@columenlabs/lumen-ai 0.1.133 → 0.1.135

package/README.md

@@ -99,7 +99,7 @@ app.all('/api/assistant/*', (c) => routes(c.req.raw));
 - **ChatGPT sign-in.** In place of their own OpenAI key a person may sign in with their ChatGPT plan (`POST /my-signin`, then `POST /my-signin/finish {url}`): the sign-in opens in a new tab and ends on `http://127.0.0.1:1455/auth/callback`, a page that does not load, whose address the person pastes back. The tokens are sealed as their own key and refreshed before they run out; answers on the plan count tokens and no dollars.
 - **Who pays.** The person's pick (the shared keys by default) while it has a key for the tier's provider and money left this month under its cap (an admin sets the shared keys' cap per person, `PUT /app`), else the other; with neither the panel says why.
 - **Tools.** Each group is Off, Read, Read + draft or Read + write per person. A tool is a read when its MCP `readOnlyHint` is set. On Read + draft a write only drafts a card, and runs as the person when they press Save, after access is checked again. Read + write is offered only for a group with `writes: true`: its writes run at once, and with `undo` set each one's line in the chat has Undo, which calls `undo(caller, { tool, args, result })` (`POST /chats/:id/writes/:step/undo`); the model is told what was undone. Cards drafted one after another show as one stack with Save all. Use `mcpServerTools` (an SDK `McpServer`), `mcpFetchTools` (a server served as a fetch handler, any SDK), `remoteMcpTools` or `plainTools`.
-- **Web.** `fetch` is a plain GET from the Worker (10 s, 2 MB, never the app's own hosts or private addresses). ScrapeQL's own tools join over its MCP API once an admin pastes a Cloudflare Access service token (`PUT /web/scrapeql`).
+- **Web.** `fetch` is a plain GET from the Worker (10 s, 2 MB, never the app's own hosts or private addresses). ScrapeQL's own tools join over its MCP API once an admin pastes a Cloudflare Access service token (`PUT /web/scrapeql`). A Worker on ScrapeQL's own Cloudflare account passes its service binding instead, `scrapeql: { url: 'https://scrapeql/mcp', fetch: env.SCRAPEQL.fetch.bind(env.SCRAPEQL) }`: no token is stored, the tools are always on and Settings shows the link with a Test.
 - **Hand off and advice.** The `escalate` tool hands one task to a higher tier (the person sets next, any or only when asked); Anthropic's advisor tool lets a higher tier send a plan, at most two an answer.
 - **Chats** stream as server-sent events (`POST /chat`); closing the request stops the answer and keeps what was said. Past 150k tokens, or on `/compact`, the history sent to the model becomes a summary. Run `assistant.purge()` once a day to drop chats 30 days after their last message.
 

package/dist/assistant/engine.d.ts

@@ -123,9 +123,13 @@ export interface AssistantOptions {
     web?: {
         /** `fetch` options, or false for no fetch. */
         fetch?: WebFetchOptions | false;
-        /** ScrapeQL's MCP address; its tools join once an admin adds the Access token. */
+        /**
+         * ScrapeQL's MCP address; its tools join once an admin adds the Access token. With `fetch`
+         * (a service binding's), ScrapeQL is reached through it: no token, its tools always on.
+         */
         scrapeql?: {
             url: string;
+            fetch?: typeof fetch;
         };
     };
     store: AssistantStore;
@@ -252,8 +256,10 @@ export declare class Assistant {
         detail: string;
         at: number;
     }>;
-    /** Lists ScrapeQL's tools with the token: works or why not. */
-    testScrapeql(token: AccessToken): Promise<{
+    /** ScrapeQL is reached over a service binding, so it needs no token. */
+    get boundScrapeql(): boolean;
+    /** Lists ScrapeQL's tools with the token (none over a binding): works or why not. */
+    testScrapeql(token: AccessToken | null): Promise<{
         ok: boolean;
         detail: string;
         at: number;

package/dist/assistant/engine.js

@@ -357,9 +357,11 @@ export class Assistant {
             web: {
                 fetch: p.web ?? true,
                 scrapeql: this.o.web?.scrapeql
-                    ? caller.admin
-                        ? keyState(scrapeql, (d) => d.client_id)
-                        : { set: !!scrapeql }
+                    ? this.o.web.scrapeql.fetch
+                        ? { set: true, bound: true }
+                        : caller.admin
+                            ? keyState(scrapeql, (d) => d.client_id)
+                            : { set: !!scrapeql }
                     : null,
             },
             providers,
@@ -525,12 +527,13 @@ export class Assistant {
                     access: 'read',
                     source: webFetchTools(this.o.web?.fetch || {}),
                 });
-            const sq = this.o.web?.scrapeql ? await this.state.scrapeql() : null;
-            if (sq && this.o.web?.scrapeql)
+            const sq = this.o.web?.scrapeql;
+            const token = sq && !sq.fetch ? await this.state.scrapeql() : null;
+            if (sq && (sq.fetch || token))
                 sources.push({
                     group: 'web',
                     access: 'read',
-                    source: scrapeqlTools(this.o.web.scrapeql.url, sq, this.o.fetch),
+                    source: scrapeqlTools(sq.url, token, sq.fetch ?? this.o.fetch),
                 });
         }
         const results = await Promise.allSettled(sources.map((s) => s.source()));
@@ -1636,20 +1639,30 @@ export class Assistant {
             return { ok: false, detail: shownError(err).message, at };
         }
     }
-    /** Lists ScrapeQL's tools with the token: works or why not. */
+    /** ScrapeQL is reached over a service binding, so it needs no token. */
+    get boundScrapeql() {
+        return !!this.o.web?.scrapeql?.fetch;
+    }
+    /** Lists ScrapeQL's tools with the token (none over a binding): works or why not. */
     async testScrapeql(token) {
         const at = Date.now();
-        const url = this.o.web?.scrapeql?.url;
-        if (!url)
+        const sq = this.o.web?.scrapeql;
+        if (!sq)
             return { ok: false, detail: 'ScrapeQL is not set up in this app.', at };
         try {
-            const open = await scrapeqlTools(url, token, this.o.fetch)();
+            const open = await scrapeqlTools(sq.url, sq.fetch ? null : token, sq.fetch ?? this.o.fetch)();
             const n = open.tools.length;
             await open.close();
             return { ok: true, detail: `ScrapeQL answered with ${n} tool${n === 1 ? '' : 's'}.`, at };
         }
         catch {
-            return { ok: false, detail: 'ScrapeQL refused the token or could not be reached.', at };
+            return {
+                ok: false,
+                detail: sq.fetch
+                    ? 'ScrapeQL could not be reached over the link.'
+                    : 'ScrapeQL refused the token or could not be reached.',
+                at,
+            };
         }
     }
     // ---------------------------------------------------------------- drafts

package/dist/assistant/routes.js

@@ -273,6 +273,8 @@ export function assistantRoutes(app, o) {
                     const no = admin();
                     if (no)
                         return no;
+                    if (a.boundScrapeql)
+                        return fail("ScrapeQL is reached over the app's link; it needs no token.", 409, 'bound');
                     const b = await body(req);
                     const client_id = str(b.client_id, 200);
                     const client_secret = str(b.client_secret, 400);
@@ -300,6 +302,8 @@ export function assistantRoutes(app, o) {
                     const no = admin();
                     if (no)
                         return no;
+                    if (a.boundScrapeql)
+                        return json(await a.testScrapeql(null));
                     const d = await a.state.scrapeql();
                     if (!d)
                         return fail('No ScrapeQL token is set.', 404);

package/dist/assistant/web.d.ts

@@ -41,5 +41,8 @@ export interface AccessToken {
     client_id: string;
     client_secret: string;
 }
-/** ScrapeQL's MCP tools over its API, with an Access service token. Every one of them reads. */
-export declare function scrapeqlTools(url: string, token: AccessToken, f?: typeof fetch): ToolSource;
+/**
+ * ScrapeQL's MCP tools over its API, with an Access service token, or none over a service
+ * binding (`f` is then the binding's fetch). Every one of them reads.
+ */
+export declare function scrapeqlTools(url: string, token: AccessToken | null, f?: typeof fetch): ToolSource;

package/dist/assistant/web.js

@@ -155,14 +155,21 @@ export function webFetchTools(o = {}) {
         return open;
     };
 }
-/** ScrapeQL's MCP tools over its API, with an Access service token. Every one of them reads. */
+/**
+ * ScrapeQL's MCP tools over its API, with an Access service token, or none over a service
+ * binding (`f` is then the binding's fetch). Every one of them reads.
+ */
 export function scrapeqlTools(url, token, f) {
     const remote = remoteMcpTools({
         url,
-        headers: {
-            'CF-Access-Client-Id': token.client_id,
-            'CF-Access-Client-Secret': token.client_secret,
-        },
+        ...(token
+            ? {
+                headers: {
+                    'CF-Access-Client-Id': token.client_id,
+                    'CF-Access-Client-Secret': token.client_secret,
+                },
+            }
+            : {}),
         ...(f ? { fetch: f } : {}),
     });
     return async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@columenlabs/lumen-ai",
-  "version": "0.1.133",
+  "version": "0.1.135",
   "description": "Lumen's assistant and agent parts: a chat assistant's server (Claude tiers, tools over MCP, the web, hand off, spend caps), serving an MCP server from a Worker, read-only tool sets and metered tool calls.",
   "license": "MIT",
   "type": "module",
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.133.0",
-    "@columenlabs/lumen-ops": "0.1.133",
-    "@columenlabs/lumen-ui-types": "0.1.133",
+    "@columenlabs/lumen-ops": "0.1.135",
+    "@columenlabs/lumen-ui-types": "0.1.135",
     "openai": "7.32.0",
     "zod": "^4.3.6"
   },