whale-code 6.4.0

package/dist/index.js

@@ -0,0 +1,538 @@
+#!/usr/bin/env node
+/**
+ * SwagManager MCP Server
+ *
+ * Thin proxy that connects any MCP client (Claude Code, Cursor, etc.)
+ * to the SwagManager platform.
+ *
+ * - Tool DEFINITIONS loaded from ai_tool_registry (database-driven)
+ * - Tool EXECUTION proxied to the Fly.io server (server-driven)
+ * - Auth via browser-based OAuth (`whale_login` tool) or env vars
+ *
+ * When tools change on the server, this MCP server automatically picks
+ * them up — no code changes, no rebuild, no redeploy.
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { createClient } from "@supabase/supabase-js";
+import { createRequire } from "module";
+import { startUpdateLoop } from "./updater.js";
+import { resolveConfig, loadConfig, updateConfig } from "./cli/services/config-store.js";
+import { getValidToken, getStoresForUser, selectStore } from "./cli/services/auth-service.js";
+import { signInWithBrowser } from "./cli/services/browser-auth.js";
+import { LocalAgentConnection } from "./local-agent/connection.js";
+import { initErrorLogger, setErrorLoggerUser, captureError } from "./cli/services/error-logger.js";
+const require = createRequire(import.meta.url);
+const PKG_VERSION = require("../package.json").version;
+// ============================================================================
+// CONFIGURATION — env vars → ~/.swagmanager/config.json (set by `whale login`)
+// ============================================================================
+let config = resolveConfig();
+let rawConfig = loadConfig();
+const SUPABASE_URL = config.supabaseUrl;
+let INITIAL_SUPABASE_KEY = config.supabaseKey;
+let STORE_ID = config.storeId;
+const IS_SERVICE_ROLE = !!process.env.SUPABASE_SERVICE_ROLE_KEY;
+// User identity — loaded from config (set by `whale login`)
+let USER_ID = rawConfig.user_id || null;
+let USER_EMAIL = rawConfig.email || null;
+// ============================================================================
+// AUTH STATE — tracks whether we can make authenticated API calls
+// ============================================================================
+let isAuthenticated = !!(SUPABASE_URL && INITIAL_SUPABASE_KEY);
+let supabase = null;
+if (isAuthenticated) {
+    supabase = createClient(SUPABASE_URL, INITIAL_SUPABASE_KEY);
+    if (IS_SERVICE_ROLE && !USER_ID) {
+        console.error("[MCP] WARNING: Using service role key without user login. Tools will work but store scoping is disabled.");
+        console.error("[MCP] For proper store-scoped access, use the whale_login tool or run `whale login` first.");
+    }
+}
+else {
+    console.error("[MCP] Not authenticated. Use the whale_login tool to sign in, or run `whale login` in a terminal.");
+}
+/** Reload config from disk and update in-memory state */
+function reloadConfig() {
+    config = resolveConfig();
+    rawConfig = loadConfig();
+    INITIAL_SUPABASE_KEY = config.supabaseKey;
+    STORE_ID = config.storeId;
+    USER_ID = rawConfig.user_id || null;
+    USER_EMAIL = rawConfig.email || null;
+    if (config.supabaseUrl && config.supabaseKey) {
+        supabase = createClient(config.supabaseUrl, config.supabaseKey);
+        isAuthenticated = true;
+    }
+}
+/** Get a fresh auth token — service role keys are static, JWTs auto-refresh */
+async function getAuthToken() {
+    if (IS_SERVICE_ROLE)
+        return INITIAL_SUPABASE_KEY;
+    // JWT user — refresh if needed
+    const token = await getValidToken();
+    return token || INITIAL_SUPABASE_KEY;
+}
+// Fly.io server URL for tool execution
+const SERVER_URL = config.serverUrl;
+// Session ID for tracing — links all tool calls in one conversation
+const SESSION_ID = crypto.randomUUID();
+const WHALE_LOGIN_TOOL = {
+    name: "whale_login",
+    description: "Log in to your WhaleTools account. Opens a browser for secure authentication. Use this when you see 'not authenticated' errors.",
+    inputSchema: { type: "object", properties: {} },
+};
+const WHALE_STATUS_TOOL = {
+    name: "whale_status",
+    description: "Check current authentication status, active store, and account info.",
+    inputSchema: { type: "object", properties: {} },
+};
+const WHALE_STORES_TOOL = {
+    name: "whale_stores",
+    description: "List your stores or switch the active store.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            store_id: {
+                type: "string",
+                description: "Store ID to switch to. Omit to list all available stores.",
+            },
+        },
+    },
+};
+const LOCAL_TOOLS = [WHALE_LOGIN_TOOL, WHALE_STATUS_TOOL, WHALE_STORES_TOOL];
+// ============================================================================
+// REMOTE TOOL DEFINITIONS (loaded from database)
+// ============================================================================
+let toolDefinitions = [];
+let toolsLoadedAt = 0;
+const TOOL_CACHE_TTL = 300_000; // 5 minutes — tool defs rarely change mid-session
+async function loadToolDefinitions(force = false) {
+    if (!isAuthenticated || !supabase)
+        return [];
+    if (!force && toolDefinitions.length > 0 && Date.now() - toolsLoadedAt < TOOL_CACHE_TTL) {
+        return toolDefinitions;
+    }
+    try {
+        const { data, error } = await supabase
+            .from("ai_tool_registry")
+            .select("name, description, definition")
+            .eq("is_active", true)
+            .neq("tool_mode", "code");
+        if (error) {
+            console.error("[MCP] Failed to load tools from registry:", error.message);
+            return toolDefinitions; // Return stale cache on error
+        }
+        toolDefinitions = (data || []).map(t => ({
+            name: t.name,
+            description: t.description || t.definition?.description || `Execute ${t.name}`,
+            inputSchema: t.definition?.input_schema || { type: "object", properties: {} }
+        }));
+        toolsLoadedAt = Date.now();
+        return toolDefinitions;
+    }
+    catch (err) {
+        console.error("[MCP] Error loading tool definitions:", err);
+        return toolDefinitions;
+    }
+}
+async function executeToolRemote(toolName, args, storeId, traceId) {
+    try {
+        const token = await getAuthToken();
+        const response = await fetch(SERVER_URL, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Authorization": `Bearer ${token}`,
+            },
+            body: JSON.stringify({
+                mode: "tool",
+                tool_name: toolName,
+                args,
+                store_id: storeId,
+                conversation_id: SESSION_ID,
+                trace_id: traceId,
+                userId: USER_ID,
+                userEmail: USER_EMAIL,
+                source: "whale-code-mcp",
+            }),
+        });
+        const result = await response.json();
+        return result;
+    }
+    catch (err) {
+        return {
+            success: false,
+            error: `Server tool call failed: ${err.message}`,
+        };
+    }
+}
+// ============================================================================
+// LOCAL TOOL HANDLERS
+// ============================================================================
+async function handleWhaleLogin() {
+    try {
+        const result = await signInWithBrowser(config.platformUrl, {
+            onBrowserOpening: (url) => {
+                console.error(`[MCP] Opening browser for login: ${url}`);
+            },
+            onWaitingForCallback: () => {
+                console.error("[MCP] Waiting for browser login...");
+            },
+            onExchangingCode: () => {
+                console.error("[MCP] Exchanging auth code...");
+            },
+        });
+        if (!result.success) {
+            return {
+                content: [{ type: "text", text: `Login failed: ${result.error}\n\nYou can also try running \`whale login\` in a terminal.` }],
+                isError: true,
+            };
+        }
+        // Reload config after successful login
+        reloadConfig();
+        // Force-reload tool definitions
+        const tools = await loadToolDefinitions(true);
+        // Notify MCP client that tools have changed
+        server.notification({ method: "notifications/tools/list_changed" });
+        const cfg = result.config;
+        let msg = `Logged in as ${cfg.email || "unknown"}`;
+        if (cfg.store_name || cfg.store_id) {
+            msg += `\nActive store: ${cfg.store_name || cfg.store_id}`;
+        }
+        msg += `\n${tools.length} tools now available.`;
+        if (result.stores && result.stores.length > 1) {
+            msg += `\n\nYou have ${result.stores.length} stores. Use whale_stores to switch:`;
+            for (const s of result.stores) {
+                msg += `\n  - ${s.name} (${s.id})`;
+            }
+        }
+        return { content: [{ type: "text", text: msg }] };
+    }
+    catch (err) {
+        return {
+            content: [{ type: "text", text: `Login error: ${err instanceof Error ? err.message : String(err)}` }],
+            isError: true,
+        };
+    }
+}
+function handleWhaleStatus() {
+    const cfg = loadConfig();
+    const lines = [];
+    if (isAuthenticated) {
+        lines.push("Authenticated: yes");
+        lines.push(`User: ${cfg.email || "(unknown)"}`);
+        lines.push(`User ID: ${cfg.user_id || "(unknown)"}`);
+        lines.push(`Store: ${cfg.store_name || cfg.store_id || "(none selected)"}`);
+        lines.push(`Auth method: ${IS_SERVICE_ROLE ? "service role key (env var)" : "user JWT (whale login)"}`);
+        if (cfg.expires_at) {
+            const exp = new Date(cfg.expires_at * 1000);
+            lines.push(`Token expires: ${exp.toISOString()}`);
+        }
+    }
+    else {
+        lines.push("Authenticated: no");
+        lines.push("Use whale_login to sign in.");
+    }
+    lines.push(`MCP version: ${PKG_VERSION}`);
+    lines.push(`Server: ${SERVER_URL}`);
+    lines.push(`Tools loaded: ${toolDefinitions.length}`);
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+}
+async function handleWhaleStores(args) {
+    if (!isAuthenticated) {
+        return {
+            content: [{ type: "text", text: "Not authenticated. Use whale_login first." }],
+            isError: true,
+        };
+    }
+    const switchToId = args.store_id;
+    if (switchToId) {
+        // Switch store
+        // Verify the store exists for this user
+        const token = await getAuthToken();
+        const stores = await getStoresForUser(token, USER_ID || "");
+        const target = stores.find(s => s.id === switchToId);
+        if (!target) {
+            return {
+                content: [{ type: "text", text: `Store not found: ${switchToId}\nAvailable stores: ${stores.map(s => `${s.name} (${s.id})`).join(", ")}` }],
+                isError: true,
+            };
+        }
+        selectStore(target.id, target.name);
+        reloadConfig();
+        // Notify MCP client that tools may have changed context
+        server.notification({ method: "notifications/tools/list_changed" });
+        return {
+            content: [{ type: "text", text: `Switched to store: ${target.name} (${target.id})` }],
+        };
+    }
+    // List stores
+    const token = await getAuthToken();
+    const stores = await getStoresForUser(token, USER_ID || "");
+    if (stores.length === 0) {
+        return { content: [{ type: "text", text: "No stores found for your account." }] };
+    }
+    const cfg = loadConfig();
+    const lines = ["Your stores:"];
+    for (const s of stores) {
+        const active = s.id === cfg.store_id ? " (active)" : "";
+        lines.push(`  - ${s.name}${s.slug ? ` [${s.slug}]` : ""}: ${s.id}${active}`);
+    }
+    lines.push("\nTo switch: use whale_stores with store_id parameter");
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+}
+// ============================================================================
+// MCP SERVER
+// ============================================================================
+const server = new Server({ name: "whale", version: PKG_VERSION }, { capabilities: { tools: {} } });
+// List available tools — local auth tools always present; remote tools when authenticated
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+    if (!isAuthenticated) {
+        console.error(`[MCP] Returning ${LOCAL_TOOLS.length} tools (not authenticated)`);
+        return {
+            tools: LOCAL_TOOLS.map(t => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+            })),
+        };
+    }
+    const remoteTools = await loadToolDefinitions();
+    const allTools = [...LOCAL_TOOLS, ...remoteTools];
+    console.error(`[MCP] Returning ${allTools.length} tools (${LOCAL_TOOLS.length} local + ${remoteTools.length} remote)`);
+    return {
+        tools: allTools.map(t => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    };
+});
+// Execute a tool — local auth tools handled here, everything else proxied to Fly.io
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const toolName = request.params.name;
+    const toolArgs = (request.params.arguments || {});
+    // ── Local tools (handled in-process) ──
+    if (toolName === "whale_login") {
+        return handleWhaleLogin();
+    }
+    if (toolName === "whale_status") {
+        return handleWhaleStatus();
+    }
+    if (toolName === "whale_stores") {
+        return handleWhaleStores(toolArgs);
+    }
+    // ── Auth gate for remote tools ──
+    if (!isAuthenticated) {
+        return {
+            content: [{
+                    type: "text",
+                    text: "Not authenticated. Please use the whale_login tool first to sign in to your WhaleTools account.",
+                }],
+            isError: true,
+        };
+    }
+    // ── Remote tool execution ──
+    const startTime = Date.now();
+    const traceId = crypto.randomUUID();
+    // Allow tool-level store_id override (e.g. multi-store users switching context)
+    const effectiveStoreId = toolArgs.store_id || STORE_ID || undefined;
+    if (toolArgs.store_id) {
+        delete toolArgs.store_id; // Don't send as a tool arg — it's a routing param
+    }
+    console.error(`[MCP] Executing: ${toolName} → Fly.io [${traceId.slice(0, 8)}] store=${effectiveStoreId?.slice(0, 8) || "none"}`);
+    const result = await executeToolRemote(toolName, toolArgs, effectiveStoreId, traceId);
+    const durationMs = Date.now() - startTime;
+    // Fire-and-forget telemetry
+    logMcpToolCall(toolName, toolArgs.action, result.success, durationMs, traceId, result.error).catch(() => { });
+    if (result.success) {
+        return {
+            content: [{
+                    type: "text",
+                    text: typeof result.data === "string"
+                        ? result.data
+                        : JSON.stringify(result.data, null, 2),
+                }],
+        };
+    }
+    else {
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({ error: result.error }),
+                }],
+            isError: true,
+        };
+    }
+});
+/**
+ * Fire-and-forget MCP proxy telemetry — logs to audit_logs as a third service
+ * ("mcp-proxy") alongside "whale-cli" and "agent-server", capturing the full
+ * network round-trip latency from MCP client → Fly.io server → response.
+ */
+async function logMcpToolCall(toolName, action, success, durationMs, traceId, error) {
+    if (!supabase)
+        return;
+    try {
+        const now = new Date();
+        const startTime = new Date(now.getTime() - durationMs);
+        const bytes = new Uint8Array(8);
+        crypto.getRandomValues(bytes);
+        const spanId = Array.from(bytes).map(b => b.toString(16).padStart(2, "0")).join("");
+        await supabase.from("audit_logs").insert({
+            action: `mcp.tool.${toolName}${action ? `.${action}` : ""}`,
+            severity: success ? "info" : "error",
+            store_id: STORE_ID || null,
+            user_id: USER_ID,
+            user_email: USER_EMAIL,
+            resource_type: "whale_code_mcp",
+            resource_id: toolName,
+            request_id: traceId,
+            conversation_id: SESSION_ID,
+            source: "whale_code_mcp",
+            details: {
+                session_id: SESSION_ID,
+                source: "whale_code_mcp",
+                tool_name: toolName,
+                action: action || null,
+            },
+            error_message: error || null,
+            duration_ms: durationMs,
+            trace_id: traceId,
+            span_id: spanId,
+            span_kind: "CLIENT",
+            service_name: "whale-code-mcp",
+            service_version: PKG_VERSION,
+            status_code: success ? "OK" : "ERROR",
+            start_time: startTime.toISOString(),
+            end_time: now.toISOString(),
+        });
+    }
+    catch {
+        // Telemetry must never break tool execution
+    }
+}
+// ============================================================================
+// LOCAL AGENT (auto-spawned — shares this process with MCP server)
+// ============================================================================
+let localAgent = null;
+/**
+ * Get or create a store API key for the local agent WebSocket connection.
+ * Persisted to ~/.swagmanager/config.json so we reuse across restarts.
+ */
+async function getOrCreateAgentApiKey() {
+    const rawConfig = loadConfig();
+    if (rawConfig.agent_api_key)
+        return rawConfig.agent_api_key;
+    // Auto-generate via the server's api_keys tool
+    try {
+        const result = await executeToolRemote("api_keys", {
+            action: "generate",
+            name: "local-agent-auto",
+            scopes: ["*"],
+            key_type: "live",
+        }, STORE_ID || undefined);
+        if (result.success && result.data) {
+            const data = result.data;
+            const key = data.key_value || data.api_key || data.key;
+            if (key) {
+                updateConfig({ agent_api_key: key });
+                console.error("[MCP] Auto-generated local agent API key");
+                return key;
+            }
+        }
+        console.error("[MCP] Failed to auto-generate agent API key:", result.error);
+        return null;
+    }
+    catch (err) {
+        console.error("[MCP] Error generating agent API key:", err.message);
+        return null;
+    }
+}
+/**
+ * Derive WebSocket URL from the HTTP server URL.
+ * https://whale-agent.fly.dev → wss://whale-agent.fly.dev/agent/ws
+ */
+function getAgentWsUrl() {
+    const base = SERVER_URL.replace(/\/$/, "");
+    const wsBase = base.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
+    return `${wsBase}/agent/ws`;
+}
+/**
+ * Start the local agent WebSocket connection in the background.
+ * Non-blocking — MCP server continues even if this fails.
+ */
+async function startLocalAgent() {
+    const apiKey = await getOrCreateAgentApiKey();
+    if (!apiKey) {
+        console.error("[MCP] Skipping local agent — no API key available");
+        return;
+    }
+    const wsUrl = getAgentWsUrl();
+    console.error(`[MCP] Starting local agent → ${wsUrl}`);
+    localAgent = new LocalAgentConnection({
+        apiKey,
+        serverUrl: wsUrl,
+        onConnected: () => console.error("[MCP] Local agent connected — WhaleChat can now use local tools"),
+        onDisconnected: (reason) => console.error(`[MCP] Local agent disconnected: ${reason}`),
+        onError: (err) => console.error(`[MCP] Local agent error: ${err.message}`),
+        onLog: (msg) => console.error(msg),
+    });
+    try {
+        await localAgent.connect();
+    }
+    catch (err) {
+        console.error(`[MCP] Local agent failed to connect: ${err.message} (non-fatal)`);
+    }
+}
+// ============================================================================
+// STARTUP
+// ============================================================================
+async function main() {
+    // Initialize error logging for MCP mode
+    initErrorLogger({ serviceName: "whale-code-mcp" });
+    if (USER_ID || USER_EMAIL) {
+        setErrorLoggerUser(USER_ID || undefined, USER_EMAIL || undefined, STORE_ID || undefined);
+    }
+    console.error(`[MCP] Whale MCP Server v${PKG_VERSION}`);
+    console.error(`[MCP] Supabase: ${SUPABASE_URL}`);
+    console.error(`[MCP] Server: ${SERVER_URL}`);
+    console.error(`[MCP] Store: ${STORE_ID || "(default)"}`);
+    console.error(`[MCP] User: ${USER_EMAIL || "(unknown)"} [${USER_ID?.slice(0, 8) || "no-id"}]`);
+    console.error(`[MCP] Session: ${SESSION_ID}`);
+    console.error(`[MCP] Authenticated: ${isAuthenticated ? "yes" : "no — use whale_login tool"}`);
+    // Pre-load tools from database (only if authenticated)
+    if (isAuthenticated) {
+        const tools = await loadToolDefinitions(true);
+        console.error(`[MCP] Loaded ${tools.length} tools from registry`);
+    }
+    else {
+        console.error(`[MCP] Skipping tool load — not authenticated. ${LOCAL_TOOLS.length} auth tools available.`);
+    }
+    // Start OTA update checker (non-blocking, runs in background)
+    startUpdateLoop(true);
+    // Connect via stdio
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("[MCP] Ready");
+    // Start local agent in background — only if authenticated
+    if (isAuthenticated) {
+        startLocalAgent().catch((err) => {
+            console.error("[MCP] Local agent startup error:", err.message);
+        });
+    }
+}
+// Graceful shutdown — disconnect local agent
+process.on("SIGINT", () => {
+    localAgent?.disconnect();
+});
+process.on("SIGTERM", () => {
+    localAgent?.disconnect();
+});
+main().catch((err) => {
+    console.error("[MCP] Fatal:", err);
+    captureError({ error: err instanceof Error ? err : new Error(String(err)), severity: "fatal", tags: { source: "mcp_main" } });
+    // Give error logger a moment to flush before exit
+    setTimeout(() => process.exit(1), 500);
+});

package/dist/local-agent/connection.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Local Agent Connection — maintains WebSocket connection to SwagManager cloud.
+ *
+ * Features:
+ * - Outbound WSS connection (no firewall issues)
+ * - Auto-reconnection with exponential backoff
+ * - Heartbeat/pong handling
+ * - Command routing to executor
+ */
+export interface AgentConfig {
+    apiKey: string;
+    serverUrl?: string;
+    autoReconnect?: boolean;
+    onConnected?: () => void;
+    onDisconnected?: (reason: string) => void;
+    onError?: (err: Error) => void;
+    onLog?: (msg: string) => void;
+}
+export declare class LocalAgentConnection {
+    private ws;
+    private config;
+    private reconnectAttempts;
+    private reconnectTimer;
+    private intentionalClose;
+    private discoveredTools;
+    private _agentId;
+    constructor(config: AgentConfig);
+    /**
+     * Connect to the SwagManager cloud gateway.
+     */
+    connect(): Promise<void>;
+    /**
+     * Disconnect gracefully.
+     */
+    disconnect(): void;
+    /**
+     * Check if connected.
+     */
+    get connected(): boolean;
+    private handleMessage;
+    private handleExec;
+    private handleToolExec;
+    private handleDiscover;
+    private send;
+    private sendResult;
+    private scheduleReconnect;
+    private log;
+}