@gpsglobal-ai/gpsglobal 1.4.4 → 1.4.5

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog — gpsglobal
 
+## 1.4.5 — 2026-06-21
+
+- **Production defaults:** `setup` and `login` use `https://lp.gpsglobal.ai` (not `localhost:8080`)
+- **`setup` default mode:** `oauth` — Cursor/VS Code/GitHub get URL-only `https://lp.gpsglobal.ai/mcp`
+- **Claude Desktop:** still gets stdio + `envFile` when mode is `oauth` (Desktop has no reliable HTTP OAuth)
+- **`doctor`:** probes `${apiBase}/mcp` → expects 401 on production (not localhost:3100)
+- Local dev: `GPS_API_BASE=http://localhost:8080 npx @gpsglobal-ai/gpsglobal setup --mode=stdio`
+
 ## 1.4.4 — 2026-06-18
 
 - CI: disable npm provenance (private GitHub repo — OIDC publish still works)

package/README.md

@@ -28,21 +28,27 @@ Data never leaves GPS infrastructure except through your authenticated session
 
 ## Quick start (recommended)
 
-One command — browser sign-in, credentials saved locally, configs merged for major AI hosts:
+One command — browser sign-in at **production**, credentials saved locally, configs merged for major AI hosts:
 
 ```bash
 npx @gpsglobal-ai/gpsglobal setup
 ```
 
-This writes `~/.gps/mcp.env` (mode `600`) and updates **Cursor**, **VS Code**, and **Claude Desktop** configs.
+This opens `https://lp.gpsglobal.ai` for OAuth, writes `~/.gps/mcp.env` (mode `600`), and updates **Cursor** (OAuth URL), **VS Code**, **GitHub Copilot**, and **Claude Desktop** (stdio) configs.
 
 **Restart your AI tool**, then ask: *"List my GPS funds using gpsglobal"*.
 
+**Local Docker dev** (backend on `localhost:8080`):
+
+```bash
+GPS_API_BASE=http://localhost:8080 npx @gpsglobal-ai/gpsglobal setup --mode=stdio
+```
+
 ### Other commands
 
 | Goal | Command |
 |------|---------|
-| OAuth Connect (URL-only, no token in config) | `npx @gpsglobal-ai/gpsglobal setup --mode=oauth` |
+| stdio-only (all hosts) | `npx @gpsglobal-ai/gpsglobal setup --mode=stdio` |
 | Verify install + backend reachability | `npx @gpsglobal-ai/gpsglobal doctor` |
 | Print config snippets for all hosts | `npx @gpsglobal-ai/gpsglobal print-config` |
 | Refresh credentials | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
@@ -60,9 +66,9 @@ gpsglobal setup
 
 | Host | Setup mode | Config key |
 |------|------------|------------|
-| **Cursor** | `setup` or `setup --mode=oauth` | `gpsglobal` |
+| **Cursor** | `setup` (default oauth) | `gpsglobal` |
 | **VS Code / GitHub Copilot** | `setup` | `gpsglobal` |
-| **Claude Desktop** | `setup` (stdio) | `gpsglobal` |
+| **Claude Desktop** | `setup` (stdio via envFile) | `gpsglobal` |
 | **Claude Code** | `claude mcp add --transport http gpsglobal https://lp.gpsglobal.ai/mcp` | `gpsglobal` |
 
 **OAuth Connect (production):** hosts discover auth via `https://lp.gpsglobal.ai/mcp` — no manual JWT paste.
@@ -129,7 +135,7 @@ gpsglobal setup
 |-------|-----|
 | Tools return 401 | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
 | Host shows disconnected | Restart the AI app after `setup` |
-| `doctor` fails | Ensure backend is running; check `GPS_API_BASE` in `~/.gps/mcp.env` |
+| `doctor` fails | Ensure you are whitelisted on prod; check `GPS_API_BASE` in `~/.gps/mcp.env` (should be `https://lp.gpsglobal.ai`) |
 | OAuth Connect loop | Confirm Cursor/VS Code config is URL-only (no stale Bearer header) |
 
 ---

package/dist/cli/doctor.js

@@ -2,6 +2,7 @@ import axios from 'axios';
 import { GpsApiClient } from '../clients/gps-api.js';
 import { loadGpsConfig, normalizeApiBase, DEFAULT_ENV_PATH } from '../config/env.js';
 import { decodeGpsJwt } from '../lib/jwt.js';
+import { resolveMcpPublicUrl } from '../lib/host-config.js';
 export async function runDoctor() {
     const checks = [];
     let config;
@@ -53,22 +54,29 @@ export async function runDoctor() {
             detail: err instanceof Error ? err.message : String(err),
         });
     }
-    const mcpUrl = process.env.GPS_MCP_PUBLIC_URL ?? 'http://localhost:3100';
+    const mcpUrl = resolveMcpPublicUrl(config.apiBase);
     try {
-        const mcpHealth = await axios.get(`${mcpUrl}/health`, { timeout: 5_000, validateStatus: () => true });
-        if (mcpHealth.status === 404) {
-            checks.push({ name: 'mcp-http', ok: true, detail: 'not running (stdio mode OK)' });
+        const mcpProbe = await axios.get(`${mcpUrl}/mcp`, {
+            timeout: 10_000,
+            validateStatus: () => true,
+            maxRedirects: 0,
+        });
+        if (mcpProbe.status === 401) {
+            checks.push({ name: 'mcp-http', ok: true, detail: `${mcpUrl}/mcp → 401 (discovery OK)` });
+        }
+        else if (mcpProbe.status === 404) {
+            checks.push({ name: 'mcp-http', ok: true, detail: 'stdio mode (no remote /mcp)' });
         }
         else {
             checks.push({
                 name: 'mcp-http',
-                ok: mcpHealth.status === 200,
-                detail: `${mcpUrl}/health → ${mcpHealth.status}`,
+                ok: mcpProbe.status === 200,
+                detail: `${mcpUrl}/mcp → ${mcpProbe.status}`,
             });
         }
     }
     catch {
-        checks.push({ name: 'mcp-http', ok: true, detail: 'not running (stdio mode OK)' });
+        checks.push({ name: 'mcp-http', ok: true, detail: 'remote MCP unreachable (stdio mode OK)' });
     }
     return { ok: checks.every((c) => c.ok), checks };
 }

package/dist/cli/setup.js

@@ -1,13 +1,14 @@
 import { browserLogin } from './browser-login.js';
-import { DEFAULT_ENV_PATH, normalizeApiBase } from '../config/env.js';
+import { DEFAULT_ENV_PATH, LOCAL_GPS_API_BASE, normalizeApiBase, resolveDefaultApiBase } from '../config/env.js';
 import { MCP_SERVER_KEY, PACKAGE, claudeCodeAddCommand, mergeVsCodeConfig, mergeVsCodeWorkspaceConfig, mergeClaudeDesktopConfig, mergeCursorConfig, buildOAuthConnectEntry, buildRemoteEntry, buildStdioEntry, resolveMcpPublicUrl, writeAllHostConfigs, } from '../lib/host-config.js';
 export async function runSetup(options) {
-    const apiBase = normalizeApiBase(options.apiBase ?? process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = normalizeApiBase(options.apiBase ?? resolveDefaultApiBase());
     const host = options.host ?? 'all';
     const useBrowser = options.useBrowser ?? true;
-    const mode = options.mode ?? 'stdio';
+    const mode = options.mode ?? 'oauth';
     const mcpPublic = resolveMcpPublicUrl(apiBase);
-    console.log(`GPS MCP setup — configure ${MCP_SERVER_KEY} for your AI tools\n`);
+    console.log(`GPS MCP setup — configure ${MCP_SERVER_KEY} for your AI tools`);
+    console.log(`  API: ${apiBase}  ·  MCP: ${mcpPublic}/mcp  ·  mode: ${mode}\n`);
     if (useBrowser) {
         const result = await browserLogin(apiBase);
         console.log(`\n✓ Signed in as ${result.username} (${result.lpId})`);
@@ -48,5 +49,6 @@ export async function runSetup(options) {
         console.log(`\nRun:\n  ${claudeCodeAddCommand(mcpPublic, mode === 'oauth' ? 'oauth' : 'remote')}`);
     }
     console.log(`\nVerify: npx ${PACKAGE} doctor`);
+    console.log(`Local dev: GPS_API_BASE=${LOCAL_GPS_API_BASE} npx ${PACKAGE} setup --mode=stdio`);
     console.log(`Done. Ask your AI: "list my GPS funds using ${MCP_SERVER_KEY}"`);
 }

package/dist/cli.js

@@ -2,14 +2,14 @@
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { GpsApiClient } from './clients/gps-api.js';
-import { DEFAULT_ENV_PATH, loadGpsConfig, normalizeApiBase, writeGpsEnvFile, } from './config/env.js';
+import { DEFAULT_ENV_PATH, loadGpsConfig, resolveDefaultApiBase, writeGpsEnvFile, } from './config/env.js';
 import { startStdioServer, startHttpFromEnv } from './index.js';
 import { browserLogin } from './cli/browser-login.js';
 import { runSetup } from './cli/setup.js';
 import { runDoctor, printDoctor } from './cli/doctor.js';
 import { MCP_SERVER_KEY, PACKAGE, buildMcpServersConfig, buildOAuthConnectEntry, buildRemoteEntry, buildStdioEntry, buildVsCodeServersConfig, resolveMcpPublicUrl, } from './lib/host-config.js';
 function printConfig(envPath) {
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = resolveDefaultApiBase();
     const mcpPublic = resolveMcpPublicUrl(apiBase);
     const stdio = buildStdioEntry(envPath);
     const remote = buildRemoteEntry(mcpPublic);
@@ -17,7 +17,7 @@ function printConfig(envPath) {
     console.log(`
 ═══ Easiest: one command (all major hosts) ═══
   npx ${PACKAGE} setup
-  npx ${PACKAGE} setup --mode=oauth   ← OAuth Connect (URL-only)
+  npx ${PACKAGE} setup --mode=stdio   ← local dev / Claude Desktop stdio-only
 
 ═══ Cursor / Claude Desktop (mcpServers) ═══
 ${JSON.stringify(buildMcpServersConfig(stdio), null, 2)}
@@ -46,7 +46,7 @@ async function promptHidden(question) {
     }
 }
 async function runLogin(refresh, useBrowser) {
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = resolveDefaultApiBase();
     if (useBrowser) {
         const result = await browserLogin(apiBase);
         console.log(`\n✓ Credentials saved to ${DEFAULT_ENV_PATH}`);
@@ -109,8 +109,8 @@ async function main() {
     const cmd = args[0];
     if (!cmd || cmd === 'help' || args.includes('--help')) {
         console.log(`Usage:
-  npx ${PACKAGE} setup              ← easiest: all hosts (Cursor, VS Code, Claude Desktop)
-  npx ${PACKAGE} setup --mode=oauth ← Cursor Connect (URL-only, no envFile)
+  npx ${PACKAGE} setup              ← production OAuth Connect (https://lp.gpsglobal.ai/mcp)
+  npx ${PACKAGE} setup --mode=stdio ← local dev (GPS_API_BASE=http://localhost:8080)
   npx ${PACKAGE} doctor             ← verify credentials + backend
   npx ${PACKAGE} login [--browser] [--refresh]
   npx ${PACKAGE} status
@@ -128,7 +128,7 @@ async function main() {
         await runSetup({
             host: host ?? 'all',
             useBrowser: !args.includes('--no-browser'),
-            mode: mode ?? 'stdio',
+            mode: mode ?? 'oauth',
         });
         return;
     }

package/dist/config/env.d.ts

@@ -1,4 +1,10 @@
 export declare const DEFAULT_ENV_PATH: string;
+/** Production LP Workspace origin — default for published npm package. */
+export declare const DEFAULT_GPS_API_BASE = "https://lp.gpsglobal.ai";
+/** Local Docker backend — opt-in via GPS_API_BASE for developers only. */
+export declare const LOCAL_GPS_API_BASE = "http://localhost:8080";
+/** Resolve API base: explicit env → production (not localhost). */
+export declare function resolveDefaultApiBase(): string;
 export interface GpsEnvConfig {
     apiBase: string;
     accessToken: string;

package/dist/config/env.js

@@ -2,6 +2,14 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 export const DEFAULT_ENV_PATH = path.join(os.homedir(), '.gps', 'mcp.env');
+/** Production LP Workspace origin — default for published npm package. */
+export const DEFAULT_GPS_API_BASE = 'https://lp.gpsglobal.ai';
+/** Local Docker backend — opt-in via GPS_API_BASE for developers only. */
+export const LOCAL_GPS_API_BASE = 'http://localhost:8080';
+/** Resolve API base: explicit env → production (not localhost). */
+export function resolveDefaultApiBase() {
+    return normalizeApiBase(process.env.GPS_API_BASE ?? DEFAULT_GPS_API_BASE);
+}
 export function parseEnvFile(content) {
     const out = {};
     for (const line of content.split('\n')) {
@@ -36,7 +44,7 @@ export function loadGpsConfig(envPath = process.env.GPS_MCP_ENV_PATH ?? DEFAULT_
     }
     const parsed = parseEnvFile(fs.readFileSync(envPath, 'utf8'));
     const merged = {
-        apiBase: normalizeApiBase(parsed.GPS_API_BASE ?? 'http://localhost:8080'),
+        apiBase: normalizeApiBase(parsed.GPS_API_BASE ?? DEFAULT_GPS_API_BASE),
         accessToken: parsed.GPS_ACCESS_TOKEN ?? '',
         lpId: parsed.GPS_LP_ID ?? '',
         role: parsed.GPS_ROLE ?? 'lp',

package/dist/http.d.ts

@@ -3,6 +3,9 @@ export interface HttpServerOptions {
     host: string;
     apiBase: string;
     publicBaseUrl: string;
+    /** Public GPS API origin for OAuth AS in PRM (defaults to publicBaseUrl). */
+    publicApiBase?: string;
     enabled: boolean;
+    version?: string;
 }
 export declare function startHttpServer(opts: HttpServerOptions): Promise<void>;

package/dist/http.js

@@ -5,6 +5,7 @@ import { assertMcpEligibleRole } from './config/env.js';
 import { createGpsMcpServer } from './server/factory.js';
 import { decodeGpsJwt } from './lib/jwt.js';
 import { assertMcpHttpToken } from './lib/token-policy.js';
+import { oauthAuthorizationServerUrl, resolvePublicApiBase } from './lib/public-api-base.js';
 function parseBearer(req) {
     const h = req.headers.authorization;
     if (!h?.startsWith('Bearer '))
@@ -28,15 +29,21 @@ function sendUnauthorized(res, resourceMetadataUrl, message) {
 export async function startHttpServer(opts) {
     const app = createMcpExpressApp({ host: opts.host });
     const resourceMetadataUrl = `${opts.publicBaseUrl}/.well-known/oauth-protected-resource`;
-    const authServer = `${opts.apiBase}/api/v2/oauth/mcp-cli`;
+    const publicApiBase = resolvePublicApiBase(opts.publicApiBase, opts.publicBaseUrl);
+    const authServer = oauthAuthorizationServerUrl(publicApiBase);
+    const serviceVersion = opts.version ?? process.env.GPS_MCP_VERSION ?? '1.4.4';
     app.get('/health', (_req, res) => {
         if (!opts.enabled) {
             res.status(503).json({ status: 'disabled', message: 'GPS MCP HTTP is disabled' });
             return;
         }
-        res.json({ status: 'ok', service: 'gpsglobal', version: '1.4.0' });
+        res.json({ status: 'ok', service: 'gpsglobal', version: serviceVersion });
     });
     app.get('/.well-known/oauth-protected-resource', (_req, res) => {
+        if (!opts.enabled) {
+            res.status(503).json({ error: 'GPS MCP is temporarily disabled' });
+            return;
+        }
         res.json({
             resource: `${opts.publicBaseUrl}/mcp`,
             authorization_servers: [authServer],

package/dist/index.js

@@ -1,6 +1,6 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { GpsApiClient } from './clients/gps-api.js';
-import { loadGpsConfig, normalizeApiBase } from './config/env.js';
+import { loadGpsConfig, normalizeApiBase, LOCAL_GPS_API_BASE } from './config/env.js';
 import { createGpsMcpServer } from './server/factory.js';
 import { startHttpServer } from './http.js';
 export async function startStdioServer() {
@@ -13,8 +13,17 @@ export async function startStdioServer() {
 export async function startHttpFromEnv() {
     const port = Number(process.env.PORT ?? 3100);
     const host = process.env.MCP_HOST ?? '0.0.0.0';
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? LOCAL_GPS_API_BASE);
     const publicBaseUrl = normalizeApiBase(process.env.GPS_MCP_PUBLIC_URL ?? `http://localhost:${port}`);
+    const publicApiBase = normalizeApiBase(process.env.GPS_MCP_PUBLIC_API_BASE ?? publicBaseUrl);
     const enabled = process.env.GPS_MCP_ENABLED !== 'false';
-    await startHttpServer({ port, host, apiBase, publicBaseUrl, enabled });
+    await startHttpServer({
+        port,
+        host,
+        apiBase,
+        publicBaseUrl,
+        publicApiBase,
+        enabled,
+        version: process.env.GPS_MCP_VERSION,
+    });
 }

package/dist/lib/host-config.js

@@ -5,6 +5,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { DEFAULT_GPS_API_BASE } from '../config/env.js';
 /** npm scoped package under org gpsglobal-ai (see docs/57-mcp/018-npm-publish-and-cicd.md). */
 export const NPM_PACKAGE = '@gpsglobal-ai/gpsglobal';
 /** MCP protocol server key in mcp.json — short, stable across hosts. */
@@ -133,7 +134,7 @@ export function resolveMcpPublicUrl(apiBase) {
     if (normalized.includes('localhost') || normalized.includes('127.0.0.1')) {
         return process.env.GPS_MCP_PUBLIC_URL ?? 'http://localhost:3100';
     }
-    return process.env.GPS_MCP_PUBLIC_URL ?? 'https://lp.gpsglobal.ai';
+    return process.env.GPS_MCP_PUBLIC_URL ?? (normalized || DEFAULT_GPS_API_BASE);
 }
 export function claudeCodeAddCommand(mcpPublicUrl, mode = 'oauth') {
     const url = `${mcpPublicUrl.replace(/\/+$/, '')}/mcp`;
@@ -172,7 +173,8 @@ export function writeAllHostConfigs(envPath, mode, mcpPublicUrl, projectRoot = p
     catch {
         results.push({ host: 'vscode', path: vscodeUserMcpPath(), written: false });
     }
-    if (mode === 'stdio') {
+    // Claude Desktop has no reliable remote HTTP + OAuth — always stdio + envFile.
+    if (mode === 'stdio' || mode === 'oauth') {
         try {
             results.push({
                 host: 'claude-desktop',

package/dist/lib/public-api-base.d.ts

@@ -0,0 +1,3 @@
+/** Public GPS API origin for OAuth PRM (external clients). Internal GPS_API_BASE may differ in ECS. */
+export declare function resolvePublicApiBase(publicApiBase: string | undefined, publicMcpUrl: string): string;
+export declare function oauthAuthorizationServerUrl(publicApiBase: string): string;

package/dist/lib/public-api-base.js

@@ -0,0 +1,8 @@
+/** Public GPS API origin for OAuth PRM (external clients). Internal GPS_API_BASE may differ in ECS. */
+export function resolvePublicApiBase(publicApiBase, publicMcpUrl) {
+    const base = (publicApiBase ?? publicMcpUrl).replace(/\/+$/, '');
+    return base;
+}
+export function oauthAuthorizationServerUrl(publicApiBase) {
+    return `${publicApiBase.replace(/\/+$/, '')}/api/v2/oauth/mcp-cli`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gpsglobal-ai/gpsglobal",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "GPS LP fund wiki MCP server — list_funds and get_fund_wiki for Cursor, Copilot, Claude",
   "type": "module",
   "main": "./dist/index.js",