@gethmy/mcp 3.6.0 → 3.8.0

package/README.md

@@ -5,7 +5,7 @@ Claude Code, OpenAI Codex, Cursor, and any MCP client claim cards, report progre
 
 ## Features
 
-- **79 MCP Tools** for full board control, knowledge graph, and workflow plans
+- **80 MCP Tools** for full board control, knowledge graph, and workflow plans
 - **Global Skills** — installable in one command, served from the DB-backed [skill hub](../../docs/skills.md) with auto-update and admin-managed versioning
 - **Knowledge Graph Memory** — Phase 1 surface: hybrid retrieval (vector + lexical + RRF), session-scoped working memory, activity feed. See [docs/memory.md](../../docs/memory.md)
 - **GSD Workflow Plans** - plan/execute/verify/done lifecycle with auto card creation
@@ -89,7 +89,7 @@ If you prefer to configure manually (e.g., in Claude.ai's UI):
 1. Get an API key from [Harmony](https://gethmy.com/user/keys)
 2. In Claude.ai, add a remote MCP server with URL `https://mcp.gethmy.com/mcp`
 3. Set the Authorization header to `Bearer hmy_your_key_here`
-4. All 79 Harmony tools become available in your conversation
+4. All 80 Harmony tools become available in your conversation
 
 **Session management** is automatic - sessions have a 1-hour TTL and are created/renewed transparently.
 

package/dist/cli.js

@@ -31,7 +31,7 @@ function noteLegacyLocalPin(path) {
   if (warnedLegacyLocalPin)
     return;
   warnedLegacyLocalPin = true;
-  console.error(`Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` + `Rename it to ${LOCAL_CONFIG_FILENAME} — the fallback that finds it is temporary.`);
+  console.error(`Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` + `Run \`harmony-agent doctor --fix\` in this repo to write ` + `${LOCAL_CONFIG_FILENAME}, or rename the file yourself. ` + `The fallback that finds it is temporary.`);
 }
 function noteLocalPinRename(from, to) {
   console.error(`Harmony: wrote the repo pin to ${to} (the pre-#1082 ${from} is now ignored and can be deleted).`);
@@ -2204,6 +2204,267 @@ var REVIEW_DISALLOWED_TOOLS = [
   "mcp__harmony__harmony_delete_subtask",
   "mcp__harmony__harmony_toggle_subtask"
 ];
+// ../harmony-shared/dist/runEventSanitize.js
+var REPLACEMENT = "�";
+function sanitizeRunEventString(value) {
+  let out = "";
+  for (let i = 0;i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code === 0)
+      continue;
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += value[i] + value[i + 1];
+        i++;
+        continue;
+      }
+      out += REPLACEMENT;
+      continue;
+    }
+    if (code >= 56320 && code <= 57343) {
+      out += REPLACEMENT;
+      continue;
+    }
+    out += value[i];
+  }
+  return out;
+}
+function sanitizeRunEventPayload(payload) {
+  return walk(payload, new Map);
+}
+function sanitizeRunEventDraft(draft) {
+  return { ...draft, payload: sanitizeRunEventPayload(draft.payload) };
+}
+function walk(value, seen) {
+  if (typeof value === "string")
+    return sanitizeRunEventString(value);
+  if (value === null || typeof value !== "object")
+    return value;
+  const already = seen.get(value);
+  if (already !== undefined)
+    return already;
+  if (Array.isArray(value)) {
+    const out2 = [];
+    seen.set(value, out2);
+    for (const entry of value)
+      out2.push(walk(entry, seen));
+    return out2;
+  }
+  const out = {};
+  seen.set(value, out);
+  for (const [key, entry] of Object.entries(value)) {
+    out[sanitizeRunEventString(key)] = walk(entry, seen);
+  }
+  return out;
+}
+// ../harmony-shared/dist/runRedaction.js
+var MAX_INPUT_CHARS = 2000;
+var MAX_OUTPUT_CHARS = 4000;
+var MAX_INPUT_STRING_CHARS = 600;
+var REDACTION_MARK = "«redacted»";
+var SENSITIVE_SEGMENTS = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".codex",
+  ".gemini",
+  ".docker",
+  ".kube",
+  ".hmy",
+  ".harmony-mcp",
+  ".password-store",
+  ".claude",
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+];
+var CONFIG_SCOPED_SEGMENTS = new Set([
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+]);
+var SENSITIVE_BASENAMES = new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".pgpass",
+  ".git-credentials",
+  ".htpasswd",
+  ".claude.json",
+  "credentials",
+  ".credentials",
+  "credentials.json",
+  ".credentials.json",
+  "credentials.yml",
+  "credentials.yaml",
+  "auth.json",
+  ".auth.json",
+  "secrets",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  "known_hosts"
+]);
+var SENSITIVE_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".jks",
+  ".asc",
+  ".gpg"
+];
+function isSensitivePath(rawPath) {
+  if (typeof rawPath !== "string" || rawPath.length === 0)
+    return false;
+  const path = rawPath.trim().toLowerCase();
+  const segments = path.split(/[\\/]+/).filter((s) => s.length > 0);
+  if (segments.length === 0)
+    return false;
+  for (let i = 0;i < segments.length; i++) {
+    const segment = segments[i];
+    if (!SENSITIVE_SEGMENTS.includes(segment))
+      continue;
+    if (CONFIG_SCOPED_SEGMENTS.has(segment)) {
+      if (i > 0 && segments[i - 1] === ".config")
+        return true;
+      continue;
+    }
+    return true;
+  }
+  const basename = segments[segments.length - 1];
+  if (SENSITIVE_BASENAMES.has(basename))
+    return true;
+  if (basename === ".env" || basename.startsWith(".env."))
+    return true;
+  if (basename.endsWith(".env"))
+    return true;
+  if (SENSITIVE_EXTENSIONS.some((ext) => basename.endsWith(ext)))
+    return true;
+  if (/service[-_]?account.*\.json$/.test(basename))
+    return true;
+  return false;
+}
+function sensitivePathsIn(input, depth = 0) {
+  if (depth > 6)
+    return [];
+  if (typeof input === "string") {
+    return isSensitivePath(input) ? [input] : [];
+  }
+  if (Array.isArray(input)) {
+    return input.flatMap((item) => sensitivePathsIn(item, depth + 1));
+  }
+  if (input !== null && typeof input === "object") {
+    return Object.values(input).flatMap((value) => sensitivePathsIn(value, depth + 1));
+  }
+  return [];
+}
+var SECRET_PATTERNS = [
+  {
+    pattern: /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*-----/g,
+    replace: REDACTION_MARK
+  },
+  { pattern: /\bhmy_at_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bhmy_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replace: REDACTION_MARK },
+  { pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, replace: REDACTION_MARK },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replace: REDACTION_MARK },
+  { pattern: /\bAIza[0-9A-Za-z_-]{20,}/g, replace: REDACTION_MARK },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replace: REDACTION_MARK
+  },
+  {
+    pattern: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+    replace: `$1 ${REDACTION_MARK}`
+  },
+  {
+    pattern: /(\w{1,32}:\/\/)[^/\s:@]+:[^/\s@]+@/g,
+    replace: `$1${REDACTION_MARK}@`
+  },
+  {
+    pattern: /\b([A-Za-z0-9_]{0,40}(?:TOKEN|SECRET|PASSWORD|PASSWD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)[A-Za-z0-9_]{0,40})\s*[=:]\s*(?:"[^"]*"|'[^']*'|`[^`]*`|[^\s,;)}\]]+)/gi,
+    replace: `$1=${REDACTION_MARK}`
+  },
+  {
+    pattern: /(--?(?:password|passwd|token|api-?key|secret|auth)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+    replace: `$1${REDACTION_MARK}`
+  }
+];
+function redactSecrets(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return text;
+  let out = text;
+  for (const { pattern, replace } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    out = out.replace(pattern, replace);
+  }
+  return out;
+}
+function truncate(text, max, originalLength) {
+  const total = originalLength ?? text.length;
+  if (total <= max)
+    return text;
+  return `${text.slice(0, max)}… [+${total - max} chars]`;
+}
+function redactThenTruncate(text, max) {
+  const preCap = max * 4 + 64;
+  const scanned = text.length > preCap ? text.slice(0, preCap) : text;
+  return truncate(redactSecrets(scanned), max, text.length);
+}
+function redactStructure(value, depth = 0) {
+  if (depth > 6)
+    return REDACTION_MARK;
+  if (typeof value === "string") {
+    return redactThenTruncate(value, MAX_INPUT_STRING_CHARS);
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item) => redactStructure(item, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = redactStructure(item, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function redactToolCall(args) {
+  const sensitive = sensitivePathsIn(args.input);
+  if (sensitive.length > 0) {
+    return { withheld: "sensitive-path" };
+  }
+  const result = {};
+  if (args.input !== undefined) {
+    let input = redactStructure(args.input);
+    let serialized;
+    try {
+      serialized = JSON.stringify(input) ?? "";
+    } catch {
+      serialized = "";
+      input = REDACTION_MARK;
+    }
+    if (serialized.length > MAX_INPUT_CHARS) {
+      input = truncate(serialized, MAX_INPUT_CHARS);
+    }
+    result.input = input;
+  }
+  if (typeof args.output === "string" && args.output.length > 0) {
+    result.output = redactThenTruncate(args.output, MAX_OUTPUT_CHARS);
+  }
+  return result;
+}
 // ../harmony-shared/dist/stageHandoff.js
 var HANDOFF_MARKER = "harmony:stage-handoff";
 var HANDOFF_BLOCK_RE = new RegExp("```json\\s*\\n//\\s*" + HANDOFF_MARKER + "\\s*\\n([\\s\\S]*?)\\n```", "m");
@@ -2517,6 +2778,15 @@ class HarmonyApiClient {
   async registerWorkspaceAgent(workspaceId, data) {
     return this.request("POST", `/workspaces/${workspaceId}/agents`, data);
   }
+  async reportAgentConfig(workspaceId, agentId, config) {
+    return this.request("POST", `/workspaces/${workspaceId}/agents/${agentId}/reported-config`, { config });
+  }
+  async getWorkspaceModelConfig(workspaceId) {
+    return this.request("GET", `/workspaces/${workspaceId}/model-config`);
+  }
+  async getModelCatalog() {
+    return this.request("GET", "/model-catalog");
+  }
   async listProjects(workspaceId) {
     return this.request("GET", `/workspaces/${workspaceId}/projects`);
   }
@@ -2665,6 +2935,9 @@ class HarmonyApiClient {
       title
     });
   }
+  async removeExternalLink(cardId, linkId) {
+    return this.request("DELETE", `/cards/${cardId}/external-links/${linkId}`);
+  }
   async uploadArtifact(data) {
     return this.request("POST", "/artifacts", data);
   }
@@ -2757,7 +3030,10 @@ class HarmonyApiClient {
     return this.request("DELETE", `/cards/${cardId}/agent-context`, data);
   }
   async appendAgentRunEvents(cardId, data) {
-    return this.request("POST", `/cards/${cardId}/agent-run-events`, data);
+    return this.request("POST", `/cards/${cardId}/agent-run-events`, {
+      ...data,
+      events: data.events.map((event) => sanitizeRunEventDraft(event))
+    });
   }
   async getPendingUserMessages(cardId, sessionId, sinceSeq) {
     return this.request("GET", `/cards/${cardId}/agent-messages?sessionId=${sessionId}&sinceSeq=${sinceSeq}`);
@@ -5447,6 +5723,23 @@ var TOOLS = {
       required: ["cardId", "url"]
     }
   },
+  harmony_remove_external_link: {
+    description: "Remove an external reference URL from a card — the counterpart to harmony_add_external_link. Takes the link id from harmony_get_card_external_links, not the URL.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        cardId: {
+          type: "string",
+          description: "Card UUID"
+        },
+        linkId: {
+          type: "string",
+          description: "External link UUID, as returned by harmony_get_card_external_links"
+        }
+      },
+      required: ["cardId", "linkId"]
+    }
+  },
   harmony_create_subtask: {
     description: "Create a subtask on a card",
     inputSchema: {
@@ -7341,6 +7634,11 @@ ${list}
       const result = await client3.addExternalLink(cardId, url, title);
       return { success: true, ...result };
     }
+    case "harmony_remove_external_link": {
+      const cardId = z.string().uuid().parse(args.cardId);
+      const linkId = z.string().uuid().parse(args.linkId);
+      return await client3.removeExternalLink(cardId, linkId);
+    }
     case "harmony_classify_card":
       return deprecatedRemovedToolResult("harmony_classify_card");
     case "harmony_create_subtask": {