@hailer/mcp 2.0.0-beta.1 → 2.0.0-beta.3

package/.claude/skills/create-and-publish-app/SKILL.md

@@ -67,10 +67,22 @@ After the first publish `public/manifest.json` holds the dev `appId`; later iter
 | Production | `My App` | publish only when the user explicitly asks |
 </dev-publish>
 
+<credentials>
+## Credentials — Read This Before Publishing Fails
+
+The publish CLI (`@hailer/app-sdk`'s `publish.cjs`, wrapped as `npm run publish-*`) authenticates ONLY from, in order: `--user-api-key` flag → `USER_API_KEY` / `HAILER_USER_API_KEY` env vars → `~/.env` in the HOME directory → `--email` flag (interactive password prompt — useless for agents).
+
+- **Hailer Studio:** `~/.env` is auto-injected — publishing just works, no flags.
+- **Local machines:** the `npx hailer-mcp` server self-provisions on first boot — it mints a user API key from the project bot's credentials and writes `HAILER_USER_API_KEY` to `~/.env` (Studio's mechanism, reproduced locally). So once the local MCP server has run once, `npm run publish-production` works flag-free. (Opt out: `HAILER_MCP_NO_PUBLISH_AUTH=true`.)
+- **If publishing still hits exit code 10** (no auth — the CLI prints usage and quits): the local server hasn't run yet, or injection was disabled. Start `npx hailer-mcp` once, OR ask the user for a Hailer user API key (Hailer → profile → API keys) and pass `-- --user-api-key <key>`. **Never read passwords from .env, never log in via curl, never probe API endpoints for keys.**
+
+Other exit codes: 8 = login failed (bad key/credentials), 7 = bundle isn't a .tgz (build problem), loud version error = `--market` without `version`/`versionDescription` in the manifest.
+</credentials>
+
 <validate>
 ## Step 4 — Validate BEFORE Any Production Publish
 
-The publish CLI is `@hailer/app-sdk`'s `tools/publish.cjs` (scaffolded projects wrap it as `npm run publish-*`). Check before publishing:
+Check before publishing:
 
 1. Read `public/manifest.json`
 2. `appId` exists, 24 chars — required for any non-`--create` publish (auto-written by `--create`)

package/CLAUDE.md

@@ -104,6 +104,8 @@ Always use `:force` — the non-force variants prompt interactively.
 | Publish | `cd app && npm run publish-production` (`--market` for marketplace versions); then share via `manage_app` add_member |
 | Register / share | Edit `workspace/apps.ts` → `npx hailer-sdk ws-config apps push --force` |
 
+Publish auth: works flag-free once the local `npx hailer-mcp` server has run once — it mints a user API key from the project bot creds into `~/.env`, mirroring Studio. Exit 10 = no auth yet → start the server once, or pass `-- --user-api-key <key>`; NEVER read passwords or probe login endpoints. Details: `create-and-publish-app` skill.
+
 ## When MCP Tools Are the Answer
 
 The MCP server exposes a curated runtime surface the SDK can't replicate locally:

package/dist/cli.js

@@ -1,5 +1,38 @@
 #!/usr/bin/env node
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 // Parse port before loading app (which reads process.env.PORT)
 // Supports: hailer-mcp --port 3031 | hailer-mcp -p 3031 | npm run mcp-start --port=3031
@@ -27,4 +60,13 @@ if (!process.env.MCP_DEFAULT_PROFILE) {
     process.env.MCP_DEFAULT_PROFILE = 'sdk';
 }
 require("./app");
+// Studio-style publish auth: on the CLI path (prod runs `node dist/app.js`,
+// never this bin), ensure ~/.env has a user API key so `npm run publish-*`
+// works flag-free. Fire-and-forget — never blocks or fails server boot.
+// Opt out with HAILER_MCP_NO_PUBLISH_AUTH=true.
+const publishAuthOptOut = /^true$/i.test(process.env.HAILER_MCP_NO_PUBLISH_AUTH ?? '');
+if (!publishAuthOptOut) {
+    Promise.resolve().then(() => __importStar(require('./mcp/publish-auth-injector'))).then(({ injectLocalPublishAuth }) => injectLocalPublishAuth())
+        .catch(() => { });
+}
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AAEA,+DAA+D;AAC/D,wFAAwF;AACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM;IACV,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACnD,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,gFAAgF;AAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM;IACV,CAAC;AACL,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED,iBAAe"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,+DAA+D;AAC/D,wFAAwF;AACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM;IACV,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACnD,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,gFAAgF;AAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM;IACV,CAAC;AACL,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED,iBAAe;AAEf,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;AACvF,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACrB,kDAAO,6BAA6B,IAC/B,IAAI,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,sBAAsB,EAAE,CAAC;SAC9D,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/mcp/publish-auth-injector.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Local publish-auth injection — mirrors Hailer Studio's flow for the
+ * `npx hailer-mcp` CLI path (never the prod server, which runs `node dist/app.js`).
+ *
+ * Studio writes the session's user API key into the sandbox's `~/.env` so the
+ * app publish script (`@hailer/app-sdk` publish.cjs) authenticates with no
+ * flags. Locally there's no session key, but the CLI server already has the
+ * project bot's credentials in CLIENT_CONFIGS — so on first boot we mint a
+ * user API key on the bot's authenticated socket and write it to `~/.env`,
+ * exactly where publish.cjs looks.
+ *
+ * Idempotent (skips if a key is already present), best-effort (never blocks
+ * or fails server startup), and CLI-gated (prod never imports this).
+ */
+/**
+ * Mint a publish user API key from the project bot's CLIENT_CONFIGS account
+ * and append it to ~/.env. No-op when a key already exists or no account is
+ * configured. Swallows every error — publishing convenience must never break
+ * the server.
+ */
+export declare function injectLocalPublishAuth(): Promise<void>;
+//# sourceMappingURL=publish-auth-injector.d.ts.map

package/dist/mcp/publish-auth-injector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-auth-injector.d.ts","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+BH;;;;;GAKG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2D5D"}

package/dist/mcp/publish-auth-injector.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Local publish-auth injection — mirrors Hailer Studio's flow for the
+ * `npx hailer-mcp` CLI path (never the prod server, which runs `node dist/app.js`).
+ *
+ * Studio writes the session's user API key into the sandbox's `~/.env` so the
+ * app publish script (`@hailer/app-sdk` publish.cjs) authenticates with no
+ * flags. Locally there's no session key, but the CLI server already has the
+ * project bot's credentials in CLIENT_CONFIGS — so on first boot we mint a
+ * user API key on the bot's authenticated socket and write it to `~/.env`,
+ * exactly where publish.cjs looks.
+ *
+ * Idempotent (skips if a key is already present), best-effort (never blocks
+ * or fails server startup), and CLI-gated (prod never imports this).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectLocalPublishAuth = injectLocalPublishAuth;
+const cli_1 = require("@hailer/cli");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const config_1 = require("../config");
+const logger_1 = require("../lib/logger");
+const logger = (0, logger_1.createLogger)({ component: 'publish-auth' });
+/** Already have a publish key on this machine? (~/.env or the live env) */
+function publishKeyAlreadyPresent(envPath) {
+    if (process.env.HAILER_USER_API_KEY || process.env.USER_API_KEY) {
+        return true;
+    }
+    if (!(0, fs_1.existsSync)(envPath)) {
+        return false;
+    }
+    try {
+        return /^\s*(HAILER_USER_API_KEY|USER_API_KEY)\s*=/m.test((0, fs_1.readFileSync)(envPath, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Mint a publish user API key from the project bot's CLIENT_CONFIGS account
+ * and append it to ~/.env. No-op when a key already exists or no account is
+ * configured. Swallows every error — publishing convenience must never break
+ * the server.
+ */
+async function injectLocalPublishAuth() {
+    const envPath = (0, path_1.join)((0, os_1.homedir)(), '.env');
+    if (publishKeyAlreadyPresent(envPath)) {
+        return;
+    }
+    const accounts = Object.values(config_1.environment.CLIENT_CONFIGS);
+    const account = accounts[0];
+    if (!account) {
+        return;
+    }
+    const isLocalDev = account.apiBaseUrl.includes('local.gd') || account.apiBaseUrl.includes('localhost');
+    let client;
+    try {
+        client = await cli_1.Client.create({
+            host: account.apiBaseUrl,
+            username: account.email,
+            password: account.password,
+            ...(isLocalDev && { rejectUnauthorized: false }),
+        });
+        const init = await client.request('v2.core.init', [['network']]);
+        const workspaceId = init.network?._id;
+        if (!workspaceId) {
+            logger.debug('Skipping publish-auth injection — no workspace on bot account');
+            return;
+        }
+        const keyName = `hailer-mcp local (${(0, os_1.hostname)()})`;
+        const created = await client.request('v3.user.apikey.create', [keyName, workspaceId, []]);
+        if (!created?.key) {
+            return;
+        }
+        // ~/.env holds a live credential — keep it owner-only (0600). Create
+        // it with restrictive mode if absent, and tighten an existing file too.
+        if (!(0, fs_1.existsSync)(envPath)) {
+            (0, fs_1.writeFileSync)(envPath, '', { mode: 0o600 });
+        }
+        (0, fs_1.chmodSync)(envPath, 0o600);
+        (0, fs_1.appendFileSync)(envPath, `\n# Added by hailer-mcp for local app publishing\nHAILER_USER_API_KEY="${created.key}"\n`);
+        process.env.HAILER_USER_API_KEY = created.key;
+        logger.info('Minted local publish key → ~/.env', { keyName, workspaceId });
+    }
+    catch (error) {
+        logger.debug('Publish-auth injection skipped', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    finally {
+        try {
+            client?.disconnect();
+        }
+        catch {
+            // best-effort cleanup
+        }
+    }
+}
+//# sourceMappingURL=publish-auth-injector.js.map

package/dist/mcp/publish-auth-injector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-auth-injector.js","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAqCH,wDA2DC;AA9FD,qCAAqC;AACrC,2BAAwF;AACxF,2BAAuC;AACvC,+BAA4B;AAC5B,sCAAwC;AACxC,0CAA6C;AAE7C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AAO3D,2EAA2E;AAC3E,SAAS,wBAAwB,CAAC,OAAe;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,6CAA6C,CAAC,IAAI,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB;IACxC,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAW,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;IACX,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvG,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,YAAM,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,UAAU,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAmC,CAAC;QACnG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACtC,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;YAC9E,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,IAAA,aAAQ,GAAE,GAAG,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,uBAAuB,EACvB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CACP,CAAC;QAExB,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAA,kBAAa,EAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAA,cAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAA,mBAAc,EAAC,OAAO,EAAE,0EAA0E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QACpH,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,IAAI,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACL,sBAAsB;QAC1B,CAAC;IACL,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hailer/mcp",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.3",
   "config": {
     "docker": {
       "registry": "registry.gitlab.com/hailer-repos/hailer-mcp"
@@ -56,7 +56,6 @@
     "form-data": "^4.0.4",
     "mammoth": "^1.12.0",
     "openai": "^5.5.1",
-    "sharp": "^0.34.5",
     "tar": "^7.5.13",
     "typescript-language-server": "^5.1.3",
     "ws": "^8.20.0",