@cr8rcho/alkahest 0.1.76 → 0.1.78

package/dist/mcp/server.js

@@ -14,46 +14,77 @@ import { listProjects } from "../core/listProjects.js";
 import { listHistory } from "../core/history.js";
 import { findProjectRoot } from "../core/project.js";
 import { checkForUpdate, cachedUpdateStatus } from "../core/version.js";
+import { fetchPublishedMap } from "../core/mapFetch.js";
+// Re-exported so the hosted repo's /api/mcp route needs no direct SDK dependency (ADR-095, hosted repo).
+export { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 const require = createRequire(import.meta.url);
 const pkg = require("../../package.json");
-/**
- * MCP server that lets agents (Claude Code/Codex/Cursor) query the product map (ALKAHEST.md §7).
- * No LLM key required — reasoning is done by the calling agent. Tools provide only deterministic structure.
- * Default target is the server's working directory (cwd). Each tool's `path` can point to a different project.
- */
-export function buildServer() {
-    const server = new McpServer({ name: "alkahest", version: pkg.version });
+export function buildServer(remote) {
+    const server = new McpServer({
+        name: "alkahest",
+        title: "Alkahest",
+        version: pkg.version,
+        // Connector-facing identity (MCP `icons`/`websiteUrl`): clients that render server metadata
+        // (e.g. claude.ai custom connectors) show these instead of a generic placeholder glyph.
+        websiteUrl: "https://www.alkahest.app",
+        icons: [
+            { src: "https://www.alkahest.app/icon.svg", mimeType: "image/svg+xml", sizes: ["any"] },
+            { src: "https://www.alkahest.app/apple-icon.png", mimeType: "image/png", sizes: ["180x180"] },
+        ],
+    });
     const rootOf = (path) => resolve(path ?? process.cwd());
-    server.registerTool("scan", {
-        title: "Scan project",
-        description: "Statically analyze a React/Next project to create/update a product map (.alkahest/map.json). " +
-            "Extracts screens, transitions between screens, and the API/data calls each screen makes. Returns a result summary (counts). " +
-            "The map is viewed on the hosted viewer — run the publish tool for a shareable link.",
-        inputSchema: { path: z.string().optional().describe("Project root (default: cwd)") },
-    }, async ({ path }) => {
-        const result = runScan(rootOf(path));
-        if (!result)
-            return text("No screens found. Only Next app-router (page.* under app/ or src/app/) is supported.");
-        const m = result.map;
-        return json({
-            framework: m.meta.framework,
-            router: m.meta.router,
-            screens: m.screens.length,
-            resources: m.resources.length,
-            transitions: m.transitions.length,
-            calls: m.calls.length,
-            mapPath: result.outFile,
+    /** Thread the connector's token/api into a core call's params (no-op for local stdio). */
+    const withAuth = (params) => remote ? { ...params, token: remote.token, api: remote.api } : params;
+    /** The product map: the local checkout's map.json, or (remote) the published bytes. */
+    const getMap = async (path, project, mapSlug) => remote ? fetchPublishedMap({ api: remote.api, token: remote.token, project, mapSlug }) : loadOrScan(rootOf(path));
+    const noMapMsg = remote
+        ? "No published code map. Pass `project` (a slug from list_projects), and `map` when the project has several code maps."
+        : "No screens, or unsupported project.";
+    /** Remote connectors have no env/config to edit — steer those hints to the connector URL + `project` arg. */
+    const hinted = (local) => remote
+        ? {
+            ...local,
+            no_token: "The connector URL is missing its token — recreate it at alkahest.app → API tokens.",
+            no_api: "The connector's API base is misconfigured.",
+            no_slug: "Pass `project` — a slug from list_projects.",
+            invalid_token: "The token in the connector URL is invalid or revoked — create a new one at alkahest.app → API tokens and update the connector.",
+        }
+        : local;
+    if (!remote)
+        server.registerTool("scan", {
+            title: "Scan project",
+            description: "Statically analyze a React/Next project to create/update a product map (.alkahest/map.json). " +
+                "Extracts screens, transitions between screens, and the API/data calls each screen makes. Returns a result summary (counts). " +
+                "The map is viewed on the hosted viewer — run the publish tool for a shareable link.",
+            inputSchema: { path: z.string().optional().describe("Project root (default: cwd)") },
+        }, async ({ path }) => {
+            const result = runScan(rootOf(path));
+            if (!result)
+                return text("No screens found. Only Next app-router (page.* under app/ or src/app/) is supported.");
+            const m = result.map;
+            return json({
+                framework: m.meta.framework,
+                router: m.meta.router,
+                screens: m.screens.length,
+                resources: m.resources.length,
+                transitions: m.transitions.length,
+                calls: m.calls.length,
+                mapPath: result.outFile,
+            });
         });
-    });
     server.registerTool("overview", {
         title: "Product map overview",
         description: "Full product map overview: list of screens (route/title/feature count) and list of resources (label/number of calling screens). " +
             "Auto-scans if map.json is missing. Call this first to grasp the product structure at a glance.",
-        inputSchema: { path: z.string().optional() },
-    }, async ({ path }) => {
-        const map = loadOrScan(rootOf(path));
+        inputSchema: {
+            path: z.string().optional(),
+            project: z.string().optional().describe("Which project (slug) — remote connectors read the PUBLISHED code map (slugs from list_projects). Ignored locally."),
+            map: z.string().optional().describe("Which code map when the project has several (remote connectors only; default: the oldest)"),
+        },
+    }, async ({ path, project, map: mapSlug }) => {
+        const map = await getMap(path, project, mapSlug);
         if (!map)
-            return text("No screens, or unsupported project.");
+            return text(noMapMsg);
         return json({
             framework: map.meta.framework,
             router: map.meta.router,
@@ -76,11 +107,16 @@ export function buildServer() {
         title: "Screen detail",
         description: "Full structure of one screen: UI features, outgoing/incoming transitions, called resources (API/data), components, and source location. " +
             "The agent can use this data to write a summary or PRD itself. Specify the screen by id/route/title.",
-        inputSchema: { screen: z.string().describe("screen id / route / title"), path: z.string().optional() },
-    }, async ({ screen, path }) => {
-        const map = loadOrScan(rootOf(path));
+        inputSchema: {
+            screen: z.string().describe("screen id / route / title"),
+            path: z.string().optional(),
+            project: z.string().optional().describe("Which project (slug) — remote connectors read the PUBLISHED code map (slugs from list_projects). Ignored locally."),
+            map: z.string().optional().describe("Which code map when the project has several (remote connectors only; default: the oldest)"),
+        },
+    }, async ({ screen, path, project, map: mapSlug }) => {
+        const map = await getMap(path, project, mapSlug);
         if (!map)
-            return text("No screens, or unsupported project.");
+            return text(noMapMsg);
         const s = matchScreen(map, screen);
         if (!s)
             return text(`Screen not found: ${screen}`);
@@ -90,11 +126,16 @@ export function buildServer() {
         title: "Resource callers (impact)",
         description: "Returns the screens that call a specific resource (API endpoint/data). For understanding data dependencies and change impact. " +
             "Specify the resource by id ('GET /api/orders') or a path fragment ('/api/orders').",
-        inputSchema: { resource: z.string(), path: z.string().optional() },
-    }, async ({ resource, path }) => {
-        const map = loadOrScan(rootOf(path));
+        inputSchema: {
+            resource: z.string(),
+            path: z.string().optional(),
+            project: z.string().optional().describe("Which project (slug) — remote connectors read the PUBLISHED code map (slugs from list_projects). Ignored locally."),
+            map: z.string().optional().describe("Which code map when the project has several (remote connectors only; default: the oldest)"),
+        },
+    }, async ({ resource, path, project, map: mapSlug }) => {
+        const map = await getMap(path, project, mapSlug);
         if (!map)
-            return text("No screens, or unsupported project.");
+            return text(noMapMsg);
         const q = resource.toLowerCase();
         const matched = map.resources.filter((r) => r.id.toLowerCase() === q || (r.path ?? "").toLowerCase().includes(q) || r.label.toLowerCase().includes(q));
         return json(matched.map((r) => ({
@@ -105,108 +146,112 @@ export function buildServer() {
         })));
     });
     // ---- write-back tools: the agent saves its prose into map.json; publish shows it on the hosted viewer ----
-    server.registerTool("set_summary", {
-        title: "Set screen summary",
-        description: "Save a one-line, PM-friendly summary ('what the user does here') onto a screen in map.json — it appears " +
-            "in the screen's panel on the hosted viewer after the next publish. Write the summary yourself from get_screen data.",
-        inputSchema: {
-            screen: z.string().describe("screen id / route / title"),
-            summary: z.string().describe("a 1-2 sentence summary in the user's language"),
-            path: z.string().optional(),
-        },
-    }, async ({ screen, summary, path }) => writeField(rootOf(path), screen, (s) => { s.summary = summary; }));
-    server.registerTool("set_prd", {
-        title: "Set screen PRD",
-        description: "Save a PRD/requirements markdown onto a screen in map.json — it appears in the screen's panel on the " +
-            "hosted viewer (rendered) after the next publish. Write the PRD yourself from get_screen / who_calls data.",
-        inputSchema: {
-            screen: z.string().describe("screen id / route / title"),
-            prd: z.string().describe("PRD/requirements as markdown"),
-            path: z.string().optional(),
-        },
-    }, async ({ screen, prd, path }) => writeField(rootOf(path), screen, (s) => { s.prd = prd; }));
+    if (!remote)
+        server.registerTool("set_summary", {
+            title: "Set screen summary",
+            description: "Save a one-line, PM-friendly summary ('what the user does here') onto a screen in map.json — it appears " +
+                "in the screen's panel on the hosted viewer after the next publish. Write the summary yourself from get_screen data.",
+            inputSchema: {
+                screen: z.string().describe("screen id / route / title"),
+                summary: z.string().describe("a 1-2 sentence summary in the user's language"),
+                path: z.string().optional(),
+            },
+        }, async ({ screen, summary, path }) => writeField(rootOf(path), screen, (s) => { s.summary = summary; }));
+    if (!remote)
+        server.registerTool("set_prd", {
+            title: "Set screen PRD",
+            description: "Save a PRD/requirements markdown onto a screen in map.json — it appears in the screen's panel on the " +
+                "hosted viewer (rendered) after the next publish. Write the PRD yourself from get_screen / who_calls data.",
+            inputSchema: {
+                screen: z.string().describe("screen id / route / title"),
+                prd: z.string().describe("PRD/requirements as markdown"),
+                path: z.string().optional(),
+            },
+        }, async ({ screen, prd, path }) => writeField(rootOf(path), screen, (s) => { s.prd = prd; }));
     // ---- publish: upload the map to the hosted viewer for a shareable link ----
-    server.registerTool("publish", {
-        title: "Publish to hosted viewer",
-        description: "Upload this project's product map (.alkahest/map.json) to the hosted viewer (alkahest.app) and return a " +
-            "shareable link anyone can open — no install, no login to view. Only map.json is uploaded; source code never " +
-            "leaves the machine. Run 'scan' first if the map is missing. Auth uses an API token from the ALKAHEST_TOKEN " +
-            "env var (set it in this server's MCP config) or a prior 'alkahest login'.",
-        inputSchema: {
-            path: z.string().optional().describe("Project root (default: cwd)"),
-            name: z.string().optional().describe("Project name for the link (first publish only; defaults to folder name)"),
-            slug: z.string().optional().describe("Update an existing project by slug (else resolved from the checkout/creds)"),
-            map: z.string().optional().describe("Which code map to publish to (a project can hold several; omit when there's one). Passing a new slug creates that code map. List them with the maps tool."),
-        },
-    }, async ({ path, name, slug, map }) => {
-        const res = await publishMap(rootOf(path), { name, slug, mapSlug: map, source: "mcp" });
-        if (!res.ok) {
-            const hints = {
-                no_map: "Run the scan tool first to build .alkahest/map.json.",
-                no_token: "Set ALKAHEST_TOKEN in this MCP server's config (get a token at alkahest.app → Account).",
-                no_api: "Set ALKAHEST_API_URL in this MCP server's config.",
-                plan_limit: "Free plan project limit reached — upgrade to Pro for more.",
-                invalid_token: "The API token is invalid or revoked — create a new one at alkahest.app → Account.",
-                client_too_old: "This alkahest is too old to publish — run 'alkahest update'.",
-                no_workspace: "This account has no workspace yet, and a first publish needs one to hold the new project. Ask the user to create one at alkahest.app/home, then call publish again — there is nothing to retry until they do.",
-                ambiguous_map: "List the project's code maps with the maps tool, then call publish again with `map` set to one of them (or a new slug to create one).",
-                ambiguous_project: "This checkout has no linked project and an existing one looks like it — do NOT create a duplicate. Pick a candidate's slug below (or use list_projects) and call publish again with `slug` set, or pass a deliberately new `name` to create a fresh project.",
-            };
-            const hint = hints[res.code ?? ""] ? ` ${hints[res.code ?? ""]}` : "";
-            // Carry the structured map list (the edge function returns it) so the agent can pick without re-listing.
-            const maps = res.maps?.length ? ` Maps: ${JSON.stringify(res.maps)}` : "";
-            // Carry slug-less-publish candidates so the agent can re-publish with the right slug.
-            const cands = res.candidates?.length
-                ? ` Candidates: ${JSON.stringify(res.candidates.map((c) => ({ slug: c.slug, name: c.projectName, workspace: c.workspace, map: c.mapSlug })))}`
-                : "";
-            return text(`Publish failed (${res.code}): ${res.message}.${hint}${maps}${cands}`);
-        }
-        const v = await cachedUpdateStatus().catch(() => null);
-        // Needs tail (cloud ADR-032): the server counts what's waiting on the token's user in this
-        // project (unresolved decision questions + assigned issues). Surface it with an explicit
-        // relay hint so agent-driven users hear about blocked decisions in their terminal.
-        const waiting = (res.needs?.decisions ?? 0) + (res.needs?.assigned ?? 0);
-        return json({
-            ok: true,
-            slug: res.slug,
-            url: res.viewerUrl ?? res.mapUrl,
-            created: res.created,
-            ...(res.needs && waiting > 0
-                ? {
-                    needs: res.needs,
-                    needsHint: `Tell the user: ${[
-                        res.needs.decisions > 0 ? `${res.needs.decisions} decision${res.needs.decisions === 1 ? "" : "s"}` : null,
-                        res.needs.assigned > 0 ? `${res.needs.assigned} assigned issue${res.needs.assigned === 1 ? "" : "s"}` : null,
-                    ].filter(Boolean).join(" and ")} waiting on them${res.needs.url ? ` at ${res.needs.url}` : ""}.`,
-                }
-                : {}),
-            ...(v?.behind
-                ? { updateAvailable: `${v.current} → ${v.latest}`, updateHint: "Tell the user to run: alkahest update" }
-                : {}),
+    if (!remote)
+        server.registerTool("publish", {
+            title: "Publish to hosted viewer",
+            description: "Upload this project's product map (.alkahest/map.json) to the hosted viewer (alkahest.app) and return a " +
+                "shareable link anyone can open — no install, no login to view. Only map.json is uploaded; source code never " +
+                "leaves the machine. Run 'scan' first if the map is missing. Auth uses an API token from the ALKAHEST_TOKEN " +
+                "env var (set it in this server's MCP config) or a prior 'alkahest login'.",
+            inputSchema: {
+                path: z.string().optional().describe("Project root (default: cwd)"),
+                name: z.string().optional().describe("Project name for the link (first publish only; defaults to folder name)"),
+                slug: z.string().optional().describe("Update an existing project by slug (else resolved from the checkout/creds)"),
+                map: z.string().optional().describe("Which code map to publish to (a project can hold several; omit when there's one). Passing a new slug creates that code map. List them with the maps tool."),
+            },
+        }, async ({ path, name, slug, map }) => {
+            const res = await publishMap(rootOf(path), { name, slug, mapSlug: map, source: "mcp" });
+            if (!res.ok) {
+                const hints = {
+                    no_map: "Run the scan tool first to build .alkahest/map.json.",
+                    no_token: "Set ALKAHEST_TOKEN in this MCP server's config (get a token at alkahest.app → Account).",
+                    no_api: "Set ALKAHEST_API_URL in this MCP server's config.",
+                    plan_limit: "Free plan project limit reached — upgrade to Pro for more.",
+                    invalid_token: "The API token is invalid or revoked — create a new one at alkahest.app → Account.",
+                    client_too_old: "This alkahest is too old to publish — run 'alkahest update'.",
+                    no_workspace: "This account has no workspace yet, and a first publish needs one to hold the new project. Ask the user to create one at alkahest.app/home, then call publish again — there is nothing to retry until they do.",
+                    ambiguous_map: "List the project's code maps with the maps tool, then call publish again with `map` set to one of them (or a new slug to create one).",
+                    ambiguous_project: "This checkout has no linked project and an existing one looks like it — do NOT create a duplicate. Pick a candidate's slug below (or use list_projects) and call publish again with `slug` set, or pass a deliberately new `name` to create a fresh project.",
+                };
+                const hint = hints[res.code ?? ""] ? ` ${hints[res.code ?? ""]}` : "";
+                // Carry the structured map list (the edge function returns it) so the agent can pick without re-listing.
+                const maps = res.maps?.length ? ` Maps: ${JSON.stringify(res.maps)}` : "";
+                // Carry slug-less-publish candidates so the agent can re-publish with the right slug.
+                const cands = res.candidates?.length
+                    ? ` Candidates: ${JSON.stringify(res.candidates.map((c) => ({ slug: c.slug, name: c.projectName, workspace: c.workspace, map: c.mapSlug })))}`
+                    : "";
+                return text(`Publish failed (${res.code}): ${res.message}.${hint}${maps}${cands}`);
+            }
+            const v = await cachedUpdateStatus().catch(() => null);
+            // Needs tail (cloud ADR-032): the server counts what's waiting on the token's user in this
+            // project (unresolved decision questions + assigned issues). Surface it with an explicit
+            // relay hint so agent-driven users hear about blocked decisions in their terminal.
+            const waiting = (res.needs?.decisions ?? 0) + (res.needs?.assigned ?? 0);
+            return json({
+                ok: true,
+                slug: res.slug,
+                url: res.viewerUrl ?? res.mapUrl,
+                created: res.created,
+                ...(res.needs && waiting > 0
+                    ? {
+                        needs: res.needs,
+                        needsHint: `Tell the user: ${[
+                            res.needs.decisions > 0 ? `${res.needs.decisions} decision${res.needs.decisions === 1 ? "" : "s"}` : null,
+                            res.needs.assigned > 0 ? `${res.needs.assigned} assigned issue${res.needs.assigned === 1 ? "" : "s"}` : null,
+                        ].filter(Boolean).join(" and ")} waiting on them${res.needs.url ? ` at ${res.needs.url}` : ""}.`,
+                    }
+                    : {}),
+                ...(v?.behind
+                    ? { updateAvailable: `${v.current} → ${v.latest}`, updateHint: "Tell the user to run: alkahest update" }
+                    : {}),
+            });
         });
-    });
     // ---- check_version: let the agent tell the user whether to update ----
-    server.registerTool("check_version", {
-        title: "Check for alkahest updates",
-        description: "Report the installed alkahest version vs the latest published on npm, so you can tell the user whether their " +
-            "alkahest is current. If behind, tell them to run 'alkahest update' — you can't update through MCP (the CLI " +
-            "updates itself and this MCP server must be restarted to pick it up). No project access; just a version check.",
-        inputSchema: {},
-    }, async () => {
-        const s = await checkForUpdate();
-        return json({
-            current: s.current,
-            latest: s.latest,
-            behind: s.behind,
-            action: s.behind
-                ? "Out of date — tell the user to run: alkahest update (then restart this MCP server)."
-                : s.latest
-                    ? "Up to date."
-                    : s.reachable
-                        ? "Nothing published on npm to compare against."
-                        : "Couldn't reach the npm registry (offline/proxy?) — version status unknown.",
+    if (!remote)
+        server.registerTool("check_version", {
+            title: "Check for alkahest updates",
+            description: "Report the installed alkahest version vs the latest published on npm, so you can tell the user whether their " +
+                "alkahest is current. If behind, tell them to run 'alkahest update' — you can't update through MCP (the CLI " +
+                "updates itself and this MCP server must be restarted to pick it up). No project access; just a version check.",
+            inputSchema: {},
+        }, async () => {
+            const s = await checkForUpdate();
+            return json({
+                current: s.current,
+                latest: s.latest,
+                behind: s.behind,
+                action: s.behind
+                    ? "Out of date — tell the user to run: alkahest update (then restart this MCP server)."
+                    : s.latest
+                        ? "Up to date."
+                        : s.reachable
+                            ? "Nothing published on npm to compare against."
+                            : "Couldn't reach the npm registry (offline/proxy?) — version status unknown.",
+            });
         });
-    });
     // ---- comments: read map comments and act on them in-editor ----
     server.registerTool("comments", {
         title: "Map comments",
@@ -222,19 +267,19 @@ export function buildServer() {
         },
     }, async ({ path, open, project }) => {
         const root = rootOf(path);
-        const res = await pullComments(root, { open, slug: project });
+        const res = await pullComments(root, withAuth({ open, slug: project }));
         if (!res.ok) {
-            const hints = {
+            const hints = hinted({
                 no_token: "Set ALKAHEST_TOKEN in this MCP server's config (token from alkahest.app → Account).",
                 no_api: "Set ALKAHEST_API_URL in this MCP server's config.",
                 no_slug: "Pass `project` — a slug from list_projects — or set ALKAHEST_PROJECT in this MCP server's config.",
                 invalid_token: "The API token is invalid or revoked — create a new one at alkahest.app → Account.",
                 not_found: "No accessible project for this slug.",
-            };
+            });
             const hint = hints[res.code ?? ""] ? ` ${hints[res.code ?? ""]}` : "";
             return text(`Couldn't read comments (${res.code}): ${res.message}.${hint}`);
         }
-        const map = loadMap(res.root ?? root);
+        const map = remote ? await getMap(undefined, res.slug) : loadMap(res.root ?? root);
         const comments = map ? enrichComments(res.comments ?? [], map) : (res.comments ?? []);
         return json({ ok: true, slug: res.slug, count: comments.length, comments });
     });
@@ -248,13 +293,13 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ id, resolved, path }) => {
-        const res = await resolveComment(rootOf(path), id, resolved === undefined ? true : resolved);
+        const res = await resolveComment(rootOf(path), id, resolved === undefined ? true : resolved, withAuth({}));
         if (!res.ok) {
-            const hints = {
+            const hints = hinted({
                 no_token: "Set ALKAHEST_TOKEN in this MCP server's config.",
                 forbidden: "Only the comment author or project owner can resolve it.",
                 not_found: "No comment with that id.",
-            };
+            });
             const hint = hints[res.code ?? ""] ? ` ${hints[res.code ?? ""]}` : "";
             return text(`Resolve failed (${res.code}): ${res.message}.${hint}`);
         }
@@ -273,19 +318,19 @@ export function buildServer() {
         },
     }, async ({ node, body, path, project }) => {
         const root = findProjectRoot(rootOf(path));
-        const map = loadOrScan(root);
+        const map = remote ? await getMap(undefined, project) : loadOrScan(root);
         if (!map)
-            return text("No map for this project — run the scan/publish tools first.");
+            return text(remote ? noMapMsg : "No map for this project — run the scan/publish tools first.");
         const n = resolveNode(map, node);
         if (!n)
             return text(`No node matches '${node}'. Use the overview tool to list screens/resources.`);
-        const res = await postComment(root, { node_key: n.node_key, anchor_kind: n.anchor_kind, anchor_label: n.anchor_label, body, slug: project });
+        const res = await postComment(root, withAuth({ node_key: n.node_key, anchor_kind: n.anchor_kind, anchor_label: n.anchor_label, body, slug: project }));
         if (!res.ok) {
-            const hints = {
+            const hints = hinted({
                 no_token: "Set ALKAHEST_TOKEN in this MCP server's config.",
                 no_slug: "Pass `project` — a slug from list_projects — or set ALKAHEST_PROJECT in this MCP server's config.",
                 forbidden: "Only the project owner or a collaborator can comment.",
-            };
+            });
             return text(`Add comment failed (${res.code}): ${res.message}.${hints[res.code ?? ""] ? " " + hints[res.code ?? ""] : ""}`);
         }
         return json({ ok: true, id: res.comment?.id, node_key: n.node_key, anchor_label: n.anchor_label });
@@ -300,49 +345,50 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ id, body, path }) => {
-        const res = await postComment(rootOf(path), { parent_id: id, body });
+        const res = await postComment(rootOf(path), withAuth({ parent_id: id, body }));
         if (!res.ok) {
-            const hints = {
+            const hints = hinted({
                 no_token: "Set ALKAHEST_TOKEN in this MCP server's config.",
                 not_found: "No comment with that id (parent).",
                 forbidden: "Only the project owner or a collaborator can comment.",
-            };
+            });
             return text(`Reply failed (${res.code}): ${res.message}.${hints[res.code ?? ""] ? " " + hints[res.code ?? ""] : ""}`);
         }
         return json({ ok: true, id: res.comment?.id, parent_id: id });
     });
-    server.registerTool("comment_to_issue", {
-        title: "File map comments as a GitHub issue",
-        description: "Group one or more map comments (ids from the comments tool) into a SINGLE GitHub issue and link it back onto each. " +
-            "Creates the issue with the local `gh` CLI (must be installed and authenticated; it runs in the project's git repo), " +
-            "then records the issue URL on the comments so the hosted viewer shows a 'tracked' badge. Use this to turn feedback " +
-            "into tracked work. Needs an API token; owner or collaborator only. Pass force:true to re-file comments that are " +
-            "already linked to an issue (creates a new one).",
-        inputSchema: {
-            ids: z.array(z.string()).min(1).describe("Comment ids to group into one issue (from the comments tool)"),
-            project: z.string().optional().describe("Which project (slug) — say it explicitly when the folder isn't a linked checkout. List them with list_projects."),
-            path: z.string().optional().describe("Project root (default: cwd)"),
-            title: z.string().optional().describe("Issue title (else derived from the comments)"),
-            repo: z.string().optional().describe("Target GitHub repo owner/repo (else gh's default for the repo)"),
-            force: z.boolean().optional().describe("File even if some selected comments are already tracked"),
-        },
-    }, async ({ ids, path, title, repo, force, project }) => {
-        const res = await fileCommentsIssue(rootOf(path), ids, { title, repo, force, slug: project });
-        if (!res.ok) {
-            const hints = {
-                no_token: "Set ALKAHEST_TOKEN in this MCP server's config.",
-                no_slug: "Pass `project` — a slug from list_projects — or set ALKAHEST_PROJECT in this MCP server's config.",
-                already_tracked: "Some comments already have an issue — pass force:true to file a new one.",
-                gh_failed: "Install and authenticate the GitHub CLI (`gh auth login`) for this repo.",
-                forbidden: "Only the project owner or a collaborator can file issues.",
-                not_found: "One or more ids don't exist — list them with the comments tool.",
-            };
-            return text(`File issue failed (${res.code}): ${res.message}.${hints[res.code ?? ""] ? " " + hints[res.code ?? ""] : ""}`);
-        }
-        return json({ ok: true, issue_url: res.issue_url, ids: res.ids, title: res.title });
-    });
+    if (!remote)
+        server.registerTool("comment_to_issue", {
+            title: "File map comments as a GitHub issue",
+            description: "Group one or more map comments (ids from the comments tool) into a SINGLE GitHub issue and link it back onto each. " +
+                "Creates the issue with the local `gh` CLI (must be installed and authenticated; it runs in the project's git repo), " +
+                "then records the issue URL on the comments so the hosted viewer shows a 'tracked' badge. Use this to turn feedback " +
+                "into tracked work. Needs an API token; owner or collaborator only. Pass force:true to re-file comments that are " +
+                "already linked to an issue (creates a new one).",
+            inputSchema: {
+                ids: z.array(z.string()).min(1).describe("Comment ids to group into one issue (from the comments tool)"),
+                project: z.string().optional().describe("Which project (slug) — say it explicitly when the folder isn't a linked checkout. List them with list_projects."),
+                path: z.string().optional().describe("Project root (default: cwd)"),
+                title: z.string().optional().describe("Issue title (else derived from the comments)"),
+                repo: z.string().optional().describe("Target GitHub repo owner/repo (else gh's default for the repo)"),
+                force: z.boolean().optional().describe("File even if some selected comments are already tracked"),
+            },
+        }, async ({ ids, path, title, repo, force, project }) => {
+            const res = await fileCommentsIssue(rootOf(path), ids, { title, repo, force, slug: project });
+            if (!res.ok) {
+                const hints = {
+                    no_token: "Set ALKAHEST_TOKEN in this MCP server's config.",
+                    no_slug: "Pass `project` — a slug from list_projects — or set ALKAHEST_PROJECT in this MCP server's config.",
+                    already_tracked: "Some comments already have an issue — pass force:true to file a new one.",
+                    gh_failed: "Install and authenticate the GitHub CLI (`gh auth login`) for this repo.",
+                    forbidden: "Only the project owner or a collaborator can file issues.",
+                    not_found: "One or more ids don't exist — list them with the comments tool.",
+                };
+                return text(`File issue failed (${res.code}): ${res.message}.${hints[res.code ?? ""] ? " " + hints[res.code ?? ""] : ""}`);
+            }
+            return json({ ok: true, issue_url: res.issue_url, ids: res.ids, title: res.title });
+        });
     // ---- issues: the Issue Map — a map-shaped issue tracker on the hosted viewer ----
-    const issueHints = {
+    const issueHints = hinted({
         no_token: "Set ALKAHEST_TOKEN in this MCP server's config (token from alkahest.app → Account).",
         no_api: "Set ALKAHEST_API_URL in this MCP server's config.",
         no_slug: "Pass `project` — a slug from list_projects — or set ALKAHEST_PROJECT in this MCP server's config.",
@@ -350,7 +396,7 @@ export function buildServer() {
         forbidden: "Only the project owner or a collaborator can write issues.",
         not_found: "Not found — list ids with the issues tool, or the project's issue maps with the maps tool.",
         ambiguous_map: "List the project's issue maps with the maps tool, then retry with `map` set to one (or create one with create_map).",
-    };
+    });
     // `maps` (present on ambiguous_map / unknown-slug) is appended as JSON so the agent can pick a map
     // without a second round-trip to the maps tool.
     const issueFail = (what, code, message, maps) => text(`${what} failed (${code}): ${message}.${issueHints[code ?? ""] ? " " + issueHints[code ?? ""] : ""}${maps?.length ? ` Maps: ${JSON.stringify(maps)}` : ""}`);
@@ -372,7 +418,7 @@ export function buildServer() {
             q: z.string().optional().describe("Filter issues by title/body substring (server-side). Edges/links stay unfiltered, so blockedBy may name issues outside the filtered list."),
         },
     }, async ({ path, open, map, q, project }) => {
-        const res = await pullIssues(rootOf(path), { mapSlug: map, q, slug: project });
+        const res = await pullIssues(rootOf(path), withAuth({ mapSlug: map, q, slug: project }));
         if (!res.ok || !res.graph)
             return issueFail("Read issues", res.code, res.message, res.maps);
         const states = deriveIssueStates(res.graph);
@@ -422,7 +468,7 @@ export function buildServer() {
                 target_key: target,
             }
             : {};
-        const res = await createIssue(rootOf(path), { title, type, status, body, priority, due_on, assignee_id, props, parent_id, mapSlug: map, slug: project, ...targetFields });
+        const res = await createIssue(rootOf(path), withAuth({ title, type, status, body, priority, due_on, assignee_id, props, parent_id, mapSlug: map, slug: project, ...targetFields }));
         if (!res.ok || !res.issue)
             return issueFail("Add issue", res.code, res.message, res.maps);
         return json({ ok: true, issue: res.issue });
@@ -463,7 +509,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ status, project, q, path }) => {
-        const res = await pullTasks(rootOf(path), { status, project, q });
+        const res = await pullTasks(rootOf(path), withAuth({ status, project, q }));
         if (!res.ok || !res.tasks)
             return issueFail("List tasks", res.code, res.message);
         return json({ ok: true, count: res.tasks.length, tasks: res.tasks });
@@ -510,7 +556,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — a linked checkout auto-tags its project)"),
         },
     }, async ({ title, body, project, workspace, tags, due_on, dedup_key, note_mode, note, skill, path }) => {
-        const res = await createTask(rootOf(path), { title, body, slug: project, workspace, tags, due_on, dedup_key, note_mode, note, skill });
+        const res = await createTask(rootOf(path), withAuth({ title, body, slug: project, workspace, tags, due_on, dedup_key, note_mode, note, skill }));
         if (!res.ok || !res.task) {
             const wsHint = res.workspaces?.length ? ` Workspaces: ${JSON.stringify(res.workspaces)}` : "";
             return issueFail("Add task", res.code, `${res.message ?? ""}${wsHint}`);
@@ -531,7 +577,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ id, reopen, path }) => {
-        const res = await completeTask(rootOf(path), { id, reopen });
+        const res = await completeTask(rootOf(path), withAuth({ id, reopen }));
         if (!res.ok || !res.task)
             return issueFail(reopen ? "Reopen task" : "Complete task", res.code, res.message);
         return json({ ok: true, task: res.task });
@@ -556,7 +602,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ id, title, body, due_on, tags, note_mode, note, skill, path }) => {
-        const res = await updateTask(rootOf(path), {
+        const res = await updateTask(rootOf(path), withAuth({
             id,
             title,
             body: body === "" ? null : body,
@@ -565,7 +611,7 @@ export function buildServer() {
             note_mode: note_mode === "" ? null : note_mode,
             note: note === "" ? null : note,
             skill: skill === "" ? null : skill,
-        });
+        }));
         if (!res.ok || !res.task)
             return issueFail("Update task", res.code, res.message);
         return json({ ok: true, task: res.task });
@@ -586,7 +632,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ path }) => {
-        const res = await pullSkills(rootOf(path));
+        const res = await pullSkills(rootOf(path), withAuth({}));
         if (!res.ok || !res.skills)
             return issueFail("List skills", res.code, res.message);
         return json({ ok: true, count: res.skills.length, skills: res.skills });
@@ -613,7 +659,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ name, body, default_for, rename_from, path }) => {
-        const res = await saveSkill(rootOf(path), { name, body, default_for, rename_from });
+        const res = await saveSkill(rootOf(path), withAuth({ name, body, default_for, rename_from }));
         if (!res.ok || !res.skill)
             return issueFail("Add skill", res.code, res.message);
         return json({ ok: true, skill: res.skill });
@@ -634,7 +680,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ task, open, path }) => {
-        const res = await pullTaskComments(rootOf(path), { task, open });
+        const res = await pullTaskComments(rootOf(path), withAuth({ task, open }));
         if (!res.ok || !res.comments)
             return issueFail("Read task comments", res.code, res.message);
         return json({ ok: true, count: res.comments.length, comments: res.comments });
@@ -652,7 +698,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ task, body, path }) => {
-        const res = await postTaskComment(rootOf(path), { task_id: task, body, kind: "question" });
+        const res = await postTaskComment(rootOf(path), withAuth({ task_id: task, body, kind: "question" }));
         if (!res.ok || !res.comment)
             return issueFail("Ask task", res.code, res.message);
         return json({ ok: true, comment: res.comment, note: "Question posted — re-check with task_comments, then resolve_task_comment once answered." });
@@ -673,7 +719,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ task, parent, body, kind, path }) => {
-        const res = await postTaskComment(rootOf(path), { task_id: task, parent, body, kind });
+        const res = await postTaskComment(rootOf(path), withAuth({ task_id: task, parent, body, kind }));
         if (!res.ok || !res.comment)
             return issueFail("Comment on task", res.code, res.message);
         return json({ ok: true, comment: res.comment });
@@ -690,7 +736,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd — used only to find your token/API)"),
         },
     }, async ({ id, resolved, path }) => {
-        const res = await resolveTaskComment(rootOf(path), { id, resolved });
+        const res = await resolveTaskComment(rootOf(path), withAuth({ id, resolved }));
         if (!res.ok)
             return issueFail("Resolve task comment", res.code, res.message);
         return json({ ok: true, id: res.id, resolved: res.resolved });
@@ -713,9 +759,9 @@ export function buildServer() {
     }, async ({ q, path, project }) => {
         const root = rootOf(path);
         const [notesRes, issuesRes, tasksRes] = await Promise.all([
-            pullNotes(root, { q, bodies: "excerpt", slug: project }),
-            pullIssues(root, { q, slug: project }),
-            pullTasks(root, { q, status: "all", project }),
+            pullNotes(root, withAuth({ q, bodies: "excerpt", slug: project })),
+            pullIssues(root, withAuth({ q, slug: project })),
+            pullTasks(root, withAuth({ q, status: "all", project })),
         ]);
         const notes = notesRes.ok && notesRes.maps
             ? notesRes.maps.flatMap((m) => m.notes.map((n) => ({ slug: n.slug, title: n.title, map: m.slug, folder: n.folder ?? null, excerpt: n.body ?? null })))
@@ -750,7 +796,7 @@ export function buildServer() {
             full_bodies: z.boolean().optional().describe("Return complete bodies instead of 240-char excerpts (heavy on a big wiki)"),
         },
     }, async ({ path, q, map, full_bodies, project }) => {
-        const res = await pullNotes(rootOf(path), { mapSlug: map, q, bodies: full_bodies ? undefined : "excerpt", slug: project });
+        const res = await pullNotes(rootOf(path), withAuth({ mapSlug: map, q, bodies: full_bodies ? undefined : "excerpt", slug: project }));
         if (!res.ok || !res.maps)
             return issueFail("Read notes", res.code, res.message, res.mapList);
         return json({ ok: true, project: res.project, count: res.maps.reduce((n, m) => n + m.notes.length, 0), maps: res.maps });
@@ -766,7 +812,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ note, map, path, project }) => {
-        const res = await getNote(rootOf(path), { note, mapSlug: map, slug: project });
+        const res = await getNote(rootOf(path), withAuth({ note, mapSlug: map, slug: project }));
         if (!res.ok || !res.note)
             return issueFail("Get note", res.code, res.message, res.mapList);
         const { ok: _ok, code: _code, message: _message, mapList: _ml, ...rest } = res;
@@ -790,7 +836,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ title, body, note_slug, folder, props, map, path, project }) => {
-        const res = await createNote(rootOf(path), { title, body, note_slug, folder, props, mapSlug: map, slug: project });
+        const res = await createNote(rootOf(path), withAuth({ title, body, note_slug, folder, props, mapSlug: map, slug: project }));
         if (!res.ok || !res.note)
             return issueFail("Add note", res.code, res.message, res.maps);
         return json({ ok: true, note: res.note });
@@ -811,7 +857,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ from, to, remove, path, project }) => {
-        const res = await linkNotes(rootOf(path), { from, to, remove, slug: project });
+        const res = await linkNotes(rootOf(path), withAuth({ from, to, remove, slug: project }));
         if (!res.ok)
             return issueFail(remove ? "Unlink notes" : "Link notes", res.code, res.message, res.maps);
         return json({ ok: true, ...(remove ? { removed: `${from} → ${to}` } : { linked: `${from} → ${to}` }) });
@@ -829,7 +875,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ note, map, path, project }) => {
-        const res = await mapNote(rootOf(path), { noteRef: note, mapSlug: map, slug: project });
+        const res = await mapNote(rootOf(path), withAuth({ noteRef: note, mapSlug: map, slug: project }));
         if (!res.ok)
             return issueFail("Move note", res.code, res.message, res.maps);
         return json({ ok: true, note: res.note, map: res.map });
@@ -859,7 +905,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ note, title, body, new_slug, folder, props, delete: del, reason, restore, map, path, project }) => {
-        const res = await updateNote(rootOf(path), { note, title, body, new_slug, folder, props, delete: del, reason, restore, mapSlug: map, slug: project });
+        const res = await updateNote(rootOf(path), withAuth({ note, title, body, new_slug, folder, props, delete: del, reason, restore, mapSlug: map, slug: project }));
         const what = del ? "Delete note" : restore ? "Restore note" : "Update note";
         if (!res.ok)
             return issueFail(what, res.code, res.message, res.maps);
@@ -899,7 +945,7 @@ export function buildServer() {
         if (!define?.length && !remove?.length) {
             return json({ ok: false, error: "bad_request", message: "Pass `define` (definitions to register) and/or `remove` (keys to unregister)." });
         }
-        const res = await editPropDefs(rootOf(path), { defs: define, remove, mapSlug: map, slug: project });
+        const res = await editPropDefs(rootOf(path), withAuth({ defs: define, remove, mapSlug: map, slug: project }));
         if (!res.ok)
             return issueFail("Edit note props", res.code, res.message, res.maps);
         return json({ ok: true, added: res.added ?? 0, merged: res.merged ?? 0, removed: res.removed ?? 0, skipped: res.skipped ?? 0 });
@@ -916,7 +962,7 @@ export function buildServer() {
             type: z.enum(["code", "issue", "note"]).optional().describe("Restrict to one type (default: all)"),
         },
     }, async ({ path, type, project }) => {
-        const res = await listMaps(rootOf(path), { type, slug: project });
+        const res = await listMaps(rootOf(path), withAuth({ type, slug: project }));
         if (!res.ok || !res.maps)
             return issueFail("List maps", res.code, res.message);
         return json({ ok: true, slug: res.slug, count: res.maps.length, maps: res.maps });
@@ -932,10 +978,10 @@ export function buildServer() {
             "(screens/resources counts) so you can match a local scan by structure. Needs an API token; no project context.",
         inputSchema: {},
     }, async () => {
-        const res = await listProjects({});
+        const res = await listProjects(withAuth({}));
         if (!res.ok || !res.projects) {
-            const hint = res.code === "no_token" ? " Set ALKAHEST_TOKEN in this MCP server's config." : "";
-            return text(`List projects failed (${res.code}): ${res.message}.${hint}`);
+            const h = hinted({ no_token: "Set ALKAHEST_TOKEN in this MCP server's config." })[res.code ?? ""];
+            return text(`List projects failed (${res.code}): ${res.message}.${h ? ` ${h}` : ""}`);
         }
         return json({
             ok: true,
@@ -966,7 +1012,7 @@ export function buildServer() {
             limit: z.number().optional().describe("Max versions (default 50)"),
         },
     }, async ({ path, map, limit, project }) => {
-        const res = await listHistory(rootOf(path), { map, limit, slug: project });
+        const res = await listHistory(rootOf(path), withAuth({ map, limit, slug: project }));
         if (!res.ok || !res.versions)
             return issueFail("History", res.code, res.message);
         // Newest first; include count deltas vs the previous version so the agent needn't recompute.
@@ -1000,7 +1046,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ slug, type, name, path, project }) => {
-        const res = await createMap(rootOf(path), { mapSlug: slug, type, mapName: name, slug: project });
+        const res = await createMap(rootOf(path), withAuth({ mapSlug: slug, type, mapName: name, slug: project }));
         if (!res.ok || !res.map)
             return issueFail("Create map", res.code, res.message);
         return json({ ok: true, map: res.map });
@@ -1050,7 +1096,7 @@ export function buildServer() {
                 set.target_key = target;
             }
         }
-        const res = await updateIssue(rootOf(path), { id, ...(del ? { delete: true } : { set }) });
+        const res = await updateIssue(rootOf(path), withAuth({ id, ...(del ? { delete: true } : { set }) }));
         if (!res.ok)
             return issueFail("Update issue", res.code, res.message);
         return json(res.deleted ? { ok: true, deleted: true, id } : { ok: true, issue: res.issue });
@@ -1069,7 +1115,7 @@ export function buildServer() {
         },
     }, async ({ from, to, kind, remove, path }) => {
         const edge = [{ to, kind: kind ?? "blocks" }];
-        const res = await updateIssue(rootOf(path), { id: from, ...(remove ? { remove_edges: edge } : { add_edges: edge }) });
+        const res = await updateIssue(rootOf(path), withAuth({ id: from, ...(remove ? { remove_edges: edge } : { add_edges: edge }) }));
         if (!res.ok)
             return issueFail("Link issues", res.code, res.message);
         return json({ ok: true, from, to, kind: kind ?? "blocks", removed: Boolean(remove) });
@@ -1088,7 +1134,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ issue, map, remove, path, project }) => {
-        const res = await mapIssue(rootOf(path), { issueId: issue, mapSlug: map, remove, slug: project });
+        const res = await mapIssue(rootOf(path), withAuth({ issueId: issue, mapSlug: map, remove, slug: project }));
         if (!res.ok)
             return issueFail(remove ? "Unmap issue" : "Map issue", res.code, res.message, res.maps);
         return json({ ok: true, issue: res.issue, map: res.map, member: res.member });
@@ -1108,7 +1154,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ issue, open, path, project }) => {
-        const res = await pullIssueComments(rootOf(path), { issue, open, slug: project });
+        const res = await pullIssueComments(rootOf(path), withAuth({ issue, open, slug: project }));
         if (!res.ok || !res.comments)
             return issueFail("Read issue comments", res.code, res.message);
         return json({ ok: true, count: res.comments.length, comments: res.comments });
@@ -1129,7 +1175,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ issue, body, mention, path }) => {
-        const res = await postIssueComment(rootOf(path), { issue_id: issue, body, kind: "question", mention });
+        const res = await postIssueComment(rootOf(path), withAuth({ issue_id: issue, body, kind: "question", mention }));
         if (!res.ok || !res.comment)
             return issueFail("Ask issue", res.code, res.message);
         return json({ ok: true, comment: res.comment, note: "Question posted — the issue is now awaiting the user's decision. Re-check with issue_comments, then resolve_issue_question once answered." });
@@ -1149,7 +1195,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ issue, parent, body, kind, mention, path }) => {
-        const res = await postIssueComment(rootOf(path), { issue_id: issue, parent, body, kind, mention });
+        const res = await postIssueComment(rootOf(path), withAuth({ issue_id: issue, parent, body, kind, mention }));
         if (!res.ok || !res.comment)
             return issueFail("Reply on issue", res.code, res.message);
         return json({ ok: true, comment: res.comment });
@@ -1165,7 +1211,7 @@ export function buildServer() {
             path: z.string().optional().describe("Project root (default: cwd)"),
         },
     }, async ({ id, resolved, path }) => {
-        const res = await resolveIssueComment(rootOf(path), { id, resolved });
+        const res = await resolveIssueComment(rootOf(path), withAuth({ id, resolved }));
         if (!res.ok)
             return issueFail("Resolve question", res.code, res.message);
         return json({ ok: true, id: res.id, resolved: res.resolved });
@@ -1189,7 +1235,7 @@ export function buildServer() {
         // Resolve the terminal status to move to (explicit, else the project's first terminal status).
         let target = status;
         if (!target) {
-            const g = await pullIssues(root, { slug: project });
+            const g = await pullIssues(root, withAuth({ slug: project }));
             if (!g.ok || !g.graph)
                 return issueFail("Complete issue", g.code, g.message, g.maps);
             const terminal = [...terminalStatuses(g.graph.issue_config)];
@@ -1197,10 +1243,10 @@ export function buildServer() {
                 return text("Complete issue failed: this project's issue_config has no terminal status. Set one, or use update_issue with an explicit status.");
             target = terminal[0];
         }
-        const upd = await updateIssue(root, { id, set: { status: target } });
+        const upd = await updateIssue(root, withAuth({ id, set: { status: target } }));
         if (!upd.ok)
             return issueFail("Complete issue", upd.code, upd.message);
-        const cmt = await postIssueComment(root, { issue_id: id, body: result, kind: "result" });
+        const cmt = await postIssueComment(root, withAuth({ issue_id: id, body: result, kind: "result" }));
         if (!cmt.ok)
             return issueFail("Complete issue (result note)", cmt.code, cmt.message);
         return json({