@heuresis/mcp 1.0.0-rc.10 → 1.0.0-rc.11

package/README.md

@@ -7,7 +7,7 @@ account, talks to the same Supabase project the webapp talks to, and
 respects the same RLS. Webapp and MCP are two front-ends to one cloud
 workspace.
 
-Current version: `1.0.0-rc.10`.
+Current version: `1.0.0-rc.11`.
 
 ## Install
 

package/dist/cli.js

@@ -27,6 +27,7 @@ import { createInterface } from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { credentialsPath, defaultDeviceName, deleteCredentials, readCredentials, writeCredentials, } from './credentials.js';
 import { exchangeRefreshToken, RefreshTokenError } from './gotrue.js';
+import { ensureProxyAgent } from './proxy.js';
 // Where the device pairing UI lives. Production default; can be overridden
 // for staging / self-hosted deploys via HEURESIS_DEVICE_BASE_URL. We also
 // allow HEURESIS_SUPABASE_URL to override which Supabase project the CLI
@@ -98,34 +99,8 @@ function parseLoginFlags(argv) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-// Wire HTTPS_PROXY / HTTP_PROXY env vars into Node's global fetch dispatcher.
-// Node 18-22's undici does NOT auto-honor these vars (Node 24+ does). Without
-// this, the CLI fails with "fetch failed" on corporate networks. Idempotent
-// and a no-op when no proxy var is set.
-let proxyAgentInstalled = false;
-async function ensureProxyAgent() {
-    if (proxyAgentInstalled)
-        return;
-    proxyAgentInstalled = true;
-    const proxyUrl = process.env.HTTPS_PROXY ||
-        process.env.https_proxy ||
-        process.env.HTTP_PROXY ||
-        process.env.http_proxy;
-    if (!proxyUrl)
-        return;
-    try {
-        // Dynamic import keeps undici out of the cold-start path when no proxy
-        // is in play. Node ships undici as part of the runtime so this resolves.
-        const { ProxyAgent, setGlobalDispatcher } = await import('undici');
-        setGlobalDispatcher(new ProxyAgent(proxyUrl));
-        log(`(routing through proxy ${proxyUrl})`);
-    }
-    catch (err) {
-        log(`(could not configure proxy ${proxyUrl}: ${err instanceof Error ? err.message : String(err)})`);
-    }
-}
 async function postJson(url, body) {
-    await ensureProxyAgent();
+    await ensureProxyAgent(log);
     const res = await fetch(url, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },

package/dist/index.js

@@ -24,6 +24,7 @@ import { getConcept as legacyGetConcept, getConceptInput as legacyGetConceptInpu
 import { CLOUD_TOOLS } from './cloudTools.js';
 import { readCredentials } from './credentials.js';
 import { CloudAuthError, getCloudClient } from './cloudClient.js';
+import { ensureProxyAgent } from './proxy.js';
 import { helpCommand, loginCommand, logoutCommand, whoamiCommand, } from './cli.js';
 import { readRealtimeFlag, resolveSubscriptionWorkspaceId, startRealtimeSubscription, stripRealtimeFlags, } from './realtime.js';
 const VERSION = '0.2.0-alpha';
@@ -93,6 +94,9 @@ function makeLegacySnapshotTools(store) {
     ];
 }
 async function runServer() {
+    // Route outbound fetch (GoTrue refresh + PostgREST queries) through
+    // HTTPS_PROXY / HTTP_PROXY before any cloud call. No-op when unset.
+    await ensureProxyAgent(console.error);
     const creds = await readCredentials();
     const snapshotEnv = process.env.HEURESIS_SNAPSHOT;
     let tools;

package/dist/proxy.js

@@ -0,0 +1,43 @@
+// Heuresis MCP — proxy wiring for Node's global fetch dispatcher.
+//
+// Node 18-22's undici does NOT auto-honor HTTPS_PROXY / HTTP_PROXY (Node 24+
+// does). Without this, every outbound fetch fails with "fetch failed" on
+// networks that require an egress proxy — both the device-pairing + GoTrue
+// refresh calls in the CLI and the SupabaseClient's PostgREST queries in the
+// running MCP server. We install an undici ProxyAgent as the global
+// dispatcher once, at process start.
+//
+// Idempotent across the whole process (module-level flag) and a no-op when no
+// proxy var is set, so it is safe to call from every entry point.
+//
+// NOTE: this only covers `fetch` (PostgREST + auth). The Realtime websocket
+// uses a separate transport that the global dispatcher does not touch; live
+// sync behind a strict proxy is a known follow-up, but it is best-effort and
+// fire-and-forget, so it never blocks tool calls.
+let proxyAgentInstalled = false;
+/**
+ * Route Node's global `fetch` through HTTPS_PROXY / HTTP_PROXY when set.
+ * Pass a logger to surface the routing decision (the CLI logs to stderr; the
+ * server passes console.error). Resolves once the dispatcher is in place.
+ */
+export async function ensureProxyAgent(log = () => { }) {
+    if (proxyAgentInstalled)
+        return;
+    proxyAgentInstalled = true;
+    const proxyUrl = process.env.HTTPS_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.http_proxy;
+    if (!proxyUrl)
+        return;
+    try {
+        // Dynamic import keeps undici off the cold-start path when no proxy is in
+        // play. It's a direct dependency, so this resolves.
+        const { ProxyAgent, setGlobalDispatcher } = await import('undici');
+        setGlobalDispatcher(new ProxyAgent(proxyUrl));
+        log(`(routing through proxy ${proxyUrl})`);
+    }
+    catch (err) {
+        log(`(could not configure proxy ${proxyUrl}: ${err instanceof Error ? err.message : String(err)})`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heuresis/mcp",
-  "version": "1.0.0-rc.10",
+  "version": "1.0.0-rc.11",
   "mcpName": "io.github.ToremLabs/heuresis",
   "description": "Cloud-authenticated Model Context Protocol server for a Heuresis workspace. Logs into the user's Heuresis account and lets any MCP client (Claude Desktop, Claude Code, Cursor, custom agents) read and write the same workspace the webapp uses. 31 data tools, 3 operator tools (Branch/Matrix/C-K/ASIT/TRIZ/Free/Combine/Explore), and live Realtime change subscriptions.",
   "type": "module",