@ductape/mcp 0.1.53 → 0.1.55

package/dist/index.js

@@ -1180,7 +1180,14 @@ function checkCli() {
 }
 function checkLoginState() {
     try {
-        execSync('ductape whoami --json', { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+        // `ductape whoami` only reports whether a local credentials file exists. It does not validate
+        // the stored token, so an expired token would be cached as authenticated and fail later with 401.
+        // Use a harmless authenticated read to validate the credential against the API.
+        execSync('ductape workspaces list --json', {
+            encoding: 'utf8',
+            timeout: 10000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
         authState = 'ok';
         return 'ok';
     }
@@ -1225,6 +1232,26 @@ function runCli(command) {
     }
     catch (err) {
         const msg = (err.stderr || err.stdout || err.message || String(err)).trim();
+        if (/\bHTTP 401\b|unauthori[sz]ed|invalid token|token expired/i.test(msg)) {
+            authState = 'none';
+            workspaceSynced = false;
+            return {
+                success: false,
+                output: [
+                    'Ductape CLI authentication expired or was revoked (HTTP 401).',
+                    'This administrative operation correctly used ductape_cli; do not retry it through ductape_execute.',
+                    '',
+                    'Re-authenticate locally in a trusted terminal:',
+                    '  ductape login',
+                    'or use an OAuth flow:',
+                    '  ductape login --browser google',
+                    '  ductape login --browser github',
+                    '',
+                    'Do not paste a password, OAuth callback token, or stored CLI credential into an agent prompt.',
+                    'After login succeeds, retry the same ductape_cli command.',
+                ].join('\n'),
+            };
+        }
         return { success: false, output: msg };
     }
 }
@@ -3688,12 +3715,18 @@ async function main() {
                     content: [{
                             type: 'text',
                             text: [
-                                'Not logged in to the Ductape CLI.',
+                                'The Ductape CLI has no remotely valid authenticated session.',
+                                '',
+                                'Administrative reads and writes must remain on ductape_cli; do not fall back to ductape_execute.',
                                 '',
-                                'Ask the user for their Ductape email and password, then call:',
-                                `  ductape_cli("login --email <email> --password <password>${wsFlag}")`,
+                                'Ask the user to re-authenticate in a trusted local terminal:',
+                                `  ductape login${wsFlag}`,
+                                'or:',
+                                `  ductape login --browser google${wsFlag}`,
+                                `  ductape login --browser github${wsFlag}`,
                                 '',
-                                'Or the user can run `ductape login` in their terminal and then retry.',
+                                'Never ask the user to paste their password, OAuth callback token, or stored CLI credential into the agent.',
+                                'After login succeeds, retry the original ductape_cli command.',
                             ].join('\n'),
                         }],
                     isError: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -46,6 +46,9 @@ const safetyChecks = [
   ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
   ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
   ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
+  ['CLI auth is remotely validated', /ductape workspaces list --json/],
+  ['CLI 401 triggers login-required state', /authentication expired or was revoked \(HTTP 401\)[\s\S]*ductape login/],
+  ['CLI auth guidance does not request secrets', /Never ask the user to paste their password/],
 ];
 
 for (const [name, pattern] of safetyChecks) {

package/src/index.ts

@@ -1242,7 +1242,14 @@ function checkCli(): { available: boolean; version?: string } {
 
 function checkLoginState(): 'ok' | 'none' {
   try {
-    execSync('ductape whoami --json', { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+    // `ductape whoami` only reports whether a local credentials file exists. It does not validate
+    // the stored token, so an expired token would be cached as authenticated and fail later with 401.
+    // Use a harmless authenticated read to validate the credential against the API.
+    execSync('ductape workspaces list --json', {
+      encoding: 'utf8',
+      timeout: 10000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
     authState = 'ok';
     return 'ok';
   } catch {
@@ -1285,6 +1292,26 @@ function runCli(command: string): { success: boolean; output: string } {
     return { success: true, output: output.trim() };
   } catch (err: any) {
     const msg = (err.stderr || err.stdout || err.message || String(err)).trim();
+    if (/\bHTTP 401\b|unauthori[sz]ed|invalid token|token expired/i.test(msg)) {
+      authState = 'none';
+      workspaceSynced = false;
+      return {
+        success: false,
+        output: [
+          'Ductape CLI authentication expired or was revoked (HTTP 401).',
+          'This administrative operation correctly used ductape_cli; do not retry it through ductape_execute.',
+          '',
+          'Re-authenticate locally in a trusted terminal:',
+          '  ductape login',
+          'or use an OAuth flow:',
+          '  ductape login --browser google',
+          '  ductape login --browser github',
+          '',
+          'Do not paste a password, OAuth callback token, or stored CLI credential into an agent prompt.',
+          'After login succeeds, retry the same ductape_cli command.',
+        ].join('\n'),
+      };
+    }
     return { success: false, output: msg };
   }
 }
@@ -3796,12 +3823,18 @@ async function main() {
           content: [{
             type: 'text',
             text: [
-              'Not logged in to the Ductape CLI.',
+              'The Ductape CLI has no remotely valid authenticated session.',
+              '',
+              'Administrative reads and writes must remain on ductape_cli; do not fall back to ductape_execute.',
               '',
-              'Ask the user for their Ductape email and password, then call:',
-              `  ductape_cli("login --email <email> --password <password>${wsFlag}")`,
+              'Ask the user to re-authenticate in a trusted local terminal:',
+              `  ductape login${wsFlag}`,
+              'or:',
+              `  ductape login --browser google${wsFlag}`,
+              `  ductape login --browser github${wsFlag}`,
               '',
-              'Or the user can run `ductape login` in their terminal and then retry.',
+              'Never ask the user to paste their password, OAuth callback token, or stored CLI credential into the agent.',
+              'After login succeeds, retry the original ductape_cli command.',
             ].join('\n'),
           }],
           isError: true,