@cloudgrid-io/mcp 0.20.50 → 0.20.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.20.50",
+  "version": "0.20.52",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -42,6 +42,7 @@
     "smoke:web": "node test/smoke-web.mjs",
     "smoke:redrop": "node test/smoke-redrop.mjs",
     "smoke:oauth": "node test/smoke-oauth.mjs",
+    "test:oauth-gate": "node test/oauth-gate.test.mjs",
     "test:auth": "node test/auth.test.mjs",
     "test:auth-strictness": "node test/auth-strictness.test.mjs",
     "test:win-cli": "node test/windows-cli-resolution.test.mjs",

package/src/oauth.js

@@ -73,8 +73,11 @@ function interstitialHtml(sid, loginUrl) {
 /**
  * Mounts the OAuth surface on an express app.
  * publicBase = this server's public origin (e.g. https://mcp.cloudgrid.io).
+ * opts.requireAuth — when false the OAuth discovery and registration routes are
+ *   not mounted (anonymous-first host has no use for them).
  */
-export function mountOAuth(app, publicBase) {
+export function mountOAuth(app, publicBase, opts = {}) {
+  if (!opts.requireAuth) return;
   const base = publicBase.replace(/\/+$/, "");
 
   const asMetadata = {

package/src/tools/cli.js

@@ -68,7 +68,12 @@ export function resolveBundledCli(deps = {}) {
     const pkgPath = pathImpl.join(srcDir, "..", "node_modules", "@cloudgrid-io", "cli", "package.json");
     if (!fsExists(pkgPath)) return null;
     const pkg = JSON.parse(fsRead(pkgPath, "utf-8"));
-    const bin = pkg.bin && pkg.bin.cloudgrid;
+    // The CLI's bin renamed cloudgrid -> grid (the product verb). Accept both:
+    // current packages ship { grid: ... } only; the cloudgrid key covers a
+    // bundled pre-rename CLI. Without the grid key this rung was silently DEAD
+    // on every current install and everything fell through to npx (review L7 —
+    // the flagged future risk had already happened).
+    const bin = pkg.bin && (pkg.bin.grid || pkg.bin.cloudgrid);
     if (!bin) return null;
     return { entry: pathImpl.join(pathImpl.dirname(pkgPath), bin), version: pkg.version || null };
   } catch {
@@ -358,10 +363,13 @@ export async function runCloudgrid(args, opts = {}, deps = {}) {
     );
   }
 
-  // 2. Global `cloudgrid` on PATH — version-gated.
-  //    On Windows the bin is `cloudgrid.cmd`; run it via cmd.exe (execMaybeCmd).
-  {
-    const globalBin = IS_WIN ? "cloudgrid.cmd" : "cloudgrid";
+  // 2. Global CLI on PATH — version-gated. The bin renamed cloudgrid -> grid
+  //    (the product verb); try `grid` first, then the pre-rename `cloudgrid`.
+  //    The version gate doubles as an identity check: an unrelated `grid`
+  //    binary won't print a CloudGrid semver >= the floor, so it is skipped.
+  //    On Windows the bins are `.cmd` shims; run via cmd.exe (execMaybeCmd).
+  for (const name of ["grid", "cloudgrid"]) {
+    const globalBin = IS_WIN ? `${name}.cmd` : name;
     let useGlobal = false;
     try {
       const { stdout: vOut } = await execMaybeCmd(
@@ -379,11 +387,11 @@ export async function runCloudgrid(args, opts = {}, deps = {}) {
         useGlobal = true;
       } else {
         console.error(
-          `cloudgrid-mcp: global CLI ${ver || vOut.trim()} < ${MIN_CLI_VERSION}, skipping`,
+          `cloudgrid-mcp: global CLI (${name}) ${ver || vOut.trim()} < ${MIN_CLI_VERSION}, skipping`,
         );
       }
     } catch {
-      // Not on PATH or --version failed — skip
+      // Not on PATH or --version failed — try the next name
     }
     if (useGlobal) {
       try {

package/src/web.js

@@ -98,7 +98,7 @@ app.use(express.urlencoded({ extended: false })); // OAuth token exchange is for
 
 app.get("/healthz", (_req, res) => res.json({ ok: true, edition: "web" }));
 
-mountOAuth(app, PUBLIC_BASE);
+mountOAuth(app, PUBLIC_BASE, { requireAuth: REQUIRE_AUTH });
 
 // One transport per MCP session, keyed by the session id.
 const transports = Object.create(null);