *
+ * Thin proxy around the Convex `okfBundle:exportOkfBundle` action. The MCP
+ * tool wrapper exposes the export to any MCP client (Claude.ai, ChatGPT,
+ * Claude Code, Codex, IDE…) via the public VantagePeers Cloud surface.
+ *
+ * **VantagePeers Cloud, multi-tenant**: this is the Cloud product (NOT
+ * Self-host). Phase 1 namespace is verrouillé to `project/elpi-corp`; the
+ * Convex action enforces the gate, the wrapper only forwards arguments.
+ *
+ * RFC parent: decisions/okf-bridge-phase-1-rfc-2026-06-18.md (commit 6613610).
+ * ADR:        decisions/adr-okf-exporter-arch.md (commit 2cd357e).
+ *
+ * Orchestrator: Sigma — VantagePeers | 2026-06-19
+ */
+import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+// ─────────────────────────────────────────────────────────────────────────────
+// Zod input schema (RFC §3.1)
+// ─────────────────────────────────────────────────────────────────────────────
+export const exportOkfBundleArgsSchema = {
+    namespace: z
+        .string()
+        .describe("OKF export namespace. Phase 1 verrouillé to 'project/elpi-corp'."),
+    types: z
+        .array(z.string())
+        .nullable()
+        .optional()
+        .describe("Optional type filter — null/omitted exports all 3 families. " +
+        "Tokens: 'memory-*' (all subtypes), 'memory-<sub>' (literal), " +
+        "'briefing-note', 'task'."),
+    format: z
+        .enum(["tarball", "tree"])
+        .describe("Bundle format. Phase 1 supports 'tarball' only; 'tree' is reserved " +
+        "for Phase 2."),
+    since: z
+        .string()
+        .nullable()
+        .optional()
+        .describe("Optional ISO 8601 timestamp — only entries updated on/after are " +
+        "included. Anticipation Phase 2."),
+    urlTtl: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Optional signed URL TTL in seconds (default 3600 = 1 hour). The " +
+        "storage object is purged at TTL expiry."),
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Registration
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Register the `export_okf_bundle` MCP tool against an McpServer instance.
+ *
+ * Call this from `tools.ts` (or directly from `server.ts`) alongside the other
+ * `server.tool(...)` registrations.
+ */
+export function registerExportOkfBundle(server, convex) {
+    server.tool("export_okf_bundle", "Export a VantagePeers namespace as an OKF v0.1 bundle (tarball). " +
+        "WHEN: use to ship a snapshot to Knowledge Catalog / RAG bridge / audit. " +
+        "EXAMPLE: export_okf_bundle namespace='project/elpi-corp' format='tarball'.", exportOkfBundleArgsSchema, {
+        readOnlyHint: true,
+        openWorldHint: false,
+        destructiveHint: false,
+        title: "Export OKF bundle",
+    }, async ({ namespace, types, format, since, urlTtl }) => {
+        try {
+            const result = (await convex.action("okfBundleNode:exportOkfBundle", {
+                namespace,
+                types: types ?? null,
+                format,
+                since: since ?? null,
+                urlTtl,
+            }));
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(result, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            if (error instanceof McpError)
+                throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            // Surface structured OKF_* error codes verbatim — the action emits
+            // them as prefix tokens in the Error message.
+            console.error("[export_okf_bundle] action failed", {
+                namespace,
+                format,
+                errorMessage: message,
+            });
+            throw new McpError(ErrorCode.InternalError, message);
+        }
+    });
+}

package/dist/src/tools.d.ts

@@ -156,8 +156,8 @@ export declare const storeMemoryOutputSchema: z.ZodObject<{
     memoryId: z.ZodString;
     namespace: z.ZodString;
     type: z.ZodEnum<{
-        project: "project";
         user: "user";
+        project: "project";
         feedback: "feedback";
         reference: "reference";
         episode: "episode";

package/dist/src/tools.js

@@ -15,6 +15,7 @@ import { clampLimit, decodeCursor, encodeCursor } from "./paging.js";
 import { listTasksGate } from "./list-tasks-gate.js";
 import { normalizeOrchestratorId } from "./normalizeOrchestratorId.js";
 import { scopeFilterGet, scopeFilterList } from "@vantageos/cloud-identity";
+import { registerExportOkfBundle } from "./tools/exportOkfBundle.js";
 import { wrapToolResult } from "./ui-resources/stream-marker.js";
 // ─────────────────────────────────────────────────────────────────────────────
 // VP_EMIT_UI_MARKERS gate
@@ -6496,4 +6497,8 @@ export function registerTools(server, convex, oauthCtx) {
             return mcpConvexError(error);
         }
     });
+    // ── export_okf_bundle (T3 — OKF Phase 1) ────────────────────────────────────
+    // Thin proxy to convex action `okfBundle:exportOkfBundle`. Registered last
+    // so its argument schema does not pollute other tool handlers' closures.
+    registerExportOkfBundle(server, convex);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vantage-peers-mcp",
-  "version": "2.12.0",
+  "version": "2.12.1",
   "description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
   "type": "module",
   "main": "./dist/server.js",