viveworker 0.8.9 → 0.9.0

package/scripts/lib/work-items.mjs

@@ -0,0 +1,179 @@
+const WORK_ITEM_SCHEMA_VERSION = 1;
+
+const TERMINAL_STATES = new Set(["completed", "failed", "canceled"]);
+const STATE_PRIORITY = new Map([
+  ["in_progress", 1],
+  ["needs_action", 2],
+  ["completed", 3],
+  ["failed", 3],
+  ["canceled", 3],
+]);
+
+function cleanText(value) {
+  return String(value ?? "").trim();
+}
+
+function normalizeProvider(value) {
+  const provider = cleanText(value).toLowerCase();
+  if (["claude", "moltbook", "a2a", "viveworker", "mcp"].includes(provider)) {
+    return provider;
+  }
+  return "codex";
+}
+
+function workItemCategory(item) {
+  switch (cleanText(item?.kind)) {
+    case "approval":
+      return cleanText(item?.approvalKind).includes("payment") ? "payment" : "approval";
+    case "plan":
+    case "plan_ready":
+      return "plan";
+    case "choice":
+      return "question";
+    case "moltbook_draft":
+      return "draft";
+    case "moltbook_reply":
+      return "reply";
+    case "thread_share":
+      return "handoff";
+    case "a2a_task":
+      return "delegation";
+    case "a2a_task_result":
+      return "delegation_result";
+    case "activity_status":
+      return "agent_run";
+    case "completion":
+    case "assistant_final":
+      return "result";
+    default:
+      return "work";
+  }
+}
+
+function terminalState(item) {
+  const taskStatus = cleanText(item?.taskStatus).toLowerCase();
+  if (["failed", "error"].includes(taskStatus)) {
+    return "failed";
+  }
+  if (["canceled", "cancelled", "rejected"].includes(taskStatus)) {
+    return "canceled";
+  }
+  return "completed";
+}
+
+function workItemPriority(item, state) {
+  if (workItemCategory(item) === "payment") {
+    return "urgent";
+  }
+  if (state === "needs_action") {
+    return cleanText(item?.kind) === "thread_share" ? "normal" : "high";
+  }
+  return state === "in_progress" ? "normal" : "low";
+}
+
+function workItemId(item) {
+  const provider = normalizeProvider(item?.provider);
+  const kind = cleanText(item?.kind) || "item";
+  const token = cleanText(item?.token);
+  const fallback = [item?.threadId, item?.createdAtMs, item?.title]
+    .map(cleanText)
+    .filter(Boolean)
+    .join(":");
+  return `${provider}:${kind}:${token || fallback || "unknown"}`;
+}
+
+function workItemThreadKey(item) {
+  const threadId = cleanText(item?.threadId);
+  return threadId ? `${normalizeProvider(item?.provider)}:${threadId}` : "";
+}
+
+function enrichWorkItem(item, state) {
+  const normalizedState = TERMINAL_STATES.has(state) ? state : cleanText(state) || "needs_action";
+  const requiresAction = normalizedState === "needs_action" && item?.supported !== false;
+  return {
+    ...item,
+    provider: normalizeProvider(item?.provider),
+    work: {
+      schemaVersion: WORK_ITEM_SCHEMA_VERSION,
+      id: workItemId(item),
+      state: normalizedState,
+      category: workItemCategory(item),
+      priority: workItemPriority(item, normalizedState),
+      requiresAction,
+      sourceRef: {
+        provider: normalizeProvider(item?.provider),
+        kind: cleanText(item?.kind),
+        token: cleanText(item?.token),
+        threadId: cleanText(item?.threadId),
+      },
+      occurredAtMs: Math.max(0, Number(item?.createdAtMs) || 0),
+    },
+  };
+}
+
+function compareWorkItems(left, right) {
+  const priorityRank = { urgent: 3, high: 2, normal: 1, low: 0 };
+  const priorityDelta = (priorityRank[right?.work?.priority] ?? 0) - (priorityRank[left?.work?.priority] ?? 0);
+  if (priorityDelta !== 0) {
+    return priorityDelta;
+  }
+  return Number(right?.createdAtMs ?? 0) - Number(left?.createdAtMs ?? 0);
+}
+
+function normalizeBucket(items, state) {
+  return (Array.isArray(items) ? items : [])
+    .filter((item) => item && typeof item === "object")
+    .map((item) => enrichWorkItem(item, state));
+}
+
+function dedupeAcrossStates(items) {
+  const byId = new Map();
+  for (const item of items) {
+    const id = cleanText(item?.work?.id);
+    if (!id) {
+      continue;
+    }
+    const previous = byId.get(id);
+    if (!previous) {
+      byId.set(id, item);
+      continue;
+    }
+    const previousRank = STATE_PRIORITY.get(previous.work.state) ?? 0;
+    const nextRank = STATE_PRIORITY.get(item.work.state) ?? 0;
+    if (nextRank > previousRank || (nextRank === previousRank && Number(item.createdAtMs) > Number(previous.createdAtMs))) {
+      byId.set(id, item);
+    }
+  }
+  return [...byId.values()];
+}
+
+export function buildWorkItemResponse({ pending = [], inProgress = [], completed = [], generatedAtMs = Date.now() } = {}) {
+  const pendingItems = normalizeBucket(pending, "needs_action");
+  const blockedThreadKeys = new Set(pendingItems.map(workItemThreadKey).filter(Boolean));
+  const activeItems = normalizeBucket(inProgress, "in_progress")
+    .filter((item) => !blockedThreadKeys.has(workItemThreadKey(item)));
+  const completedItems = (Array.isArray(completed) ? completed : [])
+    .filter((item) => item && typeof item === "object")
+    .map((item) => enrichWorkItem(item, terminalState(item)));
+
+  const deduped = dedupeAcrossStates([...activeItems, ...pendingItems, ...completedItems]);
+  const needsAction = deduped.filter((item) => item.work.state === "needs_action").sort(compareWorkItems);
+  const active = deduped.filter((item) => item.work.state === "in_progress").sort(compareWorkItems);
+  const terminal = deduped.filter((item) => TERMINAL_STATES.has(item.work.state)).sort(compareWorkItems);
+
+  return {
+    schemaVersion: WORK_ITEM_SCHEMA_VERSION,
+    generatedAtMs: Math.max(0, Number(generatedAtMs) || Date.now()),
+    counts: {
+      needsAction: needsAction.length,
+      inProgress: active.length,
+      completed: terminal.filter((item) => item.work.state === "completed").length,
+      failed: terminal.filter((item) => item.work.state === "failed").length,
+    },
+    pending: needsAction,
+    inProgress: active,
+    completed: terminal,
+  };
+}
+
+export { WORK_ITEM_SCHEMA_VERSION };

package/scripts/mcp-server.mjs

@@ -127,7 +127,7 @@ class ViveworkerMcpServer {
         websiteUrl: "https://viveworker.com",
       },
       instructions:
-        "Use viveworker tools when you need to notify, ask, request approval, share a file, hand off context, or delegate an A2A task through the user's paired mobile control plane.",
+        "Use viveworker tools when you need to inspect viveworker state, notify, ask, request approval, share a file, hand off context, or delegate an A2A task through the user's paired mobile control plane.",
     };
   }
 }
@@ -138,6 +138,20 @@ async function callTool(params) {
   switch (name) {
     case "viveworker_status":
       return toolOk(await bridgeEvent({ eventType: "status" }, SHORT_TIMEOUT_MS));
+    case "viveworker_stats":
+      return toolOk(await toolStats(args));
+    case "viveworker_share_list":
+      return toolOk(await toolShareList(args));
+    case "viveworker_a2a_activity":
+      return toolOk(await toolA2AActivity(args));
+    case "viveworker_a2a_card":
+      return toolOk(await toolA2ACard(args));
+    case "viveworker_moltbook_list":
+      return toolOk(await toolMoltbookList(args));
+    case "viveworker_moltbook_show":
+      return toolOk(await toolMoltbookShow(args));
+    case "viveworker_moltbook_thread":
+      return toolOk(await toolMoltbookThread(args));
     case "viveworker_notify":
       return toolOk(await toolNotify(args));
     case "viveworker_ask":
@@ -146,6 +160,8 @@ async function callTool(params) {
       return toolOk(await toolRequestApproval(args));
     case "viveworker_share_file":
       return toolOk(await toolShareFile(args));
+    case "viveworker_share_replace":
+      return toolOk(await toolShareReplace(args));
     case "viveworker_share_link":
       return toolOk(await toolShareLink(args));
     case "viveworker_thread_share":
@@ -157,6 +173,52 @@ async function callTool(params) {
   }
 }
 
+async function toolStats(args) {
+  const pkg = optionalString(args.pkg || args.packageName);
+  const cliArgs = ["stats", "--json"];
+  if (pkg) {
+    assertSafeNpmPackageName(pkg);
+    cliArgs.push("--pkg", pkg);
+  }
+  return runViveworkerCliJson(cliArgs, 60_000);
+}
+
+async function toolShareList(args) {
+  const cliArgs = ["share", "list", "--json"];
+  if (optionalBoolean(args.metrics)) {
+    cliArgs.push("--metrics");
+  }
+  return runViveworkerCliJson(cliArgs, 45_000);
+}
+
+async function toolA2AActivity(_args) {
+  return runViveworkerCliJson(["a2a", "activity"], 30_000);
+}
+
+async function toolA2ACard(_args) {
+  const output = await runViveworkerCliText(["a2a", "card"], 30_000);
+  return { ok: true, output: output.stdout.trim() };
+}
+
+async function toolMoltbookList(args) {
+  const cliArgs = ["moltbook", "list"];
+  if (optionalBoolean(args.all)) {
+    cliArgs.push("--all");
+  }
+  const output = await runViveworkerCliText(cliArgs, 30_000);
+  return { ok: true, output: output.stdout.trim() };
+}
+
+async function toolMoltbookShow(args) {
+  const commentId = requiredSafeIdentifier(args.commentId, "commentId");
+  return runViveworkerCliJson(["moltbook", "show", commentId], 30_000);
+}
+
+async function toolMoltbookThread(args) {
+  const commentId = requiredSafeIdentifier(args.commentId, "commentId");
+  return runViveworkerCliJson(["moltbook", "thread", commentId], 45_000);
+}
+
 async function toolNotify(args) {
   const title = requiredString(args.title, "title");
   const message = requiredString(args.message, "message");
@@ -245,11 +307,46 @@ async function toolShareFile(args) {
   return { approved: true, share: upload, tokenizedLink: link };
 }
 
-async function toolShareLink(args) {
-  const slug = requiredString(args.slug, "slug");
-  if (!/^[A-Za-z0-9]+$/.test(slug)) {
-    throw rpcInvalidParams("slug must contain only letters and numbers");
+async function toolShareReplace(args) {
+  const slug = requiredShareSlug(args.slug);
+  const requestedPath = requiredString(args.path, "path");
+  const workspaceRoot = optionalString(args.workspaceRoot) || process.env.VIVEWORKER_MCP_WORKSPACE_ROOT || process.cwd();
+  const file = await validateSharePath(requestedPath, workspaceRoot, "share_replace");
+  const stat = await fs.stat(file.realPath);
+  const expiresDays = optionalString(args.expiresDays ?? args["expires-days"]);
+  const noOptimize = optionalBoolean(args.noOptimize ?? args["no-optimize"]);
+  const approval = await bridgeEvent({
+    eventType: "approval_request",
+    title: "Replace viveworker File Share file",
+    message: [
+      "An MCP client wants to replace the file behind an existing viveworker File Share URL.",
+      "",
+      `Share slug: ${slug}`,
+      `New file: ${file.displayPath}`,
+      `Size: ${stat.size} bytes`,
+      expiresDays ? `Expires days: ${expiresDays}` : "Expires days: keep existing/default",
+      noOptimize ? "HTML optimization: disabled for this replace" : "",
+      "",
+      "This changes what existing recipients see at the same share link.",
+      "Approve only if this replacement file is safe to send outside this Mac.",
+    ].filter(Boolean).join("\n"),
+    approvalKind: "file_share_replace",
+    fileRefs: [file.displayPath],
+    timeoutMs: clampTimeout(args.timeoutMs),
+  }, clampTimeout(args.timeoutMs));
+  if (!approval.approved) {
+    return { approved: false, decision: approval.decision || "rejected" };
   }
+
+  const replaceArgs = ["share", "replace", slug, file.realPath, "--json"];
+  if (expiresDays) replaceArgs.push("--expires-days", expiresDays);
+  if (noOptimize) replaceArgs.push("--no-optimize");
+  const replace = await runViveworkerCliJson(replaceArgs, 90_000);
+  return { approved: true, share: replace };
+}
+
+async function toolShareLink(args) {
+  const slug = requiredShareSlug(args.slug);
   const password = requiredString(args.password, "password");
   if (password.length > 256) {
     throw rpcInvalidParams("password is too long (max 256 characters)");
@@ -424,7 +521,7 @@ function httpJson(endpoint, options) {
   });
 }
 
-async function validateSharePath(filePath, workspaceRoot) {
+async function validateSharePath(filePath, workspaceRoot, toolName = "share_file") {
   const root = path.resolve(String(workspaceRoot || ""));
   const candidate = path.resolve(String(filePath || ""));
   const [rootReal, fileReal] = await Promise.all([
@@ -433,16 +530,16 @@ async function validateSharePath(filePath, workspaceRoot) {
   ]);
   const rel = path.relative(rootReal, fileReal);
   if (rel.startsWith("..") || path.isAbsolute(rel)) {
-    throw new Error("share_file is limited to the current workspace root");
+    throw new Error(`${toolName} is limited to the current workspace root`);
   }
   const stat = await fs.stat(fileReal);
   if (!stat.isFile()) {
-    throw new Error("share_file path must be a regular file");
+    throw new Error(`${toolName} path must be a regular file`);
   }
   assertNotSensitivePath(rel || path.basename(fileReal));
   const ext = path.extname(fileReal).toLowerCase();
   if (!SHARE_FILE_EXTENSIONS.has(ext)) {
-    throw new Error(`share_file accepts only ${Array.from(SHARE_FILE_EXTENSIONS).join(" / ")} files. Got: ${ext || "(no extension)"}`);
+    throw new Error(`${toolName} accepts only ${Array.from(SHARE_FILE_EXTENSIONS).join(" / ")} files. Got: ${ext || "(no extension)"}`);
   }
   return {
     realPath: fileReal,
@@ -476,7 +573,16 @@ function assertNotSensitivePath(relPath) {
   }
 }
 
-function runViveworkerCliJson(args, timeoutMs) {
+async function runViveworkerCliJson(args, timeoutMs) {
+  const { stdout } = await runViveworkerCliText(args, timeoutMs);
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    throw new Error(`viveworker CLI returned non-JSON: ${stdout.slice(0, 200)}`);
+  }
+}
+
+function runViveworkerCliText(args, timeoutMs) {
   return new Promise((resolve, reject) => {
     const child = spawn(process.execPath, [viveworkerCli, ...args], {
       cwd: packageRoot,
@@ -502,11 +608,7 @@ function runViveworkerCliJson(args, timeoutMs) {
         reject(new Error((stderr || stdout || `viveworker CLI failed with code ${code}`).trim()));
         return;
       }
-      try {
-        resolve(JSON.parse(stdout));
-      } catch {
-        reject(new Error(`viveworker CLI returned non-JSON: ${stdout.slice(0, 200)}`));
-      }
+      resolve({ stdout, stderr });
     });
   });
 }
@@ -657,6 +759,29 @@ function slugFromShareUrl(value) {
   }
 }
 
+function assertSafeNpmPackageName(value) {
+  const text = optionalString(value);
+  if (!/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(text)) {
+    throw rpcInvalidParams("pkg must be a valid npm package name");
+  }
+}
+
+function requiredSafeIdentifier(value, name) {
+  const text = requiredString(value, name);
+  if (!/^[A-Za-z0-9._:-]{1,160}$/u.test(text)) {
+    throw rpcInvalidParams(`${name} contains unsupported characters`);
+  }
+  return text;
+}
+
+function requiredShareSlug(value) {
+  const slug = requiredString(value, "slug");
+  if (!/^[A-Za-z0-9]+$/.test(slug)) {
+    throw rpcInvalidParams("slug must contain only letters and numbers");
+  }
+  return slug;
+}
+
 async function createShareTokenLink(slug, password, ttlHours) {
   const linkArgs = ["share", "link", slug, "--password", password, "--json"];
   if (ttlHours !== undefined) {
@@ -808,6 +933,87 @@ const TOOLS = [
     description: "Return bridge, pairing, remote connection, A2A, and File Share status.",
     inputSchema: { type: "object", additionalProperties: false },
   },
+  {
+    name: "viveworker_stats",
+    title: "Read viveworker stats",
+    description: "Read viveworker package adoption and usage stats. Read-only.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        pkg: { type: "string" },
+      },
+    },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_share_list",
+    title: "List File Share uploads",
+    description: "List File Share uploads and optionally include usage metrics. Read-only.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        metrics: { type: "boolean" },
+      },
+    },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_a2a_activity",
+    title: "Read A2A activity",
+    description: "Read local A2A activity from the default viveworker state. Read-only.",
+    inputSchema: { type: "object", additionalProperties: false },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_a2a_card",
+    title: "Read A2A card",
+    description: "Read the current local A2A agent card settings. Read-only.",
+    inputSchema: { type: "object", additionalProperties: false },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_moltbook_list",
+    title: "List Moltbook inbox",
+    description: "List Moltbook inbox comments. Read-only.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        all: { type: "boolean" },
+      },
+    },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_moltbook_show",
+    title: "Read Moltbook comment",
+    description: "Show one Moltbook comment by commentId. Read-only.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        commentId: { type: "string" },
+      },
+      required: ["commentId"],
+    },
+    annotations: { readOnlyHint: true },
+  },
+  {
+    name: "viveworker_moltbook_thread",
+    title: "Read Moltbook thread",
+    description: "Show the Moltbook thread for one commentId. Read-only.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        commentId: { type: "string" },
+      },
+      required: ["commentId"],
+    },
+    annotations: { readOnlyHint: true },
+  },
   {
     name: "viveworker_notify",
     title: "Notify phone",
@@ -893,6 +1099,24 @@ const TOOLS = [
       required: ["path"],
     },
   },
+  {
+    name: "viveworker_share_replace",
+    title: "Replace File Share file",
+    description: "After phone approval, replace the file behind an existing viveworker File Share slug.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        slug: { type: "string" },
+        path: { type: "string" },
+        workspaceRoot: { type: "string" },
+        expiresDays: { type: "string" },
+        noOptimize: { type: "boolean" },
+        timeoutMs: { type: "number" },
+      },
+      required: ["slug", "path"],
+    },
+  },
   {
     name: "viveworker_share_link",
     title: "Create File Share token URL",
@@ -977,7 +1201,7 @@ const PROMPTS = [
       title: "Share deliverable",
       description: "Package a local deliverable through viveworker File Share with phone approval.",
     },
-    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. Only share files inside the workspace and never share secrets or credentials. If the user wants a password-protected share but the recipient should not know the password, set password plus tokenize=true, or use viveworker_share_link for an existing password-protected slug to mint a short-lived ?t= URL.",
+    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. When the user asks to replace the file behind an existing File Share slug, use viveworker_share_replace. Only share files inside the workspace and never share secrets or credentials. If the user wants a password-protected share but the recipient should not know the password, set password plus tokenize=true, or use viveworker_share_link for an existing password-protected slug to mint a short-lived ?t= URL.",
   },
   {
     definition: {

package/scripts/moltbook-api.mjs

@@ -62,6 +62,33 @@ export const DEFAULT_INBOX_DIR = path.join(os.homedir(), ".viveworker", "moltboo
 export const DEFAULT_SCOUT_STATE_FILE = path.join(os.homedir(), ".viveworker", "moltbook-scout-state.json");
 export const DEFAULT_DRAFTS_DIR = path.join(os.homedir(), ".viveworker", "moltbook-drafts");
 
+const PROVIDER_ERROR_TEXT_PATTERNS = [
+  /\bfailed to authenticate\b/iu,
+  /\binvalid authentication credentials\b/iu,
+  /\bauthentication_error\b/iu,
+  /\bapi error:\s*(?:401|403)\b/iu,
+  /\bincorrect api key\b/iu,
+  /\binvalid api key\b/iu,
+];
+
+export function looksLikeProviderErrorText(value) {
+  const text = String(value || "").trim();
+  if (!text) return false;
+  const compact = text.replace(/\s+/gu, " ");
+  if (PROVIDER_ERROR_TEXT_PATTERNS.some((pattern) => pattern.test(compact))) {
+    return true;
+  }
+  if (!compact.startsWith("{")) return false;
+  try {
+    const parsed = JSON.parse(compact);
+    const type = String(parsed?.error?.type || parsed?.type || "").toLowerCase();
+    const message = String(parsed?.error?.message || parsed?.message || "").toLowerCase();
+    return type === "authentication_error" || message.includes("invalid authentication credentials");
+  } catch {
+    return false;
+  }
+}
+
 export async function loadMoltbookEnv(envFile = DEFAULT_ENV_FILE) {
   const env = {};
   try {

package/scripts/moltbook-cli.mjs

@@ -36,6 +36,7 @@ import {
   pickInboxReplyCandidate,
   reconcileInboxDraftMarkers,
   getMoltbookReplyQuotaState,
+  looksLikeProviderErrorText,
   loopbackFetch,
 } from "./moltbook-api.mjs";
 
@@ -572,6 +573,9 @@ async function cmdPropose(postId, flags) {
   if (!postId) fail("usage: viveworker moltbook propose <postId> --text \"...\"");
   const text = typeof flags.text === "string" ? flags.text : "";
   if (!text.trim()) fail("--text is required and must be non-empty");
+  if (looksLikeProviderErrorText(text)) {
+    fail("--text looks like an LLM/provider authentication error; refusing to create a Moltbook draft");
+  }
   const ttlSec = Number(flags.ttl) || Number(flags.timeout) || 86400;
   const parentCommentId = typeof flags["parent-id"] === "string" ? flags["parent-id"] : "";
   const postTitle = typeof flags.title === "string" ? flags.title : "";
@@ -948,10 +952,6 @@ async function cmdCompose(flags) {
     return;
   }
 
-  // Mark slot as attempted (even before drafting, to avoid re-proposal on deny).
-  state.composeSlotsAttempted = [...attempted, slot];
-  await writeScoutState(state);
-
   // Load persona.
   let persona = "";
   try {
@@ -1020,6 +1020,14 @@ async function cmdComposePropose(flags) {
   }
   const token = submitRes?.token;
   if (!token) fail(`bridge did not return a token: ${JSON.stringify(submitRes)}`);
+  if (slot) {
+    const state = rollScoutDayIfNeeded(await readScoutState());
+    const attempted = Array.isArray(state.composeSlotsAttempted) ? state.composeSlotsAttempted : [];
+    if (!attempted.includes(slot)) {
+      state.composeSlotsAttempted = [...attempted, slot];
+      await writeScoutState(state);
+    }
+  }
 
   console.log(JSON.stringify({ ok: true, token, ttlSec, fireAndForget: true }));
 }