@gethmy/mcp 3.5.0 → 3.7.0

package/src/config.ts

@@ -22,7 +22,7 @@ export interface HarmonyConfig {
 }
 
 /**
- * Local project-level config (stored in .harmony-mcp.json in project root).
+ * Local project-level config (stored in .hmy.json in project root).
  * Only contains context IDs - API key stays global for security.
  */
 export interface LocalConfig {
@@ -31,22 +31,131 @@ export interface LocalConfig {
 }
 
 const DEFAULT_API_URL = "https://app.gethmy.com/api";
-const LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
 
+/**
+ * The config surface was renamed to `hmy` in card #1082 — `.harmony-mcp.json`
+ * became `.hmy.json`, and the home directory `~/.harmony-mcp/` became
+ * `~/.hmy/agent/`.
+ *
+ * `~/.hmy` already existed and belongs to the skill auto-update layer
+ * (`config.yaml`, `VERSION`, `bin/`, see `hmy-config.ts`), so the daemon's own
+ * state took the `agent/` subdirectory rather than landing a second file named
+ * `config.*` — in a different format, with a different owner — beside it.
+ *
+ * **Writes always go to the new name; reads fall back to the old one.**
+ * `@gethmy/mcp` and `@gethmy/agent` are published and the daemon runs from a
+ * frozen npx cache, so a hard cut would leave a running daemon unable to find
+ * its config until a coordinated release. `migrateConfigDir` (harmony-agent)
+ * moves the data once, at daemon startup, which makes the fallback moot in
+ * practice — it stays only for a client that never runs the daemon.
+ *
+ * The legacy spellings are exported because two things still need them after
+ * the fallback is removed: the migration, and the harness read-denylists. The
+ * old directory keeps holding an API key and 3430 run logs until an operator
+ * deletes it, so denying only the new name would OPEN it. See
+ * `credentialDirectories()` in harmony-harness and `HARNESS_CREDENTIAL_LEAVES`
+ * in `@harmony/shared`'s `runRedaction.ts`; both name old and new.
+ */
+const LOCAL_CONFIG_FILENAME = ".hmy.json";
+export const LEGACY_LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
+const CONFIG_DIR_NAME = ".hmy";
+const CONFIG_DIR_SUBDIR = "agent";
+const LEGACY_CONFIG_DIR_NAME = ".harmony-mcp";
+
+/**
+ * Fallbacks announce themselves ONCE per process (#1082).
+ *
+ * A silent fallback is the failure mode this whole compatibility window is
+ * exposed to: an operator whose migration failed, or whose daemon runs from a
+ * frozen npx cache, gets no signal that they still depend on a path scheduled
+ * for removal — and then the follow-up card that deletes the fallback breaks
+ * them with nothing in any log to connect the two.
+ *
+ * Latched per process rather than per call because these sit on hot paths —
+ * `loadConfig` runs on every tool dispatch — and a line repeated hundreds of
+ * times is read as noise and filtered out, which is the same as silence.
+ *
+ * `console.error`, not `console.log`: on stdio transport stdout carries the
+ * JSON-RPC protocol, so anything printed there corrupts the session. Same
+ * convention as `skills.ts`.
+ */
+let warnedLegacyConfigDir = false;
+let warnedLegacyLocalPin = false;
+
+/**
+ * Clear both latches. Tests only.
+ *
+ * A per-process latch is not observable twice, so without this the "said once"
+ * half of the contract is untestable — and an untested notice is how the
+ * fallback goes silent again without anyone noticing. Exported deliberately
+ * rather than left to a test reaching into module state.
+ */
+export function resetLegacyNoticesForTest(): void {
+  warnedLegacyConfigDir = false;
+  warnedLegacyLocalPin = false;
+}
+
+function noteLegacyConfigDir(path: string): void {
+  if (warnedLegacyConfigDir) return;
+  warnedLegacyConfigDir = true;
+  console.error(
+    `Harmony: reading the pre-#1082 config at ${path}. ` +
+      `The current location is ${getConfigPath()}; ` +
+      `run the agent daemon once to migrate, or move the file yourself.`,
+  );
+}
+
+/** Said once when a repo pin is read under the old name. */
+export function noteLegacyLocalPin(path: string): void {
+  if (warnedLegacyLocalPin) return;
+  warnedLegacyLocalPin = true;
+  console.error(
+    `Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` +
+      `Rename it to ${LOCAL_CONFIG_FILENAME} — the fallback that finds it is temporary.`,
+  );
+}
+
+/** Said once when a write moves the pin to the current name. */
+function noteLocalPinRename(from: string, to: string): void {
+  console.error(
+    `Harmony: wrote the repo pin to ${to} (the pre-#1082 ${from} is now ignored and can be deleted).`,
+  );
+}
+
+/**
+ * `~/.hmy` — the root the whole `hmy` surface shares. Named separately from
+ * `getConfigDir()` because the denylists want the WHOLE tree, not just the
+ * daemon's corner of it: `config.yaml` is not a credential, but a future
+ * sibling might be, and a directory has no spellings to enumerate.
+ */
+export function getHmyRootDir(): string {
+  return join(homedir(), CONFIG_DIR_NAME);
+}
+
+/** `~/.hmy/agent` — where every writer writes. Never falls back. */
 export function getConfigDir(): string {
-  return join(homedir(), ".harmony-mcp");
+  return join(getHmyRootDir(), CONFIG_DIR_SUBDIR);
+}
+
+/** `~/.harmony-mcp` — the pre-#1082 location. Read-only, and denied forever. */
+export function getLegacyConfigDir(): string {
+  return join(homedir(), LEGACY_CONFIG_DIR_NAME);
 }
 
 export function getConfigPath(): string {
   return join(getConfigDir(), "config.json");
 }
 
+export function getLegacyConfigPath(): string {
+  return join(getLegacyConfigDir(), "config.json");
+}
+
 export function getLocalConfigPath(cwd?: string): string {
   return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
 }
 
 /**
- * Find the nearest `.harmony-mcp.json` at or above `cwd` (card #893).
+ * Find the nearest `.hmy.json` at or above `cwd` (card #893).
  *
  * The old behaviour looked in the exact cwd and nowhere else, so a server
  * started from a package directory or a git worktree never saw the repo's pin
@@ -56,9 +165,15 @@ export function getLocalConfigPath(cwd?: string): string {
  * Two directories are deliberately skipped, however deep the walk goes:
  *
  * - **the home directory** — a stray file there would capture every session in
- *   every repo, and `~/.harmony-mcp/config.json` is already the global pin;
+ *   every repo, and `~/.hmy/agent/config.json` is already the global pin;
  * - **the filesystem root** — same reasoning, machine-wide.
  *
+ * **Both names are checked in the SAME directory before walking up** (#1082),
+ * which is the only ordering that preserves #893. Checking every ancestor for
+ * `.hmy.json` first and only then re-walking for `.harmony-mcp.json` would let
+ * a parent repo's new-name pin beat the current repo's own legacy pin — the
+ * nearest file must win whichever name it carries.
+ *
  * Returns `null` when no ancestor carries one.
  */
 export function findLocalConfigPath(cwd?: string): string | null {
@@ -68,8 +183,13 @@ export function findLocalConfigPath(cwd?: string): string | null {
 
   for (;;) {
     if (dir !== home && dir !== root) {
-      const candidate = join(dir, LOCAL_CONFIG_FILENAME);
-      if (existsSync(candidate)) return candidate;
+      const current = join(dir, LOCAL_CONFIG_FILENAME);
+      if (existsSync(current)) return current;
+      const legacy = join(dir, LEGACY_LOCAL_CONFIG_FILENAME);
+      if (existsSync(legacy)) {
+        noteLegacyLocalPin(legacy);
+        return legacy;
+      }
     }
     const parent = dirname(dir);
     if (parent === dir) return null;
@@ -93,10 +213,14 @@ function emptyConfig(): HarmonyConfig {
 }
 
 export function loadConfig(): HarmonyConfig {
-  const configPath = getConfigPath();
-
+  // Read the new location, fall back to the pre-#1082 one. The fallback is
+  // read-only on purpose: `saveConfig` always writes the new path, so the first
+  // write after an upgrade lands there and the old file stops being consulted.
+  let configPath = getConfigPath();
   if (!existsSync(configPath)) {
-    return emptyConfig();
+    configPath = getLegacyConfigPath();
+    if (!existsSync(configPath)) return emptyConfig();
+    noteLegacyConfigDir(configPath);
   }
 
   try {
@@ -157,14 +281,33 @@ export function loadLocalConfig(cwd?: string): LocalConfig | null {
   }
 }
 
+/** Returns the path actually written, which is NOT always `<cwd>/.hmy.json`. */
 export function saveLocalConfig(
   config: Partial<LocalConfig>,
   cwd?: string,
-): void {
-  // Write back to the file we READ, not to the cwd: a `set_project_context`
-  // issued from a package directory must update the repo's pin rather than
-  // strand a second config file the repo root never looks at (card #893).
-  const localConfigPath = findLocalConfigPath(cwd) ?? getLocalConfigPath(cwd);
+): string {
+  // Write back to the DIRECTORY we read from, under the CURRENT name (#893,
+  // #1082). #893's rule is about the directory: a `set_project_context` issued
+  // from a package subdirectory must update the repo's pin rather than strand a
+  // second config file the repo root never looks at. The filename was never the
+  // point, and writing back to `.harmony-mcp.json` because that is what the read
+  // found would make this the one writer still creating the old name — the
+  // thing #1082 exists to stop, and a live trap for the card that removes the
+  // read fallback, since a pin left under the old name goes invisible and the
+  // session falls through to the global context. That silent wrong-workspace
+  // failure is exactly what #893 was filed to remove.
+  //
+  // The legacy file is left on disk rather than deleted, matching
+  // `migrateConfigDir`'s doctrine: this code removes nothing an operator wrote.
+  // It is inert from the next read on — `findLocalConfigPath` prefers
+  // `.hmy.json` in the same directory — and `noteLocalPinRename` says so once.
+  const foundPath = findLocalConfigPath(cwd);
+  const localConfigPath = foundPath
+    ? join(dirname(foundPath), LOCAL_CONFIG_FILENAME)
+    : getLocalConfigPath(cwd);
+  if (foundPath !== null && foundPath !== localConfigPath) {
+    noteLocalPinRename(foundPath, localConfigPath);
+  }
 
   const existingConfig = loadLocalConfig(cwd) || {
     workspaceId: null,
@@ -178,6 +321,7 @@ export function saveLocalConfig(
   if (newConfig.projectId) cleanConfig.projectId = newConfig.projectId;
 
   writeFileSync(localConfigPath, JSON.stringify(cleanConfig, null, 2));
+  return localConfigPath;
 }
 
 export function hasLocalConfig(cwd?: string): boolean {
@@ -222,10 +366,10 @@ export function setUserEmail(email: string | null): void {
 }
 
 export interface SetContextOptions {
-  /** Force a write to the repo-local `.harmony-mcp.json` (creating it). */
+  /** Force a write to the repo-local `.hmy.json` (creating it). */
   local?: boolean;
   /**
-   * Force a write to the global `~/.harmony-mcp/config.json`, even when a local
+   * Force a write to the global `~/.hmy/agent/config.json`, even when a local
    * file exists. Setup uses this to mirror the chosen context into the global
    * default; without it the mirror would land back in the local file it just
    * wrote, leaving every server started from another directory with no context.
@@ -318,7 +462,7 @@ export function setActiveWorkspace(
 /**
  * The active pair, read from ONE source (card #893).
  *
- * A local `.harmony-mcp.json` wins **as a whole file**, not field by field. The
+ * A local `.hmy.json` wins **as a whole file**, not field by field. The
  * two ids used to fall back to the global config independently, which quietly
  * re-created the very mismatch this card removes: `saveLocalConfig` omits null
  * values, so writing `projectId: null` locally did not clear the project — it

package/src/hook-install.ts

@@ -12,7 +12,7 @@
  * `hooks` is not merely missing from that list — it is the key that BROKE the
  * previous denylist and forced the inversion. A hook block in a run's own
  * worktree executed as the daemon user, outside the sandbox, and read
- * `~/.ssh/config` and `~/.harmony-mcp/config.json`. So writing this hook into a
+ * `~/.ssh/config` and `~/.hmy/agent/config.json`. So writing this hook into a
  * project settings file would throw `ProjectSandboxOverrideError` on every
  * contained implement run in that repo — it would not degrade, it would stop
  * the daemon.

package/src/oauth-refresh.ts

@@ -33,7 +33,7 @@ interface RefreshResponse {
 let inFlight: Promise<string | null> | null = null;
 
 // Cross-process serialization. Every Claude Code session spawns its own stdio
-// MCP process, and they all share ~/.harmony-mcp/config.json. The refresh
+// MCP process, and they all share ~/.hmy/agent/config.json. The refresh
 // token rotates on use, so two processes refreshing concurrently would each
 // POST a refresh: the first consumes the token, the second replays a now-
 // consumed token and trips the server's reuse detection, revoking the whole

package/src/run-hook.ts

@@ -32,7 +32,7 @@
  * This module is pure. The process that calls it does the I/O.
  */
 
-import { redactToolCall } from "./run-redaction.js";
+import { redactToolCall } from "@harmony/shared";
 
 /**
  * The subset of the harness's `PostToolUse` stdin payload this reads.

package/src/run-state.ts

@@ -14,7 +14,7 @@
  * server's memory, so the session identity has to travel **through the
  * filesystem**. That is what this module is.
  *
- * ## Why not `~/.harmony-mcp/`
+ * ## Why not `~/.hmy/agent/`
  *
  * `getConfigDir()` is the FIRST entry of `credentialDirectories()`
  * (`packages/harmony-harness/src/run-containment.ts`) and is read-denied to

package/src/server.ts

@@ -3293,7 +3293,7 @@ export async function handleToolCall(
           // deliberately-set active project is a hard scope: `found` there means
           // the card was already in it, so there is nothing to change — and we
           // never let a read silently repoint a context the user chose (which,
-          // on the local stdio MCP, persists to ~/.harmony-mcp/config.json
+          // on the local stdio MCP, persists to ~/.hmy/agent/config.json
           // across sessions). Confirm the target back either way so a
           // wrong-context resolve is visible immediately.
           const established = activeProjectId == null;

package/src/tui/setup.ts

@@ -1552,6 +1552,9 @@ export async function runSetup(options: SetupOptions = {}): Promise<void> {
     }
   }
 
+  /** Set once step 9 writes the repo pin, so the summary names the real file. */
+  let writtenLocalConfigPath: string | null = null;
+
   // Step 9: Save context \u2014 both local (cwd-scoped) and global (user default).
   // Local config only resolves when the server runs with this repo as cwd;
   // remote/OAuth connections and other cwds fall back to the global active
@@ -1562,9 +1565,15 @@ export async function runSetup(options: SetupOptions = {}): Promise<void> {
     const localConfig: { workspaceId?: string; projectId?: string } = {};
     if (selectedWorkspaceId) localConfig.workspaceId = selectedWorkspaceId;
     if (selectedProjectId) localConfig.projectId = selectedProjectId;
-    saveLocalConfig(localConfig, cwd);
+    // Print the path `saveLocalConfig` ACTUALLY wrote, not a re-derived guess
+    // (#1082). `getLocalConfigPath` is `<cwd>/.hmy.json` with no upward walk,
+    // while the write targets the directory of the pin already in scope — which
+    // may be an ancestor (#893). Run setup from `packages/foo` in a repo pinned
+    // at its root and the two disagree, so this line reported a file that does
+    // not exist. Returning the path is what removes the second derivation.
+    writtenLocalConfigPath = saveLocalConfig(localConfig, cwd);
     console.log(
-      `  ${colors.success("\u2713")} ${colors.dim(formatPath(getLocalConfigPath(cwd), home))} ${colors.dim("(created)")}`,
+      `  ${colors.success("\u2713")} ${colors.dim(formatPath(writtenLocalConfigPath, home))} ${colors.dim("(created)")}`,
     );
 
     // Mirror the choice into the GLOBAL default, explicitly (#893). The local
@@ -1629,7 +1638,7 @@ export async function runSetup(options: SetupOptions = {}): Promise<void> {
     }
     if (selectedWorkspaceId || selectedProjectId) {
       console.log(
-        `    Context:   ${formatPath(getLocalConfigPath(cwd), home)}`,
+        `    Context:   ${formatPath(writtenLocalConfigPath ?? getLocalConfigPath(cwd), home)}`,
       );
     }
 

package/src/tui/writer.ts

@@ -33,6 +33,16 @@ function ensureDir(dirPath: string): void {
   }
 }
 
+/**
+ * Path fragments that mark a file as living in a Harmony config directory, and
+ * therefore as 0o600 rather than 0o644.
+ *
+ * `.hmy` covers `~/.hmy/agent/config.json` and the repo-local `.hmy.json` in one
+ * fragment. `.harmony-mcp` is the pre-#1082 spelling of both, kept so `setup`
+ * writing into an un-migrated directory still writes a private file.
+ */
+const CONFIG_DIR_MARKERS: readonly string[] = [".hmy", ".harmony-mcp"];
+
 /**
  * Write a file, optionally skipping if exists
  */
@@ -49,7 +59,17 @@ export function writeFile(
 
   try {
     ensureDir(dirname(filePath));
-    const defaultMode = filePath.includes(".harmony-mcp") ? 0o600 : 0o644;
+    // 0o600 for anything under a Harmony config directory — that is where the
+    // API key lives. BOTH names are tested (#1082): the rename to `~/.hmy`
+    // moved where setup writes, so matching the old name alone would have
+    // silently written the credential 0o644 (world-readable) at the new path,
+    // and nothing about a successful write would have said so. `setup` is also
+    // still able to write into a legacy directory that has not been migrated.
+    const defaultMode = CONFIG_DIR_MARKERS.some((marker) =>
+      filePath.includes(marker),
+    )
+      ? 0o600
+      : 0o644;
     const mode = options.mode ?? defaultMode;
     writeFileSync(filePath, content, { mode });
     if (options.mode !== undefined) {