x-developer 2.5.6 → 2.6.2

package/skills/x-twitter-scraper/references/webhooks.md

@@ -25,8 +25,12 @@ Every delivery is a `POST` request to your URL with a JSON body:
 
 ```json
 {
+  "schemaVersion": 1,
+  "streamEventId": "9010",
+  "deliveryId": "334",
   "eventType": "tweet.new",
   "username": "elonmusk",
+  "occurredAt": "2026-02-24T16:45:00.000Z",
   "data": {
     "tweetId": "1893556789012345678",
     "text": "Hello world",
@@ -37,7 +41,16 @@ Every delivery is a `POST` request to your URL with a JSON body:
 
 ## Signature Verification
 
-The `X-Xquik-Signature` header contains: `sha256=` + HMAC-SHA256(secret, raw JSON body).
+Each request contains `X-Xquik-Timestamp`, `X-Xquik-Nonce`, and
+`X-Xquik-Signature`. The signature is `sha256=` plus HMAC-SHA256 over:
+
+```text
+<timestamp>.<nonce>.<raw JSON body>
+```
+
+Reject timestamps outside a 5-minute window. Reject reused nonces within that
+window. Compare signatures in constant time before parsing JSON.
+Use an atomic shared nonce store in multi-instance deployments.
 
 ### Node.js (Standard Library)
 
@@ -47,11 +60,25 @@ import { createServer } from "node:http";
 
 // This is the per-webhook secret from the POST /webhooks response, not a Xquik account credential
 const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;
+const recentNonces = new Map();
 
-function verifySignature(payload, signature, secret) {
-  if (typeof signature !== "string" || !secret) return false;
+function claimNonce(nonce) {
+  const now = Date.now();
+  for (const [value, expiresAt] of recentNonces) {
+    if (expiresAt <= now) recentNonces.delete(value);
+  }
+  if (recentNonces.has(nonce)) return false;
+  recentNonces.set(nonce, now + 5 * 60 * 1000);
+  return true;
+}
 
-  const expected = "sha256=" + createHmac("sha256", secret).update(payload).digest("hex");
+function verifySignature(payload, signature, timestamp, nonce, secret) {
+  if (![signature, timestamp, nonce, secret].every((value) => typeof value === "string")) return false;
+  if (!/^\d+$/.test(timestamp) || !/^[0-9a-f]{32}$/.test(nonce)) return false;
+  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;
+
+  const input = `${timestamp}.${nonce}.${payload}`;
+  const expected = "sha256=" + createHmac("sha256", secret).update(input).digest("hex");
   const expectedBuffer = Buffer.from(expected, "utf8");
   const signatureBuffer = Buffer.from(signature, "utf8");
 
@@ -73,26 +100,25 @@ const server = createServer((req, res) => {
   req.on("end", () => {
     const payload = Buffer.concat(chunks).toString("utf8");
     const signature = req.headers["x-xquik-signature"];
+    const timestamp = req.headers["x-xquik-timestamp"];
+    const nonce = req.headers["x-xquik-nonce"];
 
-    if (!verifySignature(payload, signature, WEBHOOK_SECRET)) {
+    if (
+      !verifySignature(payload, signature, timestamp, nonce, WEBHOOK_SECRET) ||
+      !claimNonce(nonce)
+    ) {
       res.writeHead(401).end("Invalid signature");
       return;
     }
 
     const event = JSON.parse(payload);
 
-    switch (event.eventType) {
-      case "tweet.new":
-        console.log(`New tweet from @${event.username}: ${event.data.text}`);
-        break;
-      case "tweet.reply":
-        console.log(`Reply from @${event.username}: ${event.data.text}`);
-        break;
-      case "tweet.retweet":
-        console.log(`@${event.username} retweeted`);
-        break;
+    if (!["tweet.new", "tweet.reply", "tweet.retweet"].includes(event.eventType)) {
+      res.writeHead(400).end("Unsupported event type");
+      return;
     }
 
+    console.log("Accepted verified Xquik webhook");
     res.writeHead(200).end("OK");
   });
 });
@@ -106,6 +132,8 @@ server.listen(3000);
 import hmac
 import hashlib
 import json
+import re
+import time
 from http.server import BaseHTTPRequestHandler, HTTPServer
 
 def load_secret(name: str) -> str:
@@ -114,20 +142,36 @@ def load_secret(name: str) -> str:
 
 # Per-webhook secret from POST /webhooks response, not a Xquik account credential
 WEBHOOK_SECRET = load_secret("XQUIK_WEBHOOK_SECRET")
-
-def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
-    expected = "sha256=" + hmac.new(
-        secret.encode(), payload, hashlib.sha256
-    ).hexdigest()
+RECENT_NONCES: dict[str, int] = {}
+
+def claim_nonce(nonce: str) -> bool:
+    now = int(time.time() * 1000)
+    for value, expires_at in list(RECENT_NONCES.items()):
+        if expires_at <= now:
+            RECENT_NONCES.pop(value, None)
+    if nonce in RECENT_NONCES:
+        return False
+    RECENT_NONCES[nonce] = now + 5 * 60 * 1000
+    return True
+
+def verify_signature(payload: bytes, signature: str, timestamp: str, nonce: str, secret: str) -> bool:
+    if not timestamp.isdigit() or not re.fullmatch(r"[0-9a-f]{32}", nonce):
+        return False
+    if abs(int(time.time() * 1000) - int(timestamp)) > 5 * 60 * 1000:
+        return False
+    signing_input = timestamp.encode() + b"." + nonce.encode() + b"." + payload
+    expected = "sha256=" + hmac.new(secret.encode(), signing_input, hashlib.sha256).hexdigest()
     return hmac.compare_digest(expected, signature)
 
 class WebhookHandler(BaseHTTPRequestHandler):
     def do_POST(self):
         signature = self.headers.get("X-Xquik-Signature", "")
+        timestamp = self.headers.get("X-Xquik-Timestamp", "")
+        nonce = self.headers.get("X-Xquik-Nonce", "")
         length = int(self.headers.get("Content-Length", "0"))
         payload = self.rfile.read(length)
 
-        if not verify_signature(payload, signature, WEBHOOK_SECRET):
+        if not verify_signature(payload, signature, timestamp, nonce, WEBHOOK_SECRET) or not claim_nonce(nonce):
             self.send_response(401)
             self.end_headers()
             self.wfile.write(b"Invalid signature")
@@ -135,9 +179,13 @@ class WebhookHandler(BaseHTTPRequestHandler):
 
         event = json.loads(payload)
 
-        if event["eventType"] == "tweet.new":
-            print(f"New tweet from @{event['username']}: {event['data']['text']}")
+        if event.get("eventType") not in {"tweet.new", "tweet.reply", "tweet.retweet"}:
+            self.send_response(400)
+            self.end_headers()
+            self.wfile.write(b"Unsupported event type")
+            return
 
+        print("Accepted verified Xquik webhook")
         self.send_response(200)
         self.end_headers()
         self.wfile.write(b"OK")
@@ -159,13 +207,39 @@ import (
     "io"
     "net/http"
     "os"
+    "regexp"
+    "strconv"
+    "sync"
+    "time"
 )
 
 // Per-webhook secret from POST /webhooks response, not a Xquik account credential
 var webhookSecret = os.Getenv("XQUIK_WEBHOOK_SECRET")
+var recentNonces sync.Map
+
+func claimNonce(nonce string) bool {
+    now := time.Now().UnixMilli()
+    recentNonces.Range(func(key, value any) bool {
+        if value.(int64) <= now {
+            recentNonces.Delete(key)
+        }
+        return true
+    })
+    _, replayed := recentNonces.LoadOrStore(nonce, now+5*60*1000)
+    return !replayed
+}
 
-func verifySignature(payload []byte, signature, secret string) bool {
+func verifySignature(payload []byte, signature, timestamp, nonce, secret string) bool {
+    signedAt, err := strconv.ParseInt(timestamp, 10, 64)
+    if err != nil || !regexp.MustCompile(`^[0-9a-f]{32}$`).MatchString(nonce) {
+        return false
+    }
+    age := time.Now().UnixMilli() - signedAt
+    if age < -5*60*1000 || age > 5*60*1000 {
+        return false
+    }
     mac := hmac.New(sha256.New, []byte(secret))
+    mac.Write([]byte(timestamp + "." + nonce + "."))
     mac.Write(payload)
     expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
     return hmac.Equal([]byte(expected), []byte(signature))
@@ -179,8 +253,10 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
     }
 
     signature := r.Header.Get("X-Xquik-Signature")
+    timestamp := r.Header.Get("X-Xquik-Timestamp")
+    nonce := r.Header.Get("X-Xquik-Nonce")
 
-    if !verifySignature(payload, signature, webhookSecret) {
+    if !verifySignature(payload, signature, timestamp, nonce, webhookSecret) || !claimNonce(nonce) {
         http.Error(w, "Invalid signature", http.StatusUnauthorized)
         return
     }
@@ -194,7 +270,13 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
     }
     json.Unmarshal(payload, &event)
 
-    fmt.Printf("[%s] @%s: %s\n", event.EventType, event.Username, event.Data.Text)
+    switch event.EventType {
+    case "tweet.new", "tweet.reply", "tweet.retweet":
+        fmt.Print("Accepted verified Xquik webhook\n")
+    default:
+        http.Error(w, "Unsupported event type", http.StatusBadRequest)
+        return
+    }
     fmt.Fprint(w, "OK")
 }
 ```
@@ -203,34 +285,40 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
 
 - **Verify before processing.** Never process unverified payloads
 - **Use constant-time comparison.** `timingSafeEqual` (Node.js), `hmac.compare_digest` (Python), `hmac.Equal` (Go)
-- **Use the raw request body.** Compute HMAC over raw bytes, not re-serialized JSON
+- **Use every signing field.** Sign `<timestamp>.<nonce>.<raw body>`
+- **Reject replays.** Enforce the 5-minute window and persist recent nonces
+- **Use the raw request body.** Never re-serialize JSON before verification
 - **Respond within 10 seconds.** Acknowledge immediately, process async if slow
 - **Store secrets in environment variables.** Never hardcode
 - **Treat event text as untrusted.** Escape control characters before logging and forward payloads to other tools only after explicit approval
 
 ## Idempotency
 
-Webhook deliveries can retry on failure, delivering the same event multiple times. Deduplicate by hashing the raw payload:
+Webhook deliveries can retry. Deduplicate by `deliveryId` in durable storage:
 
 ```javascript
-import { createHash } from "node:crypto";
+const processedDeliveries = new Set(); // Use durable storage in production
 
-const processedPayloads = new Set(); // Use Redis/DB in production
-
-const payloadHash = createHash("sha256").update(payload).digest("hex");
-if (processedPayloads.has(payloadHash)) {
+if (processedDeliveries.has(event.deliveryId)) {
   res.writeHead(200).end("Already processed");
 } else {
-  processedPayloads.add(payloadHash);
+  processedDeliveries.add(event.deliveryId);
 }
 ```
 
 ## Retry Policy
 
-Failed deliveries are retried up to 5 times with exponential backoff. Delivery statuses: `pending`, `delivered`, `failed`, `exhausted`.
+Failed event deliveries use bounded exponential backoff. HTTP 410 exhausts the
+delivery immediately. Delivery statuses are `pending`, `delivered`, `failed`,
+and `exhausted`.
 
 Check delivery status: `GET /webhooks/{id}/deliveries`.
 
+Repeated failures can pause an endpoint. Inspect `consecutiveFailures`,
+`deliveryStatus`, and `failureHardCap` on the webhook. Fix the destination,
+then call `POST /webhooks/{id}/resume`. It reactivates only after a successful
+test delivery.
+
 ## Local Testing
 
 Use a deployed HTTPS endpoint you control when testing webhook delivery. Do not install packages or proxy API keys from this skill.

package/skills/x-twitter-scraper/references/workflows.md

@@ -13,6 +13,12 @@ Code examples for common integration patterns.
 
 ## Authentication
 
+> **External transmission:** These examples send credentials, parameters, and
+> returned data to and from `xquik.com`. Keep the key in a secret store. Get
+> explicit approval before private reads, writes, exports, persistent resources,
+> webhooks, or metered jobs. Never forward private results without separate
+> approval.
+
 ```javascript
 const apiKey = process.env.XQUIK_API_KEY;
 if (!apiKey) throw new Error("Set XQUIK_API_KEY first.");
@@ -23,11 +29,14 @@ const headers = { "x-api-key": apiKey, "Content-Type": "application/json" };
 
 ## Retry with Exponential Backoff
 
-Retry only `429` and `5xx`. Never retry `4xx` (except 429). Max 3 retries:
+Retry only idempotent requests after `429` and `5xx`. Never automatically retry
+`POST`, `PATCH`, or `DELETE`. Max 3 retries:
 
 ```javascript
 async function xquikFetch(path, options = {}) {
   const baseDelay = 1000;
+  const method = (options.method || "GET").toUpperCase();
+  const retrySafe = ["GET", "HEAD", "OPTIONS"].includes(method);
 
   for (let attempt = 0; attempt <= 3; attempt++) {
     const response = await fetch(`${BASE}${path}`, {
@@ -37,7 +46,7 @@ async function xquikFetch(path, options = {}) {
 
     if (response.ok) return response.json();
 
-    const retryable = response.status === 429 || response.status >= 500;
+    const retryable = retrySafe && (response.status === 429 || response.status >= 500);
     if (!retryable || attempt === 3) {
       const error = await response.json();
       throw new Error(`Xquik API ${response.status}: ${error.error}`);
@@ -55,7 +64,9 @@ async function xquikFetch(path, options = {}) {
 
 ## Cursor Pagination
 
-Events, draws, extractions, and extraction results use cursor-based pagination. When more results exist, the response includes `hasMore: true` and a `nextCursor` string. Pass `nextCursor` as the `after` query parameter.
+Events, draws, extractions, and extraction results use cursor-based pagination.
+When more results exist, the response includes `hasMore: true` and a
+`nextCursor` string. Pass it as `cursor`. Radar alone uses `after`.
 
 ```javascript
 async function fetchAllPages(path, dataKey) {
@@ -64,7 +75,7 @@ async function fetchAllPages(path, dataKey) {
 
   while (true) {
     const params = new URLSearchParams({ limit: "100" });
-    if (cursor) params.set("after", cursor);
+    if (cursor) params.set("cursor", cursor);
 
     const data = await xquikFetch(`${path}?${params}`);
     results.push(...data[dataKey]);
@@ -82,6 +93,10 @@ Cursors are opaque strings. Never decode or construct them manually.
 ## Complete Extraction Workflow
 
 ```javascript
+function requireExplicitApproval(scope) {
+  throw new Error(`Approval required for ${scope}. Implement the approval gate first.`);
+}
+
 // Step 1: Estimate usage before running
 const estimate = await xquikFetch("/extractions/estimate", {
   method: "POST",
@@ -97,7 +112,8 @@ if (!estimate.allowed) {
   return;
 }
 
-// Step 2: Create extraction job
+// Step 2: Create extraction job after approving this exact bounded request
+requireExplicitApproval("the bounded extraction job, usage, recipients, and retention");
 let job = await xquikFetch("/extractions", {
   method: "POST",
   body: JSON.stringify({
@@ -118,7 +134,7 @@ let cursor;
 const allResults = [];
 
 while (true) {
-  const path = `/extractions/${job.id}${cursor ? `?after=${cursor}` : ""}`;
+  const path = `/extractions/${job.id}${cursor ? `?cursor=${cursor}` : ""}`;
   const page = await xquikFetch(path);
   allResults.push(...page.results);
 
@@ -126,7 +142,8 @@ while (true) {
   cursor = page.nextCursor;
 }
 
-// Step 5: Export as CSV/JSON/MD/MD-document/PDF/TXT/XLSX (100,000 row limit; PDF 10,000)
+// Step 5: Export only after reviewing a bounded preview and approving transmission
+requireExplicitApproval("the fixed export scope, audience, storage, and retention");
 const exportUrl = `${BASE}/extractions/${job.id}/export?format=csv`;
 const csvResponse = await fetch(exportUrl, { headers });
 const csvData = await csvResponse.text();
@@ -160,7 +177,8 @@ const webhook = await xquikFetch("/webhooks", {
 const events = await xquikFetch("/events?monitorId=7&limit=50");
 ```
 
-Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhook.test`.
+Monitor event types include `tweet.new`, `tweet.quote`, `tweet.reply`, and
+`tweet.retweet`. Test deliveries use `webhook.test`; do not subscribe to it.
 
 ## Endpoint Guide
 
@@ -182,7 +200,7 @@ Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhoo
 | **Get bookmark folders** | `GET /x/bookmarks/folders` | Metered |
 | **Get notifications** | `GET /x/notifications` | Metered per result |
 | **Get home timeline** | `GET /x/timeline` | Metered per result |
-| **Get DM history** | `GET /x/dm/{userId}/history` | Metered per result |
+| **Get DM history** | `GET /x/dm/{userId}/history?account={username}` | Private; approve exact account and block ambiguity |
 | **Monitor an X account** | `POST /monitors` | Active monitors are metered hourly |
 | **Poll for events** | `GET /events` | Included |
 | **Receive events via webhook** | `POST /webhooks` | Included; confirmation required for destination URL |

package/skills/x-twitter-scraper/skill-card.md

@@ -53,7 +53,7 @@ Mitigation: Verify unfamiliar endpoint details against `https://docs.xquik.com`
 - NVIDIA signing guidance: `https://docs.nvidia.com/skills/signing-agent-skills`
 - NVIDIA skill card guidance: `https://docs.nvidia.com/skills/skill-cards`
 - NVIDIA release checklist: `https://docs.nvidia.com/skills/release-checklist`
-- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-16 with 0 findings. Refresh it after each skill directory change.
+- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-31 with 0 findings. Refresh it after each skill directory change.
 - Signing evidence: pending `skill.oms.sig` for signed release artifacts.
 - Evaluation evidence: pending Tier-3 evaluation data and `BENCHMARK.md` for NVIDIA-Verified release.
 
@@ -69,7 +69,7 @@ Other properties: The skill performs no shell execution, no local file access, n
 
 ## Skill Version
 
-2.5.6
+2.6.2
 
 ## Ethical Considerations
 

package/skills/x-twitter-scraper/skillspector-report.md

@@ -2,14 +2,17 @@
 
 **Skill:** x-twitter-scraper
 **Source:** `skills/x-twitter-scraper`
-**Scanned:** 2026-07-16 13:37:35 UTC
+**Scanned:** 2026-07-31 15:11:36 UTC
 
 ## Static Scan
 
 - Scanner: SkillSpector v2.3.7
 - Mode: static analysis only (`--no-llm`)
-- Components scanned: 75
+- Components scanned: 88
 - Executable scripts: no
+- Risk score: 0/100
+- Severity: low
+- Recommendation: safe
 - Findings: 0
 
 No security issues were detected by the static scan.

package/skills/xquik-social-research/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: xquik-social-research
 description: Research public X data with Xquik. Use for tweet search, tweet lookup, user discovery, profile timelines, threads, followers, trends, exports, monitoring plans, or MCP setup. Keep public reads bounded. Require explicit approval before private reads, writes, persistent resources, or bulk jobs. Not affiliated with X Corp.
+license: MIT
 ---
 
 # Xquik Social Research

package/start.sh

@@ -1,2 +1,5 @@
 #!/bin/sh
+# SPDX-FileCopyrightText: 2026 Xquik Contributors
+# SPDX-License-Identifier: MIT
+
 exec node stub-server.mjs

package/stub-server.mjs

@@ -1,20 +1,27 @@
 #!/usr/bin/env node
 
+// SPDX-FileCopyrightText: 2026 Xquik Contributors
+// SPDX-License-Identifier: MIT
+
 // Minimal stdio MCP server stub for package verification.
 // Exposes the public tool shape used by registry checks.
 // For live usage, connect to: https://xquik.com/mcp
 
 import { createInterface } from "node:readline";
+import { pathToFileURL } from "node:url";
 
 const SERVER_INFO = {
   name: "xquik",
-  version: "2.5.6",
+  version: "2.6.2",
 };
 
 const CAPABILITIES = {
   tools: { listChanged: false },
 };
 
+const MODERN_PROTOCOL_VERSION = "2026-07-28";
+const LEGACY_PROTOCOL_VERSION = "2025-11-25";
+const CACHE_TTL_MS = 300_000;
 const MAX_LINE_LENGTH = 64 * 1024;
 const JSONRPC = "2.0";
 const LIVE_SERVER_MESSAGE =
@@ -42,7 +49,7 @@ const TOOLS = [
   {
     name: "explore",
     description: description([
-      "Live Xquik tool: search the 119-route API catalog before calling 'xquik'. This package stub returns setup guidance only.",
+      "Live Xquik tool: search the 120-route API catalog before calling 'xquik'. This package stub returns setup guidance only.",
       "",
       "## When to use",
       "- Use 'explore' FIRST to find the right endpoint path, parameters, and response shape before calling 'xquik'.",
@@ -56,7 +63,7 @@ const TOOLS = [
       "## Behavior",
       "- Live server: read-only, idempotent catalog search with no API request.",
       "- Package stub: makes no network call and returns live setup guidance.",
-      "- The live catalog has 119 routes. Of these, 118 support JSON or text.",
+      "- The live catalog has 120 routes. Of these, 119 support JSON or text.",
       "- Each EndpointInfo contains method, path, summary, category, free, parameters, and responseShape fields.",
       "",
       "## Input format",
@@ -81,7 +88,7 @@ const TOOLS = [
   {
     name: "xquik",
     description: description([
-      "Live Xquik tool: send confirmed requests across 119 catalog routes. This package stub returns setup guidance only.",
+      "Live Xquik tool: send confirmed requests across 120 catalog routes. This package stub returns setup guidance only.",
       "",
       "## When to use",
       "- Use after calling 'explore' to discover the endpoint path and parameters.",
@@ -96,7 +103,7 @@ const TOOLS = [
       "- Live server: processes `xquik.request(path, options?)` inside a bounded sandbox.",
       "- Package stub: makes no API request and returns live setup guidance.",
       "- The live tool has no filesystem or arbitrary network access.",
-      "- 118 catalog routes support JSON or text. Binary support downloads use REST.",
+      "- 119 catalog routes support JSON or text. Binary support downloads use REST.",
       "- Mutating operations require prior user confirmation and can return durable actions.",
       "- Pagination responses include `has_more` and `next_cursor`. Pass `cursor` for the next page.",
       "- Some operations modify X or Xquik resources. Show the exact payload, target, and usage estimate before calling them.",
@@ -127,20 +134,21 @@ const TOOLS = [
   },
 ];
 
-const rl = createInterface({ input: process.stdin, terminal: false });
-
-function send(msg) {
-  const json = JSON.stringify(msg);
-  process.stdout.write(json + "\n");
-}
-
-function sendResult(id, result) {
-  send({ jsonrpc: JSONRPC, id, result });
-}
+const DISCOVERY_RESULT = {
+  _meta: {
+    "io.modelcontextprotocol/serverInfo": SERVER_INFO,
+  },
+  cacheScope: "private",
+  capabilities: CAPABILITIES,
+  supportedVersions: [MODERN_PROTOCOL_VERSION],
+  ttlMs: CACHE_TTL_MS,
+};
 
-function sendError(id, code, message) {
-  send({ jsonrpc: JSONRPC, id, error: { code, message } });
-}
+const TOOL_LIST_RESULT = {
+  cacheScope: "private",
+  tools: TOOLS,
+  ttlMs: CACHE_TTL_MS,
+};
 
 function isObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -150,48 +158,63 @@ function isKnownTool(name) {
   return TOOLS.some((tool) => tool.name === name);
 }
 
-function sendStubToolResult(id) {
-  sendResult(id, {
-    content: [{ type: "text", text: LIVE_SERVER_MESSAGE }],
-  });
-}
+export function createMessageHandler(writeLine) {
+  function send(msg) {
+    writeLine(`${JSON.stringify(msg)}\n`);
+  }
 
-function handleMessage(msg) {
-  const { id, method, params } = msg;
+  function sendResult(id, result) {
+    send({ jsonrpc: JSONRPC, id, result });
+  }
 
-  switch (method) {
-    case "initialize":
-      return sendResult(id, {
-        protocolVersion: "2024-11-05",
-        serverInfo: SERVER_INFO,
-        capabilities: CAPABILITIES,
-      });
+  function sendError(id, code, message) {
+    send({ jsonrpc: JSONRPC, id, error: { code, message } });
+  }
 
-    case "notifications/initialized":
-      return; // no response needed
+  function sendStubToolResult(id) {
+    sendResult(id, {
+      content: [{ type: "text", text: LIVE_SERVER_MESSAGE }],
+    });
+  }
 
-    case "tools/list":
-      return sendResult(id, { tools: TOOLS });
+  return function handleMessage(msg) {
+    const { id, method, params } = msg;
+    if (id === undefined) {
+      return;
+    }
 
-    case "tools/call": {
-      const toolName = params?.name;
-      if (isKnownTool(toolName)) {
-        return sendStubToolResult(id);
+    switch (method) {
+      case "server/discover":
+        return sendResult(id, DISCOVERY_RESULT);
+
+      case "initialize":
+        return sendResult(id, {
+          protocolVersion: LEGACY_PROTOCOL_VERSION,
+          serverInfo: SERVER_INFO,
+          capabilities: CAPABILITIES,
+        });
+
+      case "tools/list":
+        return sendResult(id, TOOL_LIST_RESULT);
+
+      case "tools/call": {
+        const toolName = params?.name;
+        if (isKnownTool(toolName)) {
+          return sendStubToolResult(id);
+        }
+        return sendError(id, -32601, `Unknown tool: ${toolName}`);
       }
-      return sendError(id, -32601, `Unknown tool: ${toolName}`);
-    }
 
-    case "ping":
-      return sendResult(id, {});
+      case "ping":
+        return sendResult(id, {});
 
-    default:
-      if (id !== undefined) {
+      default:
         return sendError(id, -32601, `Method not found: ${method}`);
-      }
-  }
+    }
+  };
 }
 
-rl.on("line", (line) => {
+export function processLine(line, handleMessage) {
   if (line.length > MAX_LINE_LENGTH) {
     return;
   }
@@ -204,4 +227,22 @@ rl.on("line", (line) => {
   } catch {
     // ignore malformed input
   }
-});
+}
+
+export function startServer({
+  input = process.stdin,
+  output = process.stdout,
+} = {}) {
+  const rl = createInterface({ input, terminal: false });
+  const handleMessage = createMessageHandler((line) => output.write(line));
+  rl.on("line", (line) => processLine(line, handleMessage));
+  return rl;
+}
+
+const isDirectExecution =
+  process.argv[1] !== undefined &&
+  import.meta.url === pathToFileURL(process.argv[1]).href;
+
+if (isDirectExecution) {
+  startServer();
+}

package/task-guides/check-mutuals.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.6"
+  version: "2.6.2"
   openclaw:
     requires:
       env: