@ductape/mcp 0.2.36 → 0.2.37

package/dist/index.js

@@ -527,6 +527,9 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
     ductape_cli("apps actions list --app <app_tag> --json")
     ductape_cli("apps actions get --app <app_tag> --action <action_tag> --json")
     ductape_cli("apps actions delete --app <app_tag> --action <action_tag>")
+  Reuse the same canonical full action asset for create and update. An unchanged top-level tag is
+  accepted and stripped locally before the immutable action is patched; never create a second
+  partial-update file. A tag that differs from --action is rejected before any mutation.
   NOTE: the flag is --action-file, NOT -f/--file — that flag belongs to the parent "apps" command
   (used by "apps create"/"apps update"), and Commander resolves a flag shared by an ancestor and a
   descendant against the ancestor, so -f here would silently never reach this subcommand. Verified
@@ -1445,6 +1448,7 @@ const ADMIN_SUBCOMMANDS = [
     'workspaces',
     'link', 'unlink', 'init',
     'products', 'apps', 'marketplace',
+    'features',
     'resources',
     'notifications',
     'events',
@@ -3124,6 +3128,21 @@ CONNECTION FILE — REQUIRED SHAPE:
   auth and credentials absent when the environment does not require authentication. Never create a
   fake auth_tag merely to store a header.
 
+  OAUTH/TOKEN ACCESS: OAuth grants and shared tokens belong to the product App connection, not to
+  Feature input and not to repeated api.oauth() calls in application code. Inspect the App auth
+  scheme; when it uses oauth2, token_access, credential_access, or fetch_credential_access, direct
+  the user through the provider-consent/login flow in Workbench and preserve the resulting encrypted
+  connection auth for every mapped product environment. Agents must never request, print, or write
+  access/refresh tokens into the repository. Application code initializes Ductape with product+env,
+  awaits ready(), and calls the action; runtime auth injection and token refresh are platform-managed.
+  api.oauth() remains only an explicit process-local override for a connection the user deliberately
+  has not persisted.
+
+  SHARED CONFIG: derive candidate keys from the selected App version's action schemas across headers,
+  query, params, and body. Deduplicate by <location>:<key>, prefer fields reused by several actions,
+  and present the exact candidates to the user. Never ask the user to invent or type a key name that
+  is already declared by an action. Only the value/$Secret reference is user-supplied.
+
   Before writing this file, inspect the exact App version/auth/action schemas. auth.data must have
   headers/query/params/body objects and must match the selected auth schema. Never guess an auth_tag,
   variable key, input location, or required field. Store credentials with secrets.create first and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",