@ezmodo/mcp-server 0.13.4 → 0.14.0

package/lib/git-helpers.js

@@ -3,26 +3,60 @@
  * Utility functions for git operations used by worktree tools
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 /**
- * Execute git command with proper error handling
- * @param {string} command - Git command to execute
+ * Run git with an ARGUMENT ARRAY — never a command string, and never a shell.
+ *
+ * This used to be `execSync(command)`, with callers building the command by
+ * interpolating branch names and paths into a template. #2614 stopped the
+ * remote transport from reaching any of it, which removed the internet-facing
+ * blast radius; this closes the hole itself, so the same mistake cannot be made
+ * again by a future caller who is not thinking about shells.
+ *
+ * execFileSync spawns git directly, so the arguments are passed as-is: a value
+ * containing `;`, a backtick or a quote is a literal branch name that git will
+ * simply not find, rather than a second command. Nothing in this file quotes
+ * anything any more, because there is no shell left to quote for.
+ *
+ * @param {string[]} args - Arguments to git, one element per argument
  * @param {string} cwd - Working directory
- * @returns {string} Command output
+ * @returns {string} Command output, trimmed
  */
-export function execGit(command, cwd) {
+export function execGit(args, cwd) {
+  if (!Array.isArray(args)) {
+    throw new TypeError('execGit takes an argument array, not a command string');
+  }
   try {
-    return execSync(command, {
+    return execFileSync('git', args, {
       cwd,
       encoding: 'utf-8',
       stdio: 'pipe',
     }).trim();
   } catch (error) {
-    throw new Error(`Git command failed: ${command}\n${error.message}`);
+    throw new Error(`Git command failed: git ${args.join(' ')}\n${error.message}`);
   }
 }
 
+/**
+ * Reject a value that git would read as an OPTION rather than as a name.
+ *
+ * The residual risk after dropping the shell is not injection, it is option
+ * injection: `--exec=...` in a branch-name position is still one argument, and
+ * git still honours it. Callers pass user-supplied refs and paths, so the
+ * values that land in those positions are checked here.
+ *
+ * @param {string} value - The candidate branch name, ref or path
+ * @param {string} label - What it is, for the error message
+ * @returns {string} The value, unchanged
+ */
+function assertNotOption(value, label) {
+  if (typeof value !== 'string' || value.startsWith('-')) {
+    throw new Error(`Invalid ${label}: ${value}`);
+  }
+  return value;
+}
+
 /**
  * Check if directory is a git repository
  * @param {string} dir - Directory path
@@ -30,11 +64,7 @@ export function execGit(command, cwd) {
  */
 export function isGitRepository(dir) {
   try {
-    execSync('git rev-parse --git-dir', {
-      cwd: dir,
-      encoding: 'utf-8',
-      stdio: 'pipe',
-    });
+    execGit(['rev-parse', '--git-dir'], dir);
     return true;
   } catch {
     return false;
@@ -48,11 +78,7 @@ export function isGitRepository(dir) {
  */
 export function getRepositoryRoot(dir) {
   try {
-    return execSync('git rev-parse --show-toplevel', {
-      cwd: dir,
-      encoding: 'utf-8',
-      stdio: 'pipe',
-    }).trim();
+    return execGit(['rev-parse', '--show-toplevel'], dir);
   } catch {
     return null;
   }
@@ -65,7 +91,7 @@ export function getRepositoryRoot(dir) {
  */
 export function getRemoteUrl(repoPath) {
   try {
-    return execGit('git config --get remote.origin.url', repoPath);
+    return execGit(['config', '--get', 'remote.origin.url'], repoPath);
   } catch {
     return null;
   }
@@ -78,7 +104,7 @@ export function getRemoteUrl(repoPath) {
  */
 export function getCurrentBranch(repoPath) {
   try {
-    return execGit('git branch --show-current', repoPath);
+    return execGit(['branch', '--show-current'], repoPath);
   } catch {
     return null;
   }
@@ -93,15 +119,17 @@ export function getCurrentBranch(repoPath) {
 export function branchExists(repoPath, branchName) {
   const result = { local: false, remote: false };
 
+  assertNotOption(branchName, 'branch name');
+
   try {
-    execGit(`git show-ref --verify refs/heads/${branchName}`, repoPath);
+    execGit(['show-ref', '--verify', `refs/heads/${branchName}`], repoPath);
     result.local = true;
   } catch {
     // Branch doesn't exist locally
   }
 
   try {
-    execGit(`git show-ref --verify refs/remotes/origin/${branchName}`, repoPath);
+    execGit(['show-ref', '--verify', `refs/remotes/origin/${branchName}`], repoPath);
     result.remote = true;
   } catch {
     // Branch doesn't exist remotely
@@ -118,18 +146,21 @@ export function branchExists(repoPath, branchName) {
  * @returns {string} Commit hash
  */
 export function createBranch(repoPath, branchName, baseBranch) {
+  assertNotOption(branchName, 'branch name');
+  assertNotOption(baseBranch, 'base branch');
+
   // Ensure base branch is up to date
   try {
-    execGit(`git fetch origin ${baseBranch}`, repoPath);
+    execGit(['fetch', 'origin', baseBranch], repoPath);
   } catch {
     // Fetch might fail if no remote, that's ok
   }
 
   // Create branch
-  execGit(`git branch ${branchName} ${baseBranch}`, repoPath);
+  execGit(['branch', branchName, baseBranch], repoPath);
 
   // Get commit hash
-  return execGit(`git rev-parse ${branchName}`, repoPath);
+  return execGit(['rev-parse', branchName], repoPath);
 }
 
 /**
@@ -141,8 +172,23 @@ export function createBranch(repoPath, branchName, baseBranch) {
  * @returns {void}
  */
 export function createWorktree(repoPath, worktreePath, branchName, createBranch = false) {
-  const branchFlag = createBranch ? '-b' : '';
-  execGit(`git worktree add ${branchFlag} "${worktreePath}" ${branchName}`, repoPath);
+  assertNotOption(worktreePath, 'worktree path');
+  assertNotOption(branchName, 'branch name');
+
+  // `git worktree add -b <new-branch> <path>` — the branch name comes FIRST
+  // after -b. The string-building version had it the other way round
+  // (`add -b "<path>" <branch>`), so git read the path as the branch name and
+  // refused it. Nothing caught that because every caller in worktree-tools.js
+  // passes createBranch = false, having created the branch already; this path
+  // has never worked. Corrected here rather than left as a trap, since the
+  // whole point of moving to an argument array is that the arguments are now
+  // legible.
+  execGit(
+    createBranch
+      ? ['worktree', 'add', '-b', branchName, worktreePath]
+      : ['worktree', 'add', worktreePath, branchName],
+    repoPath
+  );
 }
 
 /**
@@ -152,7 +198,7 @@ export function createWorktree(repoPath, worktreePath, branchName, createBranch
  */
 export function listWorktrees(repoPath) {
   try {
-    const output = execGit('git worktree list --porcelain', repoPath);
+    const output = execGit(['worktree', 'list', '--porcelain'], repoPath);
     const worktrees = [];
     const lines = output.split('\n');
 
@@ -190,8 +236,9 @@ export function listWorktrees(repoPath) {
  * @returns {void}
  */
 export function removeWorktree(repoPath, worktreePath, force = false) {
-  const forceFlag = force ? '--force' : '';
-  execGit(`git worktree remove ${forceFlag} "${worktreePath}"`, repoPath);
+  assertNotOption(worktreePath, 'worktree path');
+
+  execGit(['worktree', 'remove', ...(force ? ['--force'] : []), worktreePath], repoPath);
 }
 
 /**
@@ -209,7 +256,7 @@ export function getWorktreeStatus(worktreePath) {
   };
 
   try {
-    const output = execGit('git status --porcelain', worktreePath);
+    const output = execGit(['status', '--porcelain'], worktreePath);
 
     if (output) {
       status.isDirty = true;
@@ -248,19 +295,22 @@ export function getAheadBehindCounts(worktreePath, localBranch, remoteBranch) {
   const counts = { ahead: 0, behind: 0 };
 
   try {
+    assertNotOption(localBranch, 'local branch');
+    assertNotOption(remoteBranch, 'remote branch');
+
     // Fetch latest
-    execGit('git fetch origin', worktreePath);
+    execGit(['fetch', 'origin'], worktreePath);
 
     // Get ahead count
     const aheadOutput = execGit(
-      `git rev-list --count ${remoteBranch}..${localBranch}`,
+      ['rev-list', '--count', `${remoteBranch}..${localBranch}`],
       worktreePath
     );
     counts.ahead = parseInt(aheadOutput, 10) || 0;
 
     // Get behind count
     const behindOutput = execGit(
-      `git rev-list --count ${localBranch}..${remoteBranch}`,
+      ['rev-list', '--count', `${localBranch}..${remoteBranch}`],
       worktreePath
     );
     counts.behind = parseInt(behindOutput, 10) || 0;
@@ -280,7 +330,7 @@ export function checkForConflicts(worktreePath) {
   const result = { hasConflicts: false, files: [] };
 
   try {
-    const output = execGit('git status --porcelain', worktreePath);
+    const output = execGit(['status', '--porcelain'], worktreePath);
     const lines = output.split('\n').filter(l => l);
 
     for (const line of lines) {
@@ -310,8 +360,9 @@ export function checkForConflicts(worktreePath) {
  * @returns {void}
  */
 export function deleteBranch(repoPath, branchName, force = false) {
-  const flag = force ? '-D' : '-d';
-  execGit(`git branch ${flag} ${branchName}`, repoPath);
+  assertNotOption(branchName, 'branch name');
+
+  execGit(['branch', force ? '-D' : '-d', branchName], repoPath);
 }
 
 /**
@@ -323,7 +374,9 @@ export function deleteBranch(repoPath, branchName, force = false) {
  */
 export function isBranchMerged(repoPath, branchName, baseBranch) {
   try {
-    const output = execGit(`git branch --merged ${baseBranch}`, repoPath);
+    assertNotOption(baseBranch, 'base branch');
+
+    const output = execGit(['branch', '--merged', baseBranch], repoPath);
     return output.includes(branchName);
   } catch {
     return false;
@@ -338,10 +391,12 @@ export function isBranchMerged(repoPath, branchName, baseBranch) {
  */
 export function getLastCommit(repoPath, branchName) {
   try {
-    const hash = execGit(`git rev-parse ${branchName}`, repoPath);
-    const author = execGit(`git log -1 --format=%an ${branchName}`, repoPath);
-    const timestamp = execGit(`git log -1 --format=%ct ${branchName}`, repoPath);
-    const message = execGit(`git log -1 --format=%s ${branchName}`, repoPath);
+    assertNotOption(branchName, 'branch name');
+
+    const hash = execGit(['rev-parse', branchName], repoPath);
+    const author = execGit(['log', '-1', '--format=%an', branchName], repoPath);
+    const timestamp = execGit(['log', '-1', '--format=%ct', branchName], repoPath);
+    const message = execGit(['log', '-1', '--format=%s', branchName], repoPath);
 
     return {
       hash,
@@ -397,7 +452,10 @@ export function generateBranchName(task, defaultPrefix = 'feature') {
  */
 export function getMergeBase(repoPath, branch1, branch2) {
   try {
-    return execGit(`git merge-base ${branch1} ${branch2}`, repoPath);
+    assertNotOption(branch1, 'branch');
+    assertNotOption(branch2, 'branch');
+
+    return execGit(['merge-base', branch1, branch2], repoPath);
   } catch {
     return null;
   }
@@ -411,16 +469,16 @@ export function getMergeBase(repoPath, branch1, branch2) {
 export function getDefaultBranch(repoPath) {
   // Try to get from remote HEAD
   try {
-    const ref = execGit('git symbolic-ref refs/remotes/origin/HEAD', repoPath);
+    const ref = execGit(['symbolic-ref', 'refs/remotes/origin/HEAD'], repoPath);
     return ref.replace('refs/remotes/origin/', '');
   } catch {
     // Fall back to checking if main or master exists
     try {
-      execGit('git show-ref --verify refs/heads/main', repoPath);
+      execGit(['show-ref', '--verify', 'refs/heads/main'], repoPath);
       return 'main';
     } catch {
       try {
-        execGit('git show-ref --verify refs/heads/master', repoPath);
+        execGit(['show-ref', '--verify', 'refs/heads/master'], repoPath);
         return 'master';
       } catch {
         return 'main'; // Default fallback
@@ -439,13 +497,17 @@ export function getDefaultBranch(repoPath) {
 export function getCommitsSince(repoPath, sinceCommit, branchName) {
   try {
     // Format: hash|short|author|email|timestamp|subject
+    assertNotOption(branchName, 'branch name');
+    if (sinceCommit) {
+      assertNotOption(sinceCommit, 'commit');
+    }
+
+    // No quotes around the format: there is no shell to strip them, so a
+    // quoted format string would reach git verbatim and appear in the output.
     const format = '%H|%h|%an|%ae|%ct|%s';
     const range = sinceCommit ? `${sinceCommit}..${branchName}` : branchName;
 
-    const output = execGit(
-      `git log --format="${format}" ${range}`,
-      repoPath
-    );
+    const output = execGit(['log', `--format=${format}`, range], repoPath);
 
     if (!output) {
       return [];
@@ -469,8 +531,9 @@ export function getCommitsSince(repoPath, sinceCommit, branchName) {
 }
 
 /**
- * A commit SHA, and nothing else. The value reaches execGit inside a shell
- * string, so anything that is not hex never gets there.
+ * A commit SHA, and nothing else. Kept after execGit stopped using a shell
+ * (#2614 step 5): it is still the cheapest way to tell a real hash from a ref
+ * that would make diff-tree mean something other than "this commit".
  */
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 
@@ -497,7 +560,7 @@ export function getCommitFiles(repoPath, sha) {
   }
   try {
     const output = execGit(
-      `git diff-tree --no-commit-id --name-only -r ${sha}`,
+      ['diff-tree', '--no-commit-id', '--name-only', '-r', sha],
       repoPath
     );
     return output ? output.split('\n').map(line => line.trim()).filter(Boolean) : [];

package/lib/http-client.js

@@ -10,11 +10,13 @@ import { CONFIG } from '../config/index.js';
 import { MCP_VERSION } from './version.js';
 import { getLogger } from './logger.js';
 import { getApiUrl } from './env.js';
-// Not getApiKey() directly: over HTTP one process serves many callers, so the
-// credential belongs to the request in flight rather than the process (#2599).
-// Over stdio there is no request context and this resolves to the environment,
-// exactly as before.
-import { resolveApiKey } from './request-context.js';
+// Not getApiKey() directly. Two reasons, both about the credential belonging to
+// the CALL rather than the process: over HTTP one process serves many callers,
+// each with their own key (#2599); and over stdio the credential may be an
+// OAuth token this server obtained for itself, which can need refreshing before
+// use (#2631). lib/credentials.js owns the precedence between them.
+import { resolveCredential } from './credentials.js';
+import { NOT_AUTHENTICATED } from './auth-guidance.js';
 
 // API base URL is resolved per-request (see callZephlyAPI): getApiUrl() honors
 // the EZMODO_API_URL / ZEPHLY_API_URL override; CONFIG.apiUrl is the build-time
@@ -82,8 +84,19 @@ export async function callZephlyAPI(endpoint, data) {
   let url = `${apiUrl}/${route}`;
   let body = null;
 
+  // Resolved per call, and awaited: an expired OAuth token refreshes here.
+  const credential = await resolveCredential();
+  if (!credential) {
+    // Coded, not just worded: lib/create-server.js turns this into sign-in
+    // guidance for the agent, and matching on a message would break the first
+    // time someone reworded it.
+    const error = new Error('Not authenticated with EzModo.');
+    error.code = NOT_AUTHENTICATED;
+    throw error;
+  }
+
   const headers = {
-    'Authorization': `Bearer ${resolveApiKey()}`,
+    'Authorization': `Bearer ${credential.token}`,
     'Content-Type': 'application/json',
     'User-Agent': `ezmodo-mcp-server/${MCP_VERSION}`,
     'X-MCP-API-Version': 'v1',

package/lib/instructions.generated.js

@@ -0,0 +1,14 @@
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ *
+ * Extracted from plugins/ezmodo/skills/work-tracking/SKILL.md by
+ * scripts/build-instructions.mjs. Edit the SKILL, then run:
+ *
+ *   npm run generate:instructions --workspace=@ezmodo/mcp-server
+ *
+ * __tests__/instructions.test.js fails if this drifts from the skill.
+ */
+
+export const WORK_TRACKING_CORE = 'Work in this repository is tracked in EzModo, and the tools for it are on this\nMCP server. The contract, in short:\n\n1. **Create the task before you edit, not after.** A task written afterwards is\n   a changelog; a task written first is what the next session reads to find out\n   what you were doing and why.\n2. **Start the session by calling `get_current_project_context()`.** Cache the\n   `projectId`. It also returns the components, tags and `terminology` you need.\n   No `.ezmodo/config.json` means this repo is not tracked — say so rather than\n   guessing at a project.\n3. **Call `get_context` with a keyword query before creating anything.** Use\n   what comes back to write a task that names real files, endpoints and\n   patterns. A vague task is not worth the call that made it.\n4. **Name every component the work touches** via `componentIds`. A task spanning\n   web and api belongs to both. The list REPLACES the previous set on update.\n5. **Set `taskType`** — `feature` | `bug` | `testing` | `chore`. Not cosmetic:\n   `bug` feeds open-bug counts, milestone freezes gate on it, and estimation\n   weights past tasks of the same kind.\n6. **Toggle steps as you finish them**, not in a batch at the end\n   (`manage_task action:"update" toggleSteps:[...]`).\n7. **Capture knowledge the moment it happens**, not in a summary at the end:\n   `addKnowledge` with `fact` for a root cause, `decision` for a choice —\n   including what you rejected and why — `reference` for a key file or pattern,\n   `context` for progress. Be specific: file paths, function names, exact\n   errors. "Fixed a bug in the parser" helps nobody.\n8. **Already three edits in with no task?** Call `report_untracked_work` the\n   moment you notice, rather than continuing untracked.\n9. **Resuming?** `get_task` first, and read ALL of its knowledge items. That is\n   where the previous session\'s reasoning went — do not re-derive it.\n10. **Finish at `in_review`** with `completionNotes`, and do NOT call\n    `action:"complete"`. A human completes a task after verifying it.\n11. **Report what actually happened.** A task moved to `in_review` claiming work\n    that was not done is worse than no task, because the next session trusts it.\n\nRespect the project\'s `terminology`: a project can rename epics, tasks and\ncomponents, and a marketing project calls an epic a "Campaign". Write anything a\nhuman reads in those words; keep API field names (`epicId`, `taskId`) as they\nare.';
+
+export const WORK_TRACKING_LOCAL = 'Running against a local checkout, two more:\n\n12. **Link every commit**: `manage_task action:"link_commit"` with the full\n    40-character `sha` from `git rev-parse HEAD`. A short SHA is rejected, and\n    padding one is not a fix. Linking is also what derives component links from\n    the commit\'s files — do not link those by hand.\n13. **Pass `changedFiles`** when creating or updating a task, so the work\n    resolves to the components that own those paths.';

package/lib/instructions.js

@@ -0,0 +1,37 @@
+/**
+ * The MCP `instructions` string — what the server tells every client about how
+ * to work with it (#2633).
+ *
+ * WHY THIS MATTERS OUT OF PROPORTION TO ITS SIZE. The tools were always the
+ * easy half. What makes an agent actually TRACK work — create a task before you
+ * edit, tick steps off, capture knowledge, link the commit, finish at
+ * in_review — shipped only as Claude Code skills in plugins/ezmodo/skills/.
+ * Cursor, Codex, Zed and every other stdio MCP client got the tools and none of
+ * the discipline. The initialize result carries an instructions string that
+ * clients inject into system context, so this reaches all of them with no
+ * plugin, no per-editor packaging, and no install step.
+ *
+ * WHY IT IS SHORT. A skill is loaded on demand and can afford several hundred
+ * lines. Instructions are paid for on every session, so this is the irreducible
+ * core and nothing else. The full contract stays in the skill, and the two are
+ * the same words — see scripts/build-instructions.mjs for how, and why they are
+ * not two hand-maintained copies.
+ *
+ * WHY IT VARIES BY SURFACE. The remote connector serves no local-machine tools,
+ * so telling an agent there to link commits and pass changed files is advice it
+ * cannot follow — worse than silence, because an agent that tries will report a
+ * failure the user cannot act on. The local block is appended only for stdio,
+ * on the same `surface` parameter that filters the tool list.
+ */
+
+import { WORK_TRACKING_CORE, WORK_TRACKING_LOCAL } from './instructions.generated.js';
+
+/**
+ * @param {'local'|'remote'} [surface]
+ * @returns {string}
+ */
+export function getInstructions(surface = 'local') {
+  return surface === 'remote'
+    ? WORK_TRACKING_CORE
+    : `${WORK_TRACKING_CORE}\n\n${WORK_TRACKING_LOCAL}`;
+}

package/lib/oauth-config.js

@@ -0,0 +1,98 @@
+/**
+ * Keycloak OIDC configuration for the local (stdio) MCP server.
+ *
+ * WHY THE SERVER LOGS IN AT ALL. Installing used to be two steps, and the
+ * second one is the cumbersome one: install the server, then leave the agent,
+ * open the web UI, mint an API key, paste it into a shell profile, restart.
+ * That step is identical for Cursor, Codex, Zed or anything else speaking
+ * stdio MCP, and it is what makes people reach for the CLI. The server signs
+ * itself in instead, so installing IS the whole install (E-252 #2631).
+ *
+ * WHY `ezmodo-mcp` AND NOT `ezmodo-cli`. Both are public PKCE clients in the
+ * `ezmodo` realm and either would authenticate, since the API skips the
+ * audience check (KEYCLOAK_CLIENT_ID is deliberately empty in
+ * infra/cloud-run-api-ezmodo.tf). Three things decide it:
+ *
+ *   1. Redirect URIs. `ezmodo-cli` registers ONE fixed loopback,
+ *      http://localhost:19838/callback. A fixed port fails when it is already
+ *      taken — including by an `ezmodo auth login` running in another terminal,
+ *      which is exactly when a user is most likely to be signing in.
+ *      `ezmodo-mcp` registers http://localhost/* and http://127.0.0.1/*, which
+ *      matches ANY ephemeral port: Keycloak's RedirectUtils, on a failed match
+ *      for an http URI whose host is a loopback interface, rebuilds it with
+ *      port 80 and re-matches.
+ *   2. Consent. `ezmodo-mcp` sets consent_required. The whole argument for
+ *      preferring OAuth over a pasted key is that the user SEES what they are
+ *      granting; a client that skips the consent screen throws that away.
+ *   3. It is what this is. `ezmodo-mcp` is the MCP client, and the scopes a
+ *      human reads on the consent screen are attached to it.
+ *
+ * The client id is baked in, not pasted. That is why Keycloak's refusal of
+ * anonymous Dynamic Client Registration — the thing that makes a claude.ai
+ * connector user paste `ezmodo-mcp` by hand — does not touch a local install
+ * at all.
+ */
+
+import { CONFIG } from '../config/index.js';
+
+/**
+ * Keycloak per environment. Mirrors cli/src/lib/config.ts KEYCLOAK_CONFIG; the
+ * realm is `ezmodo` everywhere, including local, so a client that works on a
+ * laptop works in production.
+ */
+const KEYCLOAK = {
+  production: { url: 'https://auth.ezmodo.com', realm: 'ezmodo' },
+  staging: { url: 'https://auth.staging.ezmodo.com', realm: 'ezmodo' },
+  development: { url: 'http://localhost:7373', realm: 'ezmodo' },
+};
+
+/** The public PKCE client this server authenticates as. */
+export const OAUTH_CLIENT_ID = 'ezmodo-mcp';
+
+/**
+ * What we ask consent for, and deliberately NOT everything on offer.
+ *
+ * `ezmodo:delete` is a registered optional scope and is left out by default.
+ * Keycloak's consent screen is accept-or-decline over the whole requested set,
+ * so asking for it would make "permanently delete your tasks, documents, goals
+ * and projects" a condition of installing an MCP server — which is not a
+ * decision to bundle into a setup step someone is clicking through. The MCP
+ * tool surface is overwhelmingly create/update anyway; almost nothing here
+ * deletes.
+ *
+ * `offline_access` is what makes the refresh token outlive the short access
+ * token, i.e. what stops this asking for a browser every few minutes.
+ *
+ * Override with EZMODO_OAUTH_SCOPES (space-separated) to widen or narrow it —
+ * that is the escape hatch for someone who genuinely wants delete, without
+ * making it everyone's default.
+ */
+export const DEFAULT_SCOPES = 'openid email profile offline_access ezmodo:read ezmodo:write';
+
+/** The scopes to request, honouring the override. */
+export function getScopes() {
+  const override = process.env.EZMODO_OAUTH_SCOPES;
+  return override && override.trim() ? override.trim() : DEFAULT_SCOPES;
+}
+
+/**
+ * Keycloak endpoints for the environment this build targets.
+ *
+ * Falls back to production for an unrecognised environment for the same reason
+ * config/index.js defaults BUILD_ENV to production: the only caller that
+ * arrives here with nothing set is an installed copy on a real user's machine,
+ * and pointing that at localhost fails with an error saying nothing about why.
+ */
+export function getKeycloakEndpoints() {
+  const env = KEYCLOAK[CONFIG.environment] ? CONFIG.environment : 'production';
+  const { url, realm } = KEYCLOAK[env];
+  const base = `${url}/realms/${realm}/protocol/openid-connect`;
+  return {
+    environment: env,
+    issuer: `${url}/realms/${realm}`,
+    authorization: `${base}/auth`,
+    token: `${base}/token`,
+    logout: `${base}/logout`,
+    clientId: OAUTH_CLIENT_ID,
+  };
+}