@amerged/ohmyhost-mcp 0.1.19 → 0.1.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/local-client.ts

@@ -26,6 +26,8 @@ import {
   createProjectDevAccessTicket,
   ensureProjectDevShareLink,
   setProjectDevAccessMode,
+  getProjectPoweredByFlag,
+  setProjectPoweredByFlag,
   rotateProjectDevShareLink,
   revokeProjectDevShareLink,
   createCloudflareDnsAuthorization,
@@ -52,6 +54,7 @@ import {
   deletePaidProjectDomain,
   getOrganizationCredits,
   getOrganizationAccount,
+  getOrganizationReferral,
   getOrganizationCreditUsage,
   getProjectCreditBudget,
   setProjectCreditBudget,
@@ -93,6 +96,8 @@ import {
   streamOperationEvents,
   type DevAccessTicket,
   type DevAccessState,
+  type PoweredByFlag,
+  type OrganizationReferral,
   type CloudflareDnsAuthorization,
   type CloudflareDnsAuthorizationStatus,
   type OhMyHostClient,
@@ -101,16 +106,20 @@ import {
 } from "@ohmyhost/sdk-ts";
 
 import type {
+  IdentityReport,
   LocalMcpProductClient,
   WorkspaceReport,
   WorkspaceSelectionReport,
 } from "./local-server.js";
 import {
   createAuthenticatedProductTransport,
+  resolveProductCliEnvironment,
   prepareUserTokenFile,
   ProductApiAuthenticationError,
   parseDevAccessTicket,
   parseDevAccessState,
+  parsePoweredByFlag,
+  parseOrganizationReferral,
   parseCloudflareDnsAuthorization,
   parseCloudflareDnsAuthorizationStatus,
   parsePaidDomain,
@@ -119,11 +128,13 @@ import {
   parseAccountProfile,
   parseCurrentIdentity,
   chooseWorkspace,
+  publicProfile,
   publicWorkspace,
   selectWorkspace,
-  selectedWorkspaceId,
   InteractiveSessionRequiredError,
   type AuthenticatedProductApiOverrides,
+  type EffectiveContext,
+  type LocalProfile,
   type WorkspaceSession,
 } from "@ohmyhost/product-cli";
 
@@ -134,17 +145,26 @@ export class OperationEventsUnavailableError extends Error {
   }
 }
 
+/**
+ * One client per tool call, for the login that call asked for. The process binding and the call's
+ * own arguments choose it, so another agent's choice never changes which account a call uses.
+ */
 export async function createAuthenticatedLocalMcpClient(
   signal: AbortSignal,
-  overrides: Omit<AuthenticatedProductApiOverrides, "productApiOrigin"> = {},
+  overrides: Omit<AuthenticatedProductApiOverrides, "productApiOrigin" | "selector"> = {},
 ): Promise<LocalMcpProductClient> {
   try {
-    const transport = await createAuthenticatedProductTransport(signal, overrides);
+    const transport = await createAuthenticatedProductTransport(signal, {
+      ...overrides,
+      selector: "mcp",
+    });
     return new GeneratedSdkLocalMcpClient(
       transport.baseUrl,
       transport.accessToken,
       transport.fetch,
       transport.workspace,
+      transport.context,
+      resolveProductCliEnvironment(overrides.environment).commandPrefix,
     );
   } catch (error) {
     if (!(error instanceof ProductApiAuthenticationError)) throw error;
@@ -160,9 +180,13 @@ export async function createAuthenticatedLocalMcpClient(
 }
 
 export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
-  readonly #client: OhMyHostClient;
+  #client: OhMyHostClient;
 
-  readonly #workspace: WorkspaceSession | undefined;
+  #workspace: WorkspaceSession | undefined;
+
+  readonly #context: EffectiveContext;
+
+  readonly #commandPrefix: string;
 
   readonly #rescope: (accessToken: string) => OhMyHostClient;
 
@@ -171,10 +195,50 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     accessToken: string,
     fetch: typeof globalThis.fetch,
     workspace?: WorkspaceSession,
+    context?: EffectiveContext,
+    commandPrefix = "OHMYHOST_ENVIRONMENT=production ohmyhost",
   ) {
     this.#rescope = (token) => createClient({ auth: token, baseUrl, fetch, throwOnError: true });
     this.#client = this.#rescope(accessToken);
     this.#workspace = workspace;
+    this.#context = context ?? {
+      credential: workspace === undefined ? "environment_token" : "profile",
+      profile: workspace?.profile ?? null,
+    };
+    this.#commandPrefix = commandPrefix;
+  }
+
+  public actingAs(): IdentityReport["context"] {
+    return this.#contextReport();
+  }
+
+  /** Which account this call acts as, without any credential. */
+  #contextReport(): IdentityReport["context"] {
+    const profile = this.#workspace?.profile ?? this.#context.profile;
+    return {
+      credential: this.#context.credential,
+      profile: profile === null ? null : publicProfile(profile),
+    };
+  }
+
+  /**
+   * Bind this call's login, which has no organization yet, and continue with its new credential.
+   * A login in another organization keeps it; the provider verifies the account first.
+   */
+  async #bind(
+    organization: Parameters<typeof selectWorkspace>[1],
+    signal: AbortSignal,
+  ): Promise<LocalProfile> {
+    const session = this.#interactiveSession();
+    const bound = await selectWorkspace(session, organization, signal, (token) =>
+      getCurrentIdentity({}, { client: this.#rescope(token) }),
+    );
+    const store = session.profiles.credential(bound);
+    const credential = await store.read();
+    if (credential === undefined) throw new InteractiveSessionRequiredError();
+    this.#workspace = { ...session, store, profile: bound };
+    this.#client = this.#rescope(credential.accessToken);
+    return bound;
   }
 
   public async changeDatabaseCompute(input: {
@@ -275,20 +339,20 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       { client: this.#client },
     );
   }
-  public async getCurrentIdentity(signal: AbortSignal) {
+  public async getCurrentIdentity(signal: AbortSignal): Promise<IdentityReport> {
     const identity = await getCurrentIdentity({}, { client: this.#client });
     // A session signed in before a workspace could be selected carries none, and then every
     // project call answers with an empty page that reads like an empty account.
     if (this.#workspace === undefined || parseCurrentIdentity(identity).organization_ids.length > 0)
-      return identity;
+      return { ...identity, context: this.#contextReport() };
     const selection = chooseWorkspace(await this.#readWorkspaces(), undefined);
-    if (selection.outcome !== "selected") return identity;
-    await selectWorkspace(this.#workspace, selection.organization, signal);
+    if (selection.outcome !== "selected") return { ...identity, context: this.#contextReport() };
     // The workspace lives in the access token, so the repaired identity needs the new one.
-    const scoped = (await this.#workspace.store.read())?.accessToken;
-    return scoped === undefined
-      ? identity
-      : getCurrentIdentity({}, { client: this.#rescope(scoped) });
+    await this.#bind(selection.organization, signal);
+    return {
+      ...(await getCurrentIdentity({}, { client: this.#client })),
+      context: this.#contextReport(),
+    };
   }
   public async changeProjectHandle(input: {
     projectId: string;
@@ -362,6 +426,11 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     assertOrganizationAccount(account);
     return account;
   }
+  public async getOrganizationReferral(organizationId: string): Promise<OrganizationReferral> {
+    return parseOrganizationReferral(
+      await getOrganizationReferral({ organization_id: organizationId }, { client: this.#client }),
+    );
+  }
   public getOrganizationCredits(organizationId: string) {
     return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
   }
@@ -466,6 +535,16 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       },
       { client: this.#client },
     );
+    const current = this.#interactiveSession().profile;
+    // A login in another organization keeps it, so no other agent using it moves along; the new
+    // workspace gets its own login instead.
+    if (current.organizationId !== null && current.organizationId !== created.id)
+      return {
+        organization: { id: created.id, name: created.name },
+        selected: current.organizationId,
+        profile: publicProfile(current),
+        next_action: `Run '${this.#commandPrefix} login --organization ${created.id} --user ${current.userId} --json' to add a login for the new workspace as the same user, then pass its profile_name.`,
+      };
     // A created workspace only becomes usable once the access token carries it.
     return this.selectOrganization(created.id, signal);
   }
@@ -474,7 +553,8 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     const session = this.#interactiveSession();
     return {
       organizations: (await this.#readWorkspaces()).map(publicWorkspace),
-      selected: await selectedWorkspaceId(session),
+      selected: session.profile.organizationId,
+      profile: publicProfile(session.profile),
     };
   }
 
@@ -482,20 +562,21 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     organizationId: string,
     signal: AbortSignal,
   ): Promise<WorkspaceSelectionReport> {
-    const session = this.#interactiveSession();
+    this.#interactiveSession();
     const selection = chooseWorkspace(await this.#readWorkspaces(), organizationId);
     if (selection.outcome !== "selected")
       throw new Error(`ORGANIZATION_NOT_FOUND:${organizationId}`);
-    await selectWorkspace(session, selection.organization, signal);
+    const profile = await this.#bind(selection.organization, signal);
     return {
       organization: publicWorkspace(selection.organization),
       selected: selection.organization.id,
+      profile: publicProfile(profile),
     };
   }
 
   async #readWorkspaces() {
     this.#interactiveSession();
-    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+    return parseAccountProfile(await getAccountProfile({ client: this.#client })).organizations;
   }
 
   #interactiveSession(): WorkspaceSession {
@@ -537,6 +618,27 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       ),
     );
   }
+  public async getPoweredByFlag(projectId: string): Promise<PoweredByFlag> {
+    return parsePoweredByFlag(
+      await getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client }),
+    );
+  }
+  public async setPoweredByFlag(input: {
+    projectId: string;
+    enabled: boolean;
+    idempotencyKey: string;
+  }): Promise<PoweredByFlag> {
+    return parsePoweredByFlag(
+      await setProjectPoweredByFlag(
+        {
+          project_id: input.projectId,
+          "Idempotency-Key": input.idempotencyKey,
+          setPoweredByFlagRequest: { enabled: input.enabled },
+        },
+        { client: this.#client },
+      ),
+    );
+  }
   public async rotateDevShareLink(input: {
     projectId: string;
     idempotencyKey: string;