@ductape/mcp 0.1.52 → 0.1.55

package/dist/index.js

@@ -1180,7 +1180,14 @@ function checkCli() {
 }
 function checkLoginState() {
     try {
-        execSync('ductape whoami --json', { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+        // `ductape whoami` only reports whether a local credentials file exists. It does not validate
+        // the stored token, so an expired token would be cached as authenticated and fail later with 401.
+        // Use a harmless authenticated read to validate the credential against the API.
+        execSync('ductape workspaces list --json', {
+            encoding: 'utf8',
+            timeout: 10000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
         authState = 'ok';
         return 'ok';
     }
@@ -1225,6 +1232,26 @@ function runCli(command) {
     }
     catch (err) {
         const msg = (err.stderr || err.stdout || err.message || String(err)).trim();
+        if (/\bHTTP 401\b|unauthori[sz]ed|invalid token|token expired/i.test(msg)) {
+            authState = 'none';
+            workspaceSynced = false;
+            return {
+                success: false,
+                output: [
+                    'Ductape CLI authentication expired or was revoked (HTTP 401).',
+                    'This administrative operation correctly used ductape_cli; do not retry it through ductape_execute.',
+                    '',
+                    'Re-authenticate locally in a trusted terminal:',
+                    '  ductape login',
+                    'or use an OAuth flow:',
+                    '  ductape login --browser google',
+                    '  ductape login --browser github',
+                    '',
+                    'Do not paste a password, OAuth callback token, or stored CLI credential into an agent prompt.',
+                    'After login succeeds, retry the same ductape_cli command.',
+                ].join('\n'),
+            };
+        }
         return { success: false, output: msg };
     }
 }
@@ -2876,10 +2903,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });
@@ -3678,12 +3715,18 @@ async function main() {
                     content: [{
                             type: 'text',
                             text: [
-                                'Not logged in to the Ductape CLI.',
+                                'The Ductape CLI has no remotely valid authenticated session.',
+                                '',
+                                'Administrative reads and writes must remain on ductape_cli; do not fall back to ductape_execute.',
                                 '',
-                                'Ask the user for their Ductape email and password, then call:',
-                                `  ductape_cli("login --email <email> --password <password>${wsFlag}")`,
+                                'Ask the user to re-authenticate in a trusted local terminal:',
+                                `  ductape login${wsFlag}`,
+                                'or:',
+                                `  ductape login --browser google${wsFlag}`,
+                                `  ductape login --browser github${wsFlag}`,
                                 '',
-                                'Or the user can run `ductape login` in their terminal and then retry.',
+                                'Never ask the user to paste their password, OAuth callback token, or stored CLI credential into the agent.',
+                                'After login succeeds, retry the original ductape_cli command.',
                             ].join('\n'),
                         }],
                     isError: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.52",
+  "version": "0.1.55",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -42,9 +42,13 @@ const safetyChecks = [
   ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
   ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
   ['frontend durable work prohibits persisted JWTs', /For delayed\/durable work, do not persist raw JWTs indefinitely/],
+  ['browser events use frontend client', /CLIENT-SIDE \(browser — publishable key\):[\s\S]*import \{ createClient \} from '@ductape\/client';[\s\S]*ductape\.brokers\.publish/],
   ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
   ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
   ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
+  ['CLI auth is remotely validated', /ductape workspaces list --json/],
+  ['CLI 401 triggers login-required state', /authentication expired or was revoked \(HTTP 401\)[\s\S]*ductape login/],
+  ['CLI auth guidance does not request secrets', /Never ask the user to paste their password/],
 ];
 
 for (const [name, pattern] of safetyChecks) {
@@ -55,4 +59,13 @@ for (const [name, pattern] of safetyChecks) {
   }
 }
 
+const clientEventsSection = source.match(
+  /CLIENT-SIDE \(browser — publishable key\):[\s\S]*?SCHEDULED DISPATCH \(background job\):/,
+)?.[0] ?? '';
+assert.doesNotMatch(
+  clientEventsSection,
+  /from '@ductape\/sdk'/,
+  'Browser Events guidance must not import the server SDK',
+);
+
 console.log(`MCP guidance: ${checks.length + 1 + safetyChecks.length} acceptance checks passed`);

package/src/index.ts

@@ -1242,7 +1242,14 @@ function checkCli(): { available: boolean; version?: string } {
 
 function checkLoginState(): 'ok' | 'none' {
   try {
-    execSync('ductape whoami --json', { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+    // `ductape whoami` only reports whether a local credentials file exists. It does not validate
+    // the stored token, so an expired token would be cached as authenticated and fail later with 401.
+    // Use a harmless authenticated read to validate the credential against the API.
+    execSync('ductape workspaces list --json', {
+      encoding: 'utf8',
+      timeout: 10000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
     authState = 'ok';
     return 'ok';
   } catch {
@@ -1285,6 +1292,26 @@ function runCli(command: string): { success: boolean; output: string } {
     return { success: true, output: output.trim() };
   } catch (err: any) {
     const msg = (err.stderr || err.stdout || err.message || String(err)).trim();
+    if (/\bHTTP 401\b|unauthori[sz]ed|invalid token|token expired/i.test(msg)) {
+      authState = 'none';
+      workspaceSynced = false;
+      return {
+        success: false,
+        output: [
+          'Ductape CLI authentication expired or was revoked (HTTP 401).',
+          'This administrative operation correctly used ductape_cli; do not retry it through ductape_execute.',
+          '',
+          'Re-authenticate locally in a trusted terminal:',
+          '  ductape login',
+          'or use an OAuth flow:',
+          '  ductape login --browser google',
+          '  ductape login --browser github',
+          '',
+          'Do not paste a password, OAuth callback token, or stored CLI credential into an agent prompt.',
+          'After login succeeds, retry the same ductape_cli command.',
+        ].join('\n'),
+      };
+    }
     return { success: false, output: msg };
   }
 }
@@ -2963,10 +2990,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });
@@ -3786,12 +3823,18 @@ async function main() {
           content: [{
             type: 'text',
             text: [
-              'Not logged in to the Ductape CLI.',
+              'The Ductape CLI has no remotely valid authenticated session.',
+              '',
+              'Administrative reads and writes must remain on ductape_cli; do not fall back to ductape_execute.',
               '',
-              'Ask the user for their Ductape email and password, then call:',
-              `  ductape_cli("login --email <email> --password <password>${wsFlag}")`,
+              'Ask the user to re-authenticate in a trusted local terminal:',
+              `  ductape login${wsFlag}`,
+              'or:',
+              `  ductape login --browser google${wsFlag}`,
+              `  ductape login --browser github${wsFlag}`,
               '',
-              'Or the user can run `ductape login` in their terminal and then retry.',
+              'Never ask the user to paste their password, OAuth callback token, or stored CLI credential into the agent.',
+              'After login succeeds, retry the original ductape_cli command.',
             ].join('\n'),
           }],
           isError: true,