@gethmy/mcp 2.22.0 → 2.24.0

package/src/config.ts

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, parse, resolve } from "node:path";
 
 export interface HarmonyConfig {
   apiKey: string | null;
@@ -45,6 +45,38 @@ export function getLocalConfigPath(cwd?: string): string {
   return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
 }
 
+/**
+ * Find the nearest `.harmony-mcp.json` at or above `cwd` (card #893).
+ *
+ * The old behaviour looked in the exact cwd and nowhere else, so a server
+ * started from a package directory or a git worktree never saw the repo's pin
+ * and fell back to the global config **silently** — the active workspace then
+ * had nothing to do with the repo you were in.
+ *
+ * Two directories are deliberately skipped, however deep the walk goes:
+ *
+ * - **the home directory** — a stray file there would capture every session in
+ *   every repo, and `~/.harmony-mcp/config.json` is already the global pin;
+ * - **the filesystem root** — same reasoning, machine-wide.
+ *
+ * Returns `null` when no ancestor carries one.
+ */
+export function findLocalConfigPath(cwd?: string): string | null {
+  const home = resolve(homedir());
+  let dir = resolve(cwd || process.cwd());
+  const { root } = parse(dir);
+
+  for (;;) {
+    if (dir !== home && dir !== root) {
+      const candidate = join(dir, LOCAL_CONFIG_FILENAME);
+      if (existsSync(candidate)) return candidate;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
 function emptyConfig(): HarmonyConfig {
   return {
     apiKey: null,
@@ -107,9 +139,9 @@ export function saveConfig(config: Partial<HarmonyConfig>): void {
 }
 
 export function loadLocalConfig(cwd?: string): LocalConfig | null {
-  const localConfigPath = getLocalConfigPath(cwd);
+  const localConfigPath = findLocalConfigPath(cwd);
 
-  if (!existsSync(localConfigPath)) {
+  if (localConfigPath === null) {
     return null;
   }
 
@@ -129,7 +161,10 @@ export function saveLocalConfig(
   config: Partial<LocalConfig>,
   cwd?: string,
 ): void {
-  const localConfigPath = getLocalConfigPath(cwd);
+  // Write back to the file we READ, not to the cwd: a `set_project_context`
+  // issued from a package directory must update the repo's pin rather than
+  // strand a second config file the repo root never looks at (card #893).
+  const localConfigPath = findLocalConfigPath(cwd) ?? getLocalConfigPath(cwd);
 
   const existingConfig = loadLocalConfig(cwd) || {
     workspaceId: null,
@@ -146,7 +181,9 @@ export function saveLocalConfig(
 }
 
 export function hasLocalConfig(cwd?: string): boolean {
-  return existsSync(getLocalConfigPath(cwd));
+  // Same walk as `loadLocalConfig`, or this reports "no local config" for a
+  // session an ancestor file actually governs.
+  return findLocalConfigPath(cwd) !== null;
 }
 
 /**
@@ -185,48 +222,185 @@ export function setUserEmail(email: string | null): void {
 }
 
 export interface SetContextOptions {
+  /** Force a write to the repo-local `.harmony-mcp.json` (creating it). */
   local?: boolean;
+  /**
+   * Force a write to the global `~/.harmony-mcp/config.json`, even when a local
+   * file exists. Setup uses this to mirror the chosen context into the global
+   * default; without it the mirror would land back in the local file it just
+   * wrote, leaving every server started from another directory with no context.
+   */
+  global?: boolean;
   cwd?: string;
 }
 
-export function setActiveWorkspace(
-  workspaceId: string | null,
+/** The active context is ONE pair. A project always names its workspace. */
+export interface ActiveContext {
+  projectId: string | null;
+  workspaceId: string | null;
+}
+
+/**
+ * Set the active project and workspace together (card #893).
+ *
+ * This is the ONLY way to set an active project, deliberately: the two ids used
+ * to be written by separate functions, so a project could end up active in a
+ * workspace it does not belong to. Every workspace-scoped tool then read the
+ * wrong workspace and said nothing — `harmony_list_playbook` returned 0 while
+ * the project's real workspace held 4.
+ *
+ * Callers always have both values: the `#shortId` resolver returns the card's
+ * project WITH its `workspaceId`, and `harmony_set_project_context` looks the
+ * project up before writing.
+ */
+export function setActiveContext(
+  context: ActiveContext,
   options?: SetContextOptions,
 ): void {
-  if (options?.local) {
-    saveLocalConfig({ workspaceId }, options.cwd);
+  // WRITE WHERE THE READ RESOLVES. `getActiveProjectId` / `getActiveWorkspaceId`
+  // are local-first, so writing to the global config while a local file exists
+  // made the write invisible: `harmony_set_project_context` answered
+  // `success: true` and every later read still returned the local pin. Worse,
+  // a workspace switch then wrote `activeProjectId: null` into the GLOBAL file
+  // off a locally-read comparison, wiping the active project of every *other*
+  // repo that has no local pin.
+  //
+  // `options.local: true` forces a local write (setup creates the file before
+  // it exists) and `options.global: true` forces a global one (setup ALSO
+  // mirrors the choice into the global default, so a server started from
+  // another directory has a context at all). With neither, the presence of a
+  // local file decides.
+  if (options?.global) {
+    saveConfig({
+      activeWorkspaceId: context.workspaceId,
+      activeProjectId: context.projectId,
+    });
+    return;
+  }
+  const localPath = findLocalConfigPath(options?.cwd);
+  if (options?.local || localPath !== null) {
+    saveLocalConfig(
+      { workspaceId: context.workspaceId, projectId: context.projectId },
+      options?.cwd,
+    );
   } else {
-    saveConfig({ activeWorkspaceId: workspaceId });
+    saveConfig({
+      activeWorkspaceId: context.workspaceId,
+      activeProjectId: context.projectId,
+    });
   }
 }
 
-export function setActiveProject(
-  projectId: string | null,
+/**
+ * Switch the active workspace.
+ *
+ * Switching to a DIFFERENT workspace clears the active project, because we
+ * cannot know whether that project lives in the new workspace — and assuming it
+ * does is exactly what produced the mismatch this function exists to prevent.
+ * Clearing fails safe: the next `#shortId` resolve re-establishes the pair.
+ * Re-setting the same workspace is a no-op for the project.
+ */
+export function setActiveWorkspace(
+  workspaceId: string | null,
   options?: SetContextOptions,
 ): void {
-  if (options?.local) {
-    saveLocalConfig({ projectId }, options.cwd);
-  } else {
-    saveConfig({ activeProjectId: projectId });
-  }
+  const currentWorkspaceId = getActiveWorkspaceId(options?.cwd);
+  const keepProject = currentWorkspaceId === workspaceId;
+  setActiveContext(
+    {
+      workspaceId,
+      projectId: keepProject ? getActiveProjectId(options?.cwd) : null,
+    },
+    options,
+  );
 }
 
-export function getActiveWorkspaceId(cwd?: string): string | null {
-  // Local config takes precedence over global
+/**
+ * The active pair, read from ONE source (card #893).
+ *
+ * A local `.harmony-mcp.json` wins **as a whole file**, not field by field. The
+ * two ids used to fall back to the global config independently, which quietly
+ * re-created the very mismatch this card removes: `saveLocalConfig` omits null
+ * values, so writing `projectId: null` locally did not clear the project — it
+ * unmasked the GLOBAL one and paired it with the local workspace. A workspace
+ * switch then produced `{new workspace, unrelated global project}` and
+ * `describeActiveContext` called it consistent, because both halves were
+ * non-null.
+ *
+ * So: local file present ⇒ both ids come from it, and a missing key means
+ * `null`, never "ask the global config". One source, one pair.
+ */
+function readActiveContext(cwd?: string): ActiveContext {
   const localConfig = loadLocalConfig(cwd);
-  if (localConfig?.workspaceId) {
-    return localConfig.workspaceId;
+  if (localConfig) {
+    return {
+      workspaceId: localConfig.workspaceId ?? null,
+      projectId: localConfig.projectId ?? null,
+    };
   }
-  return loadConfig().activeWorkspaceId;
+  const globalConfig = loadConfig();
+  return {
+    workspaceId: globalConfig.activeWorkspaceId,
+    projectId: globalConfig.activeProjectId,
+  };
+}
+
+export function getActiveWorkspaceId(cwd?: string): string | null {
+  return readActiveContext(cwd).workspaceId;
 }
 
 export function getActiveProjectId(cwd?: string): string | null {
-  // Local config takes precedence over global
-  const localConfig = loadLocalConfig(cwd);
-  if (localConfig?.projectId) {
-    return localConfig.projectId;
+  return readActiveContext(cwd).projectId;
+}
+
+/** The active pair plus whether it holds together. See {@link getActiveContext}. */
+export interface ActiveContextReport extends ActiveContext {
+  consistent: boolean;
+  /** Human-readable reason when `consistent` is false; null otherwise. */
+  note: string | null;
+}
+
+/**
+ * Read the active pair and say whether it is coherent (card #893).
+ *
+ * `setActiveContext` keeps the pair whole from now on, but a config written
+ * before this shipped can still carry a project with no workspace. Report that
+ * instead of quietly resolving it — a silently wrong workspace is the failure
+ * mode this whole change exists to end.
+ */
+export function getActiveContext(cwd?: string): ActiveContextReport {
+  return describeActiveContext({
+    projectId: getActiveProjectId(cwd),
+    workspaceId: getActiveWorkspaceId(cwd),
+  });
+}
+
+/**
+ * The consistency rule itself, pure and transport-independent.
+ *
+ * `harmony_get_context` calls this rather than re-deriving the rule inline: the
+ * remote transport holds its pair in memory, not in a config file, so the file
+ * reader above cannot serve it — but both must answer the same question the
+ * same way. One rule, two callers.
+ */
+export function describeActiveContext(
+  context: ActiveContext,
+): ActiveContextReport {
+  const { projectId, workspaceId } = context;
+
+  if (projectId && !workspaceId) {
+    return {
+      projectId,
+      workspaceId,
+      consistent: false,
+      note:
+        `An active project (${projectId}) is set with no active workspace, so ` +
+        "workspace-scoped tools cannot resolve one from it. Re-set it with " +
+        "harmony_set_project_context, or pass workspaceId explicitly.",
+    };
   }
-  return loadConfig().activeProjectId;
+
+  return { projectId, workspaceId, consistent: true, note: null };
 }
 
 export function isConfigured(): boolean {

package/src/remote.ts

@@ -468,7 +468,7 @@ function baseDeps(
   | "getClient"
   | "getActiveProjectId"
   | "getActiveWorkspaceId"
-  | "setActiveProject"
+  | "setActiveContext"
   | "setActiveWorkspace"
 > {
   return {
@@ -523,10 +523,21 @@ function createUserContext(apiKey: string, keyInfo: TokenInfo): UserContext {
     getClient: () => ctx.sweepClient,
     getActiveProjectId: () => ctx.activeProjectId,
     getActiveWorkspaceId: () => ctx.activeWorkspaceId,
-    setActiveProject: (id) => {
-      ctx.activeProjectId = id;
+    setActiveContext: (context) => {
+      // Assign UNCONDITIONALLY, null included. Skipping a null workspace here
+      // would leave the project active inside the PREVIOUS workspace — the
+      // exact mismatch #893 removes — while the tool's reply claims it was
+      // cleared, and `harmony_get_context` calls the pair consistent because
+      // both halves are non-null.
+      ctx.activeProjectId = context.projectId;
+      ctx.activeWorkspaceId = context.workspaceId;
+      // A cleared workspace must NOT stay pinned, or the request-scoped
+      // fallback to the grant's own workspace can never take over again.
+      ctx.workspacePinned = Boolean(context.workspaceId);
     },
     setActiveWorkspace: (id) => {
+      // Switching workspace drops a project we cannot vouch for (#893).
+      if (ctx.activeWorkspaceId !== id) ctx.activeProjectId = null;
       ctx.activeWorkspaceId = id;
       ctx.workspacePinned = true;
     },
@@ -622,11 +633,28 @@ function buildRequestScope(
     getActiveWorkspaceId: () => view.workspaceId,
     // Write through: the snapshot keeps this request consistent, the context
     // carries the selection to the next one.
-    setActiveProject: (id) => {
-      view.projectId = id;
-      ctx.activeProjectId = id;
+    setActiveContext: (context) => {
+      view.projectId = context.projectId;
+      ctx.activeProjectId = context.projectId;
+      // The project's own workspace pins the scope too — carrying the project
+      // without it is what let the two drift apart (#893). A NULL workspace is
+      // written through as well: ignoring it would silently keep the previous
+      // workspace under the new project, which is the mismatch itself, and the
+      // caller has already been told the workspace was cleared.
+      view.workspaceId = context.workspaceId;
+      ctx.activeWorkspaceId = context.workspaceId;
+      // Unpin on a clear, so the next request falls back to the grant's own
+      // workspace instead of being stuck on a null it can never leave.
+      ctx.workspacePinned = Boolean(context.workspaceId);
     },
     setActiveWorkspace: (id) => {
+      // Switching workspace drops a project we cannot vouch for (#893): we
+      // don't know whether it lives in the new one, and assuming it does is
+      // precisely the mismatch this guards against.
+      if (ctx.activeWorkspaceId !== id) {
+        view.projectId = null;
+        ctx.activeProjectId = null;
+      }
       view.workspaceId = id;
       ctx.activeWorkspaceId = id;
       // An explicit choice outranks the token's primary workspace from here on.

package/src/server.ts

@@ -29,6 +29,7 @@ import {
   untrack,
 } from "./auto-session.js";
 import {
+  describeActiveContext,
   getActiveProjectId,
   getActiveWorkspaceId,
   getApiUrl,
@@ -36,7 +37,7 @@ import {
   getUserEmail,
   isConfigured,
   saveConfig,
-  setActiveProject,
+  setActiveContext,
   setActiveWorkspace,
 } from "./config.js";
 import {
@@ -305,7 +306,16 @@ export interface ToolDeps {
   isConfigured: () => boolean;
   getActiveProjectId: () => string | null;
   getActiveWorkspaceId: () => string | null;
-  setActiveProject: (id: string | null) => void;
+  /**
+   * Set the active project and its workspace TOGETHER (card #893). There is no
+   * project-only setter on purpose: writing the two independently is what let a
+   * project go active in a workspace it does not belong to, after which every
+   * workspace-scoped tool read the wrong workspace silently.
+   */
+  setActiveContext: (context: {
+    projectId: string | null;
+    workspaceId: string | null;
+  }) => void;
   setActiveWorkspace: (id: string | null) => void;
   getApiUrl: () => string;
   getMemoryDir: () => string | null;
@@ -1469,11 +1479,17 @@ export const TOOLS = {
     },
   },
   harmony_set_project_context: {
-    description: "Set the active project context for subsequent operations",
+    description:
+      "Set the active project context for subsequent operations. The project's workspace is set with it, so the two can never point at different places; pass workspaceId to skip the lookup.",
     inputSchema: {
       type: "object",
       properties: {
         projectId: { type: "string" },
+        workspaceId: {
+          type: "string",
+          description:
+            "The workspace this project belongs to. Optional — looked up when omitted.",
+        },
       },
       required: ["projectId"],
     },
@@ -1550,6 +1566,12 @@ export const TOOLS = {
           description:
             "Set true only if this session will poll harmony_get_pending_messages at its checkpoints. Enables the live steering composer for the run; leave unset/false if you won't consume steering messages.",
         },
+        driver: {
+          type: "string",
+          enum: ["daemon", "interactive", "script"],
+          description:
+            'Who is calling: the agent daemon, a human-driven interactive session, or an automation script. Names you as the holder if another caller hits a 409 on this card. Defaults to "interactive".',
+        },
       },
       required: ["cardId", "agentIdentifier", "agentName"],
     },
@@ -2358,6 +2380,22 @@ export const TOOLS = {
           description: "The playbook's ordered stage objects.",
           items: { type: "object" },
         },
+        triggerType: {
+          type: "string",
+          enum: ["manual", "auto"],
+          description:
+            "'manual' (default) — the playbook is applied by a person. 'auto' — it claims matching cards itself, and requires autoBind.",
+        },
+        autoBind: {
+          type: "object",
+          description:
+            "Auto-bind rule: {priority?: number, mode?: 'all'|'any', when: [{path, op, value}]}. Conditions are evaluated against the card's labels (lowercased), intent, complexity_score and priority with the gate operators eq/neq/gte/gt/lte/lt/contains/exists; 'contains' on labels is membership. Stored even while triggerType is 'manual', so a rule can be armed later without re-authoring it.",
+        },
+        catalogId: {
+          type: "string",
+          description:
+            "Slug of the built-in template this came from (provenance only; never used to match).",
+        },
       },
       required: ["name"],
     },
@@ -2365,7 +2403,7 @@ export const TOOLS = {
 
   harmony_update_playbook: {
     description:
-      "Update a playbook's name, description, steps/stages, enabled flag, or lifecycle state ('active'|'deprecated').",
+      "Update a playbook's name, description, steps/stages, enabled flag, lifecycle state ('active'|'deprecated'), or its auto-bind rule and arming.",
     inputSchema: {
       type: "object",
       properties: {
@@ -2389,6 +2427,17 @@ export const TOOLS = {
           enum: ["active", "deprecated"],
           description: "Lifecycle state",
         },
+        triggerType: {
+          type: "string",
+          enum: ["manual", "auto"],
+          description:
+            "Arm ('auto') or disarm ('manual') automatic application. Arming requires a rule to be present or supplied in the same call.",
+        },
+        autoBind: {
+          type: "object",
+          description:
+            "Replace the auto-bind rule: {priority?, mode?: 'all'|'any', when: [{path, op, value}]}. Pass null to remove it.",
+        },
       },
       required: ["playbookId"],
     },
@@ -3101,7 +3150,13 @@ async function handleToolCall(
           // wrong-context resolve is visible immediately.
           const established = activeProjectId == null;
           if (established) {
-            deps.setActiveProject(resolved.project.id);
+            // The pair, never the project alone (#893): `resolved.project`
+            // carries its `workspaceId`, and discarding it here is what left
+            // the active workspace pointing somewhere unrelated.
+            deps.setActiveContext({
+              projectId: resolved.project.id,
+              workspaceId: resolved.project.workspaceId,
+            });
           }
           return {
             success: true,
@@ -3784,16 +3839,97 @@ async function handleToolCall(
 
     case "harmony_set_project_context": {
       const projectId = z.string().uuid().parse(args.projectId);
-      deps.setActiveProject(projectId);
-      return { success: true, activeProjectId: projectId };
+
+      // Find the project's OWN workspace rather than keeping whichever one
+      // happened to be active (#893). The two ids are one pair; setting half of
+      // it is how a project ended up active in a foreign workspace, after which
+      // every workspace-scoped tool read the wrong one and said nothing.
+      //
+      // An explicit `workspaceId` skips the lookup. Otherwise we search the
+      // reachable workspaces, and REFUSE the whole call if that search cannot
+      // name one — we never write half a pair.
+      //
+      // Refusing beats the two alternatives. Keeping the previous workspace is
+      // the mismatch itself. Setting the project with a NULL workspace looks
+      // safe but is not: on the remote transport an unpinned workspace falls
+      // back to the grant's own, so the project would end up active inside it
+      // anyway, and on stdio the write lands in a config file that outlives the
+      // session. A project this connection cannot place is useless as context.
+      const explicitWorkspaceId = args.workspaceId
+        ? z.string().uuid().parse(args.workspaceId)
+        : null;
+
+      let owningWorkspaceId: string | null = explicitWorkspaceId;
+
+      if (!owningWorkspaceId) {
+        try {
+          const { workspaces } = await client.listWorkspaces();
+          for (const workspace of workspaces as { id?: string }[]) {
+            if (!workspace?.id) continue;
+            const { projects } = await client.listProjects(workspace.id);
+            if (
+              (projects as { id?: string }[]).some((p) => p?.id === projectId)
+            ) {
+              owningWorkspaceId = workspace.id;
+              break;
+            }
+          }
+        } catch (error) {
+          // A timeout or a 500 says nothing about where the project lives.
+          // Leave the pair untouched and say so.
+          const reason = error instanceof Error ? error.message : String(error);
+          return {
+            success: false,
+            activeProjectId: deps.getActiveProjectId(),
+            activeWorkspaceId: deps.getActiveWorkspaceId(),
+            note:
+              `Could not resolve this project's workspace (${reason}), so the ` +
+              `active context was left unchanged rather than half-written. ` +
+              `Retry, or pass workspaceId explicitly to skip the lookup.`,
+          };
+        }
+
+        if (!owningWorkspaceId) {
+          // Definitive: the listing succeeded and no reachable workspace holds
+          // this project. Setting it would produce a context whose every
+          // workspace-scoped call is wrong.
+          return {
+            success: false,
+            activeProjectId: deps.getActiveProjectId(),
+            activeWorkspaceId: deps.getActiveWorkspaceId(),
+            note:
+              `Project ${projectId} is not in any workspace this connection ` +
+              `can reach, so the active context was left unchanged. Check ` +
+              `harmony_list_projects, pass workspaceId explicitly, or ` +
+              `reconnect with /mcp if it lives in another workspace.`,
+          };
+        }
+      }
+
+      deps.setActiveContext({ projectId, workspaceId: owningWorkspaceId });
+      return {
+        success: true,
+        activeProjectId: projectId,
+        activeWorkspaceId: owningWorkspaceId,
+      };
     }
 
     case "harmony_get_context": {
+      // The rule lives in `describeActiveContext` and is called, not re-derived:
+      // a second copy of an invariant is how the two halves drifted apart in
+      // the first place. A project with no workspace still arrives from a
+      // config written before #893.
+      const report = describeActiveContext({
+        projectId: deps.getActiveProjectId(),
+        workspaceId: deps.getActiveWorkspaceId(),
+      });
       return {
         success: true,
         context: {
-          activeWorkspaceId: deps.getActiveWorkspaceId(),
-          activeProjectId: deps.getActiveProjectId(),
+          activeWorkspaceId: report.workspaceId,
+          activeProjectId: report.projectId,
+          consistent: report.consistent,
+          ...(report.note ? { note: report.note } : {}),
         },
       };
     }
@@ -3920,6 +4056,11 @@ async function handleToolCall(
           args.steerable === true || args.steerable === "true"
             ? true
             : undefined,
+        // Every MCP caller is interactive unless it says otherwise — this is
+        // the human-driven `/hmy` surface, not the daemon or the e2e script.
+        driver:
+          (args.driver as "daemon" | "interactive" | "script" | undefined) ??
+          "interactive",
       });
 
       // Mark as explicit so auto-session won't interfere
@@ -5222,6 +5363,12 @@ async function handleToolCall(
         name,
         description: args.description as string | undefined,
         steps: args.steps,
+        // Auto-bind fields ride through untouched (#892) — the edge function
+        // owns validation, so the rule cannot be shaped here and rejected
+        // there, or vice versa.
+        triggerType: args.triggerType as string | undefined,
+        autoBind: args.autoBind,
+        catalogId: args.catalogId as string | undefined,
       });
       return { success: true, playbook: result.playbook };
     }
@@ -5234,6 +5381,10 @@ async function handleToolCall(
         steps: args.steps,
         enabled: args.enabled as boolean | undefined,
         state: args.state as string | undefined,
+        // Arming and the rule (#892). `autoBind: null` clears the rule, so the
+        // key is forwarded whenever present rather than only when truthy.
+        triggerType: args.triggerType as string | undefined,
+        ...("autoBind" in args ? { autoBind: args.autoBind } : {}),
       });
       return { success: true, playbook: result.playbook };
     }
@@ -5327,8 +5478,10 @@ async function handleToolCall(
 
       // Save config and reset client
       deps.saveConfig({ apiKey: result.apiKey.rawKey });
-      deps.setActiveWorkspace(result.workspace.id);
-      deps.setActiveProject(result.project.id);
+      deps.setActiveContext({
+        projectId: result.project.id,
+        workspaceId: result.workspace.id,
+      });
       deps.resetClient();
 
       return {
@@ -5354,7 +5507,7 @@ function createConfigDeps(): ToolDeps {
     isConfigured,
     getActiveProjectId: () => getActiveProjectId(),
     getActiveWorkspaceId: () => getActiveWorkspaceId(),
-    setActiveProject: (id) => setActiveProject(id),
+    setActiveContext: (context) => setActiveContext(context),
     setActiveWorkspace: (id) => setActiveWorkspace(id),
     getApiUrl,
     getMemoryDir: () => getMemoryDir(),