@cloudgrid-io/mcp 0.20.18 → 0.20.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.20.18",
+  "version": "0.20.20",
   "description": "Use CloudGrid via MCP to brainstorm, build, deploy, and improve apps, games, websites, dashboards, and tools and get a live URL - templates, recipes, managed databases and AI, instant single-page publish, and full-app deploys, for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server, over MCP.",
   "type": "module",
   "bin": {
@@ -29,6 +29,7 @@
     "test:grid-picker": "node test/grid-picker.test.mjs",
     "test:plug-output-schema": "node test/plug-output-schema.test.mjs",
     "test:zip-deploy": "node test/zip-deploy.test.mjs",
+    "test:create-gates": "node test/create-gates.test.mjs",
     "test:mcpb-boot": "node test/mcpb-boot.test.mjs",
     "test:plug-timeout": "node test/plug-timeout.test.mjs",
     "test:manifest-confirm": "node test/manifest-confirm.test.mjs",

package/src/corpus/playbook.md

@@ -7,7 +7,7 @@ Operating rules:
 4. Always return the live share URL at the end — that is the deliverable. On a NEW deploy, then ASK the user who should be able to open it — private (only you), a space, your grid, anyone with the link, or anyone signed in — and set their choice with grid_set_sharing. Never pick the visibility silently. On a re-plug/edit of an existing entity, leave its current visibility as-is unless the user asks to change it.
 5. Brainstorm first (lightly) for a real app, then minimize questions. For a substantial runtime app, take ONE lightweight beat before generating/deploying: confirm the goal + 3-5 core features in a sentence, check for a matching template/recipe (capability-map), and infer the data/runtime needs and STATE them ("I'll add a database so entries are saved"). Keep it to a line or two; never ask a non-technical user infra questions they can't answer. A simple single page skips this and builds immediately. Otherwise use sensible defaults and build; don't front-load setup questions.
 6. If a signed-in publish fails with a server error, do not fall back to anonymous publishing (it burns the anonymous quota and downgrades ownership); surface the error, use the CLI fallback if offered, or ask the user.
-7. When signed in and the user has more than one grid, do not assume a target — the publish tools will ask; relay the choice to the user and pass the chosen grid.
+7. When signed in and the user has more than one grid, do not assume a target. For a NEW app, establish the grid UP FRONT — grid_start returns the grids; if there is more than one, ask "which grid should this go on?" before you start building, and carry that slug into grid_deploy. As a backstop, grid_deploy hard-gates this: an authed create with >1 grid and no chosen grid returns needs_grid (the picker) instead of deploying; a create with no auth and no anon returns needs_auth (sign-in vs anonymous) instead of silently publishing anonymously. Relay either ask to the user; never pick silently.
 8. When a build/deploy fails unexpectedly, offer to report it to the CloudGrid team — only with the user's explicit consent (ask first). Send just the error + the failed request by default (call grid_report), and never send the whole conversation unless the user agrees (include_conversation). Respect privacy.
 9. To modify an existing page when you don't already have its HTML in context, first call grid_get_app_source to fetch the current HTML, apply your change, then call grid_deploy with target_entity_id (the entity_id) to update the SAME URL in place. Do not ask the user to paste the HTML back.
 10. Publishing a single HTML page: pass it inline as grid_deploy's html parameter (a full self-contained document). For a heavy or image-heavy page in the local edition, pass the path parameter instead so it is read from disk (no inline size limit); never base64-encode HTML and never pass a file path (or an @-prefixed path) as html. If a page looks empty, use grid_get_app_source to check what was actually published, then re-plug with the real HTML/path and target_entity_id.

package/src/session-logger.js

@@ -22,7 +22,8 @@ const TEXT_SECRET_PATTERNS = [
   /\bAKIA[0-9A-Z]{16}\b/g,                                        // AWS access key id
   /\bAIza[0-9A-Za-z_\-]{30,}\b/g,                                 // Google API key
   /\bsk_(?:live|test)_[0-9A-Za-z]{16,}\b/g,                       // Stripe secret keys
-  /\bsk-[A-Za-z0-9]{16,}/g,                                       // sk- API keys
+  /\bsk-ant-[A-Za-z0-9_-]{20,}/g,                                 // Anthropic API keys (sk-ant-…, hyphenated)
+  /\bsk-[A-Za-z0-9]{16,}/g,                                       // other sk- API keys
   /\b[0-9a-fA-F]{32,}\b/g,                                        // long hex runs
 ];
 export function scrubText(text) {
@@ -98,6 +99,7 @@ export function renderLogText(p) {
     const dur = c.duration_ms != null ? `  (${(c.duration_ms / 1000).toFixed(1)}s)` : "";
     lines.push(`[${c.at}] ${c.name}${args}  ${c.outcome}${dur}`);
     if (c.key) lines.push(`           → ${c.key}`);
+    if (c.error_reason) lines.push(`           ✗ ${c.error_reason}`);
   }
   lines.push(RULE);
   lines.push(
@@ -171,12 +173,21 @@ export class SessionLogger {
       await this.resolveHeader();
       const outcome = result?.isError ? "error" : "ok";
       const args = scrubArgs(input);
+      // On an error, capture WHY (scrubbed): the throw path passes errorMessage;
+      // a returned fail() puts the message in content[0].text. Without this the
+      // log only said "error" and every failure needed a blind repro.
+      let errorReason = null;
+      if (outcome === "error") {
+        const raw = result?.errorMessage || result?.content?.[0]?.text || null;
+        if (raw) errorReason = scrubText(String(raw)).slice(0, 300);
+      }
       this.calls.push({
         at: this._clock(this.now()),
         name,
         args,
         outcome,
         key: this._keyResult(name, result),
+        error_reason: errorReason,
         duration_ms: durationMs,
       });
       // Only a deploy failure (grid_deploy) is the QA "failure" trigger. Other

package/src/tools/register.js

@@ -50,9 +50,11 @@ export function registerTools(server, ctx) {
       return result;
     } catch (err) {
       // A thrown handler must record as an ERROR — the old finally-based capture
-      // saw result=undefined and mis-recorded it as "ok". Synthesize an error
-      // result, then rethrow so the tool contract is unchanged.
-      try { ctx.logger?.recordCall(name, input, { isError: true }, Date.now() - started); } catch { /* never */ }
+      // saw result=undefined and mis-recorded it as "ok". Carry the error
+      // message so the QA log says WHY, not just "error" (diagnosability: a
+      // Songsmith hosted deploy logged a bare "error" and cost four blind
+      // reproductions). Synthesize an error result, then rethrow unchanged.
+      try { ctx.logger?.recordCall(name, input, { isError: true, errorMessage: String(err?.message || err) }, Date.now() - started); } catch { /* never */ }
       throw err;
     }
   };
@@ -288,6 +290,7 @@ export function registerTools(server, ctx) {
         // they validate: (1) the grid-picker "which grid?" ask (resolveGridOrAsk),
         // and (2) the signed-in CLI-fallback recovery.
         needs_grid: z.boolean().optional().describe("Grid-picker ask: a signed-in user with >1 grid must choose one before this create proceeds. Pass the chosen slug back in `grid`."),
+        needs_auth: z.boolean().optional().describe("Auth gate: a NEW deploy was attempted while not signed in. Ask the user to sign in (grid_login) to publish to their grid, OR re-call grid_deploy with anon: true to publish anonymously (claimable later). Do not proceed silently."),
         needs_org: z.boolean().optional().describe("Alias of needs_grid (legacy picker alias)."),
         grids: z.array(z.object({
           slug: z.string(),
@@ -357,7 +360,20 @@ export function registerTools(server, ctx) {
         }
         if (input?.anon !== true && !isEdit) {
           const token = await ctx.getToken();
-          if (token) {
+          if (!token) {
+            // AUTH HARD GATE (create only): not signed in and not anon → do NOT
+            // silently ride the anonymous wire. Return the login-or-anon choice
+            // and stop. The model relays it; the user picks. (Rule 17, enforced.)
+            return okResult({
+              text:
+                "You're not signed in. To publish this I can either:\n" +
+                "  1. Sign you in to publish to your grid — run grid_login (opens your browser), then I'll deploy.\n" +
+                "  2. Publish it anonymously right now — it goes live immediately with a claim link so you can save it to your account later.\n" +
+                "Which would you like? (For anonymous, re-call grid_deploy with anon: true.)",
+              structured: { needs_auth: true },
+            });
+          }
+          {
             const decision = await resolveGridOrAsk(ctx, {
               token,
               suppliedGrid: input?.grid,