@cg3/prior-mcp 0.6.3 → 0.7.0

package/dist/client.js

@@ -1,9 +1,10 @@
 "use strict";
 /**
- * Prior API client — shared between local MCP (stdio) and remote MCP server.
+ * Prior API client shared between local MCP (stdio) and remote MCP server.
  *
- * Requires an API key via PRIOR_API_KEY env var or ~/.prior/config.json.
- * Get your key at https://prior.cg3.io/account
+ * Supports:
+ * - API keys for durable machine auth
+ * - first-party OIDC browser login for interactive human auth
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -39,16 +40,159 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PriorApiClient = exports.CONFIG_PATH = void 0;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
+exports.PriorApiClient = exports.OIDC_CLIENT_ID = exports.CONFIG_PATH = void 0;
+const childProcess = __importStar(require("node:child_process"));
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const http = __importStar(require("node:http"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 exports.CONFIG_PATH = path.join(os.homedir(), ".prior", "config.json");
-const VERSION = "0.5.0";
+exports.OIDC_CLIENT_ID = "prior-mcp";
+const VERSION = "0.7.0";
+const DEFAULT_TIMEOUT_MS = 180_000;
+// Renamed prior:read/prior:write → account:read/account:write on 2026-04-26 per
+// the oauth-scope-namespace-overhaul initiative (operations/initiatives/...).
+// Breaking change for callers using DEFAULT_OIDC_SCOPES; bump npm minor.
+const DEFAULT_OIDC_SCOPES = "openid profile email account:read account:write offline_access";
+function compactConfig(config) {
+    return Object.fromEntries(Object.entries(config).filter(([, value]) => value !== undefined && value !== null && value !== ""));
+}
+function escapeHtml(input) {
+    return input
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const padded = parts[1] + "=".repeat((4 - (parts[1].length % 4)) % 4);
+        return JSON.parse(Buffer.from(padded, "base64url").toString("utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function deriveExpiresAt(accessToken, expiresIn) {
+    if (typeof expiresIn === "number" && expiresIn > 0) {
+        return new Date(Date.now() + expiresIn * 1000).toISOString();
+    }
+    const payload = decodeJwtPayload(accessToken);
+    if (typeof payload?.exp === "number") {
+        return new Date(payload.exp * 1000).toISOString();
+    }
+    return undefined;
+}
+function isExpired(expiresAt, accessToken) {
+    if (expiresAt) {
+        const expiryMs = Date.parse(expiresAt);
+        if (!Number.isNaN(expiryMs)) {
+            return expiryMs <= (Date.now() + 30_000);
+        }
+    }
+    const payload = accessToken ? decodeJwtPayload(accessToken) : null;
+    if (typeof payload?.exp === "number") {
+        return (payload.exp * 1000) <= (Date.now() + 30_000);
+    }
+    return false;
+}
+function launchDetached(command, args) {
+    const child = childProcess.spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+    });
+    child.unref();
+}
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+    return crypto.createHash("sha256").update(verifier).digest("base64url");
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    try {
+        if (platform === "darwin") {
+            launchDetached("open", [url]);
+        }
+        else if (platform === "win32") {
+            launchDetached("rundll32.exe", ["url.dll,FileProtocolHandler", url]);
+        }
+        else {
+            launchDetached("xdg-open", [url]);
+        }
+    }
+    catch {
+        // Best effort only. We always print the URL for manual fallback.
+    }
+}
+function extractData(value) {
+    if (value && typeof value === "object" && "data" in value) {
+        return value.data;
+    }
+    return value;
+}
+function buildMissingAuthMessage() {
+    return [
+        "No Prior auth configured.",
+        "Run `prior-mcp --login` for browser OIDC auth,",
+        "configure PRIOR_API_KEY for durable machine auth,",
+        "or use PRIOR_ACCESS_TOKEN only for advanced manual token overrides.",
+    ].join(" ");
+}
+function hardenConfigPermissions(filePath) {
+    const configDir = path.dirname(filePath);
+    if (process.platform === "win32") {
+        try {
+            childProcess.execSync(`icacls "${configDir}" /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F"`, {
+                stdio: "ignore",
+                shell: "cmd.exe",
+            });
+        }
+        catch {
+            // Best effort only.
+        }
+        try {
+            childProcess.execSync(`icacls "${filePath}" /inheritance:r /grant:r "%USERNAME%:F"`, {
+                stdio: "ignore",
+                shell: "cmd.exe",
+            });
+        }
+        catch {
+            // Best effort only.
+        }
+        return;
+    }
+    try {
+        fs.chmodSync(configDir, 0o700);
+    }
+    catch {
+        // Best effort only.
+    }
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Best effort only.
+    }
+}
 class PriorApiClient {
     apiUrl;
+    _authType;
     _apiKey;
     _agentId;
+    _accessToken;
+    _refreshToken;
+    _expiresAt;
+    _accountId;
+    _displayName;
+    _email;
     persistConfig;
     userAgent;
     traceId;
@@ -56,26 +200,36 @@ class PriorApiClient {
         this.apiUrl = options.apiUrl || process.env.PRIOR_API_URL || "https://api.cg3.io";
         this._apiKey = options.apiKey || process.env.PRIOR_API_KEY;
         this._agentId = options.agentId;
+        this._accessToken = options.accessToken || process.env.PRIOR_ACCESS_TOKEN;
+        this._refreshToken = options.refreshToken || process.env.PRIOR_REFRESH_TOKEN;
+        this._expiresAt = options.expiresAt;
         this.persistConfig = options.persistConfig ?? true;
         this.userAgent = options.userAgent || `prior-mcp/${VERSION}`;
         this.traceId = options.traceId;
-        // Load config on startup if no key provided
-        if (!this._apiKey && this.persistConfig) {
+        if (this._accessToken) {
+            this._authType = "oidc";
+        }
+        else if (this._apiKey) {
+            this._authType = "api_key";
+        }
+        if ((!this._apiKey && !this._accessToken) && this.persistConfig) {
             const config = this.loadConfig();
             if (config) {
-                this._apiKey = config.apiKey;
-                this._agentId = config.agentId;
+                this.applyConfig(config);
             }
         }
-        // Require an API key — no more auto-registration
-        if (!this._apiKey) {
-            throw new Error("No Prior API key configured. " +
-                "Get your key at https://prior.cg3.io/getkey then set PRIOR_API_KEY in your environment, " +
-                "or add it to ~/.prior/config.json as {\"apiKey\": \"...\"}.");
-        }
     }
+    get authType() { return this._authType; }
     get apiKey() { return this._apiKey; }
     get agentId() { return this._agentId; }
+    get accessToken() { return this._accessToken; }
+    prefersOidc() {
+        if (this._authType === "oidc")
+            return true;
+        if (this._authType === "api_key")
+            return false;
+        return Boolean(this._accessToken || this._refreshToken);
+    }
     loadConfig() {
         try {
             const raw = fs.readFileSync(exports.CONFIG_PATH, "utf-8");
@@ -86,15 +240,351 @@ class PriorApiClient {
         }
     }
     saveConfig(config) {
-        fs.mkdirSync(path.dirname(exports.CONFIG_PATH), { recursive: true });
-        fs.writeFileSync(exports.CONFIG_PATH, JSON.stringify(config, null, 2));
+        fs.mkdirSync(path.dirname(exports.CONFIG_PATH), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(exports.CONFIG_PATH, JSON.stringify(compactConfig(config), null, 2));
+        hardenConfigPermissions(exports.CONFIG_PATH);
+    }
+    clearOidcConfig() {
+        const existing = this.loadConfig() || {};
+        const next = { ...existing };
+        delete next.authType;
+        delete next.accessToken;
+        delete next.refreshToken;
+        delete next.expiresAt;
+        delete next.accountId;
+        delete next.displayName;
+        delete next.email;
+        this.saveConfig(next);
+        this._accessToken = undefined;
+        this._refreshToken = undefined;
+        this._expiresAt = undefined;
+        this._accountId = undefined;
+        this._displayName = undefined;
+        this._email = undefined;
+        this._authType = this._apiKey ? "api_key" : undefined;
+    }
+    async logout() {
+        let remoteRevoked = false;
+        if (this._refreshToken) {
+            try {
+                const revokeUrl = new URL("/revoke", this.apiUrl).toString();
+                const response = await fetch(revokeUrl, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "User-Agent": this.userAgent,
+                    },
+                    body: new URLSearchParams({
+                        token: this._refreshToken,
+                        token_type_hint: "refresh_token",
+                    }).toString(),
+                    signal: AbortSignal.timeout(5_000),
+                });
+                remoteRevoked = response.ok;
+            }
+            catch {
+                // Best effort only. We always clear local state.
+            }
+        }
+        this.clearOidcConfig();
+        return { remoteRevoked };
+    }
+    applyConfig(config) {
+        this._authType = config.authType
+            || (config.accessToken ? "oidc" : config.apiKey ? "api_key" : undefined);
+        this._apiKey = this._apiKey || config.apiKey;
+        this._agentId = this._agentId || config.agentId;
+        this._accessToken = this._accessToken || config.accessToken;
+        this._refreshToken = this._refreshToken || config.refreshToken;
+        this._expiresAt = this._expiresAt || config.expiresAt;
+        this._accountId = this._accountId || config.accountId;
+        this._displayName = this._displayName || config.displayName;
+        this._email = this._email || config.email;
+    }
+    persistCurrentConfig(patch) {
+        if (!this.persistConfig)
+            return;
+        const base = this.loadConfig() || {};
+        this.saveConfig({ ...base, ...patch });
+    }
+    async loadDiscovery() {
+        const discoveryUrl = new URL("/.well-known/openid-configuration", this.apiUrl).toString();
+        const res = await fetch(discoveryUrl, {
+            headers: { "User-Agent": this.userAgent },
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok) {
+            throw new Error(`OIDC discovery failed (${res.status})`);
+        }
+        return await res.json();
+    }
+    async fetchUserInfo(token, explicitUrl) {
+        const userinfoUrl = explicitUrl || new URL("/userinfo", this.apiUrl).toString();
+        const res = await fetch(userinfoUrl, {
+            headers: {
+                "Authorization": `Bearer ${token}`,
+                "User-Agent": this.userAgent,
+            },
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok) {
+            throw new Error(`userinfo request failed (${res.status})`);
+        }
+        return await res.json();
+    }
+    async loginInteractive() {
+        const discovery = await this.loadDiscovery();
+        const authorizeUrl = discovery.authorization_endpoint || new URL("/authorize", this.apiUrl).toString();
+        const tokenUrl = discovery.token_endpoint || new URL("/token", this.apiUrl).toString();
+        const userinfoUrl = discovery.userinfo_endpoint || new URL("/userinfo", this.apiUrl).toString();
+        const state = crypto.randomBytes(16).toString("hex");
+        const nonce = crypto.randomBytes(16).toString("hex");
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const finishResolve = (config) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeoutHandle);
+                resolve(config);
+            };
+            const finishReject = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeoutHandle);
+                reject(error);
+            };
+            const closeServer = () => {
+                try {
+                    server.close();
+                }
+                catch {
+                    // Ignore close races when the callback and timeout fire near-simultaneously.
+                }
+            };
+            const server = http.createServer(async (req, res) => {
+                if (!req.url?.startsWith("/callback")) {
+                    res.writeHead(404);
+                    res.end();
+                    return;
+                }
+                const callbackUrl = new URL(req.url, `http://${req.headers.host}`);
+                const returnedState = callbackUrl.searchParams.get("state");
+                const code = callbackUrl.searchParams.get("code");
+                const error = callbackUrl.searchParams.get("error");
+                if (returnedState !== state) {
+                    res.writeHead(403, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                    res.end("<html><body><h1>Invalid state</h1><p>This login response did not match the original request.</p></body></html>");
+                    return;
+                }
+                if (error) {
+                    res.writeHead(200, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                    res.end(`<html><body><h1>Login cancelled</h1><p>${escapeHtml(error)}</p></body></html>`);
+                    finishReject(new Error(`OIDC login cancelled: ${error}`));
+                    closeServer();
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(400, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                    res.end("<html><body><h1>Missing authorization code</h1></body></html>");
+                    finishReject(new Error("OIDC login failed: missing authorization code"));
+                    closeServer();
+                    return;
+                }
+                try {
+                    const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+                    const tokenRes = await fetch(tokenUrl, {
+                        method: "POST",
+                        headers: {
+                            "Content-Type": "application/x-www-form-urlencoded",
+                            "User-Agent": this.userAgent,
+                        },
+                        body: new URLSearchParams({
+                            grant_type: "authorization_code",
+                            client_id: exports.OIDC_CLIENT_ID,
+                            code,
+                            code_verifier: codeVerifier,
+                            redirect_uri: redirectUri,
+                        }).toString(),
+                        signal: AbortSignal.timeout(10_000),
+                    });
+                    const tokenBody = await tokenRes.json();
+                    if (!tokenRes.ok || !tokenBody.access_token) {
+                        const message = tokenBody.error_description || tokenBody.error || `OIDC token exchange failed (${tokenRes.status})`;
+                        res.writeHead(200, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                        res.end(`<html><body><h1>Login failed</h1><p>${escapeHtml(message)}</p></body></html>`);
+                        finishReject(new Error(message));
+                        closeServer();
+                        return;
+                    }
+                    const userinfo = await this.fetchUserInfo(tokenBody.access_token, userinfoUrl);
+                    const config = {
+                        ...(this.loadConfig() || {}),
+                        authType: "oidc",
+                        accessToken: tokenBody.access_token,
+                        refreshToken: tokenBody.refresh_token,
+                        expiresAt: deriveExpiresAt(tokenBody.access_token, tokenBody.expires_in),
+                        accountId: userinfo.sub,
+                        displayName: userinfo.name,
+                        email: userinfo.email,
+                    };
+                    this.applyConfig(config);
+                    this.persistCurrentConfig(config);
+                    res.writeHead(200, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                    res.end(`<html><body><h1>Connected to Prior</h1><p>You can close this tab.</p><script>setTimeout(()=>window.close(), 1500)</script></body></html>`);
+                    finishResolve(config);
+                    closeServer();
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : "Unknown error";
+                    res.writeHead(500, { "Content-Type": "text/html", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+                    res.end(`<html><body><h1>Login failed</h1><p>${escapeHtml(message)}</p></body></html>`);
+                    finishReject(new Error(message));
+                    closeServer();
+                }
+            });
+            server.listen(0, "127.0.0.1", () => {
+                const address = server.address();
+                const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+                const loginUrl = `${authorizeUrl}?${new URLSearchParams({
+                    response_type: "code",
+                    client_id: exports.OIDC_CLIENT_ID,
+                    redirect_uri: redirectUri,
+                    scope: DEFAULT_OIDC_SCOPES,
+                    state,
+                    nonce,
+                    code_challenge: codeChallenge,
+                    code_challenge_method: "S256",
+                }).toString()}`;
+                process.stderr.write(`[prior-mcp] Opening browser login for ${exports.OIDC_CLIENT_ID}\n`);
+                process.stderr.write(`[prior-mcp] If the browser does not open, visit: ${loginUrl}\n`);
+                openBrowser(loginUrl);
+            });
+            const timeoutHandle = setTimeout(() => {
+                closeServer();
+                finishReject(new Error("OIDC login timed out"));
+            }, DEFAULT_TIMEOUT_MS);
+            timeoutHandle.unref?.();
+        });
+    }
+    async refreshOidcAccessToken() {
+        if (!this._refreshToken) {
+            return false;
+        }
+        const tokenUrl = new URL("/token", this.apiUrl).toString();
+        try {
+            const res = await fetch(tokenUrl, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "User-Agent": this.userAgent,
+                },
+                body: new URLSearchParams({
+                    grant_type: "refresh_token",
+                    client_id: exports.OIDC_CLIENT_ID,
+                    refresh_token: this._refreshToken,
+                }).toString(),
+                signal: AbortSignal.timeout(10_000),
+            });
+            const body = await res.json();
+            if (!res.ok || !body.access_token) {
+                this.clearOidcConfig();
+                return false;
+            }
+            this._authType = "oidc";
+            this._accessToken = body.access_token;
+            this._refreshToken = body.refresh_token || this._refreshToken;
+            this._expiresAt = deriveExpiresAt(body.access_token, body.expires_in);
+            this.persistCurrentConfig({
+                authType: "oidc",
+                accessToken: this._accessToken,
+                refreshToken: this._refreshToken,
+                expiresAt: this._expiresAt,
+                accountId: this._accountId,
+                displayName: this._displayName,
+                email: this._email,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async ensureAuth() {
+        if (this.prefersOidc()) {
+            this._authType = "oidc";
+            if (this._accessToken && !isExpired(this._expiresAt, this._accessToken)) {
+                return this._accessToken;
+            }
+            const refreshed = await this.refreshOidcAccessToken();
+            if (refreshed && this._accessToken) {
+                return this._accessToken;
+            }
+            if (this._accessToken || this._refreshToken) {
+                throw new Error("Stored Prior OIDC auth is no longer usable. Run `prior-mcp --login` to refresh it " +
+                    "or `prior-mcp --logout` to clear it before falling back to machine auth.");
+            }
+        }
+        if (this._apiKey) {
+            this._authType = "api_key";
+            return this._apiKey;
+        }
+        throw new Error(buildMissingAuthMessage());
+    }
+    async getStatus() {
+        const auth = await this.ensureAuth();
+        if (this._authType === "oidc") {
+            const [accountEnvelope, profileEnvelope, userinfo] = await Promise.all([
+                this.request("GET", "/v1/account", undefined, auth),
+                this.request("GET", "/v1/prior/me/profile", undefined, auth),
+                this.fetchUserInfo(auth),
+            ]);
+            const account = extractData(accountEnvelope);
+            const profile = extractData(profileEnvelope);
+            const displayName = userinfo.name || this._displayName;
+            const email = userinfo.email || this._email;
+            this._accountId = userinfo.sub || account?.account?.id || this._accountId;
+            this._displayName = displayName;
+            this._email = email;
+            this.persistCurrentConfig({
+                authType: "oidc",
+                accessToken: this._accessToken,
+                refreshToken: this._refreshToken,
+                expiresAt: this._expiresAt,
+                accountId: this._accountId,
+                displayName: this._displayName,
+                email: this._email,
+            });
+            return {
+                id: account?.account?.id || userinfo.sub || "",
+                authType: "oidc",
+                credits: Number(profile?.subscription?.credits ?? 0),
+                tier: profile?.subscription?.tier || "free",
+                contributions: profile?.reputation?.contributionCount,
+                displayName,
+                email,
+            };
+        }
+        const data = await this.request("GET", "/v1/agents/me", undefined, auth);
+        const agent = extractData(data);
+        return {
+            id: agent?.id || "",
+            authType: "api_key",
+            credits: agent?.credits ?? 0,
+            tier: agent?.tier || "free",
+            contributions: agent?.contributions,
+            displayName: agent?.agentName,
+        };
     }
-    async request(method, path, body, key) {
-        const k = key || this._apiKey;
-        const res = await fetch(`${this.apiUrl}${path}`, {
+    async request(method, requestPath, body, key) {
+        const auth = key || await this.ensureAuth();
+        const res = await fetch(`${this.apiUrl}${requestPath}`, {
             method,
             headers: {
-                ...(k ? { "Authorization": `Bearer ${k}` } : {}),
+                "Authorization": `Bearer ${auth}`,
                 "Content-Type": "application/json",
                 "User-Agent": this.userAgent,
                 ...(this.traceId ? { "X-Request-Id": this.traceId } : {}),

package/dist/index.d.ts

@@ -1,13 +1,11 @@
 #!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { PriorApiClient, type PriorConfig } from "./client.js";
 export { CONFIG_PATH, PriorApiClient } from "./client.js";
 export { registerTools } from "./tools.js";
 export { registerResources } from "./resources.js";
 export { detectHost, formatResults } from "./utils.js";
-export declare function loadConfig(): import("./client.js").PriorConfig | null;
-export declare function saveConfig(config: {
-    apiKey: string;
-    agentId: string;
-}): void;
-export declare function createServer(): McpServer;
+export declare function loadConfig(): PriorConfig | null;
+export declare function saveConfig(config: PriorConfig): void;
+export declare function createServer(client?: PriorApiClient): McpServer;
 export declare function main(): Promise<void>;

package/dist/index.js

@@ -24,22 +24,42 @@ Object.defineProperty(exports, "registerResources", { enumerable: true, get: fun
 var utils_js_1 = require("./utils.js");
 Object.defineProperty(exports, "detectHost", { enumerable: true, get: function () { return utils_js_1.detectHost; } });
 Object.defineProperty(exports, "formatResults", { enumerable: true, get: function () { return utils_js_1.formatResults; } });
-// Legacy function exports for backward compatibility
-function loadConfig() { return client.loadConfig(); }
-function saveConfig(config) { return client.saveConfig(config); }
-const client = new client_js_1.PriorApiClient();
-const server = new mcp_js_1.McpServer({
-    name: "prior",
-    version: "0.6.3",
-}, {
-    instructions: `Prior is a knowledge base of agent-discovered solutions to technical problems and research questions — including debugging, troubleshooting, configuration, integration, migration, architecture decisions, and more. Search Prior before investigating errors or starting multi-step research. Tool responses handle feedback and contribution prompts. See prior://docs/agent-guide for usage patterns.`,
-});
-(0, tools_js_1.registerTools)(server, { client });
-(0, resources_js_1.registerResources)(server, { client });
-function createServer() {
+function buildServer(client) {
+    const server = new mcp_js_1.McpServer({
+        name: "prior",
+        version: "0.6.4",
+    }, {
+        instructions: `Prior is a knowledge base of agent-discovered solutions to technical problems and research questions, including debugging, troubleshooting, configuration, integration, migration, architecture decisions, and more. Search Prior before investigating errors or starting multi-step research. Tool responses handle feedback and contribution prompts. See prior://docs/agent-guide for usage patterns.`,
+    });
+    (0, tools_js_1.registerTools)(server, { client });
+    (0, resources_js_1.registerResources)(server, { client });
     return server;
 }
+// Legacy function exports for backward compatibility
+function loadConfig() {
+    return new client_js_1.PriorApiClient({ persistConfig: true }).loadConfig();
+}
+function saveConfig(config) {
+    return new client_js_1.PriorApiClient({ persistConfig: true }).saveConfig(config);
+}
+function createServer(client = new client_js_1.PriorApiClient()) {
+    return buildServer(client);
+}
 async function main() {
+    if (process.argv.includes("--login")) {
+        const client = new client_js_1.PriorApiClient({ persistConfig: true });
+        const config = await client.loginInteractive();
+        const subject = config.displayName || config.email || config.accountId || "Prior user";
+        console.error(`[prior-mcp] Browser login complete for ${subject}`);
+        return;
+    }
+    if (process.argv.includes("--logout")) {
+        const client = new client_js_1.PriorApiClient({ persistConfig: true });
+        await client.logout();
+        console.error("[prior-mcp] Cleared stored OIDC login. API key config, if any, was preserved.");
+        return;
+    }
+    const server = createServer();
     const transport = new stdio_js_1.StdioServerTransport();
     await server.connect(transport);
 }

package/dist/resources.d.ts

@@ -1,5 +1,5 @@
 /**
- * Prior MCP resources — shared between local and remote MCP servers.
+ * Prior MCP resources shared between local and remote MCP servers.
  *
  * Usage:
  *   import { registerResources } from "@cg3/prior-mcp/resources";