feat: MCP-mode Dockerfile; handshake version read from package.json

Author: pugstro

Dockerfile.mcp

@@ -0,0 +1,61 @@
+# DocForge — MCP server image (stdio).
+#
+# Runs dist/index.js (the MCP stdio server) directly — no Slack, no HTTP.
+# This is the image MCP directories (e.g. Glama) use to start the server and
+# probe it with introspection requests. For the Slack Agent delivery image,
+# see ./Dockerfile.
+
+# ---- build stage ---------------------------------------------------------
+FROM node:22-bookworm-slim AS build
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+# ---- runtime stage -------------------------------------------------------
+FROM node:22-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+# Pinned Typst (same version/asset as CI).
+ARG TYPST_VERSION=0.14.2
+ARG TYPST_SHA256=a6044cbad2a954deb921167e257e120ac0a16b20339ec01121194ff9d394996d
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl xz-utils ca-certificates \
+ && curl -fsSL -o /tmp/typst.tar.xz "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz" \
+ && echo "${TYPST_SHA256}  /tmp/typst.tar.xz" | sha256sum -c - \
+ && tar -xJf /tmp/typst.tar.xz -C /tmp \
+ && mv /tmp/typst-x86_64-unknown-linux-musl/typst /usr/local/bin/typst \
+ && chmod +x /usr/local/bin/typst \
+ && apt-get purge -y curl xz-utils && apt-get autoremove -y \
+ && rm -rf /var/lib/apt/lists/* /tmp/typst-* /tmp/typst.tar.xz \
+ && typst --version
+
+# Production dependencies only.
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+# Build output + runtime assets.
+COPY --from=build /app/dist ./dist
+COPY templates ./templates
+COPY brand_kits ./brand_kits
+COPY packages ./packages
+COPY marketplace ./marketplace
+COPY vendor ./vendor
+COPY scripts ./scripts
+
+# Fail the build if Typst is below pin or a vendored package is missing.
+RUN node scripts/check-typst-version.mjs \
+ && node scripts/check-vendored-packages.mjs
+
+# Persisted document workspaces.
+ENV DOCFORGE_DATA_ROOT=/data/documents
+RUN mkdir -p /data/documents
+VOLUME ["/data"]
+
+# MCP server over stdio.
+CMD ["node", "dist/index.js"]

src/forge/mcp-client.ts

@@ -1,9 +1,15 @@
 import path from "node:path";
 import { access } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
+import { readFileSync } from "node:fs";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { getDataRoot } from "../config.js";
+import { getDataRoot, PACKAGE_ROOT } from "../config.js";
+
+// Version from package.json so the client identity can't drift from the release.
+const PACKAGE_VERSION: string = JSON.parse(
+  readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf8"),
+).version;
 import type { Diagnostic } from "../errors.js";
 import type { LintIssue } from "../lint/engine.js";
 import type { VisualQAFinding } from "../qa/visual.js";
@@ -120,7 +126,7 @@ export class DocForgeMcpClient {
       args: [this.serverEntry],
       env: { ...process.env } as Record<string, string>,
     });
-    const client = new Client({ name: "forge-slack-agent", version: "0.7.0" });
+    const client = new Client({ name: "forge-slack-agent", version: PACKAGE_VERSION });
     // If the child dies, drop our handles so the next call respawns.
     transport.onclose = () => {
       if (this.transport === transport) {

src/mcp/server.ts

@@ -1,10 +1,18 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { PACKAGE_ROOT } from "../config.js";
 import * as service from "../service.js";
 import { getTemplateReadme, getTemplateSample } from "../templates/registry.js";
 
+// Version from package.json so the MCP handshake can't drift from the release.
+const PACKAGE_VERSION: string = JSON.parse(
+  readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf8"),
+).version;
+
 const TOOL_DESCRIPTION_CREATE = `Creates a document from template + validated JSON data.
 Returns document_id (required for compile, preview, export). Expires after 24h idle.
 WHEN TO USE: After docforge_get_template_schema, when structured data is ready.
@@ -13,7 +21,7 @@ ON FAILURE: schema_error with agent_action — fix fields before compile.`;
 export async function startMcpServer(): Promise<void> {
   await service.initService();
 
-  const server = new McpServer({ name: "docforge", version: "0.7.0" });
+  const server = new McpServer({ name: "docforge", version: PACKAGE_VERSION });
 
   server.registerTool(
     "docforge_list_templates",