@biomate/connect 0.1.0 → 0.1.1

package/README.md

@@ -2,7 +2,7 @@
 
 > One-line installer that wires BioMate AI into Claude Code, Claude Desktop, Cursor, OpenAI Codex, ChatGPT, and Open Claw (WeChat).
 
-Real bioinformatics — `WGS variant-calling pipeline`, CryoSPARC, AlphaFold, ADMET screens, PBPK — runs from your favorite AI coding assistant. No SaaS lock-in: tokens are stored locally and revocable per-surface from your BioMate account.
+Real bioinformatics — `nf-core/sarek`, CryoSPARC, AlphaFold, ADMET screens, PBPK — runs from your favorite AI coding assistant. No SaaS lock-in: tokens are stored locally in a protected credential file.
 
 ## Install
 
@@ -17,7 +17,7 @@ npx @biomate/connect cursor
 npx @biomate/connect codex
 ```
 
-That's it. The CLI opens your browser, runs OAuth 2.1 + PKCE against `https://biomate.ai`, writes the MCP server entry into the right host config file, and stashes a refresh token in your OS keychain.
+The CLI opens your browser for OAuth with PKCE and writes the MCP configuration. Version 0.1.1 stores rotating tokens in a mode-0600 file under `~/.config/biomate/`; host configurations contain only its path. This release defaults explicitly to the verified development deployment at `https://dev-public.biomate.ai`; use `--auth-base` to select a different deployed server. Existing OAuth installations must reconnect with the updated installer.
 
 ## Supported surfaces
 
@@ -32,12 +32,12 @@ That's it. The CLI opens your browser, runs OAuth 2.1 + PKCE against `https://bi
 
 ## What you get
 
-After connecting, your AI assistant has access to BioMate's 14-tool MCP surface:
+After connecting, your AI assistant has access to BioMate's 19-tool MCP surface:
 
-- **`biomate_session`** — natural-language goal → streaming workflow run with phase/step/QC/findings events
-- **`search_workflow`** + **`get_workflow_spec`** — discover from 2,455 indexed workflows
-- **`run_workflow`** + **`get_run`** + **`cancel_run`** — fine control
-- **`preview_file`**, **`export_report`**, **`recall_memory`**, **`upload_file`**, **`analyze_results`**, **`explain_error`**, **`query_database`**
+- **`biomate_session`** — natural-language goal → analysis plan, workflow suggestions and clarification requests; review the plan before execution
+- **`search_workflow`** + **`get_workflow_spec`** — discover workflows in the catalog
+- **`run_workflow`** + **`get_run`** + **`watch_run`** + **`cancel_run`** — launch, cancel and poll run status (snapshot updates)
+- **`preview_file`**, **`export_report`**, **`analyze_results`**, **`explain_error`**, **`query_database`**, **`resolve_accession`**, **`browse_data`**, **`fetch_public_data`**, **`search_literature`**, **`recall_memory`**, **`upload_file`**
 
 ## Try it
 
@@ -59,9 +59,9 @@ Look up UniProt P04637.
 
 ## Privacy & security
 
-- OAuth 2.1 + PKCE; tokens scoped per surface, revocable individually at
-  https://biomate.ai/account/connectors
-- Refresh tokens hashed at rest with HMAC-SHA256
+- OAuth with PKCE; access tokens carry permission scopes enforced by
+  the OAuth service; access is also blocked when the associated personal API key is revoked
+- Server-side refresh-token records are hashed; local credential files contain secrets and must stay private
 - Access tokens are 30-minute JWTs; refresh tokens rotate on use (OAuth 2.1 §6.1)
 - No telemetry beyond standard API logs
 
@@ -76,3 +76,7 @@ npm test
 ## License
 
 MIT
+
+## Supported exports
+
+This package exports Markdown findings reports. PDF, DOCX, other report sections, instrument tools and MCP progress notifications are not advertised by the 0.1.1 stdio package. ChatGPT Actions and hosted WeChat setup are separate integrations and are not validated by the desktop installer tests.

package/dist/cli.js

@@ -1,42 +1,7 @@
 #!/usr/bin/env node
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const oauth_js_1 = require("./oauth.js");
-const surfaces_js_1 = require("./surfaces.js");
-const AUTH_BASE = process.env.BIOMATE_AUTH_BASE ?? 'https://api.biomate.ai';
+import { runPKCEFlow } from './oauth.js';
+import { SURFACES } from './surfaces.js';
+const AUTH_BASE = process.env.BIOMATE_AUTH_BASE ?? 'https://dev-public.biomate.ai';
 const USAGE = `\nUsage:  npx @biomate/connect <surface> [--auth-base URL]\n\nSurfaces:\n  claude-code      Anthropic Claude Code (CLI)\n  claude-desktop   Anthropic Claude Desktop\n  cursor           Cursor IDE\n  codex            OpenAI Codex CLI\n  chatgpt          ChatGPT (Custom GPT Actions)\n  open-claw        WeChat / Open Claw\n\nExamples:\n  npx @biomate/connect claude-code\n  npx @biomate/connect cursor\n\nEnvironment:\n  BIOMATE_AUTH_BASE   Auth server URL (default ${AUTH_BASE})\n  BIOMATE_API_BASE    API base URL for installed configs\n`;
 async function main() {
     const args = process.argv.slice(2);
@@ -45,22 +10,21 @@ async function main() {
         return 0;
     }
     const id = args[0];
-    const surface = surfaces_js_1.SURFACES[id];
+    const surface = SURFACES[id];
     if (!surface) {
         console.error(`Unknown surface: ${id}\n${USAGE}`);
         return 1;
     }
     try {
-        const tokens = await (0, oauth_js_1.runPKCEFlow)(surface, AUTH_BASE);
+        const flag = args.indexOf('--auth-base');
+        if (flag !== -1 && !args[flag + 1])
+            throw new Error('--auth-base requires a URL');
+        const authBase = flag === -1 ? AUTH_BASE : args[flag + 1];
+        const origin = new URL(authBase);
+        if (origin.protocol !== 'https:' && !(origin.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(origin.hostname)))
+            throw new Error('OAuth requires HTTPS');
+        const tokens = await runPKCEFlow(surface, origin.origin);
         const where = await surface.install(tokens.access_token, tokens.refresh_token);
-        // Stash the refresh token in the OS keychain too (best-effort).
-        try {
-            const keytar = await Promise.resolve().then(() => __importStar(require('keytar')));
-            await keytar.default.setPassword('biomate', surface.id, tokens.refresh_token);
-        }
-        catch {
-            /* keychain optional */
-        }
         console.log(`\n✓ ${surface.label} connected.`);
         if (where && !where.startsWith('(')) {
             console.log(`  Config written: ${where}`);

package/dist/configWriters.js

@@ -1,47 +1,10 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.upsertJSON = upsertJSON;
-exports.upsertTOML = upsertTOML;
-const fs_1 = require("fs");
-const path = __importStar(require("path"));
-async function upsertJSON(filePath, mutate) {
-    await fs_1.promises.mkdir(path.dirname(filePath), { recursive: true });
+import { promises as fs } from 'fs';
+import * as path from 'path';
+export async function upsertJSON(filePath, mutate) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
     let existing = {};
     try {
-        const raw = await fs_1.promises.readFile(filePath, 'utf8');
+        const raw = await fs.readFile(filePath, 'utf8');
         existing = JSON.parse(raw);
     }
     catch (e) {
@@ -51,11 +14,11 @@ async function upsertJSON(filePath, mutate) {
     const next = mutate(existing) ?? existing;
     await atomicWrite(filePath, JSON.stringify(next, null, 2));
 }
-async function upsertTOML(filePath, append) {
-    await fs_1.promises.mkdir(path.dirname(filePath), { recursive: true });
+export async function upsertTOML(filePath, append) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
     let existing = '';
     try {
-        existing = await fs_1.promises.readFile(filePath, 'utf8');
+        existing = await fs.readFile(filePath, 'utf8');
     }
     catch (e) {
         if (e.code !== 'ENOENT')
@@ -63,12 +26,12 @@ async function upsertTOML(filePath, append) {
     }
     if (existing.includes('[mcp_servers.biomate]')) {
         // Naive replacement: drop the existing block and re-append.
-        existing = existing.replace(/\n\[mcp_servers\.biomate\][\s\S]*?(?=\n\[|$)/g, '');
+        existing = existing.replace(/(?:^|\n)\[mcp_servers\.biomate(?:\.[^\]]+)?\][\s\S]*?(?=\n\[|$)/g, '');
     }
     await atomicWrite(filePath, existing + append);
 }
 async function atomicWrite(filePath, contents) {
     const tmp = `${filePath}.${process.pid}.tmp`;
-    await fs_1.promises.writeFile(tmp, contents, 'utf8');
-    await fs_1.promises.rename(tmp, filePath);
+    await fs.writeFile(tmp, contents, 'utf8');
+    await fs.rename(tmp, filePath);
 }

package/dist/index.js

@@ -1,9 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SURFACES = exports.runPKCEFlow = exports.generatePKCE = void 0;
-var pkce_js_1 = require("./pkce.js");
-Object.defineProperty(exports, "generatePKCE", { enumerable: true, get: function () { return pkce_js_1.generatePKCE; } });
-var oauth_js_1 = require("./oauth.js");
-Object.defineProperty(exports, "runPKCEFlow", { enumerable: true, get: function () { return oauth_js_1.runPKCEFlow; } });
-var surfaces_js_1 = require("./surfaces.js");
-Object.defineProperty(exports, "SURFACES", { enumerable: true, get: function () { return surfaces_js_1.SURFACES; } });
+export { generatePKCE } from './pkce.js';
+export { runPKCEFlow } from './oauth.js';
+export { SURFACES } from './surfaces.js';

package/dist/oauth.js

@@ -1,26 +1,33 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runPKCEFlow = runPKCEFlow;
-const http_1 = require("http");
-const url_1 = require("url");
-const open_1 = __importDefault(require("open"));
-const pkce_js_1 = require("./pkce.js");
-async function runPKCEFlow(surface, authBaseUrl) {
-    const { verifier, challenge } = (0, pkce_js_1.generatePKCE)();
+import { createServer } from 'http';
+import { URL } from 'url';
+import open from 'open';
+import { randomBytes } from 'node:crypto';
+import { generatePKCE } from './pkce.js';
+export async function runPKCEFlow(surface, authBaseUrl) {
+    const { verifier, challenge } = generatePKCE();
     const port = surface.callbackPort;
     const redirectUri = `http://127.0.0.1:${port}/callback`;
-    const state = Math.random().toString(36).slice(2);
+    const state = randomBytes(32).toString('base64url');
+    const registration = await fetch(`${authBaseUrl}/oauth/register`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ client_name: `BioMate ${surface.label}`, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none' }),
+        redirect: 'error', signal: AbortSignal.timeout(15000),
+    });
+    if (!registration.ok)
+        throw new Error(`OAuth registration failed: HTTP ${registration.status}`);
+    const { client_id } = await registration.json();
+    if (!client_id)
+        throw new Error('OAuth registration returned no client ID');
+    process.env.BIOMATE_OAUTH_CLIENT_ID = client_id;
+    process.env.BIOMATE_AUTH_BASE = authBaseUrl;
     const codePromise = catchCallback(port, state);
     // Mark the rejection as handled — the awaiter below will still receive it.
     // Without this, Node's unhandled-rejection detector fires when the callback
     // server rejects before `await codePromise` has attached a handler.
     codePromise.catch(() => undefined);
-    const authUrl = new url_1.URL(`${authBaseUrl}/oauth/authorize`);
+    const authUrl = new URL(`${authBaseUrl}/oauth/authorize`);
     authUrl.searchParams.set('response_type', 'code');
-    authUrl.searchParams.set('client_id', surface.clientId);
+    authUrl.searchParams.set('client_id', client_id);
     authUrl.searchParams.set('redirect_uri', redirectUri);
     authUrl.searchParams.set('code_challenge', challenge);
     authUrl.searchParams.set('code_challenge_method', 'S256');
@@ -28,13 +35,13 @@ async function runPKCEFlow(surface, authBaseUrl) {
     authUrl.searchParams.set('state', state);
     console.log(`\nOpening browser to authorize ${surface.label}…`);
     console.log(`If it doesn't open, visit:\n  ${authUrl.toString()}\n`);
-    await (0, open_1.default)(authUrl.toString());
+    await open(authUrl.toString());
     const code = await codePromise;
     const body = new URLSearchParams({
         grant_type: 'authorization_code',
         code,
         redirect_uri: redirectUri,
-        client_id: surface.clientId,
+        client_id,
         code_verifier: verifier,
     });
     const resp = await fetch(`${authBaseUrl}/oauth/token`, {
@@ -49,9 +56,9 @@ async function runPKCEFlow(surface, authBaseUrl) {
 }
 function catchCallback(port, expectedState) {
     return new Promise((resolve, reject) => {
-        const server = (0, http_1.createServer)((req, res) => {
+        const server = createServer((req, res) => {
             try {
-                const url = new url_1.URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+                const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
                 if (url.pathname !== '/callback') {
                     res.writeHead(404);
                     res.end();
@@ -83,10 +90,11 @@ function catchCallback(port, expectedState) {
         });
         server.on('error', reject);
         server.listen(port, '127.0.0.1');
-        setTimeout(() => {
+        const timeout = setTimeout(() => {
             server.close();
             reject(new Error('OAuth callback timed out after 3 minutes'));
         }, 3 * 60 * 1000);
+        server.on('close', () => clearTimeout(timeout));
     });
 }
 function htmlResult(message, ok) {

package/dist/pkce.js

@@ -1,10 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generatePKCE = generatePKCE;
-const crypto_1 = require("crypto");
-function generatePKCE() {
-    const verifier = base64url((0, crypto_1.randomBytes)(48));
-    const challenge = base64url((0, crypto_1.createHash)('sha256').update(verifier).digest());
+import { createHash, randomBytes } from 'crypto';
+export function generatePKCE() {
+    const verifier = base64url(randomBytes(48));
+    const challenge = base64url(createHash('sha256').update(verifier).digest());
     return { verifier, challenge, method: 'S256' };
 }
 function base64url(buf) {

package/dist/surfaces.js

@@ -1,41 +1,6 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SURFACES = void 0;
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
+import * as os from 'os';
+import { mkdirSync, writeFileSync, renameSync } from 'node:fs';
+import * as path from 'path';
 const DEFAULT_SCOPES = [
     'runs:read',
     'runs:write',
@@ -56,19 +21,25 @@ function platformConfigDir() {
         return process.env.APPDATA ?? home();
     return path.join(home(), '.config');
 }
-function mcpServerEntry(refreshToken) {
-    const apiBase = process.env.BIOMATE_API_BASE ?? 'https://api.biomate.ai';
+function mcpServerEntry(accessToken, refreshToken, clientId) {
+    const authBase = process.env.BIOMATE_AUTH_BASE ?? 'https://dev-public.biomate.ai';
+    const directory = path.join(home(), '.config', 'biomate');
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const credentialFile = path.join(directory, clientId + '.json');
+    const temporary = credentialFile + '.' + process.pid + '.tmp';
+    writeFileSync(temporary, JSON.stringify({
+        authBase, clientId: process.env.BIOMATE_OAUTH_CLIENT_ID ?? clientId,
+        access_token: accessToken, refresh_token: refreshToken,
+        expires_at: 0,
+    }), { mode: 0o600 });
+    renameSync(temporary, credentialFile);
     return {
-        command: 'npx',
-        args: ['-y', '@biomate/mcp-server'],
-        env: {
-            BIOMATE_API_BASE: apiBase,
-            BIOMATE_REFRESH_TOKEN: refreshToken,
-        },
+        command: 'npx', args: ['-y', '@biomate/mcp-server@0.1.1'],
+        env: { BIOMATE_OAUTH_FILE: credentialFile },
     };
 }
-const configWriters_js_1 = require("./configWriters.js");
-exports.SURFACES = {
+import { upsertJSON, upsertTOML } from './configWriters.js';
+export const SURFACES = {
     'claude-code': {
         id: 'claude-code',
         label: 'Claude Code',
@@ -76,11 +47,11 @@ exports.SURFACES = {
         callbackPort: 53682,
         scopes: DEFAULT_SCOPES,
         configPath: () => path.join(home(), '.claude.json'),
-        install: async (_t, refresh) => {
+        install: async (access, refresh) => {
             const p = path.join(home(), '.claude.json');
-            await (0, configWriters_js_1.upsertJSON)(p, (cfg) => {
+            await upsertJSON(p, (cfg) => {
                 cfg.mcpServers ??= {};
-                cfg.mcpServers.biomate = mcpServerEntry(refresh);
+                cfg.mcpServers.biomate = mcpServerEntry(access, refresh, 'biomate-claude-code');
                 return cfg;
             });
             return p;
@@ -93,11 +64,11 @@ exports.SURFACES = {
         callbackPort: 53683,
         scopes: DEFAULT_SCOPES,
         configPath: () => path.join(platformConfigDir(), 'Claude', 'claude_desktop_config.json'),
-        install: async (_t, refresh) => {
+        install: async (access, refresh) => {
             const p = path.join(platformConfigDir(), 'Claude', 'claude_desktop_config.json');
-            await (0, configWriters_js_1.upsertJSON)(p, (cfg) => {
+            await upsertJSON(p, (cfg) => {
                 cfg.mcpServers ??= {};
-                cfg.mcpServers.biomate = mcpServerEntry(refresh);
+                cfg.mcpServers.biomate = mcpServerEntry(access, refresh, 'biomate-claude-desktop');
                 return cfg;
             });
             return p;
@@ -110,11 +81,11 @@ exports.SURFACES = {
         callbackPort: 53684,
         scopes: DEFAULT_SCOPES,
         configPath: () => path.join(home(), '.cursor', 'mcp.json'),
-        install: async (_t, refresh) => {
+        install: async (access, refresh) => {
             const p = path.join(home(), '.cursor', 'mcp.json');
-            await (0, configWriters_js_1.upsertJSON)(p, (cfg) => {
+            await upsertJSON(p, (cfg) => {
                 cfg.mcpServers ??= {};
-                cfg.mcpServers.biomate = mcpServerEntry(refresh);
+                cfg.mcpServers.biomate = mcpServerEntry(access, refresh, 'biomate-cursor');
                 return cfg;
             });
             return p;
@@ -127,10 +98,10 @@ exports.SURFACES = {
         callbackPort: 53685,
         scopes: DEFAULT_SCOPES,
         configPath: () => path.join(home(), '.codex', 'config.toml'),
-        install: async (_t, refresh) => {
+        install: async (access, refresh) => {
             const p = path.join(home(), '.codex', 'config.toml');
-            const apiBase = process.env.BIOMATE_API_BASE ?? 'https://api.biomate.ai';
-            await (0, configWriters_js_1.upsertTOML)(p, `\n[mcp_servers.biomate]\ncommand = "npx"\nargs = ["-y", "@biomate/mcp-server"]\n\n[mcp_servers.biomate.env]\nBIOMATE_API_BASE = "${apiBase}"\nBIOMATE_REFRESH_TOKEN = "${refresh}"\n`);
+            const entry = mcpServerEntry(access, refresh, 'biomate-codex');
+            await upsertTOML(p, `\n[mcp_servers.biomate]\ncommand = "npx"\nargs = ["-y", "@biomate/mcp-server@0.1.1"]\n\n[mcp_servers.biomate.env]\nBIOMATE_OAUTH_FILE = ${JSON.stringify(entry.env.BIOMATE_OAUTH_FILE)}\n`);
             return p;
         },
     },
@@ -164,7 +135,7 @@ Install steps:
         callbackPort: 53687,
         scopes: DEFAULT_SCOPES,
         configPath: () => '(Open Claw — hosted by BioMate)',
-        install: async (_t, refresh) => {
+        install: async (access, refresh) => {
             console.log(`
 Open Claw runs as a hosted webhook — there's nothing to install locally.
 We've linked your account; in WeChat search the BioMate Open Claw bot and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biomate/connect",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "One-line installer that connects BioMate to Claude Code, Claude Desktop, Cursor, Codex, and ChatGPT via OAuth 2.1 + PKCE.",
   "bin": {
     "biomate-connect": "./dist/cli.js"
@@ -11,7 +11,15 @@
     "test": "vitest run",
     "prepublishOnly": "npm run build"
   },
-  "keywords": ["biomate", "mcp", "claude", "cursor", "codex", "chatgpt", "bioinformatics"],
+  "keywords": [
+    "biomate",
+    "mcp",
+    "claude",
+    "cursor",
+    "codex",
+    "chatgpt",
+    "bioinformatics"
+  ],
   "author": "BioMate AI",
   "license": "MIT",
   "repository": {
@@ -23,7 +31,6 @@
     "node": ">=18"
   },
   "dependencies": {
-    "keytar": "^7.9.0",
     "open": "^9.1.0"
   },
   "devDependencies": {
@@ -31,8 +38,10 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0"
   },
-  "files": ["dist", "README.md"],
-  "publishConfig": {
-    "access": "public"
-  }
+  "files": [
+    "dist/*.js",
+    "dist/*.d.ts",
+    "README.md"
+  ],
+  "type": "module"
 }

package/dist/__tests__/configWriters.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/__tests__/configWriters.test.js

@@ -1,89 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const fs_1 = require("fs");
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const configWriters_js_1 = require("../configWriters.js");
-async function tmpDir() {
-    return fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'biomate-test-'));
-}
-(0, vitest_1.describe)('upsertJSON', () => {
-    (0, vitest_1.it)('creates new file with content', async () => {
-        const dir = await tmpDir();
-        const f = path.join(dir, 'a', 'b', 'cfg.json');
-        await (0, configWriters_js_1.upsertJSON)(f, (cfg) => {
-            cfg.mcpServers = { biomate: { command: 'npx', args: [] } };
-            return cfg;
-        });
-        const got = JSON.parse(await fs_1.promises.readFile(f, 'utf8'));
-        (0, vitest_1.expect)(got.mcpServers.biomate.command).toBe('npx');
-    });
-    (0, vitest_1.it)('preserves existing keys', async () => {
-        const dir = await tmpDir();
-        const f = path.join(dir, 'cfg.json');
-        await fs_1.promises.writeFile(f, JSON.stringify({ theme: 'dark', mcpServers: { other: { command: 'foo' } } }));
-        await (0, configWriters_js_1.upsertJSON)(f, (cfg) => {
-            cfg.mcpServers.biomate = { command: 'npx' };
-            return cfg;
-        });
-        const got = JSON.parse(await fs_1.promises.readFile(f, 'utf8'));
-        (0, vitest_1.expect)(got.theme).toBe('dark');
-        (0, vitest_1.expect)(got.mcpServers.other.command).toBe('foo');
-        (0, vitest_1.expect)(got.mcpServers.biomate.command).toBe('npx');
-    });
-});
-(0, vitest_1.describe)('upsertTOML', () => {
-    (0, vitest_1.it)('appends a new biomate block', async () => {
-        const dir = await tmpDir();
-        const f = path.join(dir, 'config.toml');
-        await fs_1.promises.writeFile(f, '[other]\nfoo = "bar"\n');
-        await (0, configWriters_js_1.upsertTOML)(f, '\n[mcp_servers.biomate]\ncommand = "npx"\n');
-        const got = await fs_1.promises.readFile(f, 'utf8');
-        (0, vitest_1.expect)(got).toContain('[other]');
-        (0, vitest_1.expect)(got).toContain('[mcp_servers.biomate]');
-        (0, vitest_1.expect)(got).toContain('command = "npx"');
-    });
-    (0, vitest_1.it)('replaces existing biomate block on re-install', async () => {
-        const dir = await tmpDir();
-        const f = path.join(dir, 'config.toml');
-        await (0, configWriters_js_1.upsertTOML)(f, '\n[mcp_servers.biomate]\ntoken = "old"\n');
-        await (0, configWriters_js_1.upsertTOML)(f, '\n[mcp_servers.biomate]\ntoken = "new"\n');
-        const got = await fs_1.promises.readFile(f, 'utf8');
-        (0, vitest_1.expect)(got).toContain('token = "new"');
-        (0, vitest_1.expect)(got).not.toContain('token = "old"');
-    });
-});

package/dist/__tests__/flow.test.d.ts

@@ -1,9 +0,0 @@
-/**
- * Installer end-to-end flow tests.
- *
- * Covers TEST_PLAN.md §3.2 (12 cases). Each test spins up a mock OAuth
- * server (Node http) that mirrors api.biomate.ai's /oauth/authorize and
- * /oauth/token endpoints, then drives the installer against a tmp HOME so
- * file writes don't touch the developer's real config.
- */
-export {};

package/dist/__tests__/flow.test.js

@@ -1,291 +0,0 @@
-"use strict";
-/**
- * Installer end-to-end flow tests.
- *
- * Covers TEST_PLAN.md §3.2 (12 cases). Each test spins up a mock OAuth
- * server (Node http) that mirrors api.biomate.ai's /oauth/authorize and
- * /oauth/token endpoints, then drives the installer against a tmp HOME so
- * file writes don't touch the developer's real config.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const fs_1 = require("fs");
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-// os.homedir() in Node is non-configurable; we can't replace it directly.
-// Instead, mock the entire 'os' module so surfaces.ts gets our stub.
-let __testHome = process.env.HOME ?? '/tmp';
-vitest_1.vi.mock('os', async () => {
-    const actual = await vitest_1.vi.importActual('os');
-    return { ...actual, homedir: () => __testHome };
-});
-const http_1 = require("http");
-const url_1 = require("url");
-// Hold the per-test handler that the mocked `open` will call.
-let __openHandler = null;
-vitest_1.vi.mock('open', () => ({
-    default: async (url) => {
-        if (__openHandler)
-            await __openHandler(typeof url === 'string' ? url : url.toString());
-        return { unref: () => undefined };
-    },
-}));
-const oauth_js_1 = require("../oauth.js");
-const surfaces_js_1 = require("../surfaces.js");
-// Assign each test a unique port to avoid TCP TIME_WAIT collisions across tests.
-let __portCursor = 60000;
-function uniquePort() {
-    return __portCursor++;
-}
-function withPort(s) {
-    return { ...s, callbackPort: uniquePort() };
-}
-function startMockServer() {
-    const behavior = {};
-    let lastVerifier = null;
-    let issuedCodes = new Map();
-    const server = (0, http_1.createServer)(async (req, res) => {
-        const u = new url_1.URL(req.url ?? '/', `http://${req.headers.host}`);
-        if (u.pathname === '/oauth/authorize' && req.method === 'GET') {
-            // The installer never hits /oauth/authorize as an HTTP client — its
-            // browser does. We simulate by auto-redirecting on a different path.
-            res.writeHead(200);
-            res.end('ok');
-            return;
-        }
-        if (u.pathname === '/simulate-callback' && req.method === 'GET') {
-            // Test helper: forwards a code (or error) to the installer's callback port.
-            const code = u.searchParams.get('code');
-            const error = u.searchParams.get('error');
-            const state = u.searchParams.get('state');
-            const port = u.searchParams.get('port');
-            const params = new URLSearchParams();
-            if (code)
-                params.set('code', code);
-            if (error)
-                params.set('error', error);
-            if (state)
-                params.set('state', state);
-            const cbUrl = `http://127.0.0.1:${port}/callback?${params.toString()}`;
-            await fetch(cbUrl).catch(() => { });
-            res.writeHead(200);
-            res.end('forwarded');
-            return;
-        }
-        if (u.pathname === '/oauth/token' && req.method === 'POST') {
-            const body = await readBody(req);
-            const form = new URLSearchParams(body);
-            lastVerifier = form.get('code_verifier');
-            const status = behavior.tokenStatus ?? 200;
-            res.writeHead(status, { 'content-type': 'application/json' });
-            if (status !== 200) {
-                res.end(JSON.stringify({ error: 'invalid_grant', error_description: 'mock' }));
-                return;
-            }
-            res.end(JSON.stringify({
-                access_token: 'mock_access_token',
-                refresh_token: 'mock_refresh_token',
-                token_type: 'Bearer',
-                expires_in: 1800,
-                scope: form.get('scope') ?? 'runs:read runs:write',
-            }));
-            return;
-        }
-        res.writeHead(404);
-        res.end();
-    });
-    return new Promise((resolve) => {
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            const port = typeof addr === 'object' && addr ? addr.port : 0;
-            resolve({
-                url: `http://127.0.0.1:${port}`,
-                close: () => new Promise((r) => server.close(() => r(undefined))),
-                lastVerifier: () => lastVerifier,
-                behavior,
-            });
-        });
-    });
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-        req.on('error', reject);
-    });
-}
-/**
- * Replace `open` with a function that, instead of launching a browser, hits
- * /simulate-callback on the mock server with the right code + state.
- */
-function installOpenStub(mockUrl, port, opts) {
-    __openHandler = async (authUrl) => {
-        const u = new url_1.URL(authUrl);
-        const state = opts.stateOverride ?? (u.searchParams.get('state') ?? '');
-        const params = new URLSearchParams({ port: String(port) });
-        if (opts.error)
-            params.set('error', opts.error);
-        else
-            params.set('code', 'mock_code_' + Math.random().toString(36).slice(2));
-        params.set('state', state);
-        await fetch(`${mockUrl}/simulate-callback?${params.toString()}`);
-    };
-}
-(0, vitest_1.describe)('installer end-to-end flow', () => {
-    let mock;
-    let tmpHome;
-    let origHome;
-    (0, vitest_1.beforeEach)(async () => {
-        mock = await startMockServer();
-        tmpHome = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'biomate-flow-'));
-        origHome = process.env.HOME;
-        process.env.HOME = tmpHome;
-        __testHome = tmpHome;
-        process.env.BIOMATE_API_BASE = 'https://mock.api.example';
-    });
-    (0, vitest_1.afterEach)(async () => {
-        __openHandler = null;
-        await mock.close();
-        if (origHome)
-            process.env.HOME = origHome;
-        else
-            delete process.env.HOME;
-        await fs_1.promises.rm(tmpHome, { recursive: true, force: true });
-    });
-    // --- §3.2.1, §3.2.2, §3.2.3, §3.2.4, §3.2.5, §3.2.6, §3.2.7 — per-surface ---
-    (0, vitest_1.it)('§3.2.1 claude-code: writes ~/.claude.json with mcpServers.biomate on fresh machine', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['claude-code']);
-        installOpenStub(mock.url, surface.callbackPort, {});
-        const tokens = await (0, oauth_js_1.runPKCEFlow)(surface, mock.url);
-        await surface.install(tokens.access_token, tokens.refresh_token);
-        const cfg = JSON.parse(await fs_1.promises.readFile(path.join(tmpHome, '.claude.json'), 'utf8'));
-        (0, vitest_1.expect)(cfg.mcpServers.biomate.command).toBe('npx');
-        (0, vitest_1.expect)(cfg.mcpServers.biomate.env.BIOMATE_REFRESH_TOKEN).toBe('mock_refresh_token');
-    });
-    (0, vitest_1.it)('§3.2.2 claude-code: preserves existing keys in ~/.claude.json', async () => {
-        await fs_1.promises.writeFile(path.join(tmpHome, '.claude.json'), JSON.stringify({ theme: 'dark', mcpServers: { other: { command: 'foo' } } }));
-        const surface = withPort(surfaces_js_1.SURFACES['claude-code']);
-        installOpenStub(mock.url, surface.callbackPort, {});
-        const tokens = await (0, oauth_js_1.runPKCEFlow)(surface, mock.url);
-        await surface.install(tokens.access_token, tokens.refresh_token);
-        const cfg = JSON.parse(await fs_1.promises.readFile(path.join(tmpHome, '.claude.json'), 'utf8'));
-        (0, vitest_1.expect)(cfg.theme).toBe('dark');
-        (0, vitest_1.expect)(cfg.mcpServers.other.command).toBe('foo');
-        (0, vitest_1.expect)(cfg.mcpServers.biomate.command).toBe('npx');
-    });
-    (0, vitest_1.it)('§3.2.3 claude-code: re-install is idempotent (no duplicate biomate entry)', async () => {
-        const surface1 = withPort(surfaces_js_1.SURFACES['claude-code']);
-        installOpenStub(mock.url, surface1.callbackPort, {});
-        let tokens = await (0, oauth_js_1.runPKCEFlow)(surface1, mock.url);
-        await surface1.install(tokens.access_token, tokens.refresh_token);
-        __openHandler = null;
-        const surface2 = withPort(surfaces_js_1.SURFACES['claude-code']); // fresh port
-        installOpenStub(mock.url, surface2.callbackPort, {});
-        tokens = await (0, oauth_js_1.runPKCEFlow)(surface2, mock.url);
-        await surface2.install(tokens.access_token, tokens.refresh_token);
-        const cfg = JSON.parse(await fs_1.promises.readFile(path.join(tmpHome, '.claude.json'), 'utf8'));
-        // Only one `biomate` key — JSON objects can't have duplicates anyway, but
-        // we assert structure is unchanged after second install.
-        (0, vitest_1.expect)(Object.keys(cfg.mcpServers)).toEqual(['biomate']);
-    });
-    (0, vitest_1.it)('§3.2.4 cursor: writes ~/.cursor/mcp.json', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['cursor']);
-        installOpenStub(mock.url, surface.callbackPort, {});
-        const tokens = await (0, oauth_js_1.runPKCEFlow)(surface, mock.url);
-        await surface.install(tokens.access_token, tokens.refresh_token);
-        const cfg = JSON.parse(await fs_1.promises.readFile(path.join(tmpHome, '.cursor', 'mcp.json'), 'utf8'));
-        (0, vitest_1.expect)(cfg.mcpServers.biomate).toBeDefined();
-    });
-    (0, vitest_1.it)('§3.2.5 codex: writes [mcp_servers.biomate] to ~/.codex/config.toml', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['codex']);
-        installOpenStub(mock.url, surface.callbackPort, {});
-        const tokens = await (0, oauth_js_1.runPKCEFlow)(surface, mock.url);
-        await surface.install(tokens.access_token, tokens.refresh_token);
-        const cfg = await fs_1.promises.readFile(path.join(tmpHome, '.codex', 'config.toml'), 'utf8');
-        (0, vitest_1.expect)(cfg).toContain('[mcp_servers.biomate]');
-        (0, vitest_1.expect)(cfg).toContain('mock_refresh_token');
-    });
-    (0, vitest_1.it)('§3.2.6 chatgpt: prints instructions, writes no file', async () => {
-        const surface = surfaces_js_1.SURFACES['chatgpt'];
-        const logSpy = vitest_1.vi.spyOn(console, 'log').mockImplementation(() => undefined);
-        const result = await surface.install('access', 'refresh');
-        (0, vitest_1.expect)(result).toMatch(/ChatGPT/);
-        // No .chatgpt-style files in $HOME.
-        const entries = await fs_1.promises.readdir(tmpHome);
-        (0, vitest_1.expect)(entries).toEqual([]);
-        logSpy.mockRestore();
-    });
-    (0, vitest_1.it)('§3.2.7 open-claw: prints WeChat instructions, writes no file', async () => {
-        const surface = surfaces_js_1.SURFACES['open-claw'];
-        const logSpy = vitest_1.vi.spyOn(console, 'log').mockImplementation(() => undefined);
-        const result = await surface.install('access', 'refresh');
-        (0, vitest_1.expect)(result).toBe('(linked)');
-        const entries = await fs_1.promises.readdir(tmpHome);
-        (0, vitest_1.expect)(entries).toEqual([]);
-        logSpy.mockRestore();
-    });
-    // --- §3.2.9–§3.2.12 — failure modes ---
-    (0, vitest_1.it)('§3.2.10 OAuth callback error=access_denied surfaces cleanly', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['cursor']);
-        installOpenStub(mock.url, surface.callbackPort, { error: 'access_denied' });
-        await (0, vitest_1.expect)((0, oauth_js_1.runPKCEFlow)(surface, mock.url)).rejects.toThrow(/access_denied/);
-    });
-    (0, vitest_1.it)('§3.2.11 state mismatch on callback rejected', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['cursor']);
-        installOpenStub(mock.url, surface.callbackPort, { stateOverride: 'wrong-state' });
-        await (0, vitest_1.expect)((0, oauth_js_1.runPKCEFlow)(surface, mock.url)).rejects.toThrow(/invalid callback/);
-    });
-    (0, vitest_1.it)('§3.2.12 token exchange 400 surfaces the server reply', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['cursor']);
-        mock.behavior.tokenStatus = 400;
-        installOpenStub(mock.url, surface.callbackPort, {});
-        await (0, vitest_1.expect)((0, oauth_js_1.runPKCEFlow)(surface, mock.url)).rejects.toThrow(/token exchange failed: 400/);
-    });
-    // --- §3.2.8 — unknown surface (CLI-level; verified via lookup) ---
-    (0, vitest_1.it)('§3.2.8 unknown surface id returns undefined from SURFACES map', () => {
-        (0, vitest_1.expect)(surfaces_js_1.SURFACES['not-a-surface']).toBeUndefined();
-    });
-    // --- bonus: PKCE verifier is forwarded to token endpoint ---
-    (0, vitest_1.it)('bonus: code_verifier is presented to /oauth/token', async () => {
-        const surface = withPort(surfaces_js_1.SURFACES['cursor']);
-        installOpenStub(mock.url, surface.callbackPort, {});
-        await (0, oauth_js_1.runPKCEFlow)(surface, mock.url);
-        const v = mock.lastVerifier();
-        (0, vitest_1.expect)(v).not.toBeNull();
-        (0, vitest_1.expect)(v.length).toBeGreaterThanOrEqual(43);
-    });
-});

package/dist/__tests__/pkce.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/__tests__/pkce.test.js

@@ -1,28 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const crypto_1 = require("crypto");
-const pkce_js_1 = require("../pkce.js");
-(0, vitest_1.describe)('PKCE', () => {
-    (0, vitest_1.it)('verifier length is in [43, 128]', () => {
-        for (let i = 0; i < 20; i++) {
-            const p = (0, pkce_js_1.generatePKCE)();
-            (0, vitest_1.expect)(p.verifier.length).toBeGreaterThanOrEqual(43);
-            (0, vitest_1.expect)(p.verifier.length).toBeLessThanOrEqual(128);
-        }
-    });
-    (0, vitest_1.it)('challenge equals base64url(sha256(verifier))', () => {
-        const p = (0, pkce_js_1.generatePKCE)();
-        const computed = (0, crypto_1.createHash)('sha256').update(p.verifier).digest('base64')
-            .replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-        (0, vitest_1.expect)(p.challenge).toBe(computed);
-    });
-    (0, vitest_1.it)('uses S256 method', () => {
-        (0, vitest_1.expect)((0, pkce_js_1.generatePKCE)().method).toBe('S256');
-    });
-    (0, vitest_1.it)('verifier and challenge are URL-safe (no +,/,=)', () => {
-        const p = (0, pkce_js_1.generatePKCE)();
-        (0, vitest_1.expect)(p.verifier).not.toMatch(/[+/=]/);
-        (0, vitest_1.expect)(p.challenge).not.toMatch(/[+/=]/);
-    });
-});