@amerged/ohmyhost-mcp 0.1.18 → 0.1.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/local-client.ts

@@ -101,12 +101,14 @@ import {
 } from "@ohmyhost/sdk-ts";
 
 import type {
+  IdentityReport,
   LocalMcpProductClient,
   WorkspaceReport,
   WorkspaceSelectionReport,
 } from "./local-server.js";
 import {
   createAuthenticatedProductTransport,
+  resolveProductCliEnvironment,
   prepareUserTokenFile,
   ProductApiAuthenticationError,
   parseDevAccessTicket,
@@ -119,11 +121,13 @@ import {
   parseAccountProfile,
   parseCurrentIdentity,
   chooseWorkspace,
+  publicProfile,
   publicWorkspace,
   selectWorkspace,
-  selectedWorkspaceId,
   InteractiveSessionRequiredError,
   type AuthenticatedProductApiOverrides,
+  type EffectiveContext,
+  type LocalProfile,
   type WorkspaceSession,
 } from "@ohmyhost/product-cli";
 
@@ -134,17 +138,26 @@ export class OperationEventsUnavailableError extends Error {
   }
 }
 
+/**
+ * One client per tool call, for the login that call asked for. The process binding and the call's
+ * own arguments choose it, so another agent's choice never changes which account a call uses.
+ */
 export async function createAuthenticatedLocalMcpClient(
   signal: AbortSignal,
-  overrides: Omit<AuthenticatedProductApiOverrides, "productApiOrigin"> = {},
+  overrides: Omit<AuthenticatedProductApiOverrides, "productApiOrigin" | "selector"> = {},
 ): Promise<LocalMcpProductClient> {
   try {
-    const transport = await createAuthenticatedProductTransport(signal, overrides);
+    const transport = await createAuthenticatedProductTransport(signal, {
+      ...overrides,
+      selector: "mcp",
+    });
     return new GeneratedSdkLocalMcpClient(
       transport.baseUrl,
       transport.accessToken,
       transport.fetch,
       transport.workspace,
+      transport.context,
+      resolveProductCliEnvironment(overrides.environment).commandPrefix,
     );
   } catch (error) {
     if (!(error instanceof ProductApiAuthenticationError)) throw error;
@@ -160,9 +173,13 @@ export async function createAuthenticatedLocalMcpClient(
 }
 
 export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
-  readonly #client: OhMyHostClient;
+  #client: OhMyHostClient;
 
-  readonly #workspace: WorkspaceSession | undefined;
+  #workspace: WorkspaceSession | undefined;
+
+  readonly #context: EffectiveContext;
+
+  readonly #commandPrefix: string;
 
   readonly #rescope: (accessToken: string) => OhMyHostClient;
 
@@ -171,10 +188,50 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     accessToken: string,
     fetch: typeof globalThis.fetch,
     workspace?: WorkspaceSession,
+    context?: EffectiveContext,
+    commandPrefix = "OHMYHOST_ENVIRONMENT=production ohmyhost",
   ) {
     this.#rescope = (token) => createClient({ auth: token, baseUrl, fetch, throwOnError: true });
     this.#client = this.#rescope(accessToken);
     this.#workspace = workspace;
+    this.#context = context ?? {
+      credential: workspace === undefined ? "environment_token" : "profile",
+      profile: workspace?.profile ?? null,
+    };
+    this.#commandPrefix = commandPrefix;
+  }
+
+  public actingAs(): IdentityReport["context"] {
+    return this.#contextReport();
+  }
+
+  /** Which account this call acts as, without any credential. */
+  #contextReport(): IdentityReport["context"] {
+    const profile = this.#workspace?.profile ?? this.#context.profile;
+    return {
+      credential: this.#context.credential,
+      profile: profile === null ? null : publicProfile(profile),
+    };
+  }
+
+  /**
+   * Bind this call's login, which has no organization yet, and continue with its new credential.
+   * A login in another organization keeps it; the provider verifies the account first.
+   */
+  async #bind(
+    organization: Parameters<typeof selectWorkspace>[1],
+    signal: AbortSignal,
+  ): Promise<LocalProfile> {
+    const session = this.#interactiveSession();
+    const bound = await selectWorkspace(session, organization, signal, (token) =>
+      getCurrentIdentity({}, { client: this.#rescope(token) }),
+    );
+    const store = session.profiles.credential(bound);
+    const credential = await store.read();
+    if (credential === undefined) throw new InteractiveSessionRequiredError();
+    this.#workspace = { ...session, store, profile: bound };
+    this.#client = this.#rescope(credential.accessToken);
+    return bound;
   }
 
   public async changeDatabaseCompute(input: {
@@ -275,20 +332,20 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       { client: this.#client },
     );
   }
-  public async getCurrentIdentity(signal: AbortSignal) {
+  public async getCurrentIdentity(signal: AbortSignal): Promise<IdentityReport> {
     const identity = await getCurrentIdentity({}, { client: this.#client });
     // A session signed in before a workspace could be selected carries none, and then every
     // project call answers with an empty page that reads like an empty account.
     if (this.#workspace === undefined || parseCurrentIdentity(identity).organization_ids.length > 0)
-      return identity;
+      return { ...identity, context: this.#contextReport() };
     const selection = chooseWorkspace(await this.#readWorkspaces(), undefined);
-    if (selection.outcome !== "selected") return identity;
-    await selectWorkspace(this.#workspace, selection.organization, signal);
+    if (selection.outcome !== "selected") return { ...identity, context: this.#contextReport() };
     // The workspace lives in the access token, so the repaired identity needs the new one.
-    const scoped = (await this.#workspace.store.read())?.accessToken;
-    return scoped === undefined
-      ? identity
-      : getCurrentIdentity({}, { client: this.#rescope(scoped) });
+    await this.#bind(selection.organization, signal);
+    return {
+      ...(await getCurrentIdentity({}, { client: this.#client })),
+      context: this.#contextReport(),
+    };
   }
   public async changeProjectHandle(input: {
     projectId: string;
@@ -466,6 +523,16 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       },
       { client: this.#client },
     );
+    const current = this.#interactiveSession().profile;
+    // A login in another organization keeps it, so no other agent using it moves along; the new
+    // workspace gets its own login instead.
+    if (current.organizationId !== null && current.organizationId !== created.id)
+      return {
+        organization: { id: created.id, name: created.name },
+        selected: current.organizationId,
+        profile: publicProfile(current),
+        next_action: `Run '${this.#commandPrefix} login --organization ${created.id} --user ${current.userId} --json' to add a login for the new workspace as the same user, then pass its profile_name.`,
+      };
     // A created workspace only becomes usable once the access token carries it.
     return this.selectOrganization(created.id, signal);
   }
@@ -474,7 +541,8 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     const session = this.#interactiveSession();
     return {
       organizations: (await this.#readWorkspaces()).map(publicWorkspace),
-      selected: await selectedWorkspaceId(session),
+      selected: session.profile.organizationId,
+      profile: publicProfile(session.profile),
     };
   }
 
@@ -482,20 +550,21 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     organizationId: string,
     signal: AbortSignal,
   ): Promise<WorkspaceSelectionReport> {
-    const session = this.#interactiveSession();
+    this.#interactiveSession();
     const selection = chooseWorkspace(await this.#readWorkspaces(), organizationId);
     if (selection.outcome !== "selected")
       throw new Error(`ORGANIZATION_NOT_FOUND:${organizationId}`);
-    await selectWorkspace(session, selection.organization, signal);
+    const profile = await this.#bind(selection.organization, signal);
     return {
       organization: publicWorkspace(selection.organization),
       selected: selection.organization.id,
+      profile: publicProfile(profile),
     };
   }
 
   async #readWorkspaces() {
     this.#interactiveSession();
-    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+    return parseAccountProfile(await getAccountProfile({ client: this.#client })).organizations;
   }
 
   #interactiveSession(): WorkspaceSession {